26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_70% Sample f3cae5595f04… — Score 69/100 — Hybrid Analysis","description":"Malicious verdict for sample f3cae5595f04…. Malware family: Win/grayware_confidence_70%. Threat score 69/100. 1/27 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f3cae5595f04825e38620f7b0690d61827df9626d0c5a4b56ee2110a8ee2c56b","keywords":["Malicious","Win/grayware_confidence_70%","malware analysis","sandbox report","threat intelligence","f3cae5595f04825e38620f7b0690d61827df9626d0c5a4b56ee2110a8ee2c56b"],"about":{"@type":"SoftwareApplication","name":"EndcordInstaller.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f3cae5595f04825e38620f7b0690d61827df9626d0c5a4b56ee2110a8ee2c56b","additionalType":"Malicious sample"},"threatScore":69,"malwareFamily":"Win/grayware_confidence_70%","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9ef,file/memory contains long string with (Indicator: "read"; Source: "sample.bin"), file/memory contains long string with (Indicator: "access"; Source: "sample.bin"), file/memory contains long string with (Indicator: "bind"; Source: "sample.bin"), file/memory contains long string with (Indicator: "connect"; Source: "sample.bin"), file/memory contains long string with (Indicator: "listen"; Source: "sample.bin"), file/memory contains long string with (Indicator: "select"; Source: "sample.bin"), file/memory contains long string with (Indicator: "stat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "link"; Source: "sample.bin"), file/memory contains long string with (Indicator: "open"; Source: "sample.bin"), file/memory contains long string with (Indicator: "time"; Source: "sample.bin"), file/memory contains long string with (Indicator: "creat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "pause"; Source: "sample.bin"), file/memory contains long string with (Indicator: "write"; Source: "sample.bin"), file/memory contains long string with (Indicator: "sync"; Source: "sample.bin"), file/memory contains long string with (Indicator: "splice"; Source: "sample.bin"), file/memory contains long string with (Indicator: "close"; Source: "sample.bin"), file/memory contains long string with (Indicator: "times"; Source: "sample.bin"), file/memory contains long string with (Indicator: "accept"; Source: "sample.bin"), file/memory contains long string with (Indicator: "mount"; Source: "sample.bin"), file/memory contains long string with (Indicator: "tee"; Source: "sample.bin"), file/memory contains long string with (Indicator: "clone"; Source: "sample.bin"), file/memory contains long string with (Indicator: "socket"; Source: "sample.bin"), file/memory contains long string with (Indicator: "rename"; Source: "sample.bin"), file/memory contains long string with (Indicator: "dup"; Source: "sample.bin"), file/memory contains long string with (Indicator: "poll"; Source: "sample.bin"), Found reference to API "Close the suitcase" (Indicator: "close"; Source: "sample.bin"), file/memory contains long string with (Indicator: "fork"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), file/memory contains long string with (Indicator: "exit"; Source: "sample.bin"), file/memory contains long string with (Indicator: "mkdir"; Source: "sample.bin"), file/memory contains long string with (Indicator: "iopl"; Source: "sample.bin")28:T6724,"ndcordNative.quickCss.openEditor()}),i(h,null,i(Vc,{Icon:I0,text:e("Relaunch Discord"),action:nr}),i(Vc,{Icon:qs,text:e("Open Settings Folder"),action:()=>EndcordNative.settings.openFolder()})),i(Vc,{Icon:Ab,text:e("View Source Code"),action:()=>EndcordNative.native.openExternal(wz)}))),i(Qt,null),i("section",{className:ne.top16},i(Ilt,null),i(me.FormTitle,{tag:"h5"},e("Settings")),i(me.FormText,{className:ne.bottom20,style:{color:"var(--text-muted)"}},e("Hint: You can change the position of this settings section in the")," ",i("a",{onClick:()=>Ll(Ci)},e("settings of the Settings plugin")),"!"),i(Tlt,null)),i(Nle,null),i(Fle,null),i(qse,null))}var wz,$C,Ule=y(()=>{"use strict";c();i5();Y();Ir();Tn();av();at();FC();gz();Fm();KC();cy();Wc();z();q();ro();Me();Nl();I();Lle();sz();Ole();wz="https://github.com/rootpoii/Endcord";$C=yr(Mlt,"Endcord Settings")});function Qa({className:e,...t}){return i("div",{className:ie(Ele.markup,e)},It.defaultRules.codeBlock.react(t,null,{}))}function uy({children:e,className:t}){" (Indicator: "github.com"), "le:\i\}\))/,replace:"$1,$self.RenderTip(arguments[0]?.invite?.expires_at)"},{match:/(?<=\]\}\),)(?=.{0,15}onlineCount:\i\.onlineCount)/,replace:"$self.Header(arguments[0]?.invite?.inviter,arguments[0]?.profile?.name),"}]}],RenderTip(e){if(!e)return null;let t=i(h,null,It.parse(``)),o=i(h,null,p("This invite will")," ",e?i(h,null,"expire ",t):i(h,null,p("not expire")));return i(Ae,{text:o},({onMouseEnter:r,onMouseLeave:n})=>i("div",{className:"vc-bi-tooltip",onMouseEnter:r,onMouseLeave:n},i(Tr,{className:"vc-bi-tooltip-icon"})))},Header(e,t){if(!e)return null;let r=U.getCurrentUser().id===e.id;return i("div",{className:"vc-bi-header-inner"},i("img",{alt:"",className:ie(_me.avatar,_me.clickable)+" vc-bi-inviter-avatar",onClick:()=>Fi(e.id),src:e.avatar?`https://cdn.discordapp.com/avatars/${e.id}/${e.avatar}.webp?size=80`:"/assets/1f0bfc0865d324c2587920a7d80c609b.png?size=128"}),i("div",{className:"vc-bi-header-text"},r?`You sent an invite to join ${t}`:`${e.global_n" (Indicator: "discordapp.com"), "2()-1)),Nh.has(t)&&Nh.delete(t);return}if(m||fu.store.ignoreBots&&r?.author.bot||d){Tf.has(t)&&(Tf.delete(t),QM(s2()-1));return}g||n.isCurrentUser||Tf.has(t)||(Tf.add(t),QM(s2()+1))},[n.isCurrentUser,n.isDataProcessed,t,r?.id,d]),!n.isDataProcessed||!o||!r||n.isCurrentUser||M6e(e)||s||fu.store.ignoreBots&&r.author.bot||d||!fu.store.showDmIcons?null:i("div",{className:l2("icon",R4t.wrapper)},i(KM,{fill:n.containsQuestionMark?"#ff8000":"currentColor"}))}var Tf,Nh,$M,iQ,rQ,R4t,R6e=y(()=>{"use strict";c();se();I();aQ();oQ();Tf=new Set,Nh=new Map,$M=new Set,iQ=0,rQ=new Set;R4t=Ee("muted","wrapper")});function N4t(e){let t=new Date(e),o=String(t.getMonth()+1).padStart(2,"0"),r=String(t.getDate()).padStart(2,"0"),n=String(t.getFullYear()).slice(-2);return`${o}/${r}/${n}`}function O4t({channel:e}){return e.icon?i(Kn,{src:`https://cdn.discordapp.com/channel-icons/${e.id}/${e.icon}.png`,size:"SIZE_40","aria-label":e?.name||"Unnamed Group"}):i(L4t,{recipients:e?.recipients??[],channel:e,size:"SIZE_40",isTyping:null})}fu" (Indicator: "discordapp.com"), "3E\u0431\u0449\u0435\u043D\u0438\u0439 \u0432\u043E \u0432\u0441\u0442\u0430\u0432\u043A\u0430\u0445","Background opacity":"\u041F\u0440\u043E\u0437\u0440\u0430\u0447\u043D\u043E\u0441\u0442\u044C \u0444\u043E\u043D\u0430","Badge Url":"\u0421\u0441\u044B\u043B\u043A\u0430 \u043D\u0430 \u0437\u043D\u0430\u0447\u043E\u043A","Badge image URL (e.g. https://cdn.discordapp.com/emojis/ID.png). Ignored if an image is uploaded above.":"\u0421\u0441\u044B\u043B\u043A\u0430 \u043D\u0430 \u0438\u0437\u043E\u0431\u0440\u0430\u0436\u0435\u043D\u0438\u0435 \u0437\u043D\u0430\u0447\u043A\u0430 (\u043D\u0430\u043F\u0440\u0438\u043C\u0435\u0440 https://cdn.discordapp.com/emojis/ID.png). \u0418\u0433\u043D\u043E\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044F, \u0435\u0441\u043B\u0438 \u0432\u044B\u0448\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043D\u043E \u0438\u0437\u043E\u0431\u0440\u0430\u0436\u0435\u043D\u0438\u0435.","Banner to use if both Nitro and USRBG banners are present":"\u041A\u0430\u043A\u043E\u0439 \u0431" (Indicator: "discordapp.com"), "r Xvt,Dwe,Twe,DI,aW=y(()=>{"use strict";c();Te();pr();xh();wx();wh();Ky();Ge();q();ro();se();I();Xvt=be(".currentTarget.files","lineClamp:1"),{HelpMessage:Dwe,HelpMessageTypes:Twe}=Io('POSITIVE="positive',{HelpMessageTypes:Ne.byProps("POSITIVE","WARNING","INFO"),HelpMessage:Ne.byCode("messageType:")});DI=()=>Promise.all([Ax(),hwe()]).then(()=>re(e=>i(txt,{...e})))});function oxt(e){return i(Ao,{...e,title:p("Hold on"),confirmText:p("Continue"),variant:"primary",onConfirm:()=>{Cx.store.agreedToGuidelines=!0,e.onClose(),DI()}},i("div",{className:kx.modal},i(me.FormText,null,p("By submitting a decoration, you agree to")," ",i(to,{href:"https://github.com/decor-discord/.github/blob/main/GUIDELINES.md"},p("the guidelines")),"."," ",p("Not reading these guidelines may get your account suspended from creating more decorations in the future."))))}var Iwe,Mwe=y(()=>{"use strict";c();pr();TI();wh();q();I();aW();Iwe=()=>Ax().then(()=>re(e=>i(oxt,{...e})))});function ixt(){let[e,t]=M([]);return K(()=>{fwe().then(t)},[])," (Indicator: "github.com"), "ferencedMessage.authorName}**: ${r.referencedMessage.content}`),o.push(`**${r.authorName}** \u2014 *${n}*${r.editedAt?` ${bo("(edited)")}`:""}${r.pinned?` ${bo("[pinned]")}`:""}`),r.content&&o.push(r.content);for(let a of r.attachments)o.push(`[${a.filename}](${a.url}) *(${QI(a.size)})*`);for(let a of r.embeds)a.url&&o.push(`[${a.title??"Lien"}](${a.url})`);for(let a of r.stickers)o.push(`*Sticker: ${a.name}*`);r.reactions.length&&o.push(r.reactions.map(a=>`${a.emoji} \`${a.count}\``).join(" ")),o.push("")}return o.join(` `)}function oSt(e,t){let o=e.map(r=>{let n=new Date(r.timestamp).toLocaleString(),a=r.editedAt?`${bo("(edited)")}`:"",s=r.pinned?`${bo("[pinned]")}`:"",l=r.authorAvatar?`https://cdn.discordapp.com/avatars/${r.authorId}/${r.authorAvatar}.webp?size=32`:`https://cdn.discordapp.com/embed/avatars/${Math.abs(parseInt(r.authorId.slice(-4),16))%5}.png`,u=r.referencedMessage?`

${r.referencedMessage.authorName}: ${r.referenc" (Indicator: "discordapp.com"), "s-tab .vc-github-repos-stars{font-size:10px} `,classNames:{},dom:null});((window.EndcordPluginStyles??={}).githubRepos??=[]).push("src/plugins/githubRepos/styles.css")});async function SP(e){try{let t=`https://api.github.com/users/${e}`,o=await fetch(t);if(!o.ok)return null;let r=await o.json();return{username:r.login,totalRepos:r.public_repos,avatarUrl:r.avatar_url}}catch(t){return xP.error("Error fetching user info",t),null}}async function wP(e,t=30){try{let o=`https://api.github.com/user/${e}/repos?sort=stars&direction=desc&per_page=${t}`,r=await fetch(o);if(!r.ok)return null;let n=await r.json();return o$(n)}catch(o){return xP.error("Error fetching repos by ID",o),null}}async function kP(e,t=30){let o=`https://api.github.com/users/${e}/repos?sort=stars&direction=desc&per_page=${t}`,r=await fetch(o);if(!r.ok)throw new Error(`Error fetching repos by username: ${r.status}`);let n=await r.json();return o$(n)}async function AP(e){try{let t=`https://api.github.com/users/${e}/orgs`,o=await fetch(t);return o.ok?a" (Indicator: "github.com"), " Ka=new Set(["cdn.discordapp.com","images-ext-1.discordapp.net","images-ext-2.discordapp.net","media.discordapp.net"]);async function Xa(r,e){let{content_type:t,filename:i}=e,n=URL.parse(e.url);if(!n||!Ka.has(n.hostname))throw new Error("Invalid URL");let s=await fetch(n,{headers:{Accept:"*/*"}});if(!s.ok)throw new Error("Server error");let o=await s.blob(),l=o.type||t||"application/octet-stream",h=await o.arrayBuffer();return{type:l,data:h,filename:i}}var kr={};N(kr,{fetchFile:()=>mo,uploadTo0x0:()=>to,uploadToBuzzheavier:()=>oo,uploadToCatbox:()=>no,uploadToEzHost:()=>eo,uploadToFilebin:()=>co,uploadToGofile:()=>so,uploadToLitterbox:()=>io,uploadToNest:()=>Qa,uploadToPixelDrain:()=>ho,uploadToPixelVault:()=>uo,uploadToS3:()=>ro,uploadToTempSh:()=>lo,uploadToTmpfiles:()=>ao,uploadToWebdav:()=>fo});w();async function Qa(r,e,t,i){try{let n=new FormData;n.append("file",new Blob([e]),t);let s=await fetch("https://nest.rip/api/files/upload",{method:"POST",headers:{Authorization:i},body:n});if(!s.ok){let l=await s" (Indicator: "discordapp.com"), "sn't work anymore :(")))}},n("Discord Server")))})}var zce=y(()=>{"use strict";c();kt();at();pr();zC();Ge();q();I()});function Gce(e,t){if(t){if(Ke.enabledThemes.includes(e))return;Ke.enabledThemes=[...Ke.enabledThemes,e]}else Ke.enabledThemes=Ke.enabledThemes.filter(o=>o!==e)}function Hce(){let{t:e}=vt(),t=Jt(["enabledThemes"]),o=we(null),[r,n]=M(null);K(()=>{a()},[]);async function a(){let s=await EndcordNative.themes.getThemesList();n(s)}return i(ue,{flexDirection:"column",gap:"1em"},i(Ct,null,i(me.FormTitle,{tag:"h5"},e("Find Themes:")),i("div",{style:{marginBottom:".5em",display:"flex",flexDirection:"column"}},i(to,{style:{marginRight:".5em"},href:"https://betterdiscord.app/themes"},e("BetterDiscord Themes")),i(to,{href:"https://github.com/search?q=discord+theme"},"GitHub")),i(me.FormText,null,e('If using the BD site, click on "Download" and place the downloaded .theme.css file into your themes folder.'))),i(Ct,null,i(me.FormTitle,{tag:"h5"},e("External Resources")),i(me.FormText,null,e("For security rea" (Indicator: "github.com"), "ttachmentFileExtensions="none":t.attachmentFileExtensions=n.join(","),await pt(t)}var Ar={};N(Ar,{resolveRedirect:()=>qo});w();var Pi=require("https"),Fo=/^https:\/\/(spotify\.link|s\.team)\/.+$/;function Di(r){return new Promise((e,t)=>{let i=(0,Pi.request)(new URL(r),{method:"HEAD"},n=>{e(n.headers.location?Di(n.headers.location):r)});i.on("error",t),i.end()})}async function qo(r,e){return Fo.test(e)?Di(e):e}var Rr={};N(Rr,{fetchPdf:()=>Go});w();var jo=new Set(["cdn.discordapp.com","media.discordapp.net"]),Ai=[37,80,68,70],zo=3e4;function Bo(r){let e=new URL(r);if(e.protocol!=="https:")throw new Error("Not an https URL");if(!jo.has(e.hostname))throw new Error("Not a Discord CDN host");let t=decodeURIComponent(e.pathname).toLowerCase();if(!t.startsWith("/attachments/")&&!t.startsWith("/ephemeral-attachments/"))throw new Error("Not an attachment path");if(!t.endsWith(".pdf"))throw new Error("Not a PDF");return e}async function Go(r,e,t){let i=Bo(e),n=new AbortController,s=setTimeout(()=>n.abort(),zo);try{let " (Indicator: "discordapp.com"), "a bir s\xFCre sonra g\xF6nderilecek \u015Fekilde zamanla.",SearchFix:"Can s\u0131kan 'B\xFCy\xFCteci d\xFC\u015F\xFCrd\xFCk!' hatas\u0131n\u0131 d\xFCzeltir.",SecretRingToneEnabler:"Discord zil sesinin gizli s\xFCr\xFCm\xFCn\xFC her zaman \xE7alar (\xF6zel etkinlikler hari\xE7)",SedEnhanced:"Discord'un basit `sed` deste\u011Fini geni\u015Fletir.",SekaiStickers:"Discord'a yerle\u015Fik Sekai \xE7\u0131kartmalar\u0131 (github.com/TheOriginalAyaka'dan)",SelfDestruct:"Ayarlanan s\xFCre sonra otomatik silinen mesajlar g\xF6nderir. Her mesajda k\u0131rm\u0131z\u0131 saya\xE7 g\xF6r\xFCn\xFCr.",SendTimestamps:"Mesaj kutusundaki buton ve k\u0131sayollarla kolayca zaman damgas\u0131 g\xF6nder. Ayr\u0131nt\u0131l\u0131 a\xE7\u0131klamay\u0131 oku!",ServerPinner:"Sunucular\u0131 sa\u011F t\u0131k men\xFCs\xFCnden sunucu listenin en \xFCst\xFCne sabitle; klas\xF6rlerin de\u011Fi\u015Fmez.",ServerBackup:"Bir sunucunun kanallar\u0131n\u0131, rollerini ve izinlerini dosyaya yedekle ve ba\u015Fka bir sunucuya geri y\xFCkle."" (Indicator: "github.com"), "tion u(d){a(d);let m=o(d);m===!0?(l(void 0),t(d)):l(m)}return i(h,null,i(Be,{type:"text",value:n,onChange:u,placeholder:r,error:s}))}var pv=y(()=>{"use strict";c();I()});function x5(e){let t={display:e.inline?"inline-grid":"grid",gridTemplateColumns:`repeat(${e.columns}, 1fr)`,gap:e.gap,...e.style};return i("div",{...e,style:t},e.children)}var qz=y(()=>{"use strict";c()});function nct(e){try{return new URL(e),!0}catch{return"Invalid URL"}}function S5({children:e,Icon:t,className:o,...r}){return i(xe,{...r,className:ie("vc-cloud-icon-with-button",o)},i(t,{className:"vc-cloud-button-icon"}),e)}function act(){let{cloud:e}=Jt(["cloud.authenticated","cloud.url"]);return i("section",null,i(Wz,{text:p("Cloud Integrations")}),i(le,{size:"md",className:ne.bottom20},p("Endcord comes with a cloud integration that adds goodies like settings sync across devices. It")," ",i(to,{href:"https://endcord.com/cloud/privacy"},p("respects your privacy")),p(", and the")," ",i(to,{href:"https://github.com/rootpoii/Endcord"},p("sourc" (Indicator: "github.com"), "e say\u0131s\u0131","Background Preload Limit":"Arka plan \xF6n y\xFCkleme s\u0131n\u0131r\u0131","Background color":"Arka plan rengi","Background color for messages in rich embeds":"Zengin \xF6nizlemelerdeki mesajlar\u0131n arka plan rengi","Background opacity":"Arka plan opakl\u0131\u011F\u0131","Badge Url":"Rozet ba\u011Flant\u0131s\u0131","Badge image URL (e.g. https://cdn.discordapp.com/emojis/ID.png). Ignored if an image is uploaded above.":"Rozet resmi ba\u011Flant\u0131s\u0131 (\xF6r. https://cdn.discordapp.com/emojis/ID.png). Yukar\u0131da resim y\xFCklendiyse yok say\u0131l\u0131r.","Banner to use if both Nitro and USRBG banners are present":"Hem Nitro hem USRBG afi\u015Fi varsa kullan\u0131lacak afi\u015F","Base (Recommended)":"Temel (\xF6nerilen)",Behaviour:"Davran\u0131\u015F",Better:"Daha iyi","Bg Opacity":"Arka plan opakl\u0131\u011F\u0131","Black (light / Nitro gradient themes)":"Siyah (a\xE7\u0131k / Nitro gradyan temalar\u0131)",Blacklist:"Kara liste","Blacklisted Ids":"Kara listedeki ID'ler" (Indicator: "discordapp.com"), "#eb459f"}},NW=new Set(["friend_add","friend_remove","friend_request","friend_request_cancel","block"]),I2t=new Set(["guild_member_add","guild_member_remove","guild_ban","guild_timeout","guild_kick","user_disconnect"]),M2t=(e,t)=>t?`https://cdn.discordapp.com/avatars/${e}/${t}.webp?size=32`:`https://cdn.discordapp.com/embed/avatars/${Math.abs(parseInt(e.slice(-4),16))%5}.png`;B2t=[{key:"all",label:"All"},{key:"delete",label:"Deleted"},{key:"edit",label:"Edited"},{key:"vocal",label:"Voice"},{key:"myvoice",label:"My Voice"},{key:"friends",label:"Friends"},{key:"guild",label:"Servers"},{key:"ping",label:"Ping"}];LW=[],WI=new Map;O2t=S({name:"EventLogs",enabledByDefault:!1,description:"Logs: deleted/edited messages, voice, friends, servers.",authors:[f.vpg],dependencies:["HeaderBarAPI"],start(){try{let e=w2t?.getVoiceChannelId?.();e&&(Bx=e)}catch{}D2t(),Zs("nightcord-event-logs",()=>i(L2t,null),7),F2t()},stop(){Js("nightcord-event-logs"),LW.forEach(e=>e()),LW=[],Nx!==null&&(clearTimeout(Nx),Nx=null),Cs=[],Vl.clear" (Indicator: "discordapp.com"), ":0,props:{style:{borderRadius:"50%",transform:"scale(0.9)"}},onContextMenu(r,n){Xe.openContextMenu(r,()=>$.createElement(Mn,{badge:n}))},onClick(){return s7e(U.getUser(e))}}))}})});var p7e={};_(p7e,{default:()=>u6t});function c6t(e){let t=Je(e,"input",""),o=""+d7e[_h.store.defaultEngine]+encodeURIComponent(t);return _h.store.customEngineURL&&(o=""+[_h.store.customEngineURL]+encodeURIComponent(t)),_h.store.hyperlink&&!_h.store.embed?`[${t}](<${o}>)`:_h.store.hyperlink?`[${t}](${o})`:_h.store.embed?o:`<${o}>`}var d7e,_h,u6t,m7e=y(()=>{"use strict";c();Co();Y();z();L();d7e={Google:"https://www.google.com/search?q=",Bing:"https://www.bing.com/search?q=",Yahoo:"https://search.yahoo.com/search?p=",DuckDuckGo:"https://duckduckgo.com/?q=",Baidu:"https://www.baidu.com/s?wd=",Yandex:"https://yandex.com/search/?text=",Ecosia:"https://www.ecosia.org/search?q=",Ask:"https://www.ask.com/web?q=",AOL:"https://search.aol.com/aol/search?q=",LetMeGoogleThatForYou:"https://letmegooglethat.com/?q="},_h=R({hyperlink:{type:3,descri" (Indicator: "yandex.com"), "g{position:absolute;width:100%;height:100%;background-color:#000;z-index:99999;object-fit:contain;opacity:0}.jumpscare-animate{animation:jumpscare-animation .7s}@keyframes jumpscare-animation{0%{transform:scale(0)}80%{transform:scale(1);opacity:1}to{transform:scale(0);opacity:0}} `,classNames:{},dom:null});((window.EndcordPluginStyles??={}).jumpscare??=[]).push("src/plugins/jumpscare/styles.css")});var YTe={};_(YTe,{default:()=>nCt});function rCt(){if(!_3){let e=document.createElement("div");e.id="jumpscare-root",e.classList.add("jumpscare-root"),document.body.append(e),_3=mn(e)}return _3}var _3,A2,nCt,ZTe=y(()=>{"use strict";c();$Te();Ys();Y();z();L();I();A2=R({imageSource:{type:0,description:"Sets the image url of the jumpscare",default:"https://github.com/Equicord/Equibored/blob/main/icons/jumpscare/troll.gif?raw=true"},audioSource:{type:0,description:"Sets the audio url of the jumpscare",default:"https://github.com/Equicord/Equibored/raw/main/sounds/jumpscare/trollolol.mp3?raw=true"},chance:{type:1,descri" (Indicator: "github.com"), " 796.579 631.804C778.78 667.239 755.483 699.439 727.687 727.279C698.944 756.068 652.543 746.455 629.998 712.591C607.453 678.727 617.982 633.466 642.711 601.164C651.181 590.1 658.628 578.224 664.932 565.676C682.324 531.051 690.402 492.494 688.371 453.799C687.303 433.462 683.462 413.454 677.02 394.312L583.246 450.657C583.889 455.647 584.219 460.734 584.219 465.898ZM260.937 644.321C258.599 645.742 256.214 647.175 253.783 648.619L260.937 644.321Z"}),i("path",{d:"M470.711 406.73C493.342 393.132 522.712 400.455 536.311 423.086C549.909 445.718 542.587 475.088 519.955 488.687L253.783 648.619L204.538 566.663L470.711 406.73Z"}))});var $y,dW=y(()=>{c();$y="rootpoii/endcord"});var PI,oke,Hqo,BI=y(()=>{"use strict";c();tv();dW();PI=sp.slice(0,9),oke=`Endcord/${sp}${$y?` (https://github.com/${$y})`:""}`,Hqo=`Endcord${$y?` (https://github.com/${$y})`:""}`});function hxt(){return"Standalone"}function MI(e){try{return yxt(e)}catch(t){return console.error("[DiscordDevBanner] Failed to render banner",t),"Endcord"}}function yxt(" (Indicator: "github.com"), "ption:"The chance of a jumpscare happening (1 in X so: 100 = 1/100 or 1%, 50 = 1/50 or 2%, etc.)",default:1e3}});nCt=S({name:"Jumpscare",description:"Adds a configurable chance of jumpscaring you whenever you open a channel. Inspired by Geometry Dash Mega Hack",tags:["Fun"],authors:[f.ewlle,f.kraethis,f.Sharp],dependencies:["AudioPlayerAPI"],settings:A2,start(){for(let e of["imageSource","audioSource"]){let t=A2.store[e];t?.includes("github.com/Endcord/Equibored/")&&(A2.store[e]=t.replace("github.com/Endcord/","github.com/Equicord/"))}rCt().render(i(this.JumpscareComponent,null))},stop(){_3?.unmount(),_3=void 0},JumpscareComponent(){let[e,t]=M(!1),o=ip(A2.store.audioSource,{volume:100,onEnded:()=>{t(!1)}}),r=ut(n=>{if(e)return;let a=1/A2.store.chance;Math.random()>a||(t(!0),o.play())},[e]);return K(()=>(V.subscribe("CHANNEL_SELECT",r),()=>{V.unsubscribe("CHANNEL_SELECT",r)}),[r]),i("img",{className:`jumpscare-img ${e?"jumpscare-animate":""}`,src:A2.store.imageSource})}})});var tIe={};_(tIe,{default:()=>lCt});" (Indicator: "github.com"), "),V.dispatch({type:"APP_ICON_UPDATED",id:g}),Go.setItem("vc_app_icons",JSON.stringify(u))}return i(br,{...e,size:"medium"},i(vr,null,i(Re,{color:"header-primary",variant:"heading-lg/semibold",tag:"h1",style:{flexGrow:1}},p("Add a custom app icon:")),i(xn,{onClick:e.onClose})),i(Di,null,i("br",null),i("div",null,i(me.FormTitle,{tag:"h5"},p("Name")),i(me.FormText,null,p("This name will be shown in the App Icons list.")),i(Be,{placeholder:p("My awesome Custom App Icon!"),value:t,onChange:o})),i("br",null),i("div",null,i(me.FormTitle,{tag:"h5"},p("Image URL")),i(me.FormText,null,p("Paste here your image URL to upload your icon (.webp, .jpg, .jpeg, .png, .gif, .ico and Discord Icons, Emojis, PFPs, etc.).")),i(Be,{placeholder:"https://cdn.discordapp.com/emojis/1098881040900173895.gif",value:r,onChange:n}))),i(rl,null,i(ee,{onClick:()=>{a(t,r)},disabled:!t||!r&&r.match(/(https:\/\/www\.|http:\/\/www\.|https:\/\/|http:\/\/)?[a-zA-Z]{2,}(\.[a-zA-Z]{2,})(\.[a-zA-Z]{2,})?\/[a-zA-Z0-9]{2,}|((https:\/\/www\.|http:\/\/www\" (Indicator: "discordapp.com"), ".setAttribute("draggable","false"),e.props.animated&&(A.current=X.querySelector("video"),A.current.addEventListener("timeupdate",N)),n(!0)}),document.addEventListener("keydown",D),document.addEventListener("keyup",B),document.addEventListener("mousemove",F),document.addEventListener("mousedown",E),document.addEventListener("mouseup",j),document.addEventListener("wheel",Z),()=>{document.removeEventListener("keydown",D),document.removeEventListener("keyup",B),document.removeEventListener("mousemove",F),document.removeEventListener("mousedown",E),document.removeEventListener("mouseup",j),document.removeEventListener("wheel",Z)}},[]);let k=ke(()=>{try{let D=new URL(e.props.src);return D.pathname.startsWith("/attachments/")&&(D.hostname="cdn.discordapp.com"),D.searchParams.set("animated","true"),D.toString()}catch{return e.props.src}},[e.props.src]);if(!r)return null;let T=x.current?.getBoundingClientRect();return T?i("div",{className:oTe("lens",{"nearest-neighbor":er.store.nearestNeighbour,square:er.store.square}" (Indicator: "discordapp.com"), "n J7(e,t){if(e.dataset.cfp)return;e.dataset.cfp="1";let o=r=>{r.preventDefault(),r.stopImmediatePropagation(),zft(t)};e._cfpHandler=o,e.addEventListener("click",o,!0),HH.add(e),e.removeAttribute("disabled"),e.style.cursor="pointer",e.style.opacity="1"}function zH(e=document){GH()&&(e.querySelectorAll('button[aria-label="Outgoing Friend Request"]').forEach(t=>{if(!(t.closest("[class*='profileButtons']")??t.closest("[class*='profileHeader']")??t.closest("[class*='inner']")))return;let n=(t.closest("[class*='modal'], [class*='userPopout'], [class*='profileBody']")??document)?.querySelector?.("img[src*='cdn.discordapp.com/avatars/']");if(n){let s=n.getAttribute("src")?.match(/avatars\/(\d+)\//);if(s){J7(t,s[1]);return}}let a=$ge();a&&J7(t,a)}),e.querySelectorAll('button[disabled][class*="secondary"]').forEach(t=>{let o=t.closest("[class*='container_b50d96'], [class*='dmWelcome'], [class*='privateChannelEmptyMessage']");if(!o)return;let r=o.querySelector("img[src*='cdn.discordapp.com/avatars/']");if(r){let a=r.get" (Indicator: "discordapp.com"), "require("fs/promises"),Yn=require("path");lr();Vn();Ia="https://api.github.com/repos/rootpoii/endcord",hr=[];ht.ipcMain.handle("EndcordGetRepo",ut(()=>"https://github.com/rootpoii/Endcord"));ht.ipcMain.handle("EndcordGetUpdates",ut(Da));ht.ipcMain.handle("EndcordUpdate",ut(Jn));ht.ipcMain.handle("EndcordBuild",ut(Aa))});var et=q(Ki=>{w();(function(){this.Event=class{constructor(e,t){this.start_mark=e,this.end_mark=t}},this.NodeEvent=class extends this.Event{constructor(e,t,i){super(t,i),this.anchor=e}},this.CollectionStartEvent=class extends this.NodeEvent{constructor(e,t,i,n,s,o){super(e,n,s),this.tag=t,this.implicit=i,this.flow_style=o}},this.CollectionEndEvent=class extends this.Event{},this.StreamStartEvent=class extends this.Event{constructor(e,t,i){super(e,t),this.encoding=i}},this.StreamEndEvent=class extends this.Event{},this.DocumentStartEvent=class extends this.Event{constructor(e,t,i,n,s){super(e,t),this.explicit=i,this.version=n,this.tags=s}},this.DocumentEndEvent=class extends this.Event{construc" (Indicator: "github.com"), "}function Ga(r,e){return Je.get(e)?.tmpPath??null}async function Wa(r,e){let t=Je.get(e);if(!t)return null;try{let i=await(0,re.readFile)(t.tmpPath);return new Uint8Array(i.buffer,i.byteOffset,i.byteLength)}catch{return null}}async function Ha(r,e){let t=Je.get(e);if(t&&(Je.delete(e),!!Ze(mr,t.tmpDir)))try{await(0,re.rm)(t.tmpDir,{force:!0,recursive:!0})}catch{}}async function Va(r,e){let t=Dt.get(e);return t?qa(t):null}var vr={};N(vr,{initDevtoolsOpenEagerLoad:()=>Za});w();function Za(r){let e=()=>r.sender.executeJavaScript("Endcord.Plugins.plugins.ConsoleShortcuts.eagerLoad(true)");r.sender.isDevToolsOpened()?e():r.sender.once("devtools-opened",()=>e())}var wr={};N(wr,{saveAttachment:()=>Ja});w();var Ya=new Set(["cdn.discordapp.com","media.discordapp.net"]);async function Ja(r,e){let t=new URL(e),{hostname:i,protocol:n}=t;if(!Ya.has(i))throw new Error(`Disallowed host: ${i}`);if(n!=="https:")throw new Error(`Disallowed protocol: ${n}`);r.sender.downloadURL(e)}var yr={};N(yr,{fetchAttachment:()=>Xa});w();var" (Indicator: "discordapp.com"), "pp.com/badge-icons/ec92202290b48d0879b7413d2dde3bab.png"],X2e=[{key:"account_age",label:"Account Age",tiers:[{label:"Seed",icon:"https://cdn.discordapp.com/assets/content/8da9339b9d405f0194947e607c839b1bd43436211e5bf07fe7f4ce005578e9e4.png"},{label:"Sprout",icon:"https://cdn.discordapp.com/assets/content/f12847ebadd9022c3d67e5b31b5f3608e1ff48a222528fb6059e0fd310fc71b7.png"},{label:"Sapling",icon:"https://cdn.discordapp.com/assets/content/dccc28b53d39406e65e76541d6b940b23a9d31ef418100d77d6eb30c4adb9098.png"},{label:"Bud",icon:"https://cdn.discordapp.com/assets/content/7c0a10981060861722c0216fd6c01a9fd8b10accbd3d6a04dcde275896e82e8b.png"},{label:"Blossom",icon:"https://cdn.discordapp.com/assets/content/52c374af536a4621a65503b4350f7459e3d00f3ed4e3b941c3902c0d9af45f4a.png"},{label:"Redwood",icon:"https://cdn.discordapp.com/assets/content/8041acaf604df1ace1ad2a12fd020513e50dfdd09899dc2e455e622d41c91000.png"},{label:"Sequoia",icon:"https://cdn.discordapp.com/assets/content/7c5a1b1ce27181145c7e37bf6ad323353c14e8db20" (Indicator: "discordapp.com"), "label:"Recreational",icon:"https://cdn.discordapp.com/assets/content/157b789531c602542070e680c410d74275e796b6c45cd717292f6d2a59593972.png"},{label:"Dedicated",icon:"https://cdn.discordapp.com/assets/content/d6ab0696aae97fca8e6b2b88d4117f09f9ea895d4f0cebee770564369ff06873.png"},{label:"Committed",icon:"https://cdn.discordapp.com/assets/content/cc1edd8d955872cd9fbd9bafec80c973287817560d0895587686e3e1671a698e.png"},{label:"Serious",icon:"https://cdn.discordapp.com/assets/content/4039caeef586467d50939f3154f87828645d6f1bd699b8f0c1da686b02cefe68.png"},{label:"Devoted",icon:"https://cdn.discordapp.com/assets/content/3d39b6cef7f00fe9e2d51f229034650b900481823af05d09e6537e912de30301.png"},{label:"Seasoned",icon:"https://cdn.discordapp.com/assets/content/46512ce94203c84d7919904acfbd07fc5a8316010a610b8fd6a1cc937e5ac75e.png"},{label:"Ironclad",icon:"https://cdn.discordapp.com/assets/content/9bff716e6bae2ef42dc959bac05a0dfc480bf89484c111ed7fb4aa0332cb22d8.png"},{label:"Unshakeable",icon:"https://cdn.discordapp.com/assets/c" (Indicator: "discordapp.com")29:T466,"return!1;let t=process.execPath,i="HKCU:\\Software\\Microsoft\\DirectX\\UserGpuPreferences",n=`GpuPreference=${e};`,s=t.replace(/'/g,"''"),o=n.replace(/'/g,"''"),l=i.replace(/'/g,"''");try{let h=`powershell -NoProfile -Command "$p = '${l}'; $n = '${s}'; if (Test-Path $p) { (Get-ItemProperty -Path $p -ErrorAction SilentlyContinue).$n } else { '' }"`,{stdout:d}=await an(h),f=(d||"").trim(),g=!1;if(f!==n){let m=`powershell -NoProfile -Command "$p = '${l}'; if (-not (Test-Path $p)) { New-Item -Path $p -Force | Out-Null }; Set-ItemProperty -Path $p -Name '${s}' -Value '${o}' -Type String -Force"`;await an(m),console.log("[GpuBinder Native] Applied GPU preference to current Discord path."),g=!0}let u=`powershell -NoProfile -Command "$p = '${l}'; if (Test-Path $p) { $props = Get-ItemProperty -Path $p; $props.PSObject.Properties | Where-Object { $_.Name -like '*Discord.exe*' -and $_.Name -ne '${s}' } | ForEach-Object { Remove-ItemProperty -Path $p -Name $_.Name -ErrorAction SilentlyContinue } }"`;return await an(u),g" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: sample.bin2a:T6960,Pattern match: "https://github.com/rootpoii/endcord;$c=yr", Pattern match: "https://unpkg.com/@ffmpeg/core@${w0t}/dist/um", Pattern match: "https://nest.rip/api/files/upload,{method:post,he", Pattern match: "https://${window.global_env.cdn_host}/stickers/${e.id}.${z1t[e.format_type]}?size=512&lossless=true`}function", Pattern match: "https://cdn.discordapp.com/avatars/${e.id}/${e.avatar}.webp?size=80`:/assets/1f0bfc0865d324c2587920a7d80c609b.png?size=128", Pattern match: "http://www.w3.org/2000/svg", Pattern match: "http://localhost:8080", Pattern match: "i.scdn.co/image", Pattern match: "https://cdn.discordapp.com/channel-icons/${e.id}/${e.icon}.png`,size:size_40,aria-label:e?.name||unnamed", Pattern match: "https://pixelvault.co/,{method:post,headers:{authorization:o.trim()},body:r", Pattern match: "http://www.w3.org/2000/svg},i", Pattern match: "https://cdn.discordapp.com/emojis/id.png", Pattern match: "https://imgur.com/", Pattern match: "https://navidrome.example.com", Pattern match: "http://www.w3.org/2000/svg,width:20,height:20,viewbox:0", Pattern match: "https://github.com/decor-discord/.github/blob/main/guidelines.md},p", Pattern match: "https://${m}/emojis/${l.id}${u}?size=512&quality=lossless`;else{u=.+m6t[l.format_type];let", Pattern match: "https://cdn.discordapp.com/avatars/${r.authorid}/${r.authoravatar}.webp?size=32`:`https://cdn.discordapp.com/embed/avatars/${math.abs", Pattern match: "anary.discord.com/assets/ec5d85405877c27caeda.mp3,halloween_message1:https://canary.discord.com/assets/e386c839fb98675c6a79.mp3,halloween_mute:https://canary.discord.com/assets/ee7fdadf4c714eed6254.mp3,winter_mute:https://canary.discord.com/assets/6d", Pattern match: "https://nextcloud.example.com/remote.php/dav/files/username", Pattern match: "https://litterbox.catbox.moe/resources/internals/api.php,{method:post,body:n", Pattern match: "https://api.github.com/users/${e}`,o=await", Pattern match: "https://drive.google.com/viewerng/viewer?embedded=true&url=${encodeuricomponent(e)}`,qkt=e=", Pattern match: "https://nest.rip/api/files/upload,{method:post,headers:{authorization:i},body:n", Pattern match: "b.com/theoriginalayaka", Pattern match: "https://raw.githubusercontent.com/clearurls/rules/master/data.min.json,a0t=s", Pattern match: "https://www.tiktok.com,https://www.tnktok.com],[https://vt.tiktok.com,https://www.tnktok.com],[https://x.com,https://www.fxtwitter.com],[https://www.twitter.com,https://www.fxtwitter.com],[https://www.instagram.com,https://www.kkinstagram", Pattern match: "https://betterdiscord.app/themes},e", Heuristic match: "d:'avatarwithtext',replacement:[{match:/(\}=\i)/,replace:,style$1},{match:/(?<=div,\{classname:\i\.\i,)(?=children:\[)/,replace:style:style||{},}],predicate:()=>w4.store.dmlist},{find:'reply chain nudge)',replacement:{match:/(classname:.{0,15},co", Pattern match: "github.com/theoriginalayaka'dan", Pattern match: "www.reddit.com:d,*.wikipedia.org:d,free.freeipapi.com:d,huggingface.co:d,*.huggingface.co:d,*.hf.co:d,api.stats.fm:d,dc.songspotlight.nexpid.xyz:d,api.imgur.com:d,api.openai.com:d,aiapi.serversmp.xyz:d,placeholder.nin0.dev:x,*.tenor", Pattern match: "https://example.com/video.mp4,value:a?\u2705", Pattern match: "https://usrbg.is-hardly.online/users,a7=r", Pattern match: "https://tmpfiles.org/api/v1/upload,{method:post,body:i", Pattern match: "https://litterbox.catbox.moe/resources/internals/api.php,{method:post,body:r", Pattern match: "https://endcord.com/cloud/privacy},p", Pattern match: "https://www.last.fm/user/${ss.store.username", Pattern match: "https://platform.openai.com/api-keys", Pattern match: "https://api.e-z.host/files,{method:post,headers:{key:o},body:r", Pattern match: "https://api.e-z.host/files,{method:post,headers:{key:i},body:n", Heuristic match: "(vcblurnsfw,j0),vge()},stop(){uh?.remove()}})});var wge={};_(wge,{default:()=>vft});function bft(e){return[...e].map(t=>{let o=t.codepointat(0);return o>=65&&o<=90?string.fromcodepoint(119808+o-65):o>=97&&o<=122?string.fromcodepoint(119834+o-97):o>=48&&o", Pattern match: "https://cdn.jsdelivr.net/npm/@ffmpeg/core@\${core_version}/dist/umd/ffmpeg-core.js\", Pattern match: "https://youtube.com/@yourchannel:\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440", Pattern match: "https://i.imgur.com/", Pattern match: "https://cdn.discordapp.com/avatars/${e}/${t}.webp?size=32`:`https://cdn.discordapp.com/embed/avatars/${math.abs", Pattern match: "http://www.w3.org/2000/svg,width:16,height:16,fill:none,viewbox:0", Pattern match: "https://api.openai.com/v1/c", Pattern match: "http://pyyaml.org/wiki/yamlcoloninflowcontext", Pattern match: "https://www.google.com/search?q=,bing:https://www.bing.com/search?q=,yahoo:https://search.yahoo.com/search?p=,duckduckgo:https://duckduckgo.com/?q=,baidu:https://www.baidu.com/s?wd=,yandex:https://yandex.com/search/?text=,ecosia:https://www.eco", Pattern match: "https://www.last.fm/music/${encodeuricomponent(e.artist)}`,e.album&&(a.assets.large_url=`https://www.last.fm/music/${encodeuricomponent(e.artist)}/${encodeuricomponent(e.album)}`)", Pattern match: "https://github.com/equicord/equibored/blob/main/icons/jumpscare/troll.gif?raw=true},audiosource:{type:0,description:sets", Pattern match: "https://api-widget.soundcloud.com/${r}s/${e}${t?/tracks:}`,query:{format:json,limit:20,client_id:zr,app_version:vi", Pattern match: "http://www.w3.org/2000/svg,width:24,hei", Pattern match: "http://www.w3.org/2000/svg,width:20,height:20,fill:none,viewbox:0", Pattern match: "https://i.imgur.com/...:\u0421\u0441\u044b\u043b\u043a\u0438", Pattern match: "https://github.com/${$y", Pattern match: "github.com/endcord/equibored/", Heuristic match: "){return jke.exec(e)?.[1]??null}var zxt,jke,vke,qke,gxt,wke,hxt,jxt,ww=y(()=>{use strict;c();zxt=/<@!?(\d{17,20})>/,jke=/discord(?:(?:app)?\.com|:\/\/-?)\/users\/(\d{17,20})/,vke=/cdn\.discordapp\.com\/(?:avatars|users)\/(\d{17,20})\//,qke=/cdn\.discorda", Heuristic match: "e}function nxt({section:e}){let t=typeof e.subtitle{rxt.push(async()=>{if(e.authorids)for(let a of e.authorids){let s=u.getuser(a)??await dr.getuser(a).catch(()=>null);s!=null&&n(l=>[...l,s])}})},[e.au", Heuristic match: "ach(t=>t())}function tst({userid:e,issidebar:t}){let[,o]=m(0);return k(()=>{let r=()=>o(n=>n+1);return wc.add(r),()=>{wc.delete(r)}},[]),array.from(s_).sort(([,r],[,n])=>n.priority-r.priority).map(([r,{render:n}])=>i(j,{noop:!0,key:r,onerror:a=>dst.error(`", Pattern match: "https://cdn.discordapp.com/emojis/1098881040900173895.gif,value:r,onchange:n", Pattern match: "https://endcord.com/plugins/${e.name", Heuristic match: "push(` ${r.reactions.map(a=>`${a.emoji} x${a.count}`).join( )}`)}return o.join(` `)}function x2t(e,t){return json.stringify({channel:t,exported:new date().toisostring(),count:e.length,messages:e},null,2)}function est(e){let t=r=>`${string(r??).replac", Pattern match: "https://discord.com/channels/${vb}/${bg", Pattern match: "https://${e}.discordsays.com/", Pattern match: "http://www.w3.org/2000/svg,width:1.5em,height:1.5em,viewbox:0", Pattern match: "https://cors.keiran0.workers.dev?url=,ydt=12e6;wm=r", Pattern match: "https://youtube.com/@yourchannel:p", Pattern match: "cdn.discordapp.com/avatars/", Pattern match: "https://fonts.google.com/$rpc/fonts.fe.catalog.actions.metadata.metadataservice/fontsearch,{method:post,headers:{content-type:application/json+protobuf,x-user-agent:grpc-web-javascript/0.1},body:json.stringify([[e,null,null,null,null,null,1],[5]", Pattern match: "n.size/2,y:n.size/2},s={x:a.x,y:a.y},l=1e3/n.framerate,u=9e3,d=3e3,m=12,g=document.createelement(div),b,v=0;function", Pattern match: "https://api.github.com/repos/rootpoii/endcord,hr=[];ht.ipcmain.handle", Pattern match: "https://${t.replace(/^\/\//,)", Pattern match: "i.full/,replace:$1$self.rendertimestamp", Pattern match: "last.fm/listenbrainz,mutualgroupdms:affiche", Pattern match: "https://...,onchange:z8},size:{type:5,description:cursor", Pattern match: "discord.gg/${o.code", Pattern match: "pp.com/badge-icons/ec92202290b48d0879b7413d2dde3bab.png],x2e=[{key:account_age,label:account", Heuristic match: "trict;c();xh();d4();uwe=async e=>{if(e?.length===0)return{};let t=new url(vh+/users);return e&&e.length!==0&&t.searchparams.set(ids,json.stringify(e)),await fetch(t).then(o=>o.json())},dwe=async(e=@me)=>wi(vh+`/users/${e}/decorations`).then(t=>t.jso", Pattern match: "https://cdn.discordapp.com/assets/content/157b789531c602542070e680c410d74275e796b6c45cd717292f6d2a59593972.png},{label:dedicated,icon:https://cdn.discordapp.com/assets/content/d6ab0696aae97fca8e6b2b88d4117f09f9ea895d4f0cebee770564369ff06873.png},{labe", Pattern match: "https://${window.global_env.api_endpoint}/guilds/${e}/widget.png?style=banner1`,[e", Heuristic match: "!0,description:p(helps us provide support to you),authors:[f.ven],dependencies:[usersettingsapi],settings:tct,patches:[{find:#{intl::beginning_dm},replacement:{match:/#{intl::beginning_dm},{.+?}\),(?=.{0,300}(\i)\.ismultiuserdm)/,replace:$& $self.re", Pattern match: "https://cdn.discordapp.com/emojis/${r}.png`,alt:e,style:{width:18,height:18,verticalalign:middle", Pattern match: "https://your-zipline-instance.com", Pattern match: "https://raw.githubusercontent.com/adryd325/oneko.js/5281d057c4ea9bd4f6f997ee96ba30491aed16c0/oneko.gif,j1t=https://raw.githubusercontent.com/nexpid/fatass-horse/08bc4042750d5f995c55327f7b6c6710158f5263/sheet.png,iq=oe(vc-cursor-buddy-);ll=r", Pattern match: "https://temp.sh/upload,{method:post,body:i", Pattern match: "last.fm/listenbrainz,mutualgroupdms:\u041f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442", Pattern match: "https://canary.discord.com/assets/0950a7ea4f1dd037870b.mp3,winter_call_calling:https://canary.discord.com/assets/7b945e7be3f86c5b7c82.mp3,halloween_call_ringing:https://canary.discord.com/assets/1b883b366ae11a303b82.mp3,winter_call_ringing:https://ca", Pattern match: "https://decor.fieryflames.dev,vh=yvt+/api,swe=vh+/authorize,lwe=https://ugc.decor.fieryflames.dev,cwe=1096966363416899624,wy=100101099111114,a4=11497119,sx=1096357702931841148,c4=dxp2sdxdcp,$q=1e3*60*60*4", Pattern match: "https://discord.gg/${e.invite}`,onclick:async", Pattern match: "https://example.com/a.css", Pattern match: "https://tmpfiles.org/api/v1/upload,{method:post,body:o", Pattern match: "https://cdn.jsdelivr.net/npm/@ffmpeg/core@0.12.6/dist/esm,t=`///", Pattern match: "https://cdn.discordapp.com/badge-icons/6de6d34650760ba5551a79732e98ed60.png,pq=[{label:p", Pattern match: "https://images-ext-1.discordapp.net/external/085kikmvni8n60g3ghe1rgca0xgh6ogbkizquiqysxc/%3fname%3dunknown%2520file%26subtitle%3d0%2520mb/https/placeholder.nin0.dev/image", Pattern match: "https://googlechrome.github.io/samples/image-rendering-pixelated/index.html", Pattern match: "github.com/theoriginalayaka", Pattern match: "https://fonts.googleapis.com/css2?family=${encodeuricomponent(e)}${t}&display=swap`,d1=null,ap=null,v3=arial;w3t=s", Pattern match: "www.tidal.com,listen.tidal.com],types:[artist,album,playlist,track],async", Pattern match: "https://discord.com/", Pattern match: "https://cdn.discordapp.com/assets/content/8a62ba720addf7584d3e7f82170104e6a2b35aea4aba5ffc7260cfd706f40c37.png}]},{key:game_variety,label:game", Pattern match: "https://cdn.jsdelivr.net/npm/@vap/shiki-worker@0.0.8/dist/index.min.js,ate=https://cdn.jsdelivr.net/npm/@vap/shiki@0.10.3/dist/onig.wasm,cte=gs", Pattern match: "https://cdn.discordapp.com/assets/content/183d6521c3696b0b42f73dd9c319307490982a5dffdc34a923b760d82b20916a.png},{label:maverick,icon:https://cdn.discordapp.com/assets/content/84d4695cdcbb350ad5385c06e87caf06835872135625a8bff6bac300af858412.png},{label", Pattern match: "https://raw.githubusercontent.com/rootpoii/endcord/main/version.json${r", Pattern match: "https://fonts.google.com/$rpc/fonts.fe.catalog.actions.metadata.metadataservice/fontsearch,{body:json.stringify([[,null,null,null,null,null,1],[5],null,400]),headers:{content-type:application/json+protobuf,x-user-agent:grpc-web-javascript/0.1},m", Pattern match: "https://example", Heuristic match: "ce:$1$self.trailingwrapper,}}],trailingwrapper({children:e}){return i(h,null,e,i(j,{key:vc-toolbox,noop:!0},i(rft,null)))},start(){zfe()},stop(){th()}})});async function ph(e=!1){try{let t=await fetch(`${nft}?t=${date.now()}`);if(!t.ok)return;let o=awa", Pattern match: "https://$2.$3", Pattern match: "https://github.com/${cr", Pattern match: "https://your-cors-proxy.example.com", Pattern match: "http://www.w3.org/2000/svg,width:t,height:t,fill:none,viewbox:0", Heuristic match: "t})),referencedmessage:d.referenced_message?{id:d.referenced_message.id,authorname:d.referenced_message.author?.username??inconnu,content:d.referenced_message.content?.slice(0,100)??}:void 0,pinned:d.pinned??!1,type:d.type??0,components:d.components??[", Pattern match: "https://raw.githubusercontent.com/equicord/equibored/main/sounds/animalese;zut=s", Pattern match: "https://i.imgur.com/...:les", Pattern match: "https://i.imgur.com/...:imgur", Pattern match: "https://discord.gg/${e}`}async", Pattern match: "https://github.com/autumnvn/usrbg#how-to-request-your-own-usrbg-banner,variant:primary},p", Pattern match: "https://github.com/equicord/equibored/raw/main/icons/loginwithqr/cross.png,deviceimage:{success:https://github.com/equicord/equibored/raw/main/icons/loginwithqr/success.png,notfound:https://github.com/equicord/equibored/raw/main/icons/loginwithqr/not-f", Pattern match: "https://discord.nfp.is/?v=${encodeuricomponent(e)}`;default:return", Pattern match: "https://fonts.googleapis.com/css2?family=${encodeuricomponent(e)}${t}&display=swap`,kae=e=", Pattern match: "https://fonts.google.com/$rpc/fonts.fe.catalog.actions.metadata.metadataservice/fontsearch,{body:json.stringify", Pattern match: "https://pixelvault.co/,{method:post,headers:{authorization:i},body:n", Pattern match: "https://cdn.discordapp.com/assets/content/9482ad3a1104986a4cce2979291c733eca0707f6218ddfb6ff36e32e3fd709e9.png},{label:headliner,icon:https://cdn.discordapp.com/assets/content/2cf2a4ab39800a963efdb900b823dc8ccb23464434f3e11d329851ae566cac22.png},{labe", Pattern match: "deepl.com/your-account", Pattern match: "https://github.com/rootpoii/endcord/releases", Pattern match: "https://youtube.com/@yourchannel:ex", Heuristic match: "iption:adds configurable timeout presets to the status (presence) menu.,tags:[activity,utility],authors:[f.ewlle,f.kraethis,f.sharp],settings:jy,patches:[{find:#{intl::duration_forever},replacement:{match:/\[\{duration.*?#{intl::duration_forever}\)", Pattern match: "https://github.com/${o}?tab=repositories`,_blank", Pattern match: "https://cdn.discordapp.com&&e.pathname.startswith(/attachments/)?e:null}function", Pattern match: "https://pixeldrain.com/u/${s.id}`}async", Pattern match: "https://discord.com/popout:casehttps://ptb.discord.com/popout:casehttps://canary.discord.com/popout:return{action:allow}}try{var{protocol:t}=new", Pattern match: "https://c.tenor.com/yeg33hsleaiaaaac/parksandrec-oops.gif},collectionssorttype:{description:the", Pattern match: "https://${r", Pattern match: "https://manti.vendicated.dev/api/reviewdb,tm=50,c8t=2;j3e=e=", Pattern match: "i.id/,replace:$&", Pattern match: "github.com/sponsors/mantikafasi", Pattern match: "https://discord.com/channels/${a.guild_id}/${t}/${v}`:w=`https://discord.com/channels/@me/${t}/${v}`}w&&(m.set(v,w),b.push({id:v,index:x}))}return", Pattern match: "https://endcord.com/,settingssync:!1,settingssyncversion:0}},xe=endcordnative.settings.get();qb(xe,qat);go=new", Pattern match: "https://your-endpoint.example.com", Pattern match: "https://itunes.apple.com/search", Pattern match: "http://localhost:*:$,http://127.0.0.1:*:$,localhost:*:$,127.0.0.1:*:$,*.github.io:$,github.com:[...$,media-src],raw.githubusercontent.com:[...$,media-src],*.gitlab.io:$,gitlab.com:$,*.codeberg.page:$,codeberg.org:$,*.githack.com:", Pattern match: "http://www.w3.org/2000/svg,classname:e},i", Heuristic match: "()=>pe,generatetextcss:()=>wo,handlesettingstaberror:()=>tz,opencontributormodal:()=>cv,openpluginmodal:()=>ll,opensettingstabmodal:()=>og,wraptab:()=>yr});var wy=y(()=>{use strict;c();jt();ft();bi();pv();$u();ir();te();gc();kt();tn();qz();st();av();at()", Pattern match: "last.fm/listenbrainz", Pattern match: "https://i.imgur.com/...:los", Pattern match: "https://soundcloud.com/oembed,query:{format:json,url:r", Pattern match: "https://fonts.googleapis.com/css2?family=${encodeuricomponent(e).replace(/%20/g,+)}${t}&display=swap`;c3=null,dp=null", Pattern match: "https://catbox.moe/user/api.php,{method:post,body:r", Pattern match: "https://encrypting.host/upload,{method:post,body:r", Pattern match: "https://discord.com/channels/@me/${e}`:f4.store.channeloutput===link?`https://discord.com/channels/${t??o.guild_id??@me}/${e", Pattern match: "https://media.discordapp.net/stickers/${t}.${o}?size=${si.store.stickersize}`},async", Pattern match: "https://${r}.discordsays.com/.proxy/acf/quest/progress`,{headers:mi(i,e,n),body:json.stringify({progress:t}),method:post,mode:cors,credentials:include", Heuristic match: "{let o=t.getusertag.bind(t);t.getusertag=(r,...n)=>{if(r?.id){let a=cl(r.id);if(a&&a.username)return a.username}return o(r,...n)}}if(t.usename){let o=t.usename.bind(t);t.usename=r=>{if(r?.id){let n=wo?.getid?.(),a=!!(n&&r.id===n),s=cl(r.id);if(a&&s?.global", Pattern match: "https://api.imgur.com/3/image,{method:post,headers:{authorization:client-id", Pattern match: "https://${window.global_env.cdn_host}/icons/${r?.id}/${r?.icon}.png`,classname:ko(bookmark-icon)", Heuristic match: "kraethis,f.sharp],description:adds the ability to change the order of your favourite emotes,tags:[customisation,chat,emotes],patches:[{find:#{intl::emoji_favorite_tooltip},replacement:[{match:/(ref:\i,children:)($0,\i.jsxs?$\(\i)/,replace:$1ar", Pattern match: "https://manti.vendicated.dev/api/reviewdb/auth,permissions:0n,clientid:915703782174752809,cancelcompletesflow:!1,callback:async", Pattern match: "https://discord.com/api/v9/channels/${e}/messages?limit=100${n?`&before=${n}`:}`,l=await", Pattern match: "https://placeholder.nin0.dev/ima", Pattern match: "https://equicord.org/assets/plugins/friendshipranks/sprout.png},{title:blooming,description:your", Pattern match: "https://badges.equicord.org/,restartneeded:!1,isvalid", Pattern match: "https://api.giphy.com/v1${e}?`+new", Heuristic match: ":e,at:t},!1)}function fi(){return no.active||no.activeentity!==null||no.activeuserid!==null||no.activeguildid!==null}function dke(){return no.activeguildid!==null||no.activeentity?.kind===guild}function tke(){return no.activeuserid!==null||no.activeentit", Pattern match: "https://themes.equicord.org/api/download/${encodeuricomponent(e.id)", Pattern match: "https://cdn.discordapp.com", Pattern match: "https://github.com/rootpoii/endcord/commit/${sp", Pattern match: "http://www.w3.org/2000/svg,viewbox:0", Pattern match: "https://www.youtube.com/", Heuristic match: "${e.name}.`,o.type.failure);return}o.enabled=!t,q(`${e.name} ${t?disabled:enabled}.`,o.type.success)}function myt(){return object.values(_t).filter(e=>!e.required&&!e.hidden).sort((e,t)=>e.name.localecompare(t.name)).map(e=>{let t=dt(e.name);return{id:", Pattern match: "https://cdn.discordapp.com/avatars/${e.recipientid}/${e.avatar}.webp?size=32`:null}let", Pattern match: "https://youtube.com/@yourchannel:\xf6rn", Pattern match: "https://music.apple.com/${jr}/${r}/${il}/${e}`}var", Pattern match: "https://i.giphy.com/${r[r.length-2]}.gif`:e}return", Pattern match: "https://example.org,src:https://example.org,width:100,height:100,format:0", Pattern match: "https://cdn.discordapp.com/emojis/${r}.${a}`,alt:e,style:{width:18,height:18,verticalalign:middle", Pattern match: "https://open.spotify.com/embed/", Pattern match: "https://example.com/api/upload,body:multipartformdata}',onchange:k=", Pattern match: "youtube.com/embed/", Pattern match: "https://${window.global_env.cdn_host}/soundboard-sounds/${e}`,{volume:50", Pattern match: "https://www.last.fm/api/account/create,classname:ne.top8},p", Pattern match: "http://www.w3.org/2000/svg,width:t,height:e,fill:none,viewbox:0", Pattern match: "https://sponsor.ajay.app/api/branding?videoid=${r", Pattern match: "https://cdn.jsdelivr.net/npm/@ffmpeg/core@0.12.6/dist/esm,o=`///", Pattern match: "https://bit.ly/ligma_hotline", Pattern match: "http://www.w3.o", Pattern match: "https://dearrow-thumb.ajay.app/api/v1/getthumbnail?videoid=${r}&time=${s[0].timestamp}`;e.dearrow.oldthumb=o?e.thumbnail.proxyurl:d,o&&(e.thumbnail.proxyurl=d)}this.forceupdate()}catch(e){new", Pattern match: "https://api.tenor.com/v1${e}?`+new", Pattern match: "https://cdn.discordapp.com/app-icons/${d.id}/${d.icon}.png`;o.push({image:{src:m,alt:d.name},activity:n,application:d})}else", Pattern match: "git.nin0.dev/userplugins", Pattern match: "https://cdn.discordapp.com/badge-icons/cd5e2cfd9d7f27a8cdcd3e8a8d5dc9f4.png},{label:p", Pattern match: "http://www.w3.org/2000/svg,viewbox:-2", Pattern match: "https://media.discordapp.net/${a.replace(/mp:/,)}`;(fl.store.rendergifs||!k.endswith(.gif))&&o.push({image:{src:k,alt:c},activity:n})}else", Pattern match: "https://example.com/image.png", Pattern match: "https://media.tenor.com/${d}${b?n.video:n.tenor}/${m}.${b?g:webp}`}let", Pattern match: "https://momentjs.com/docs/#/displaying/format/},p", Pattern match: "https://discord.com/,referrerpolicy:strict-origin-when-cross-origin,mode:cors,credentials:omit", Heuristic match: "d,x.dims.left,x.dims.top);let c=document.createelement(canvas);c.width=a,c.height=s;let k=c.getcontext(2d);if(!k)throw new error(failed to get canvas context for frame snapshot.);k.drawimage(l,0,0),g.push(c),v%20===19&&await gi(0)}return await qq(t.w", Pattern match: "https://${window.global_env.cdn_host", Heuristic match: "p,.8)},n.onerror=()=>{url.revokeobjecturl(r),o(new error(could not decode that image))},n.src=r})}function l5(e,t,o,r,n){return km(async()=>{let a=await wpt(e),s=await td(),l=c=>c.kind===t&&c.group===o,u=s.find(c=>l(c)&&c.sig===a);if(u)return u;let d=n?", Pattern match: "http://www.w3.org/2000/svg,width:e,height:t,viewbox:0", Pattern match: "http://www.w3.org/2000/svg},e?i", Pattern match: "https://${m}/stickers/${l.id}.gif?size=4096&lossless=true`,c=await", Pattern match: "https://equicord.org/assets/plugins/friendshipranks/royal.png},{title:besties,description:how", Pattern match: "te.php/dav/files/username", Pattern match: "https://discord.gg/${e.code", Pattern match: "https://corsproxy.io/?url=],b3t=[discordapp.com,discordapp.net", Pattern match: "https://youtube.com/@yourchannel", Pattern match: "https://cdn.discordapp.com/avatars/${e.id}/${e.avatar}.webp?size=32`:`https://cdn.discordapp.com/embed/avatars/${e.discriminator&&e.discriminator!==0?parseint(e.discriminator)%5:number", Pattern match: "https://www.myinstants.com/media/sounds/nextel-walkie-talkie.mp3,sde=gs", Pattern match: "https://github.com/equicord/equibored/raw/main/sounds/keyboardsounds/operagx/click1.wav,https://github.com/equicord/equibored/raw/main/sounds/keyboardsounds/operagx/click2.wav,https://github.com/equicord/equibored/raw/main/sounds/keyboardsounds/operagx", Pattern match: "https://${window.global_env.cdn_host}/icons/${e?.id}/${e?.icon}.png`,classname:nn(icon)", Pattern match: "https://cdn.discordapp.com/assets/content/53b3a2b4307df9dfc05a4c9da977baa4a6fd822f5a3d24843f949d1c93398322.png},{label:stromatolite,icon:https://cdn.discordapp.com/assets/content/d30993594816cc6035041941291dc7a5862e55676ce85eef91f89fd0c59f2931.png},{l", Pattern match: "https://endcord.com/source},o(contributed)", Pattern match: "https://cdn\\.discordapp\\.com/emojis/${o}\\", Pattern match: "https://discord.com/developers/applications},p", Pattern match: "https://api.github.com/orgs/${e}/repos?sort=stars&direction=desc&per_page=${t}`,r=await", Pattern match: "https://cdn.discordapp.com/media/v1/collectibles-shop/${e}/${t?animated:static}`}function", Pattern match: "https://amp-api.music.apple.com/v1/catalog/${jr}/${r}s`,query:{include:songs,ids:e},headers:{authorization:`bearer", Pattern match: "last.fm/listenbrainz,mutualgroupdms:muestra", Pattern match: "http://www.youtube.com/cthru?]','a[href^=https://www.youtube.com/cthru?]',ytd-action-companion-ad-renderer,ytd-banner-promo-renderer,ytd-compact-promoted-video-renderer,ytd-companion-slot-renderer,ytd-display-ad-renderer,ytd-promoted-sparkles", Pattern match: "t.size/1024/1024", Pattern match: "https://github.com/equicord/equibored/raw/main/sounds/keyboardsounds/osu/key-confirm.mp3],arrows:[https://github.com/equicord/equibored/raw/main/sounds/keyboardsounds/osu/key-movement.mp3],allowedignored:[capslock,arrowup,arrowright,arrowleft,a", Pattern match: "https://${r}.discordsays.com/.proxy/acf/authorize`,{headers:mi(t,,i),body:json.stringify({code:e}),method:post,mode:cors,credentials:include", Pattern match: "http://www.w3.org/2000/svg,fill:currentcolor,viewbox:0", Pattern match: "https://temp.sh/upload,{method:post,body:o", Pattern match: "https://cors.keiran0.workers.dev", Pattern match: "http://www.w3.org/2000/svg,width:e,height:t,fill:none,viewbox:0", Pattern match: "https://open.spotify.com/embed/${r}/${e", Pattern match: "https://cdn.discordapp.com/banners/${e}/${t.banner}.${t.banner.startswith(a_)?gif:png}`,et(kg,this.data)", Heuristic match: "|d?.searchparams.get(animated)===true;return it.defaultrules.customemoji.react({jumboable:!t&&e.length===1&&typeof e[0].type!=string,animated:g,emojiid:u[1],name:m,fake:!0},void 0,{key:string(o++)})}}if(si.store.transformstickers){if(h7.test(l.props.", Pattern match: "https://discord.com/users/${t.id", Pattern match: "https://cdn.discordapp.com/badge-icons/2ba85e8026a8614b640c2837bcdfe21b.png},{label:p", Pattern match: "https://github.com/sammcheese/invisible-chat/raw/newreplugged/src/assets/lock.png,widt", Pattern match: "n.size/2;a.x=math.min(math.max(he,a.x),window.innerwidth-he),a.y=math.min(math.max(he,a.y),window.innerheight-he),c(e,!0)}else", Pattern match: "https://discord.gg/${c4}`,onclick:async", Pattern match: "https://cdn.discordapp.com/badge-icons/83d8a1eb09a8d64e59233eec5d4d5c2d.png},gift_patron:{label:p", Pattern match: "https://cdn.discordapp.com/avatars/1134864775000629298/3f87ad315b32ee464d84f1270c8d1b37.png?size=256&format=webp&quality=lossless,discordid:1134864775000629298,badges:[]}}]};if(!r||u.reviews.length===0)return", Pattern match: "https://discord.com/api/v9/users/@me/clan,{method:put,headers:{authority:discord.com,accept:*/*,accept-language:en-us,authorization:e,cache-control:no-cache,content-type:application/json,cookie:__dcfduid=generic_dcfduid", Pattern match: "https://cdn.discordapp.com/badge-icons/7060786766c9c840eb3019e725d2b358.png},{label:p", Pattern match: "https://catbox.moe/user/api.php,{method:post,body:n", Pattern match: "https://clients2.google.com/service/update2/crx?response=redirect&acceptformat=crx2,crx3&x=id%3d${r}%26uc&prodversion=${process.versions.chrome}`,n=await"2b:T66d,Found HTTPS url "https://github.com", Found HTTPS url "https://unpkg.com", Found HTTPS url "https://nest.rip", Found HTTPS url "https://cdn.discordapp.com", Found HTTPS url "https://api.tidal.com", Found HTTPS url "https://pixelvault.co", Found HTTPS url "https://pixeldrain.com", Found HTTPS url "https://imgur.com", Found HTTPS url "https://navidrome.example.com", Found HTTPS url "https://canary.discord.com", Found HTTPS url "https://nextcloud.example.com", Found HTTPS url "https://litterbox.catbox.moe", Found HTTPS url "https://upload.gofile.io", Found HTTPS url "https://gofile.io", Found HTTPS url "https://api.github.com", Found HTTPS url "https://drive.google.com", Found HTTPS url "https://view.officeapps.live.com", Found HTTPS url "https://www.viewstl.com", Found HTTPS url "https://raw.githubusercontent.com", Found HTTPS url "https://www.tiktok.com", Found HTTPS url "https://www.tnktok.com", Found HTTPS url "https://vt.tiktok.com", Found HTTPS url "https://x.com", Found HTTPS url "https://www.fxtwitter.com", Found HTTPS url "https://www.twitter.com", Found HTTPS url "https://www.instagram.com", Found HTTPS url "https://www.kkinstagram.com", Found HTTPS url "https://betterdiscord.app", Found HTTPS url "https://example.com", Found HTTPS url "https://usrbg.is", Found HTTPS url "https://tmpfiles.org", Found HTTPS url "https://w.buzzheavier.com", Found HTTPS url "https://buzzheavier.com", Found HTTPS url "https://endcord.com", Found HTTPS url "https://www.last.fm", Found HTTPS url "https://platform.openai.com", Found HTTPS url "https://api.e", Found HTTPS url "https://0x0.st", Found HTTPS url "https://cdn.jsdelivr.net"2c:T42d,Observed email domain:"reach(e=>e())}function px(e){mx={...mx,...e},bxt()}function rke(){return mx.visible}function yw(e,t){tx={x:e,y:t},ix===null&&(px({x:e,y:t}),ix=requestanimationframe(()=>{tx&&px({x:tx.x,y:tx.y}),tx=null,ix=null}))}function yy(){mx.visible&&(md!==null&&(cleartimeout(md),md=null),px({exiting:!0}),md=window.settimeout(()=>{md=null,px({visible:!1,exiting:!1})},200))}function nke(e,t){md!==null&&(cleartimeout(md),md=null),t&&yw(t.x,t.y),px({...e,visible:!0,exiting:!1})}function lke(){if(typeof document>"u")return;let{body:e}=document;if(e){if(b4){pp&&!pp.isconnected&&e.appendchild(pp);return}pp||(pp=document.createelement("div")),pp.isconnected||e.appendchild(pp),b4=mn(pp),b4.render(i("div",{classname:os("ghost-container")},i(j,{noop:!0},i(rxt,null))))}}function fke(){b4?.unmount(),b4=null,pp?.remove(),pp=null,ix!==null&&(cancelanimationframe(ix),ix=null),tx=null,md!==null&&(cleartimeout(md),md=null),px({visible:!1,exiting:!1})}function nxt({classname:e,size:t=14}){return i("svg",{classname:e,xmlns:"http://www.w3.o" [Source: sample.bin]2d:T433,"ycdn\.com\/image/,"://i.scdn.co/image");return r==="track"?{form:"single",...i,thumbnailUrl:n,single:{audio:t.audioPreview&&t.duration?{duration:t.duration,previewUrl:t.audioPreview.url}:void 0}}:{form:"list",...i,thumbnailUrl:n,list:(t.trackList??[]).slice(0,15).map(s=>({label:s.title,sublabel:s.subtitle??s.artists?.map(o=>o.name).join(", "),link:Bi(s.uri),explicit:!!s.isExplicit,audio:s.audioPreview&&s.duration?{duration:s.duration,previewUrl:s.audioPreview.url}:void 0}))}},async validate(r,e){return!(await zi(r,e))?.props?.pageProps?.title}},hl="vNVdglQOjFJJGG2U";async function Lt(r,e,t="",i={}){return await V({url:`https://api.tidal.com/v1/${r}s/${e}/${t}`,query:{countryCode:"US",...i},headers:{"X-Tidal-Token":hl}}).then(n=>n.ok?n.json:void 0)}async function Gi(r){let e=await Lt("track",r,"playbackinfo",{audioquality:"HIGH",playbackmode:"STREAM",assetpresentation:"FULL"});if(e?.manifest)return JSON.parse(atob(e.manifest)).urls[0]}function Wi(r){try{let e=new URL(r);return e.protocol="https://",e.toString(" (Indicator: "countrycode") in Source: sample.bin2e:T51a2,Found reference to API "f.createFFmpegCore = (await import( /* webpackIgnore: true */ /* @vite-ignore */ _coreURL)).default; if (!self.createFFmpegCore) { throw ERROR_IMPORT_FAILURE; } } const coreURL = _coreURL; const wasmURL = _wasmURL ? _wasmURL : _coreURL.replace(/.js$/g, ".wasm"); const workerURL = _workerURL ? _workerURL : _coreURL.replace(/.js$/g, ".worker.js"); ffmpeg = await self.createFFmpegCore({ mainScriptUrlOrBlob: \`\${coreURL}#\${btoa(JSON.stringify({ wasmURL, workerURL }))}\`, }); ffmpeg.setLogger((data) => self.postMessage({ type: FFMessageType.LOG, data })); ffmpeg.setProgress((data) => self.postMessage({ type: FFMessageType.PROGRESS, data, })); return first; }; const exec = ({ args, timeout = -1 }) => { ffmpeg.setTimeout(timeout); ffmpeg.exec(...args); const ret = ffmpeg.ret; ffmpeg.reset(); return ret; }; const writeFile = ({ path, data }) => { ffmpeg.FS.writeFile(path, data); return true; }; const readFile = ({ path, encoding }) => ffmpe" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "ace(/.js$/g, ".worker.js"); ffmpeg = await self.createFFmpegCore({ // Fix \`Overload resolution failed.\` when using multi-threaded ffmpeg-core. // Encoded wasmURL and workerURL in the URL as a hack to fix locateFile issue. mainScriptUrlOrBlob: \`\${coreURL}#\${btoa(JSON.stringify({ wasmURL, workerURL }))}\`, }); ffmpeg.setLogger((data) => self.postMessage({ type: FFMessageType.LOG, data })); ffmpeg.setProgress((data) => self.postMessage({ type: FFMessageType.PROGRESS, data, })); return first; }; const exec = ({ args, timeout = -1 }) => { ffmpeg.setTimeout(timeout); ffmpeg.exec(...args); const ret = ffmpeg.ret; ffmpeg.reset(); return ret; }; const writeFile = ({ path, data }) => { ffmpeg.FS.writeFile(path, data); return true; }; const readFile = ({ path, encoding }) => ffmpeg.FS.readFile(path, { encoding }); // TODO: check if deletion works. const deleteFile = ({ path }) => { ffmpeg.FS.unlink(path); return true; }; const rename = ({ oldPath, newPath }) => { " (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "ferences.getAccentColor?.()??"";return r.length&&r[0]!=="#"&&(r=`#${r}`),{"os-accent-color":r}});C.ipcMain.handle("EndcordOpenThemesFolder",()=>C.shell.openPath(pe));C.ipcMain.handle("EndcordOpenSettingsFolder",()=>C.shell.openPath(Ne));C.ipcMain.handle("EndcordInitFileWatchers",({sender:r})=>{let e,t;(0,Re.open)(We,"a+").then(n=>{n.close(),e=(0,ke.watch)(We,{persistent:!1},gn(async()=>{r.postMessage("EndcordQuickCssUpdate",await Us())},50))}).catch(()=>{});let i=(0,ke.watch)(pe,{persistent:!1},gn(()=>{r.postMessage("EndcordThemeUpdate",void 0)}));r.once("destroyed",()=>{e?.close(),i.close(),t?.close()})});C.ipcMain.on("EndcordGetMonacoTheme",r=>{r.returnValue=C.nativeTheme.shouldUseDarkColors?"vs-dark":"vs-light"});C.ipcMain.handle("EndcordOpenMonacoEditor",async()=>{let r="Endcord QuickCSS Editor",e=C.BrowserWindow.getAllWindows().find(i=>i.title===r);if(e&&!e.isDestroyed()){e.focus();return}let t=new C.BrowserWindow({title:r,autoHideMenuBar:!0,darkTheme:!0,backgroundColor:C.nativeTheme.shouldUseDarkColors?" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "){r.stickerIds=o;let n={content:"",tts:!1,invalidEmojis:[],validNonShortcutEmojis:[]};Et._sendMessage(e.id,n,r)}else Et.sendGreetMessage(e.id,o[0],r)}function d6t({channel:e,message:t}){let o=LP.use(["greetMode","multiGreetChoices"]),{greetMode:r,multiGreetChoices:n=[]}=o;return i(P.Menu,{navId:"greet-sticker-picker",onClose:()=>V.dispatch({type:"CONTEXT_MENU_CLOSE"}),"aria-label":"Greet Sticker Picker"},i(P.MenuGroup,{label:p("Greet Mode")},Object.values(g7e).map(a=>i(P.MenuRadioItem,{key:a,group:"greet-mode",id:"greet-mode-"+a,label:a,checked:a===r,action:()=>o.greetMode=a}))),i(P.MenuSeparator,null),i(P.MenuGroup,{label:p("Greet Stickers")},u$.map(a=>i(P.MenuItem,{key:a.id,id:"greet-"+a.id,label:a.description.split(" ")[0],action:()=>f7e(e,t,[a.id])}))),LP.store.unholyMultiGreetEnabled?i(h,null,i(P.MenuSeparator,null),i(P.MenuItem,{label:p("Unholy Multi-Greet"),id:"unholy-multi-greet"},u$.map(a=>{let s=n.some(l=>l===a.id);return i(P.MenuCheckboxItem,{key:a.id,id:"multi-greet-"+a.id,label:a.description.spli" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "(/=>(\i)\?\i$\1/)}),{zustandPersist:E0}=Io(".onRehydrateStorage)?",{zustandPersist:Ne.byCode(/(\(\i,\i$)=>.+?\i\1/)}),Et=de("editMessage","sendMessage"),oC=de("clearCache","_channelMessages"),Jw={openUserProfileModal:_e('type:"USER_PROFILE_MODAL_OPEN"')},Xw=de("resolveInvite"),_a=de("openPrivateChannel"),qe=de("getGuildBannerURL","getUserAvatarURL"),Ec=Io("expression-picker-last-active-view",{openExpressionPicker:Ne.byCode(/setState${activeView:(?:(?!null)\i),activeViewType:/),closeExpressionPicker:Ne.byCode("setState({activeView:null"),toggleMultiExpressionPicker:Ne.byCode(".EMOJI,"),toggleExpressionPicker:Ne.byCode(/\i\.activeView===\i&&\i\.activeViewType===\i&&/),setExpressionPickerView:Ne.byCode(/setState\({activeView:\i,lastActiveView:/),setSearchQuery:Ne.byCode("searchQuery:"),useExpressionPickerStore:Ne.byCode(/\(\i,\i=\i$=>/)}),Pg=Io('type:"POPOUT_WINDOW_OPEN"',{open:Ne.byCode('type:"POPOUT_WINDOW_OPEN"'),close:Ne.byCode('type:"POPOUT_WINDOW_CLOSE"'),setAlwaysOnTop:Ne.byCode('type:"POPOUT_WINDOW_S" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API ")),n!=null&&(d.description=n),V.dispatch({type:"DELETE_PENDING_REPLY",channelId:t.id}),Li(t.id,{},!1,{...Et.getSendMessageOptionsForReply(u),attachmentsToUpload:[d]})}function cK(e,t){return!!t&&(yt.can(e,t)||t.isPrivate())}function S4e(e){return e.normalize("NFD").replace(Tkt,"").normalize("NFKC").toLowerCase().trim()}function Ikt(e,t){let o=0,r=0;for(let n=0;n{Ea.FrecencyUserSettingsActionCreators.loadIfNecessary()},[]);let o=ge([Eu],()=>{let n=Eu.frecencyWithoutFetchingLatest.favoriteGifs?.gifs;return n?Object.entries(n).filter(([,{format:a}])=>a===0).map(([a,{src:s,...l}])=>({...l,...aK.decode(URL.parse(s)?.hash.replace("#","")??""),url:a})).filter(({format:a,data:s})=>s&&a===e):null},[e]),{state:r}=ge([Eu],()=>{let n=t&&S4e(t);if(!o)return{query:n,state:null};if(!n)return{query:n,state:o.toSorted((s,l)=>l.order-s.order)};let a=o.map(s=>({item:s,score:Ikt(n,S4e(aK.stringify(s.format,s.data)))})).filter(({s" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "h (e) { self.postMessage({ id, type: FFMessageType.ERROR, data: e.toString(), }); return; } if (data instanceof Uint8Array) { trans.push(data.buffer); } self.postMessage({ id, type, data }, trans); }; `,o=new Blob([new TextEncoder().encode(t)],{type:"text/javascript"}),r=URL.createObjectURL(o);return await Yx.load({coreURL:`${e}/ffmpeg-core.js`,wasmURL:`${e}/ffmpeg-core.wasm`,workerURL:`${e}/ffmpeg-core.worker.js`,classWorkerURL:r}),r3e=!0,console.log("[FileUpload] FFmpeg loaded"),Yx})(),SM)}async function n3e(e){let t=c5t++,o=`input_${t}.png`,r=`output_${t}.gif`;try{let n=await u5t(),a=await e.arrayBuffer();await n.writeFile(o,new Uint8Array(a)),await n.exec(["-i",o,"-filter_complex","split[s0][s1];[s0]palettegen=stats_mode=single:transparency_color=000000[p];[s1][p]paletteuse=new=1:alpha_threshold=10",r]);let s=await n.readFile(r);return typeof s=="string"?(console.error("[FileUpload] FFmpeg returned string instead of Uint8Array"),null):new Blob([new Uint8Array(s)]" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "i.RENAME:case Ii.CREATE_DIR:case Ii.LIST_DIR:case Ii.DELETE_DIR:this.#i[t](r);break;case Ii.LOG:this.#n.forEach(n=>n(r));break;case Ii.PROGRESS:this.#a.forEach(n=>n(r));break;case Ii.ERROR:this.#o[t](r);break}delete this.#i[t],delete this.#o[t]})};#t=({type:t,data:o},r=[],n)=>this.#e?new Promise((a,s)=>{let l=T1e();this.#e&&this.#e.postMessage({id:l,type:t,data:o},r),this.#i[l]=a,this.#o[l]=s,n?.addEventListener("abort",()=>{s(new DOMException(`Message # ${l} was aborted`,"AbortError"))},{once:!0})}):Promise.reject(M1e);on(t,o){t==="log"?this.#n.push(o):t==="progress"&&this.#a.push(o)}off(t,o){t==="log"?this.#n=this.#n.filter(r=>r!==o):t==="progress"&&(this.#a=this.#a.filter(r=>r!==o))}load=({classWorkerURL:t,...o}={},{signal:r}={})=>(this.#e||(this.#e=t?new Worker(new URL(t,R1e.url),{type:"module"}):new Worker(new URL("./worker.js",R1e.url),{type:"module"}),this.#s()),this.#t({type:Ii.LOAD,data:o},void 0,r));exec=(t,o=-1,{signal:r}={})=>this.#t({type:Ii.EXEC,data:{args:t,timeout:o}},void 0,r);ffprobe=(t,o=-1" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "nelId())}function Vs(){return Ue.getGuild(Eo()?.guild_id)}function Kw(e,t=!0){return _a.openPrivateChannel({recipientIds:[e],navigateToChannel:t})}function wg(){try{return Ea.PreloadedUserSettingsActionCreators.getCurrentValue()?.appearance?.theme}catch{return 1}}function Cr(e){Mc.dispatchToLastSubscribed("INSERT_TEXT",{rawText:e,plainText:e})}async function rt(e,t="Copied to clipboard!"){await po(e),O.show({message:t,id:O.genId(),type:O.Type.SUCCESS})}function Li(e,t,o=!0,r={}){let n={content:"",invalidEmojis:[],tts:!1,validNonShortcutEmojis:[],...t};return Et.sendMessage(e,n,o,r)}function dr(e,t){return Zw({items:[{type:"IMAGE",original:e.original??e.url,...e}],...t})}async function Fi(e){if(!await Dr.getUser(e))throw new Error("No such user: "+e);let o=Kt.getGuildId();Jw.openUserProfileModal({userId:e,guildId:o,channelId:ve.getChannelId(),analyticsLocation:{page:o?"Guild Channel":"DM Channel",section:"Profile Popout"}})}async function $w(e,t){let o=lo.getUserProfile(e);if(o)return o;V.dispatch({type:"USER_" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "}),await Q1e(n,{fileName:s.trim(),participants:u,title:m.trim(),spoiler:b,remix:x,thumbnail:A,createdAt:new Date(k).toISOString(),message:D,channelId:t,applicationId:N.trim()||void 0,remoteClipId:My(o?.remoteClipId),eventsTimeline:o?.eventsTimeline,messageReference:Ve?Et.getSendMessageOptionsForReply(Ve)?.messageReference:null})){e.onClose();return}j(!1)}return i(ye,{...e,title:p("Upload Clip File"),notice:he,actions:[{text:"Cancel",variant:"secondary",onClick:e.onClose,disabled:E},{text:E?"Uploading":"Upload",variant:"primary",onClick:()=>{Oe()},disabled:!ce}]},i(ue,{flexDirection:"column",gap:12},i("section",null,i(Se,{tag:"h5"},p("File")),i(ue,{alignItems:"center",gap:8},i(xe,{onClick:()=>{Pe()},disabled:E},p("Select File")),i(le,null,n?.name??"No file selected")),i(ym,{value:Z,onChange:(Ve,Qe)=>X(Qe),disabled:E,type:"row"},p("Parse clip metadata from file"))),i(yT,{title:p("File name"),value:s,onChange:l,placeholder:"my_clip.mp4",disabled:E}),i(yT,{title:p("Title"),value:m,onChange:g,placeholder:p("Epic M" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "TTACH_FILES,o),canSendMessages:cK(lt.SEND_MESSAGES,o)}),[o]),b=ke(()=>{switch(!0){case m:return async()=>{l(!0),await D4e(d,o),Ec.closeExpressionPicker(),l(!1)};case g:return()=>n(e);default:return null}},[d,m,g,o,e]);return i("div",{ref:u,className:du("attachment-container",a&&"reduced-padding")},i(R4e,{attachment:d}),b&&i(xe,{onClick:b,variant:"secondary",disabled:s},i(Ukt,{width:20,height:20})))}function L4e(){let e=$.useContext(fK),t=$.useContext(gK),o=ke(()=>{if(!e||e.type==="gifv")return null;let{video:r,image:n,images:a,thumbnail:s}=e;if(r){let m=!!r.proxyURL,g=r.proxyURL??s?.proxyURL??r.url,b=m?2:1,v=m?r.url:e.url;return{...r,format:b,src:g,url:v}}let l=t!=null&&a?.[t]||n;if(!l)return null;let u=l.proxyURL??l.url;return sK.isAnimated({...l,original:l.url,src:u,animated:!1})?null:{...l,format:1,src:u}},[e,t]);return o&&i("div",{className:du("image-accessory")},i(hK,{...o,className:Rkt.gifFavoriteButton}))}function yK({attachment:e,component:t,children:o}){let r=ke(()=>{if(t){let{id:n,size:a,name:s,spoi" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "e",function(l){return n(null,l)}).on("exit",function(l){l&&!s&&n(new Error("exited with code "+l),null)});return kn&&(i=i.filter(function(l){return!kn(l)})),o.postMessage(t,i),o.terminate=function(){return s=!0,zt.prototype.terminate.call(o)},o}:function(r,e,t,i,n){setImmediate(function(){return n(new Error("async operations unsupported - update to Node 12+ (or Node 10-11 with the --experimental-worker CLI flag)"),null)});var s=function(){};return{terminate:s,postMessage:s}},H=Uint8Array,$e=Uint16Array,js=Int32Array,xn=new H([0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0,0,0,0]),En=new H([0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13,0,0]),zs=new H([16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15]),Bs=function(r,e){for(var t=new $e(31),i=0;i<31;++i)t[i]=e+=1<{"use strict";c();z();L();z_=S({name:"MessageEventsAPI",description:"Api required by anything using message events.",authors:[f.Arjix,f.hunt,f.Ven],patches:[{find:"#{intl::EDIT_TEXTAREA_HELP}",replacement:{match:/(?<=,channel:\i,message:\i\}\)\.then$).+?(?=\i\.content!==this\.props\.message\.content&&\i\((.+?)$\})/,replace:(e,t)=>`async ${e}if(await Endcord.Api.MessageEvents._handlePreEdit(${t}))return Promise.resolve({shouldClear:false,shouldRefocus:true});`}},{find:".handleSendMessage,onResize:",replacement:{match:/(?<=channel:\i\}\)\.then$)(?:async )?(\i=>.+?let (\i)=\i\.\i\.parse\((\i),.+?\.getSendMessageOptions\(\{.+?\}$?;)(?=.+?(\i)\.flags=)(?<=\)$({.+?})$\.then.+?)/,replace:(e,t,o,r," (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "h:16}),p("View Arguments guide")))))}var s2e,aq=y(()=>{"use strict";c();$u();nq();kt();St();at();Pt();q();I();oI();XT();s2e="Hello {{user}}! I am feeling {{mood = great}}."});var c2e={};_(c2e,{default:()=>lbt,parseTagArguments:()=>iI,registerTagCommand:()=>tI});function iI(e){let t=[];for(let[,o]of e.matchAll(l2e)){let[r,n]=o.split("=").map(a=>a.trim());r&&(t.some(a=>a.name===r)||t.push({name:r.toLowerCase(),defaultValue:n??null}))}return t}function tI(e){let t=iI(e.message);Wb({name:e.name,description:e.name,inputType:0,options:[...t.map(o=>({name:o.name,description:o.name,type:3,required:o.defaultValue===null})),{name:"ephemeral",description:"Whether the response should only be visible to you",type:5,required:!1}],execute:async(o,{channel:r})=>{let n=Je(o,"ephemeral",!1),a=e.message.replace(l2e,(l,u)=>{let[d,m]=u.split("=").map(g=>g.trim());return Je(o,d,null)??m??l}).replaceAll("\\n",` `);(n?$e:Li)(r.id,{content:a},!1,Et.getSendMessageOptionsForReply($n.getPendingReply(r.id))),V.dispatch({type:"DELETE_PEND" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API ",width:t,height:e,fill:"currentColor",viewBox:"0 0 24 24",...o},i("path",{d:"M6.6 10.02 14 11.4a.6.6 0 0 1 0 1.18L6.6 14l-2.94 5.87a1.48 1.48 0 0 0 1.99 1.98l17.03-8.52a1.48 1.48 0 0 0 0-2.64L5.65 2.16a1.48 1.48 0 0 0-1.99 1.98l2.94 5.88Z"}))}function M4e({name:e,subtitle:t}){let[,o]=pM(e);return i("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"-2 -2 32 11",style:{font:"2px sans-serif"},fill:"#242429"},i("path",{d:"M-2-2h32v11H-2"}),i("rect",{width:"5",height:"7",rx:".5",fill:"#ddf"}),i("g",{fill:"#78e"},i("path",{d:"M3-1v2.5q0 .5.5.5H6"}),o&&i("text",{x:".85",y:"6",fontFamily:"monospace"},o.slice(1,4))),i("path",{d:"M6 3V-2H1"}),i("text",{x:"7",y:"2.8",fill:"#eff"},e),i("text",{x:"7",y:"5.6",fill:"#777"},t))}function Ekt({url:e,file:t,channel:o,onResize:r,onSubmit:n,reducePadding:a}){let[s,l]=M(!1),u=we(null);k4e(u,({height:v})=>r(e,v),[r,e]);let d=ge([Mh],()=>({...t,url:Mh.get(t.url),proxy_url:Mh.get(t.proxy_url)}),[t],ys.isEqual),{canAttachFiles:m,canSendMessages:g}=ge([yt],()=>({canAttachFiles:cK(lt.A" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "ption:"If the sent link should hyperlink with the query as the label",default:!1},embed:{type:3,description:"If the sent link should render an embed",default:!0},defaultEngine:{type:4,description:"The search engine to use",options:Object.keys(d7e).map((e,t)=>({label:e,value:e,default:t===0}))},customEngineURL:{description:"The URL of the Engine you wish to use",type:0,placeholder:""}}),u6t=S({name:"GoogleThat",description:"Adds a command to send a internet search link",dependencies:["CommandsAPI"],tags:["Commands","Utility"],authors:[f.ewlle,f.kraethis,f.Sharp],searchTerms:["search","google","query","duckduckgo","command"],settings:_h,commands:[{name:"googlethat",description:"send a search engine link",options:[{name:"input",description:"The search query",type:3,required:!0}],execute:e=>({content:c6t(e)})}]})});var h7e={};_(h7e,{default:()=>p6t});function f7e(e,t,o){let r=Et.getSendMessageOptionsForReply({channel:e,message:t,shouldMention:!0,showMentionToggle:!0});if(LP.store.greetMode==="Message"||o.length>1" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "s,xn,En,zs,Sn,Ws,Vs,Zs,Wt,Js,nt,Bt,se,Gt,Ys,Ht,W,Ks,Tn,Xs,Qs]};var Xs=function(r){return postMessage(r,[r.buffer])},Qs=function(r){return r&&{out:r.size&&new H(r.size),dictionary:r.dictionary}},fc=function(r,e,t,i,n,s){var o=hc(t,i,n,function(l,h){o.terminate(),s(l,h)});return o.postMessage([r,e],e.consume?[r.buffer]:[]),function(){o.terminate()}};var de=function(r,e){return r[e]|r[e+1]<<8},ae=function(r,e){return(r[e]|r[e+1]<<8|r[e+2]<<16|r[e+3]<<24)>>>0},yn=function(r,e){return ae(r,e)+ae(r,e+4)*4294967296};function dc(r,e,t){return t||(t=e,e={}),typeof t!="function"&&W(7),fc(r,e,[pc],function(i){return Xs(Tn(i.data[0],Qs(i.data[1])))},1,t)}function Tn(r,e){return Ks(r,{i:2},e&&e.out,e&&e.dictionary)}var bn=typeof TextDecoder<"u"&&new TextDecoder,mc=0;try{bn.decode(lc,{stream:!0}),mc=1}catch{}var _c=function(r){for(var e="",t=0;;){var i=r[t++],n=(i>127)+(i>223)+(i>239);if(t+n>r.length)return{s:e,r:Ht(r,t-1)};n?n==3?(i=((i&15)<<18|(r[t++]&63)<<12|(r[t++]&63)<<6|r[t++]&63)-65536,e+=String.fromCharCode(55296|i" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API " default: throw ERROR_UNKNOWN_MESSAGE_TYPE; } } catch (e) { self.postMessage({ id, type: FFMessageType.ERROR, data: e.toString(), }); return; } if (data instanceof Uint8Array) { trans.push(data.buffer); } self.postMessage({ id, type, data }, trans); }; `,r=new Blob([new TextEncoder().encode(o)],{type:"text/javascript"}),n=URL.createObjectURL(r);try{return await e.load({coreURL:`${t}/ffmpeg-core.js`,wasmURL:`${t}/ffmpeg-core.wasm`,workerURL:`${t}/ffmpeg-core.worker.js`,classWorkerURL:n}),mT=e,k0t.info("FFmpeg loaded."),e}catch(a){throw e.terminate(),mT=null,a}finally{URL.revokeObjectURL(n),M8=null}})(),M8)}function D0t(e,t){return`input_${t}${e.match(/\.[a-z0-9]+$/i)?.[0].toLowerCase()??".video"}`}async function O1e(e,t){let o=A0t++,r=D0t(e.name,o),n=`output_${o}.mp4`,a=await C0t();try{if(await a.writeFile(r,new Uint8Array(await e.arrayBuffer())),await a.exec(["-i",r,"-map","0:v:0","-map","0:a:0?","-c:v","libx264","-preset","veryfast","-profile:v","hig" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API ""#1e1e1e":"white",webPreferences:{preload:(0,Ae.join)(__dirname,"preload.js"),contextIsolation:!0,nodeIntegration:!1,sandbox:!1}});Ns(t),await t.loadURL(`data:text/html;base64,${Ds}`)});C.ipcMain.handle("EndcordGetRendererCss",()=>(0,Re.readFile)(rc,"utf-8"));C.ipcMain.on("EndcordPreloadGetRendererJs",r=>{r.returnValue=(0,ke.readFileSync)((0,Ae.join)(__dirname,"renderer.js"),"utf-8")});C.ipcMain.on("EndcordSupportsWindowsMaterial",r=>{r.returnValue=process.platform==="win32"&&Number((0,Ls.release)().split(".")[2])>=22621});le();ve();w();var ra=require("electron");w();var qs=require("module"),ic=(0,qs.createRequire)("/"),rt,zt,kn,sc=";var __w=require('worker_threads');__w.parentPort.on('message',function(m){onmessage({data:m})}),postMessage=function(m,t){__w.parentPort.postMessage(m,t)},close=process.exit;self=global";try{rt=ic("worker_threads"),zt=rt.Worker,kn=rt.isMarkedAsUntransferable}catch{}var ac=zt?function(r,e,t,i,n){var s=!1,o=new zt(r+sc,{eval:!0}).on("error",function(l){return n(l,null)}).on("messag" (Indicator: "postmessage"; Source: "sample.bin")2f:T67e6,Found string - bleClick:\i,/,replace:'draggable:!0,onDragStart:e=>$self.onUserDragStart(e,{id:arguments[0].participantUserId}),"data-dragify-user":!0,"data-user-id":arguments[0].participantUserId,$&'}},{find:"PrivateChannel.renderAvatar: Invalid prop configuration - no user or channel",replacement:{match:/\.CHANNEL$\i\.\i,\i\.\i$,(?=.{0,150}\.isMultiUserDM)/,replace:"$&draggable:!0,onDragStart:e=>$self.onDmDragStart(e,arguments[0].channel),"}},{find:"[aria-owns=folder-items-",replacement:{match:/"data-dnd-name":(\i)\.name,(?="data-drop-hovering".{0,300}"aria-selected":\i\}\)\}\))/,replace:"$&draggable:!0,onDragStart:e=>$self.onGuildDragStart(e,$1.id),"}}],async onDrop(e,t){if(LI())return;let{dataTransfer:o}=e;if(!o||o.files?.length)return;let r=t??(ve?.getChannelId?.()?W.getChannel(ve.getChannelId()):null);if(!r)return;if(_I(o)){let s=SW(o.getData("application/dragify"));if(!s){hc();return}if(fW(t5e(s,r.id)))return;await this.handleDropEntity(s,r);return}let n=await xW(o),a=UI(n,{ChannelStore:W,GuildStore:Ue,UserStore; Source: "sample.bin"), Found string - IPTION}",predicate:()=>si.store.transformEmojis,replacement:{match:/(?<=emojiDescription:)(\i)(?<=\1=function$\i$\{let\{sourceType:.+?)/,replace:(e,t)=>`$self.addFakeNotice(1,${t},!!arguments[0]?.fakeNitroNode?.fake)`}},{find:"getCurrentDesktopIcon(),",replacement:{match:/\i\.\i\.isPremium$\i\.\i\.getCurrentUser\($\)/,replace:"true"}},{find:'type:"GUILD_SOUNDBOARD_SOUND_CREATE"',replacement:{match:/(?<=type:"(?:SOUNDBOARD_SOUNDS_RECEIVED|GUILD_SOUNDBOARD_SOUND_CREATE|GUILD_SOUNDBOARD_SOUND_UPDATE|GUILD_SOUNDBOARD_SOUNDS_UPDATE)".+?available:)\i\.available/g,replace:"true"}},{find:"Cannot find the corresponding SKU to the user's premium type ",replacement:{match:/\i\.warn$`Cannot find the corresponding SKU to the user's premium type \$\{[^`]+\.premiumType\}`$,/,replace:""}},{find:"Cannot find the corresponding product catalog entry to the user's SKU ",replacement:{match:/\i\.warn$`Cannot find the corresponding product catalog entry to the user's SKU \$\{[^`]+\.premiumType\}`$,/,replace:""}}],get guildI; Source: "sample.bin"), Found string - G5.name].enableStreamQualityBypass,noWarn:!0},{find:"#{intl::STREAM_FPS_OPTION}",replacement:{match:/guildPremiumTier:\i\.\i\.TIER_\d,?/g,replace:""},predicate:()=>Qg.store.unlockQualityOptions&&!dt(G5.name),noWarn:!0},{find:",setIsForceShowSharingPopout:",replacement:{match:/\i!==\i\.\i\.RESOLUTION_720\|\|\i===\i\.\i\.FPS_60/,replace:"true"},predicate:()=>Qg.store.unlockQualityOptions},{find:"}setDesktopEncodingOptions(",replacement:[{match:/setDesktopEncodingOptions$(\i),(\i),(\i)$\{/,replace:"setDesktopEncodingOptions($1,$2,$3){$1=$self.getWidth();$2=$self.getHeight();$3=$self.getFps();"},{match:/keyframeInterval=0/,replace:"keyframeInterval=5000"}]},{find:"desktopBitrate:{",replacement:{match:/desktopBitrate:\{min:5e5,max:35e5,target:6e5\}/,replace:"desktopBitrate:{min:5e5,max:4e7,target:1e7}"}},{find:"Reduced framerate after",replacement:{match:/this\.framerateReductionTimeout=setTimeout/,replace:"this.framerateReductionTimeout=void 0&&setTimeout"},predicate:()=>Qg.store.preventFramerateReduction}],get; Source: "sample.bin"), Found string - lt:(\i)=(\i\.\i\.string$\i\.\i#{intl::GIF}$)(?=,[^}]*\}=(\i))/,replace:"alt_$$:$1=$self.altify($3)||$2"}}],altify(e){if(e.alt??="GIF",e.alt!=="GIF")return e.alt;let t=e.original||e.src;try{t=decodeURI(t)}catch{}let o=t.slice(t.lastIndexOf("/")+1).replace(/\d/g,"").replace(/.gif$/,"").split(/[,\-_ ]+/g).slice(0,20).join(" ");return o.length>300&&(o=o.slice(0,300)+"..."),o&&(e.alt+=` - ${o}`),e.alt}})});var cme={};_(cme,{default:()=>Gpt});function zpt(e){let t=e.startsWith("//")?`https:${e}`:e,o=t.match(_pt);if(!o)return t;let{protocol:r,rest:n}=o.groups;return`${decodeURIComponent(r)}://${decodeURIComponent(n)}`}var B7,sme,Upt,Ept,_pt,lme,Gpt,ume=y(()=>{"use strict";c();Y();z();L();B7={High:1,Reasonable:2,Low:3,Horrible:4},sme=[{giphy:"giphy",tenor:"Ax",cap:480,video:"Po"},{giphy:"480w",tenor:"A5",cap:360,video:"P3"},{giphy:"200",tenor:"A1",cap:200,video:"P2"},{giphy:"100",tenor:"A2",cap:120,video:"P4"}],Upt=/^https:\/\/(?:media\d?|c)\.tenor\.com(?:\/m)?\/(?.+?)(?\w{2})\/(?[^/]+)\.(?g; Source: "sample.bin"), Found string - it only pops up the screenshare select"),i("br",null),p("For X11 it may or may not work :shrug:")),i("br",null),i(co,null,p("Video Devices")),i(le,null,p("Supports cameras and capture cards (like Elgato HD60X) when enabled in settings")),i("br",null),i(co,null,p("Regarding Sound & Preview Settings")),i(le,null,p("We use the settings set and used by discord to decide if stream preview and sound should be enabled or not"))),patches:[{find:"DISCONNECT_FROM_VOICE_CHANNEL]",predicate:()=>Da.store.keybindScreenshare,replacement:{match:/\[\i\.\i\.DISCONNECT_FROM_VOICE_CHANNEL/,replace:'["INSTANT_SCREEN_SHARE"]:{onTrigger(){$self.autoStartStream(false)},keyEvents:{keyUp:!1,keyDown:!0}},$&'}},{find:'"push-to-talk-priority"',predicate:()=>Da.store.keybindScreenshare,replacement:{match:/=\[(\{id:.{0,25}value:\i\.\i\.UNASSIGNED)/,replace:'=[{id:"instant-screen-share",value:"INSTANT_SCREEN_SHARE",label:"Instant Screenshare"},$1'}}],flux:{async VOICE_STATE_UPDATES({voiceStates:e}){if(!Da.store.toolboxManagement||!Da.store; Source: "sample.bin"), Found string - .store.zoomSpeed,onChange:Jo(s=>er.store.zoomSpeed=s,100),renderValue:s=>`${s.toFixed(3)}x`})})))},M9t=S({name:"ImageZoom",description:"Lets you zoom in to images and gifs. Use scroll wheel to zoom in and shift + scroll wheel to increase lens radius / size",tags:["Media","Utility"],authors:[f.ewlle,f.kraethis,f.Sharp],searchTerms:["ImageUtilities"],managedStyle:rTe,patches:[{find:"disableArrowKeySeek:!0",replacement:[{match:/useFullWidth:!0,shouldLink:/,replace:`id:"${E3}",$&`},{match:/(?<=null!=(\i)\?.{0,20})\i(?:\.\i)?,{children:\1/,replace:"'div',{onClick:e=>e.stopPropagation(),children:$1"}]},{find:'="FOCUS_SENSITIVE",',replacement:{match:/(?<=\[\i\.\i]:)\i&&!\i&&"PINNED"!==\i/,replace:"false"}},{find:".handleImageLoad)",replacement:[{match:/placeholderVersion:\i,(?=.{0,50}children:)/,replace:"...$self.makeProps(this),$&"},{match:/componentDidMount{/,replace:"$&$self.renderMagnifier(this);"},{match:/componentWillUnmount{/,replace:"$&$self.unMountMagnifier();"},{match:/componentDidUpdate$\i${/,re; Source: "sample.bin"), Found string - [{match:/(?=$0,\i\.\i$$(\i),\{from:\{position:"absolute")/,replace:"(_cb=>_cb(void 0,$1))||"},{match:/\i\.animated\.div/,replace:'"div"'}],predicate:()=>Ym.store.disableFade},{find:'"data-mana-component":"layer-modal"',replacement:[{match:/(\i)\.animated\.div(?=,\{"data-mana-component":"layer-modal")/,replace:'"div"'},{match:/(?<="data-mana-component":"layer-modal"[^}]*?)style:\i,/,replace:"style:{},"}],predicate:()=>Ym.store.disableFade},{find:"headerId:void 0,headerIdIsManaged:!1",replacement:{match:/let (\i)=300/,replace:"let $1=0"},predicate:()=>Ym.store.disableFade},{find:"handleOpenSettingsContextMenu=",replacement:{match:/(?=handleOpenSettingsContextMenu=.{0,100}?null!=\i&&.{0,100}?(await [^};]*?$\)))/,replace:"_endcordBetterSettingsEagerLoad=(async ()=>$1)();"},predicate:()=>Ym.store.eagerLoad},{find:"#{intl::USER_SETTINGS_ACTIONS_MENU_LABEL}",predicate:()=>Ym.store.organizeMenu,replacement:[{match:/children:\[(\i),(?<=\1=(?:function|.{0,30}\.openUserSettings).+?)/,replace:"children:[$self.transfo; Source: "sample.bin"), Found string - d:'"AvatarWithText"',replacement:[{match:/(\}=\i)/,replace:",style$1"},{match:/(?<="div",\{className:\i\.\i,)(?=children:\[)/,replace:"style:style||{},"}],predicate:()=>w4.store.dmList},{find:'"Reply Chain Nudge")',replacement:{match:/(className:.{0,15},colorString:)(\i),/,replace:"$1$self.colorInReplyingTo(arguments[0]) ?? $2,"}}],wrapMessageColorProps(e,t){try{let o=ve.getChannelId(),r=W.getChannel(o),n=!!r&&(r.isDM()||r.isMultiUserDM()),a=this.colorIfServer(t);return a===e.colorString||!w4.store.colorInServers&&!n?e:{...e,colorString:a,colorStrings:e.colorStrings&&{primaryColor:a,secondaryColor:void 0,tertiaryColor:void 0}}}catch(o){return console.error("Failed to calculate message color strings:",o),e}},colorDMList(e){let t=e?.user?.id??e?.channel?.id;return k4(t,!0)??"inherit"},colorIfServer(e){let t=e?.message?.author?.id,o=e?.author?.colorString;return e?.message?.channel_id==="1337"&&t==="313337"||e?.channel?.guild_id&&!w4.store.colorInServers?o:k4(t,!0)??o??void 0},colorInReplyingTo(e){let{id:t}=e.re; Source: "sample.bin"), Found string - ntext menus.",authors:[f.Nuckyz,f.Ven,f.Kyuuhachi],required:!0,patches:[{find:"navId:",all:!0,noWarn:!0,replacement:[{match:/navId:(?=.+?([,}].*?\)))/g,replace:(e,t)=>t.match(/}=.+/)==null?`contextMenuAPIArguments:typeof arguments!=='undefined'?arguments:[],${e}`:e}]},{find:"Menu API only allows Items",replacement:[{match:/(?=let{navId:)(?<=function \i$(\i)$.+?)/,replace:"$1=Endcord.Api.ContextMenu._usePatchContextMenu($1);"},{match:/(?<=($\i\.type===(\i\.\i)$.{0,50}?navigable:.+Menu API).+?)}$/s,replace:(e,t)=>{let o=[],r=ha(/$\i\.type===(\i\.\i)$/g),n=/type:"(\w+)"/g,a;for(;(a=r.exec(t))!==null;){let s=a[1];n.lastIndex=r.lastIndex;let l=n.exec(t)?.[1];if(l&&l in yse){let u=yse[l];o.push(`$self.registerMenuItem("${u}",${s})`)}}return o.length<6&&console.warn("[MenuItemDemanglerAPI] Expected to remap 6 items, only remapped",o.length),`${o.join(";")};}`}}]}],registerMenuItem(e,t){Object.defineProperty(t,"name",{value:e}),P[e]=t}})});var F_,vse=y(()=>{"use strict";c();z();L();F_=S({name:"DynamicImageModal; Source: "sample.bin"), Found string - "inboxTitle","tab"),vCt=be("navigator:","containerProps:"),xCt=_e("onKeyDown","tabIndex","useContext","aria-orientation"),SCt=_e("keyboardModeEnabled)","scrollIntoViewNode"),wCt=_e(".createFromServer(",".isBlockedForMessage","messageReference:"),w1="KeywordNotify_keywordEntries",C2="KeywordNotify_log",nB="vc-keywordnotify-keywords",xd=oe("vc-keywordnotify-");Y$=(o=>(o.BlackList="BlackList",o.Whitelist="Whitelist",o))(Y$||{});aB=R({ignoreBots:{type:3,description:"Ignore messages from bots",default:!0,hidden:!0},amountToKeep:{type:1,description:"Amount of messages to keep in the log",default:50},keywords:{type:6,description:"Manage keywords",component:()=>i(MIe,null)}}),ACt=S({name:"KeywordNotify",authors:[f.ewlle,f.kraethis,f.Sharp],description:"Sends a notification if a given message matches certain keywords or regexes",settings:aB,keywordTabId:nB,patches:[{find:'name:"InboxPopoutRenderer"',replacement:{match:/(?<=\[\i,\i\]=)\[$0,\i\.\i$$\[\i\.\i\],\($=>\i\.\i\.settings\.inbox\?\.currentTab.{0,300}?\.FREQ; Source: "sample.bin"), Found string - olean),[r,n]=$.useState(WP.has(t.id)),[a,s]=$.useState(o.includes(t.id));e.push(i(h,null,i(P.MenuSeparator,null),i(P.MenuCheckboxItem,{id:"vc-ignore-calls-temp",label:p("Temporarily Ignore Calls"),checked:r,action:()=>{r?WP.delete(t.id):WP.add(t.id),n(!r)}}),i(P.MenuCheckboxItem,{id:"vc-ignore-calls-perm",label:p("Permanently Ignore Calls"),checked:a,action:()=>{let l=o.slice();a?l=l.filter(u=>u!==t.id):l.push(t.id),KP.store.permanentlyIgnoredUsers=l.join(", "),s(!a)}})))},KP=R({permanentlyIgnoredUsers:{type:0,description:"User IDs (comma + space) who should be permanently ignored",restartNeeded:!0,default:""}}),w9t=S({name:"IgnoreCalls",description:"Allows you to ignore calls from specific users or dm groups.",tags:["Voice"],authors:[f.ewlle,f.kraethis,f.Sharp],settings:KP,patches:[{find:"#{intl::INCOMING_CALL_ELLIPSIS}",replacement:{match:/(?<=onCallJoined:.{0,150})$\i$\}\),className:\i\.\i\}\)/,replace:"$&,$self.renderIgnore(arguments[0].channel)"}}],contextMenus:{"user-context":qDe,"gdm-context":qDe; Source: "sample.bin"), Found string - t=S({name:"Declutter",description:"Cleans up Discord by removing non-essential UI elements like profile effects, shop tabs, boosts, and more.",tags:["Appearance","Customisation"],authors:[f.ewlle,f.kraethis,f.Sharp],start(){dt("Decor")&&li.store.removeAvatarDecoration&&(li.store.removeAvatarDecoration=!1)},settings:li,patches:[{find:"skuId,layers:null!=",replacement:{match:/(?=0!==\i.length&&\i\?$0,)/,replace:"null&&"},predicate:()=>li.store.removeProfileFrame},{find:"isAvatarDecorationAnimating:",replacement:{match:/(?<=\{avatarDecoration:.{0,40}?)(void 0!==\i\?\i:)\i(?=$?,canAnimate:)/,replace:"$1null"},predicate:()=>li.store.removeAvatarDecoration&&!dt(Qy.name)},{find:"showCommunicationDisabledStyles",replacement:{match:/null==\i\|\|\i\?null:$0,\i\.jsxs?$$"img",\{className:\i\.\i,src:\i,alt:" ","aria-hidden":!0\}$/,replace:"null"},predicate:()=>li.store.removeAvatarDecoration&&!dt(Qy.name)},{find:"#{intl::USER_PROFILE_ACCOUNT_POPOUT_BUTTON_A11Y_LABEL}",replacement:[{match:/((\i)=\i\?\.avatarDecoratio; Source: "sample.bin"), Found string - (\i)=$0,\i\.\i$$\i$.+?;/,replace:(e,t,o)=>`${e}${o}=$self.patchFakeNitroStickers(${o},${t});`},{predicate:()=>si.store.transformStickers,match:/renderAttachments$\i${.+?{attachments:(\i).+?;/,replace:(e,t)=>`${e}${t}=$self.filterAttachments(${t});`}]},{find:"#{intl::STICKER_POPOUT_UNJOINED_PRIVATE_GUILD_DESCRIPTION}",predicate:()=>si.store.transformStickers,replacement:[{match:/let{renderableSticker:(\i).{0,270}sticker:\i,channel:\i,/,replace:(e,t)=>`${e}fakeNitroRenderableSticker:${t},`},{match:/(let \i,{sticker:\i,channel:\i,closePopout:\i.+?}=(\i).+?;)(.+?description:)(\i)(?=,sticker:\i)/,replace:(e,t,o,r,n)=>`${t}let{fakeNitroRenderableSticker}=${o};${r}$self.addFakeNotice(0,${n},!!fakeNitroRenderableSticker?.fake)`}]},{find:".EMOJI_UPSELL_POPOUT_MORE_EMOJIS_OPENED,",predicate:()=>si.store.transformEmojis,replacement:{match:/isDiscoverable:\i,shouldHideRoleSubscriptionCTA:\i,(?<={node:(\i),.+?)/,replace:(e,t)=>`${e}fakeNitroNode:${t},`}},{find:"#{intl::EMOJI_POPOUT_UNJOINED_DISCOVERABLE_GUILD_DESCR; Source: "sample.bin"), Found string - MediaEmbed",replacement:[{match:"render()",replace:"$&{return $self.renderEmbed(this)}__render()"},{match:/\.images\.map$(\i)=>(this.renderImage\(\{[^}]{50,100}\}$)\)/,replace:".images.map(($1,index)=>$self.renderEmbedMosaicItem($2,index))"}]},{find:"#{intl::MEDIA_MOSAIC_ALT_TEXT_POPOUT_TITLE}",replacement:{match:/renderAdjacentContent:\i/g,replace:"$&=$self.renderEmbedAccessory"}},{find:'["VIDEO","CLIP","AUDIO"]',replacement:[{match:/(?<=children:)(\i)=>(\i$\1$)\}\):(\i)/,replace:"$1=>$self.renderAttachment($2,arguments[0])}):$self.renderAttachment($3,arguments[0])"},{match:/let \i=Math.max$0,(\i)\.length-\i$/,replace:"$1.unshift($self.renderAttachmentAccessory());$&"}]},{find:"#{intl::ATTACHMENT_FILENAME_UNKNOWN}",replacement:{match:/(?<=case \i\.\i\.FILE:)return($0,\i\.jsx$$\i,\{\.\.\.(\i)\},(\i)$)/,replace:"return $self.renderCV2File($1,$3,$2)"}},{find:"#{intl::EXPRESSION_PICKER_CATEGORIES_A11Y_LABEL}",replacement:[{match:/$0,\i\.jsx$$(\i),[^}]{20,40}?"aria-selected":(\i)[^}]{50,100}?#{in; Source: "sample.bin"), Found string - &!\i(?=$return \i\.\i\.DISALLOW_EXTERNAL;)/,replace:e=>`${e}&&!${z7}`},{match:/!\i\.available(?=\)return \i\.\i\.GUILD_SUBSCRIPTION_UNAVAILABLE;)/,replace:e=>`${e}&&!${z7}`},{match:/(?<=!$\i\|\|)\i\.\i\.canUseEmojisEverywhere\(\i$/,replace:e=>`(${e}||${z7})`},{match:/(?<=\|\|)\i\.\i\.canUseAnimatedEmojis$\i$/,replace:e=>`(${e}||${z7})`}]},{find:".getUserIsAdmin(",replacement:{match:/(function \i$\i,\i)${(.{0,250}.getUserIsAdmin$.+?return!1})/,replace:(e,t,o)=>`${t},fakeNitroOriginal){if(!fakeNitroOriginal)return false;${o}`}},{find:'"SENDABLE"',predicate:()=>si.store.enableStickerBypass,replacement:{match:/\i\.available\?/,replace:"true?"}},{find:"#{intl::STREAM_FPS_OPTION}",predicate:()=>si.store.enableStreamQualityBypass,replacement:{match:/guildPremiumTier:\i\.\i\.TIER_\d,?/g,replace:""}},{find:'"UserSettingsProtoStore"',replacement:[{match:/(?<=CONNECTION_OPEN:function\((\i)${)/,replace:(e,t)=>`$self.handleProtoChange(${t}.userSettingsProto,${t}.user);`},{match:/let{settings:/,replace:"arguments[; Source: "sample.bin"), Found string - ?.isBetterFolders&&${t};`},{predicate:()=>!vn.store.keepIcons,match:/(?=,\{from:\{height)/,replace:"&&$self.shouldShowTransition(arguments[0])"},{predicate:()=>!vn.store.keepIcons,match:/"--custom-folder-color".+?(?=\i$\(\i,\i,\i$=>{let{key:.{0,70}"ul")(?<=selected:\i,expanded:(\i),.+?)/,replace:(e,t)=>`${e}$self.shouldRenderContents(arguments[0],${t})?null:`},{predicate:()=>vn.store.showFolderIcon!==1,match:/"--custom-folder-color".{0,110}?children:\[/,replace:"$&$self.shouldShowFolderIconAndBackground(!!arguments[0]?.isBetterFolders,arguments[0]?.betterFoldersExpandedIds)&&"},{predicate:()=>vn.store.showFolderIcon!==1,match:/"--custom-folder-color".+?className:\i\.\i}\),(?=\i,)/,replace:"$&!$self.shouldShowFolderIconAndBackground(!!arguments[0]?.isBetterFolders,arguments[0]?.betterFoldersExpandedIds)?null:"}]},{find:"APPLICATION_LIBRARY,render:",predicate:()=>vn.store.sidebar,group:!0,replacement:[{match:/(?<=[[,])((?:!?\i&&)+)$.{0,50}({className:\i\.\i,themeOverride:\i})$/g,replace:(e,t,o)=>`${e},${t}$; Source: "sample.bin"), Found string - ET_ALWAYS_ON_TOP"')}),hat=de("useName","getGlobalName"),yat=Io(/=\i\.getUserProfile$\i$,\i=\i\.getGuildMemberProfile$/,{getDisplayProfile:Ne.byCode(".getGuildMemberProfile("),useDisplayProfile:Ne.byCode(/\[\i\.\i,\i\.\i],\($=>/)}),Zd=Io("millisecondsInUnit:",{calendarFormat:Ne.byCode('<-1?"sameElse":'),dateFormat:Ne.byCode('<2?"nextDay":"sameElse";'),isSameDay:Ne.byCode(/Math\.abs$\i-\i$/),diffAsUnits:Ne.byCode("days:0","millisecondsInUnit")}),bk=de("REPLYABLE","FORWARDABLE"),Jd=_e("useDrag::spec.begin was deprecated"),_c=_e(".disconnectDropTarget()",".dropTargetOptions="),$s=de("toggleSelfMute"),bat=de("setServerMute","setServerDeaf"),Fb=de("selectChannel","selectVoiceChannel"),vat=de("saveDraft","changeDraft"),xat=de("pinMessage","unpinMessage"),eE=Io("Invalid hex color format",{rgbToHex:Ne.byCode(".toString(16).slice(1)"),hexToRgba:Ne.byCode("`rgba(${"),hexToRgb:Ne.byCode(".rgb();return"),rgbToHsl:Ne.byCode("saturation:","lightness:"),mixColors:Ne.byCode(".substring(1,3),16)"),hexWithAlpha:Ne.byCode(; Source: "sample.bin"), Found string - {this.element=document.createElement("div"),this.element.classList.add("MagnifierContainer"),document.body.appendChild(this.element)},stop(){this.root&&this.root.unmount(),this.element?.remove()}})});var lTe={};_(lTe,{default:()=>P9t});var sTe,P9t,cTe=y(()=>{"use strict";c();Y();z();He();L();I();sTe=R({sortByAffinity:{type:3,default:!0,description:"Whether to sort implicit relationships by their affinity to you.",restartNeeded:!0}}),P9t=S({name:"ImplicitRelationships",description:"Shows your implicit relationships in the Friends tab.",tags:["Friends","Servers"],authors:[f.ewlle,f.kraethis,f.Sharp],settings:sTe,patches:[{find:"#{intl::FRIENDS_ALL_HEADER}",replacement:{match:/toString\}\);case (\i\.\i)\.PENDING/,replace:'toString()});case $1.IMPLICIT:return "Implicit \u2014 "+arguments[1];case $1.BLOCKED'}},{find:"FriendsEmptyState: Invalid empty state",replacement:{match:/case (\i\.\i)\.ONLINE:(?=return (\i)\.SECTION_ONLINE)/,replace:"case $1.ONLINE:case $1.IMPLICIT:"}},{find:"#{intl::FRIENDS_SECTION_ONLIN; Source: "sample.bin"), Found string - tl::EXPRESSION_PICKER_GIF}\)\}\)/,replace:"$self.renderTabs($1,$2)"},{match:/\{onSelectGIF:(\i),[^}]{20,40}\}\):null,(?=(\i)===)/,replace:"$&$self.renderFilePicker($2,$1),"}]},{find:'.sortBy("order").reverse().value()',replacement:{match:'.sortBy("order").reverse()',replace:"$&.filter($self.filterGifs)"}},{find:"#{intl::FAVORITE_GIFS_LIMIT_REACHED_BODY}",replacement:{match:/function (\i)$(\i)$\{(?=\i\.\i\.updateAsync$"favoriteGifs")/g,replace:"async function $1($2){await $self.fixFavItem($2);await "}}],renderTabs(e,t){return i(h,null,i(e,{id:"gif-picker-tab",key:"gif-picker-tab","aria-controls":"gif-picker-tab-panel","aria-selected":t==="gif",isActive:t==="gif",viewType:"gif"},ot("QUICKSEARCH_MEDIA")),i(e,{id:"files-picker-tab",key:"files-picker-tab","aria-controls":"files-picker-tab-panel","aria-selected":t==="files",isActive:t==="files",viewType:"files"},ot("QUICKSEARCH_FILES")))},renderFilePicker(e,t){return e==="files"?i(N4e,{onSelectItem:t}):null},renderAttachment(e,{item:t}){return q4()?i(yK,{attachm; Source: "sample.bin"), Found string - EN}$,)className:\i\.\i,/,replace:"",predicate:()=>li.store.removeAudioMenus},{match:/,$0,\i\.jsxs?$$\i\.\i,\{.{0,650}#{intl::ACCOUNT_OUTPUT_OPTIONS}$\}\)(?=\])/,replace:"",predicate:()=>li.store.removeAudioMenus}]},{find:"#{intl::USER_SETTINGS_WITH_BUILD_OVERRIDE}",replacement:{match:/tooltipText:\i,tooltipPositionKey/,replace:"tooltipText:void 0,tooltipPositionKey"},predicate:()=>li.store.removeButtonTooltips},{find:'tutorialId:"direct-messages"',replacement:[{match:/"nitro-tab-group"\)/,replace:"$&&&undefined",predicate:()=>li.store.removeShopAboveDms},{match:/NAVIGATION_LINK\}\}\},"discord-shop"\)/,replace:"$&&&undefined",predicate:()=>li.store.removeShopAboveDms},{match:/\.QUEST_HOME\)\},"quests"\)/,replace:"$&&&undefined",predicate:()=>li.store.removeQuestsAboveDms},{match:/\.APPLICATION_LIBRARY\)\},"library"\)/,replace:"$&&&undefined",predicate:()=>li.store.removeLibraryAboveDms},{match:/\.FAMILY_CENTER\)\},"family-center"\)/,replace:"$&&&undefined",predicate:()=>li.store.removeFamilyCenterAboveDms; Source: "sample.bin"), Found string - ivity Settings"),value:"belowActivity"},{label:p("At the very bottom"),value:"bottom"}]}},includeEndcordInfoWhenCopying:{type:3,get description(){return p("Also copy Endcord info (Endcord, Electron, Chromium) when clicking the version info in the bottom left area of the Settings page")},default:!0}}),Ci=S({name:"Settings",description:"Adds Settings UI and debug info",authors:[f.Ven,f.Megu],required:!0,settings:rG,patches:[{find:"#{intl::COPY_VERSION}",replacement:[{match:/"text-xxs\/normal".{0,300}?(?=null!=(\i)&&(.{0,20}\i\.\i.{0,200}?,children:).{0,15}?("span"),{className:(\i\.\i),children:\["Build Override: ",\1\.id,\i\]\}\)\}\))/,replace:(e,t,o,r,n)=>`${e},$self.makeInfoElements(${r},{className:${n}}).map(e=>${o}e})),`},{match:/copyValue:\i\.join$" "$/g,replace:"$& + $self.getInfoString()"}]},{find:".buildLayout().map",replacement:{match:/(\i)\.buildLayout(?=\.map)/,replace:"$self.buildLayout($1)"}}],buildEntry(e){let{key:t,title:o,panelTitle:r=o,Component:n,Icon:a}=e,s={key:t+"_panel",type:hv.PANEL; Source: "sample.bin"), Found string - ore.volume)}catch(l){console.error("[Animalese]",l)}}},async start(){bn||(bn=new AudioContext,await Kut())},stop(){bn&&(bn.close(),bn=null)}})});var lde={};_(lde,{default:()=>NG,tarExtMatcher:()=>m7});var Jut,RG,m7,vv,NG,LG=y(()=>{"use strict";c();Y();Te();z();L();se();I();Jut=_e("Children.map","isValidElement","dangerous:"),RG=Symbol("vcAnonymise"),m7=/\.tar\.\w+$/,vv=R({anonymiseByDefault:{description:"Whether to anonymise file names by default",type:3,default:!0},method:{description:"Anonymising method",type:4,options:[{label:"Random Characters",value:0,default:!0},{label:"Consistent",value:1},{label:"Timestamp",value:2}]},randomisedLength:{description:"Random characters length",type:1,default:7},consistent:{description:"Consistent filename",type:0,default:"image"}},{randomisedLength:{disabled(){return this.store.method!==0}},consistent:{disabled(){return this.store.method!==1}}}),NG=S({name:"AnonymiseFileNames",authors:[f.ewlle,f.kraethis,f.Sharp],description:"Anonymise uploaded file names",tags:["Privacy; Source: "sample.bin"), Found string - terAPI"],messagePopoverButton:{icon:Age,render(e){return{label:q5.has(e.id)?"Remove Bookmark":"Bookmark",icon:Age,message:e,channel:W.getChannel(e.channel_id),onClick:()=>wft(e)}}},toolboxActions:{"Open Bookmarks"(){Aft()}},async start(){await Sft()},stop(){uc=[],q5.clear()}})});var Mge={};_(Mge,{default:()=>Dft});var Dft,Pge=y(()=>{"use strict";c();z();L();Dft=S({name:"BypassPinPrompt",description:"Bypass the pin prompt when using the pin functions",tags:["Shortcuts"],authors:[f.ewlle,f.kraethis,f.Sharp],patches:[...['source:"message-actions"','id:"pin",action','"Channel Pins"'].map(e=>({find:e,replacement:[{match:/(\i\.\i\.(?:unpin|pin)Message$\i,\i\.id$):\i\.\i\.confirm(?:Unpin|Pin)$\i,\i$/g,replace:"$1:$1"}]}))]})});var Lge={};_(Lge,{default:()=>Ift});function Bge(){return i("svg",{width:"18",height:"18"},i("circle",{cx:"9",cy:"9",r:"8",fill:"var(--status-danger)"}),i("circle",{cx:"9",cy:"9",r:"3.75",fill:"white"}))}function Rge(){return i("svg",{width:"18",height:"18"},i("circle",{cx:"9",cy:"9",r:"8"; Source: "sample.bin"), Found string - sition($1)",predicate:()=>qg.store.dontFollowForwards},{match:/((\i)=\i\.useCallback$\()($=>\{)(null!=\i&&\i\.\i\.clearDraft)(?=.{1500,2000}onClick:\2)/,replace:(e,t,o,r,n)=>`${t}vencordArg1${r}$self.setShift(vencordArg1);${n}`,predicate:()=>qg.store.dontFollowForwards}]},{find:".FORWARD_BREADCRUMB_CLICKED,{",replacement:{match:/(disableComponentInteractivity:\i\}\),!\i&&$0,\i\.jsx$$)\i/,replace:"$1$self.ForwardFooter"}},{find:".getChannelHistory(),",predicate:()=>qg.store.selfForward,replacement:{match:/\[\i\.id\]/,replace:"[]"}}],async sendForward(e,t,o,r){let n=o.messageSnapshots[0]?.message??o,a=` ${qg.store.forwardPreface} `,s=`${a}*Forwarded from <#${o.channel_id}>*${a}${n.content.trim().replaceAll(` `,a)}`,l=e?` ${e.trim()}`:"",u=r.onlyAttachmentIds,d=u?n.attachments.filter(b=>u.includes(b.id)):n.attachments,m=(await Promise.all(t.map(Lpt))).filter(Boolean),g=5;m.forEach(b=>{if(d.length>0)for(let v=0;vA.url).j; Source: "sample.bin"), Found string - tch:/\{file:(\i),imageUri:/,replace:"{bieShelf,file:$1,imageUri:"},{match:/\(0,\i\.jsx$$\i\.\i,\{id:\i,children:.{0,50}#{intl::IMAGE_CROP_KEYBOARD_CANNOT_REPOSITION}/,replace:"bieShelf,$&"},{match:/\("div",\{role:"group",(?="aria-label":)/,replace:'$&className:"vc-bie-split",'}]},{find:'"SET_IMAGE_ZOOM_RATIO"',replacement:{match:/(?<=(?:(\i)\.current\.getBoundingClientRect\($.{0,40})?=)($0,(\i)\.\i$$[^)]+$)(?=,\i=($0,\3\.\i$)$(\i),[^,()]+,[^,()]+,([^()]+)$)/g,replace:(e,t,o,r,n,a,s)=>`$self.fill(${o},(bieW,bieH)=>${n}(${a},bieW,bieH,${s})${t?`,${t}.current`:""})`}},{find:'displayName="RecentAvatarsStore"',replacement:{match:/(uploadType:(\i),guild:\i,handleOpenImageEditingModal:(\i),.{0,250}null\]\}\),).{0,20}\{onComplete:(\i),returnRef:\i\}\)/,replace:"$1$self.pickerRow($2,$3,$4,arguments[0])"}},{find:'displayName="RecentAvatarsStore"',replacement:{match:/size:"md"(,title:\i,.{0,50}className:)(\i\.\i)/,replace:'size:"lg"$1$self.pickerClass($2)'}}],pickerClass(e){return ie(e,ra("picker"))},fill(e,t; Source: "sample.bin")30:Ta7b,"EndcordInstaller.exe" queries volume information of "C:\EndcordInstaller.exe" at 00000000-00002636-00000C17-1312997980 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1314350801 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00002636-00000C17-1314494056 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1314594839 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00002636-00000C17-1315049400 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00002636-00000C17-1315101291 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1315968557 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1316062631 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00002636-00000C17-1316070968 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1316074631 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00002636-00000C17-1316077061 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1316078580 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00002636-00000C17-1316080056 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1316081409 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00002636-00000C17-1316082656 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1316084324 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00002636-00000C17-1316085529 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1316087023 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1316088630 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\bahnschrift.ttf" at 00000000-00002636-00000C17-1327274915 "EndcordInstaller.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00002636-00000C17-132955265331:T492,Process EndcordInstaller.exe created mutex with name "\Sessions\1\BaseNamedObjects\__DDrawExclMode__" Process EndcordInstaller.exe created mutex with name "\Sessions\1\BaseNamedObjects\__DDrawCheckExclMode__" Process EndcordInstaller.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2636:304:WilStaging_02" Process EndcordInstaller.exe created mutex with name "SM0:2636:120:WilError_03" Process EndcordInstaller.exe created mutex with name "__DDrawCheckExclMode__" Process EndcordInstaller.exe created mutex with name "__DDrawExclMode__" Process EndcordInstaller.exe created mutex with name "Local\SM0:2636:304:WilStaging_02" Process EndcordInstaller.exe created mutex with name "Local\SM0:2636:120:WilError_03" Process EndcordInstaller.exe created mutex with name "SM0:2636:304:WilStaging_02" Process EndcordInstaller.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2636:304:WilStaging_02" Process EndcordInstaller.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2636:120:WilError_03" Process EndcordInstaller.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2636:120:WilError_03"32:T491,"EndcordInstaller.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"33:T49c,"EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "EndcordInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP")34:T650,"EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")35:Ta24,"EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "319DC449-ADA5-50F7-428E-957DB6791668"; Value: "") "EndcordInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "")36:T5de,"EndcordInstaller.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "EndcordInstaller.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll.aux" "EndcordInstaller.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\presentatio5ae0f00f#\a64188f841fdf0a13a905fafa000db81\presentationframework.ni.dll.aux" "EndcordInstaller.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\windowsbase\66837cc8b458305f9c9c23fae59f39f6\windowsbase.ni.dll.aux" "EndcordInstaller.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\21ff4ba4607b18a9b179ab90fd3b0bc1\system.core.ni.dll.aux" "EndcordInstaller.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\fe3c9cf707273488c6c658d52d624640\system.ni.dll.aux" "EndcordInstaller.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\presentationcore\e829e1c722e0d503d9df58d9adb9fbe1\presentationcore.ni.dll.aux" "EndcordInstaller.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xaml\f73fe58cb3a8bbd638427d56fb64cf76\system.xaml.ni.dll.aux" "EndcordInstaller.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\24206316825bb75ebfbdd31895df2f1f\system.configuration.ni.dll.aux" "EndcordInstaller.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\76ff225c5a523f0be2364b0fc02bf7f9\system.xml.ni.dll.aux"37:T8cb,"EndcordInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.exe" "EndcordInstaller.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.exe" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.exe" "EndcordInstaller.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.exe" "EndcordInstaller.exe" trying to access non-existent file "C:\CRYPTSP.dll" "EndcordInstaller.exe" trying to access non-existent file "C:\CRYPTBASE.dll"38:T620,"EndcordInstaller.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.local" "EndcordInstaller.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "EndcordInstaller.exe" trying to access non-existent file "C:\EndcordInstaller.exe.config" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\EndcordInstaller" "EndcordInstaller.exe" trying to access non-existent file "C:\EndcordInstaller.INI" "EndcordInstaller.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "EndcordInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Discord" "EndcordInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\DiscordPTB" "EndcordInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\DiscordCanary" "EndcordInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\DiscordDevelopment" "EndcordInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Equicord" "EndcordInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Nightcord" "EndcordInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Mallcord" "EndcordInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Suncord"39:T800,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002636.00000000.157439.012F0000.00000004.mdmp, 00000000-00002636.00000000.157439.017D0000.00000004.mdmp, 00000000-00002636.00000001.159359.012F0000.00000004.mdmp, 00000000-00002636.00000001.159359.017D0000.00000004.mdmp, 00000000-00002636.00000002.161282.012F0000.00000004.mdmp, 00000000-00002636.00000002.161282.01520000.00000004.mdmp, 00000000-00002636.00000002.161282.017D0000.00000004.mdmp, 00000000-00002636.00000003.168084.012F0000.00000004.mdmp, 00000000-00002636.00000003.168084.01520000.00000004.mdmp, 00000000-00002636.00000003.168084.017D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002636.00000000.157439.012F0000.00000004.mdmp, 00000000-00002636.00000000.157439.017D0000.00000004.mdmp, 00000000-00002636.00000001.159359.012F0000.00000004.mdmp, 00000000-00002636.00000001.159359.017D0000.00000004.mdmp, 00000000-00002636.00000002.161282.012F0000.00000004.mdmp, 00000000-00002636.00000002.161282.01520000.00000004.mdmp, 00000000-00002636.00000002.161282.017D0000.00000004.mdmp, 00000000-00002636.00000003.168084.012F0000.00000004.mdmp, 00000000-00002636.00000003.168084.01520000.00000004.mdmp, 00000000-00002636.00000003.168084.017D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002636.00000000.157439.012F0000.00000004.mdmp, 00000000-00002636.00000001.159359.012F0000.00000004.mdmp, 00000000-00002636.00000002.161282.012F0000.00000004.mdmp, 00000000-00002636.00000003.168084.012F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002636.00000000.157439.1C630000.00000004.mdmp, 00000000-00002636.00000001.159359.1C630000.00000004.mdmp, 00000000-00002636.00000002.161282.1C630000.00000004.mdmp, 00000000-00002636.00000003.168084.1C69A000.00000004.mdmp")3a:Tca8,"go:WNe(e.mainImage),stickers:e.stickers.map(WNe)}}function YZ(e){let t=new DOMParser().parseFromString(e,"text/html"),o=JSON.parse(t.querySelector("[ref=mainImage]")?.dataset?.preview??"null"),{id:r}=o,n=[...t.querySelectorAll(".FnStickerPreviewItem")].map(s=>JSON.parse(s.dataset.preview??"null")).filter(s=>s!==null).map(s=>({...s,stickerPackId:r}));return{title:t.querySelector("[data-test=emoji-name-title]")?.textContent??"null",author:{name:t.querySelector("[data-test=emoji-author]")?.textContent??"null",url:"https://store.line.me/"+(t.querySelector("[data-test=emoji-author]")?.getAttribute("href")??"null")},id:r,mainImage:o,stickers:n}}function QNe(e){return e.includes('data-test="emoji-name-title"')}async function $Ne(e,t="en"){let r=await(await Yh(`https://store.line.me/emojishop/product/${e}/${t}`)).text();return YZ(r)}var YNe=y(()=>{"use strict";c();Uf()});function tR(e){let o=/^https:\/\/store\.line\.me\/stickershop\/product\/([a-z0-9]+)\/.*$/.exec(e);if(o===null)throw new Error("Invalid URL");return" (Indicator: "line.me"; File: "EndcordInstaller.exe") "o[1]}function JNe(e){return"MoreStickers:Line:Pack:"+e}function LIt(e,t){return"MoreStickers:Line:Sticker:"+t+":"+e}function ZNe(e){return{id:LIt(e.id,e.stickerPackId),image:e.animationUrl||e.staticUrl,title:e.id,stickerPackId:JNe(e.stickerPackId),isAnimated:!!e.animationUrl}}function ZZ(e){return{id:JNe(e.id),title:e.title,author:e.author,logo:ZNe(e.mainImage),stickers:e.stickers.map(ZNe)}}function JZ(e){let t=new DOMParser().parseFromString(e,"text/html"),o=JSON.parse(t.querySelector("[ref=mainImage]")?.dataset?.preview??"null"),{id:r}=o,n=[...t.querySelectorAll('[data-test="sticker-item"]')].map(s=>JSON.parse(s.dataset.preview??"null")).filter(s=>s!==null).map(s=>({...s,stickerPackId:r}));return{title:t.querySelector('[data-test="sticker-name-title"]')?.textContent??"null",author:{name:t.querySelector('[data-test="sticker-author"]')?.textContent??"null",url:"https://store.line.me/"+(t.querySelector('[data-test="sticker-author"]')?.getAttribute("href")??"null")},id:r,mainImage:o,stickers:n}}function XNe(e){" (Indicator: "line.me"; File: "EndcordInstaller.exe") "return e.includes('data-test="sticker-name-title"')}async function eLe(e,t="en"){let r=await(await Yh(`https://store.line.me/stickershop/product/${e}/${t}`)).text();return JZ(r)}var tLe=y(()=>{"use strict";c();Uf()});function FIt(e){return{id:e.id,title:e.title=e.title==="null"?e.id.match(/\d+/)?.[0]??e.id:e.title,author:e.author,logo:e.logo,dynamic:e.dynamic}}async function Zh(e,t=XZ){let o=FIt(e);await Promise.all([et(`${e.id}`,e),(async()=>{let r=await oLe.lock();try{let n=await Ye(t)??null;n?.some(a=>a.id===e.id)?n=n.map(a=>a.id===e.id?o:a):n=n===null?[o]:[...n,o],await et(t,n)}finally{r()}})()])}async function Cd(e=XZ){return await Ye(e)??null??[]}async function tS(e){return await Ye(e)??null}async function SA(e,t=XZ){await Promise.all([Or(e),iLe(e),(async()=>{let o=await oLe.lock();try{let r=await Ye(t)??null;if(r===null)return;await et(t,r.filter(n=>n.id!==e))}finally{o()}})()])}var oLe,XZ,oR=y(()=>{"use strict";c();Xt();eJ();Uf();oLe=new eS,XZ="MoreStickers:Packs"});function UIt(e){return e.startsWith" (Indicator: "line.me"; File: "EndcordInstaller.exe")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f3cae5595f04825e38620f7b0690d61827df9626d0c5a4b56ee2110a8ee2c56b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":69,"unified_at_epoch_ms":1792893002227,"unified_at":"2026-10-25T01:50:02.227Z","metadata":{"hashes":{"sha256":"f3cae5595f04825e38620f7b0690d61827df9626d0c5a4b56ee2110a8ee2c56b","sha1":"3b6a74d36d6116c49c35bbd4047e63db51a7365c","md5":"358a4f3518fb2ee16f7f293884f3212e","sha512":"10825e318030ead9d3b3f76f94c8409b1becdeccec5b446194c56f83f518e794c88a7eafae7d0c336e213c4ccbeb35c853fd4c8571dfa75af130c497d49fafef","ssdeep":"49152:+mP1rDwbAV/0/dZaaqRzw4oUFBESkh1kGkg31+d9qI6zbtGkMt4dVVYpTxsa2Rrb:+rdi6","ssdeep_chunks":["49152:+mP1rDw","49152:mP1rDwb","49152:P1rDwbA","49152:1rDwbAV","49152:rDwbAV/","49152:DwbAV/0","49152:wbAV/0/","49152:bAV/0/d","49152:AV/0/dZ","49152:V/0/dZa","49152:/0/dZaa","49152:0/dZaaq","49152:/dZaaqR","49152:dZaaqRz","49152:ZaaqRzw","49152:aaqRzw4","49152:aqRzw4o","49152:qRzw4oU","49152:Rzw4oUF","49152:zw4oUFB","49152:w4oUFBE","49152:4oUFBES","49152:oUFBESk","49152:UFBESkh","49152:FBESkh1","49152:BESkh1k","49152:ESkh1kG","49152:Skh1kGk","49152:kh1kGkg","49152:h1kGkg3","49152:1kGkg31","49152:kGkg31+","49152:Gkg31+d","49152:kg31+d9","49152:g31+d9q","49152:31+d9qI","49152:1+d9qI6","49152:+d9qI6z","49152:d9qI6zb","49152:9qI6zbt","49152:qI6zbtG","49152:I6zbtGk","49152:6zbtGkM","49152:zbtGkMt","49152:btGkMt4","49152:tGkMt4d","49152:GkMt4dV","49152:kMt4dVV","49152:Mt4dVVY","49152:t4dVVYp","49152:4dVVYpT","49152:dVVYpTx","49152:VVYpTxs","49152:VYpTxsa","49152:YpTxsa2","49152:pTxsa2R","49152:Txsa2Rr","49152:xsa2Rrb","98304:+mP1rDw","98304:mP1rDwb","98304:P1rDwbA","98304:1rDwbAV","98304:rDwbAV/","98304:DwbAV/0","98304:wbAV/0/","98304:bAV/0/d","98304:AV/0/dZ","98304:V/0/dZa","98304:/0/dZaa","98304:0/dZaaq","98304:/dZaaqR","98304:dZaaqRz","98304:ZaaqRzw","98304:aaqRzw4","98304:aqRzw4o","98304:qRzw4oU","98304:Rzw4oUF","98304:zw4oUFB","98304:w4oUFBE","98304:4oUFBES","98304:oUFBESk","98304:UFBESkh","98304:FBESkh1","98304:BESkh1k","98304:ESkh1kG","98304:Skh1kGk","98304:kh1kGkg","98304:h1kGkg3","98304:1kGkg31","98304:kGkg31+","98304:Gkg31+d","98304:kg31+d9","98304:g31+d9q","98304:31+d9qI","98304:1+d9qI6","98304:+d9qI6z","98304:d9qI6zb","98304:9qI6zbt","98304:qI6zbtG","98304:I6zbtGk","98304:6zbtGkM","98304:zbtGkMt","98304:btGkMt4","98304:tGkMt4d","98304:GkMt4dV","98304:kMt4dVV","98304:Mt4dVVY","98304:t4dVVYp","98304:4dVVYpT","98304:dVVYpTx","98304:VVYpTxs","98304:VYpTxsa","98304:YpTxsa2","98304:pTxsa2R","98304:Txsa2Rr","98304:xsa2Rrb"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"EndcordInstaller.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":6408712,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792892636000,"last_seen":1792892636000,"last_multi_scan":1792892636000}},"detections":{"summary":{"verdict":"malicious","score":69,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":59},"sandbox_signatures":{"informative_count":106,"suspicious_count":11,"malicious_count":1,"total":118},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/grayware_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Execution","technique":"Systemd Timers","attack_id":"T1053.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/006","identifiers":[{"type":"informative","value":"Able to access scheduled job timer"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move items (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve system configuration"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Contains ability to set the value of an HTTP request header"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":".NET code is able to query registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Credential Access","technique":"Securityd Memory","attack_id":"T1555.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/002","identifiers":[{"type":"informative","value":"Able to retrieve credentials from memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Able to format disks"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Able to execute application (.NET)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Credential Access","technique":"Steal Application Access Token","attack_id":"T1528","attack_id_wiki":"https://attack.mitre.org/techniques/T1528","identifiers":[{"type":"informative","value":"Able to access AWS credential file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"youtube\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"twitter\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$28","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$29","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Test-Path\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" connect \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" socket \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" bind \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"cdn.discordapp.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"drive.google.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"githubusercontent.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"api.openai.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"huggingface.co\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \".googleapis.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Move-ItemProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-378","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"file/memory contains long string with (Indicator: \"webdav\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-476","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"file/memory contains long string with (Indicator: \"\"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.27.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$2c","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-623","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"$2d","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-575","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2e","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ping\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \".encrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should Endcord live?\" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve credentials from memory","description":"file/memory contains long string with (Indicator: \"gcore \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.002","id":"string-5073","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ForEach-Object\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Where-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-374","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-ItemProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[end]\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access scheduled job timer","description":"file/memory contains long string with (Indicator: \".timer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.006","id":"string-5057","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2f","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-Item\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-333","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HMAC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"System Security","name":"Able to format disks","description":"file/memory contains long string with (Indicator: \"\"format \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1561.001","id":"string-407","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-ItemProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-367","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-ItemProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-369","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"file/memory contains long string with (Indicator: \"secretaccesskey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1528","id":"string-5076","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-Null\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-373","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"New-Item \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-396","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"decodebase64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"file/memory contains long string with (Indicator: \"servers=\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-29","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"EndcordInstaller.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"EndcordInstaller.exe\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"EndcordInstaller.exe has big resource with name: \"app_logo.png\" size: \"81478\" and abnormal entropy:\"7.9824791802823825\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"EndcordInstaller.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"EndcordInstaller.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"EndcordInstaller.exe\" queried SystemProcessInformation at 00000000-00002636-00000C15-1314067512 [PID: 2636]\n \"EndcordInstaller.exe\" queried SystemProcessInformation at 00000000-00002636-00000C15-1314076814 [PID: 2636]\n \"EndcordInstaller.exe\" queried SystemProcessInformation at 00000000-00002636-00000C15-1314086533 [PID: 2636]\n \"EndcordInstaller.exe\" queried SystemProcessInformation at 00000000-00002636-00000C15-1314095631 [PID: 2636]\n \"EndcordInstaller.exe\" queried SystemProcessInformation at 00000000-00002636-00000C15-1314104905 [PID: 2636]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 6189183; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 6217606; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 6232816; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 6368572; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 6375108; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 6396731; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 6407854; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"EndcordInstaller.exe\"\n Observed dotnet function \"GetDirectories\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002636.00000000.157439.12FD0000.00000004.mdmp, 00000000-00002636.00000001.159359.12FD0000.00000004.mdmp, 00000000-00002636.00000003.168084.12FD0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002636.00000000.157439.12FD0000.00000004.mdmp, 00000000-00002636.00000001.159359.12FD0000.00000004.mdmp, 00000000-00002636.00000003.168084.12FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"EndcordInstaller.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002636)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"EndcordInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00002636.00000000.157439.012F0000.00000004.mdmp\n 00000000-00002636.00000001.159359.012F0000.00000004.mdmp\n 00000000-00002636.00000002.161282.012F0000.00000004.mdmp\n 00000000-00002636.00000003.168084.012F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"file/memory contains long string with (Indicator: \"\"systeminfo\"; File: \"EndcordInstaller.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"EndcordInstaller.exe\" queried token user identity (UID: 00000000-00002636)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"EndcordInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"EndcordInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"EndcordInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\DISCORD\")\n \"EndcordInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\DISCORDPTB\")\n \"EndcordInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\DISCORDCANARY\")\n \"EndcordInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\DISCORDDEVELOPMENT\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"EndcordInstaller.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"EndcordInstaller.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$31","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"EndcordInstaller.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"AttachConsole\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"EndcordInstaller.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at C8930000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"EndcordInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F3880000\n \"EndcordInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F3A10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"EndcordInstaller.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at C9F90000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"EndcordInstaller.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F3B70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"EndcordInstaller.exe\" was detected as \".NET\" and name: \"Library\"\n \"EndcordInstaller.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"EndcordInstaller.exe\" touched \"TF_TransitoryExtensionUIEntry\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"EndcordInstaller.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"EndcordInstaller.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$32","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x611a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x611954\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$33","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Endcord Open Source Developer, O=Endcord, C=US\" (SHA1: F4:AE:0C:D2:DA:75:44:12:FC:AE:42:B7:AB:4E:2D:33:FD:86:79:CA; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"EndcordInstaller.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"EndcordInstaller.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"EndcordInstaller.exe\" queries basic process information of the \"C:\\EndcordInstaller.exe\" (UID: 2636)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"EndcordInstaller.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"EndcordInstaller.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL\"\n \"EndcordInstaller.exe\" trying to touch file \"\\Device\\KsecDD\"\n \"EndcordInstaller.exe\" trying to touch file \"C:\\Windows\\System32\\MSCOREE.DLL.local\"\n \"EndcordInstaller.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local\"\n \"EndcordInstaller.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\"\n \"EndcordInstaller.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll\"\n \"EndcordInstaller.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll\"\n \"EndcordInstaller.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\"\n \"EndcordInstaller.exe\" trying to touch file \"C:\\EndcordInstaller.exe.config\"\n \"EndcordInstaller.exe\" trying to touch file \"C:\\EndcordInstaller.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://fs.microsoft.com/fs/windows/config.json10/25\" - Source: \"00000000-00002636.00000002.161282.1B950000.00000002.mdmp\")\n Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,010/25\" - Source: \"00000000-00002636.00000002.161282.1B950000.00000002.mdmp\")\n Found URL \"https://fs.microsoft.com/fs/windows/config.json10/25\" - Source: \"00000000-00002636.00000003.168084.1B950000.00000002.mdmp\")\n Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,010/25\" - Source: \"00000000-00002636.00000003.168084.1B950000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://localhost:8080\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLECB17AE004A7826BD46BC9B0DBFC1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000000.157439.012F0000.00000004.mdmp, 00000000-00002636.00000001.159359.012F0000.00000004.mdmp, 00000000-00002636.00000002.161282.012F0000.00000004.mdmp, 00000000-00002636.00000003.168084.012F0000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLECB17AE004A7826BD46BC9B0DBFC1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000000.157439.1C630000.00000004.mdmp, 00000000-00002636.00000001.159359.1C630000.00000004.mdmp, 00000000-00002636.00000002.161282.1C630000.00000004.mdmp, 00000000-00002636.00000003.168084.1C630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002636.00000000.157439.1C630000.00000004.mdmp, 00000000-00002636.00000001.159359.1C630000.00000004.mdmp, 00000000-00002636.00000002.161282.1C630000.00000004.mdmp, 00000000-00002636.00000003.168084.1C630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"EndcordInstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"EndcordInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"PRUNINGMODE\")\n \"EndcordInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"HARDWAREINFORMATION.MEMORYSIZE\")\n \"EndcordInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"INSTALLEDDISPLAYDRIVERS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$39","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"EndcordInstaller.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"EndcordInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"update.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00002636.00000000.157439.12FD0000.00000004.mdmp, 00000000-00002636.00000001.159359.12FD0000.00000004.mdmp, 00000000-00002636.00000003.168084.12FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"EndcordInstaller.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (6363476 bytes)\n possible junk padding","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"EndcordInstaller.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2636)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"EndcordInstaller.exe\" has section name .rsrc with entropy \"7.8643156812629\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\EndcordInstaller.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"EndcordInstaller.exe\" has resource with unusual entropy \"RT_ICON:7.926450311390732\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_DiscordURL\" matched file \"sample.bin\" as \"Detects executables Discord URL observed in first stage droppers\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessesByName(System.String) at 358a4f3518fb2ee16f7f293884f3212e-600006a-DiscordLocator~TryFindFromRegistryOrProcess\n System.Diagnostics.Process::GetProcessesByName(System.String) at 358a4f3518fb2ee16f7f293884f3212e-60000c1-InstallationEngine~IsProcessRunning\n System.Diagnostics.Process::GetProcessesByName(System.String) at 358a4f3518fb2ee16f7f293884f3212e-60000c2-InstallationEngine~CloseDiscordProcess","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"$3a","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":85,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility"],"sandbox_reports":[{"id":"6add5edb93aa27a8520fe14e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":69,"submit_name":"EndcordInstaller.exe","analysis_start_time":"2026-10-25T01:43:56+00:00","indicators_count":{"informative":104,"suspicious":15,"malicious":1},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}],"processes":[{"pid":2636,"ppid":0,"name":"EndcordInstaller.exe","command_line":"","sha256":"f3cae5595f04825e38620f7b0690d61827df9626d0c5a4b56ee2110a8ee2c56b","normalized_path":"C:\\EndcordInstaller.exe","uid":"00000000-00002636","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABEElEQVR4Xu2UzUrEMBSFu5rZdF1XTgekT6CitEVmMSC46XPZaZq3alIFfRrxJ22OuZGCZCkkRcgHl5DkwjlpTpokkUgk8kfquobWGkRRFHD3vZPnuTWwlLvvFTq1+tSoqsqKN00T1sDL+ArGOMryFlmWmbEMa4A4HO6w2aRItlukaYrd7iyciU5+4SQ1TkKhkxM6AbRjoBy0zzCiGmycTRlhqYyRGf3TFMYAG4yY+QLuejBWN9ALDT4qMPGOdvjA4/BmR7fPG1wCvZh+wmdqCaLb5w0S53LG+eUR+6sjLm7usb9+CGeAxOkK3PVgUAbYmgboFSw54OYHRHM2KDt3e71hr+FXkQEuVnyakUjkX/MNEmPeM1fE8w4AAAAASUVORK5CYII="}],"all_imported_dlls":["D3DCompiler_47.dll","msvcp_win.dll","mscorlib.ni.dll","ole32.dll","shell32.dll","wldp.dll","d3d10warp.dll","umpdc.dll","dcomp.dll","user32.dll","psapi.dll","d3d11.dll","DXCore.dll","dwmapi.dll","msvcrt.dll","clrjit.dll","powrprof.dll","CoreMessaging.dll","UIAutomationProvider.ni.dll","clr.dll","gdi32full.dll","uxtheme.dll","System.Xml.ni.dll","UIAutomationCore.dll","sechost.dll","gdi32.dll","imm32.dll","msctf.dll","propsys.dll","bcryptprimitives.dll","oleaut32.dll","PresentationFramework.Aero2.ni.dll","TextInputFramework.dll","msctfui.dll","combase.dll","kernel32.dll","rpcrt4.dll","PresentationFramework.ni.dll","shlwapi.dll","WindowsBase.ni.dll","WindowsCodecs.dll","clbcatq.dll","IconCodecService.dll","CoreUIComponents.dll","ucrtbase.dll","System.Configuration.ni.dll","profapi.dll","winsta.dll","ntmarta.dll","UIAutomationTypes.ni.dll","System.ni.dll","TextShaping.dll","DataExchange.dll","ResourcePolicyClient.dll","ws2_32.dll","KernelBase.dll","version.dll","vcruntime140_clr0400.dll","ucrtbase_clr0400.dll","PresentationNative_v0400.dll","windows.storage.dll","dxgi.dll","WinTypes.dll","ntdll.dll","advapi32.dll","kernel.appcore.dll","win32u.dll","cryptbase.dll","d3d9.dll","twinapi.appcore.dll","winmm.dll","mscoree.dll","System.Xaml.ni.dll","wpfgfx_v0400.dll","msvcp140_clr0400.dll","cfgmgr32.dll","cryptsp.dll","rsaenh.dll","SHCore.dll","mscoreei.dll","DWrite.dll","wtsapi32.dll","bcrypt.dll","System.Core.ni.dll","PresentationCore.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"SM0:2636:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"Local\\SM0:2636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"Local\\SM0:2636:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"SM0:2636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2636:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2636:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6add5edb93aa27a8520fe14e"}]}]}},"report_ids":{"sandbox_job_ids":["6add5edb93aa27a8520fe14e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/grayware_confidence_70% Sample f3cae5595f04… — Score 69/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f3cae5595f04…. Malware family: Win/grayware_confidence_70%. Threat score 69/100. 1/27 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f3cae5595f04825e38620f7b0690d61827df9626d0c5a4b56ee2110a8ee2c56b"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/grayware_confidence_70% Sample f3cae5595f04… — Score 69/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f3cae5595f04…. Malware family: Win/grayware_confidence_70%. Threat score 69/100. 1/27 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f3cae5595f04825e38620f7b0690d61827df9626d0c5a4b56ee2110a8ee2c56b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/grayware_confidence_70% Sample f3cae5595f04… — Score 69/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f3cae5595f04…. Malware family: Win/grayware_confidence_70%. Threat score 69/100. 1/27 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]]