Analysis
- max time kernel
150s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 05:43
Behavioral task
behavioral1
Sample
PotaToolsTrainer-Setup-0.1.0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target PotaToolsTrainer-Setup-0.1.0.exe
- Size 50.0MB
- Sample260729-ge2nnaxyes
- SHA256 b1d886296ed562c6d599e4e5a1a524b6d628c188ec17072f63ef448486970e62
- MD5 28ab06b38f53af80824a05901c08e473
- SHA1 4c6bccf22f67bb73384fcfd56ff32217ed81a345
- SHA512 89dfd54cc899ab6d2c8ac908f1629090ccf6eac42abec8e3dfc6ffc3642956c9a44ada731f7306ddbf740ea3c98e467dd17e89485b2e8b0cc7a642191c2bf717
- SSDEEP 786432:F9jQ+eSS6Ct2TgR3rSrIzeXmARqDWbtyboHt0GkOiRCZEF0jBPKM1V5an2c4j8Ho:Pj5DS6CEs3JFstFqGEMBPKM1VI2rnll
- TLSH T102B7333F7267203EF56E52783AB2D664583B76A2A2128C46D7F8C48CCF252701D3E597
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3360 PotaToolsTrainer-Setup-0.1.0.tmp 4508 PotaToolsTrainer.exe - Loads dropped DLL 47 IoCs
pid Process 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\PotaTools Trainer\es\is-JG6IB8S6IF.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\Tables\is-I5M8D739II.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Net.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Net.Primitives.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\ja\ReachFramework.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\pl\UIAutomationClientSideProviders.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-12R4GRY3RY.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-VL5S6GBQKB.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\Microsoft.Win32.Primitives.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Resources.ResourceManager.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\ru\is-XD7PF3D78F.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\Tables\is-U64YQVVEUT.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Threading.AccessControl.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Net.NameResolution.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-LW7MRSXVZB.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\tr\is-GI5Q3CREF9.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.IO.Compression.Brotli.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Text.RegularExpressions.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\PresentationFramework.Luna.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Reflection.TypeExtensions.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Xml.ReaderWriter.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\it\UIAutomationTypes.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-TZ5WPY8YJE.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\ko\is-V1SS7A2NZU.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\zh-Hans\is-AO2QASCL4Q.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\it\PresentationUI.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-9YIWYC6CVY.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-CN4Q2HHVP3.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\cs\is-G9U4EYHT8S.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\it\is-9Z8BYPAHOO.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\recordings\is-YVGDQZ6WCH.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Security.Cryptography.X509Certificates.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\zh-Hant\System.Windows.Forms.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\fr\UIAutomationTypes.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\Tables\is-MT3HCZKWMN.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\ru\System.Windows.Controls.Ribbon.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-9UMHC14FBT.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Drawing.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-OA2HYII7DR.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-AL86QDVETI.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.AppContext.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\ru\System.Windows.Forms.Primitives.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\ja\WindowsFormsIntegration.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Xml.XPath.XDocument.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\zh-Hant\PresentationUI.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\it\is-4BD5QRRDXO.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Threading.Tasks.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\zh-Hans\PresentationFramework.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\pt-BR\is-9CN1KU83JZ.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\tr\is-D06LSSTPAX.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\Tables\is-LIODBUYMHI.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Net.WebSockets.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Windows.Presentation.dll PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-OB0APDRE88.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\is-G87IVW4ZFH.tmp PotaToolsTrainer-Setup-0.1.0.tmp File created C:\Program Files\PotaTools Trainer\tr\is-BFMO3NCNPB.tmp PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\es\WindowsBase.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\System.Xml.XmlDocument.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\ko\PresentationUI.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\msquic.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\es\System.Windows.Forms.Design.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\de\System.Windows.Forms.Design.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\clretwrc.dll PotaToolsTrainer-Setup-0.1.0.tmp File opened for modification C:\Program Files\PotaTools Trainer\cs\PresentationFramework.resources.dll PotaToolsTrainer-Setup-0.1.0.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PotaToolsTrainer-Setup-0.1.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PotaToolsTrainer-Setup-0.1.0.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/3292-0-0x0000000000F10000-0x0000000000FFD000-memory.dmp innosetup behavioral2/memory/3292-8-0x0000000000F10000-0x0000000000FFD000-memory.dmp innosetup behavioral2/memory/3292-1163-0x0000000000F10000-0x0000000000FFD000-memory.dmp innosetup - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3360 PotaToolsTrainer-Setup-0.1.0.tmp 3360 PotaToolsTrainer-Setup-0.1.0.tmp 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe 4508 PotaToolsTrainer.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4508 PotaToolsTrainer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3360 PotaToolsTrainer-Setup-0.1.0.tmp - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3292 wrote to memory of 3360 3292 PotaToolsTrainer-Setup-0.1.0.exe 89 PID 3360 wrote to memory of 4508 3360 PotaToolsTrainer-Setup-0.1.0.tmp 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\PotaToolsTrainer-Setup-0.1.0.exe"C:\Users\Admin\AppData\Local\Temp\PotaToolsTrainer-Setup-0.1.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\is-4G5FYFZ9ZT.tmp\PotaToolsTrainer-Setup-0.1.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-4G5FYFZ9ZT.tmp\PotaToolsTrainer-Setup-0.1.0.tmp" /SL5="$501EE,51126050,912896,C:\Users\Admin\AppData\Local\Temp\PotaToolsTrainer-Setup-0.1.0.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Program Files\PotaTools Trainer\PotaToolsTrainer.exe"C:\Program Files\PotaTools Trainer\PotaToolsTrainer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\PotaTools Trainer\DirectWriteForwarder.dll
- Size 505KB
- SHA256 3a2a918b1508fb0a1177444f4326362607cd896cabc3f5044a368b553e09e272
- MD5 5ab4981417d69c9f9a3e8cc5fd21dd9b
- SHA1 443665e79c22d5b038e51216f846539e16f593b8
- SHA512 6a17144cc3cda721327a0feaf1629ce1661af916d9ed4c03cc65210e1288f629fe3204cbc871661dd808e7a0a978663c46ed39b7d3c835aac71c9552d111f44c
- SSDEEP 12288:o8Y9r3Jm/RXQMkIl0LC0eDS103uaJ+AG3:BY9DJmjJNp+Yu++T
- TLSH T1DEB49D15FAC43793E92D82BE8663CA52D67099F21312E7C7C141CA562E2F3C2D77B096
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\Microsoft.Win32.Primitives.dll
- Size 14KB
- SHA256 190d9e13ec667b7c311c06213cbfae12e4b90528db2f032456f778891ac170ef
- MD5 5aff35fb8eb7897666d36724466db397
- SHA1 3aa7f1cd5568f42c4aa83e1aeeb597a35edd6eff
- SHA512 18ae67a5f7c0b575fd89e977576c864feea3d6c5177ab49d758d2c4ba27a6945a675613094c928a661fd77acb9a8bfb8f17640bf43ebbb2b0bdcf38329c9d0d9
- SSDEEP 192:R1iBpKxVWhPmpW1WCWKie1BzBWseaUW/0R3JKX01k9z3AWCUIVV:niLQVWhPmpWNZlN5jR9zTs
- TLSH T10B624A82CB3C4117EDEB6EB09AA8DD833C3963C749509A1A16D9F1181C63BC5DB3163A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\Microsoft.Win32.Registry.dll
- Size 117KB
- SHA256 4b2e3b646a85c9db904647f57763a7134dee6307ba5866f7ce51d32b914ce1cf
- MD5 130c55013461647a5e6292a46306e504
- SHA1 3a73f284827e5ae76b3e531842735872bfd71354
- SHA512 14111db0f91aa489ff40874e520dd94ce6ff77f6ea3dc42e4cb270ace9fbdb747a2f00b6c02a68c9e0358ea5b3ab3f62f8a048f91922b3f072cbcf03c52d4f15
- SSDEEP 3072:Ya1wNXwrxA7wECisvqzJSvEVcULViU3io1dPo:2NIAFC6zJSvEVzbDC
- TLSH T1DAC32A1177C8430BFAABCA7988628985E172E4871701EECF96C5C15E3F5BBC6E671601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\PotaToolsTrainer.deps.json
- Size 35KB
- SHA256 5d141b5fb5c6c725dcee04ccc4ac46e42b31b7f89670e9f02bda933efa6af875
- MD5 45fa9fdb59a3ab37997d69f8b8140759
- SHA1 46fa8ab18bdf5e11a41339d9d96fd8e83fd6b327
- SHA512 5c9f6405f61db096b3007633b10a0b126772b4cf23445a1e0044ff1c2c2e3beea17d611fc106b3267c3454cab6b9409700cded060e2ee50967d1e1e4017b8c46
- SSDEEP 384:QTkzhaf5oUD02IOlOqEHsfsWxcsmZyysjCH5V7M7NjLN8:QDDy/HT2jLN8
- TLSH T184F28234C9601AE70C36ABDE28355646F37903AF3082484EB4BD342D9F779BA8155B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\PotaToolsTrainer.dll
- Size 104KB
- SHA256 d7cbd5627f091e903aad0c23437eb6d96ee37c9b0b3ce3a09884a5e404415719
- MD5 0e7d742e7307ac42b5c799e8469fccf7
- SHA1 b123a21ce9d8de31d3b3275a02ca8fae83338db1
- SHA512 abf9421cddb0007358a689de2abcf6a4c82c7c8be00cfd45ec2f1208572b97b3b77d7e46c020634de55d803369d0dfe8cd423170de59acbe7e634441d849a736
- SSDEEP 3072:h1REWSdSagRqtp+8yYzbVd19ze27v7VY:hDEWotK+Vd19zJT
- TLSH T139A3F16233F58759C4BB0BB2E4A292904B378F42D952DF9C19CE54CFAD427468702BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\PotaToolsTrainer.exe
- Size 222KB
- SHA256 32fa39f3d8c08a4de5419bd71e67cb66370af069c03c5e077ef9770db7c9e139
- MD5 863946b7586f262e9e0d305c5e7d8edc
- SHA1 38ea2b13e1af6fec0eb3ae6fa88df91ff18c2c8d
- SHA512 1a25f6abc043be281fe6a849a2aaa73eb031fc37464796518119cf9e5ac8013ce2ac84126b9c231a55b32662f49f6d7173cc64c47a3268f391b5350c83a8624c
- SSDEEP 3072:GqeXA/4yIg9vkNPNu6H6xCYOiVUE2654JldS0gRqQp+tyYFbVd19ze27v7V2:GvgvkNFNaxmNEYJ7Qh0Vd19zJT
- TLSH T104248D07A2A851BEE1B6C679C9924941FB737C598B71A7CF03504AB61F63BD09F39302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\PotaToolsTrainer.runtimeconfig.json
- Size 468B
- SHA256 019a0076bcf2729f4c42702c7636862e8619d9fad2c2d6472b8dc6974cccdb98
- MD5 bf419db65090761421716f742dc7258d
- SHA1 52f9c4b517fec3f8201f43c4f2f1f721a5326736
- SHA512 f0729f6a6652cf97f3338dabe971c53d6f8ce16c006d040b1050f64a23c0764115f952b96dc94d982dbaa7dd826fb1a7fd8eb63cb70fa3fb96eadf37fb0fee34
- TLSH T120F0E57ACA246D7714F9B77DC52AC1C2EB34132B10005D9178FD041C6F779A64112F5A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\PotaTools Trainer\PresentationCore.dll
- Size 8.2MB
- SHA256 211d9cddbbbd3280be88e48762dff0a8bf052e21a42c4b839a15dc5fd5728cf7
- MD5 00420f1c21da87b6a4f1e974687ccff2
- SHA1 5e1a0c7c205c49dfaaff6794c350aba6cd9dde75
- SHA512 76b3a5821fc2fabad86eeb39f5b3f66ab09c397546aa7b8fd476aad7911500e3fd53930c512062817345a5de3cd92daa0947a761924caffbd1b48ba800547464
- SSDEEP 98304:SJhAhMO3bBEZhL2Src8n5EsxhP3Ws135PNcQQoWP04cHlKRFqV:SJ7O3b02SrLn5+sZWP0rFKWV
- TLSH T16B867C15B7C40715D2BF86BED2934222E5B0A4635311D0CB746CEB2A2FA3FC1A7F6652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\PresentationFramework.dll
- Size 15.4MB
- SHA256 6465a8ee9b84837434419596e1fa820b31a93ab04d0e8ef1eff83b63a2d653f4
- MD5 b343dacb8b72ae24b4aa3ae52ec371f1
- SHA1 1f284075e4e2ec2c56f38065be61cc974c930536
- SHA512 30e3c96e02c14ad6c92ab152d49ddfc5778c943abe07f5564a6d7f546742353461acf189c7e7b5d30d5b6c4ad73ff7fd226ae45a62ebbd0b49f4163c85b87247
- SSDEEP 196608:+s/CQJQreoZct7Hg/FjD6xPgsLSrEo+HYA208ZhV2PCu6:+s/CQ2nZqg/FjD6xPgsLS4lJmqPq
- TLSH T172F69E2593DC4A05D37EBEFCD2634102E9F0F4926B32D4CF8916D9092F877C1667AA62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\PresentationNative_cor3.dll
- Size 1.2MB
- SHA256 67629b6aaee39328d02b11e5d85a53b35aa6cea71d4d37a671295a76c02b240e
- MD5 38f9831155956106c61b9885d6113444
- SHA1 8cbc1aaf60edfd4155bb4f10fdb5257d7c4b84f8
- SHA512 e1e3859d83ee49bfdd0ea5b929772426d529e417c7d6d6bbdf251cc3d5ae5a2eaf055d0be62598231a444a5e54a1b0cea5eb60d4140d5e9739210c3b0d667b18
- SSDEEP 24576:/hNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa5:/xKcdPHmMLYpX7T35/fPoGPpGFjztQcR
- TLSH T1FC453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Collections.NonGeneric.dll
- Size 101KB
- SHA256 aba7167d2e95ee23a55a03586588eb01ca3e63942ff2e1392936692bc337c194
- MD5 9a208dbc9f6ea15911a634abde78edd8
- SHA1 df9f0a91436b7d9afe573100603f2b400a4a9659
- SHA512 173b3a02b0cfae84b4f7af22a6de582521024b806321d9e754176891664705ec1cf82e2dc725396255d05697e73e3647634da8a0c4420c13aa875aca5a464b55
- SSDEEP 1536:lWd0tJVDX9LuIbwNC5IQ7XVrMZqz9AZWTUdOoz6Y:lg0dzNuIc+IQLGZqzKZAoeY
- TLSH T19AA3182673D80322C69E6BFC81938A01E6B5F4D26713D1DF1618A9CD1F9BBC2D6B2147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Collections.Specialized.dll
- Size 101KB
- SHA256 c4b625cf2ec04fc659e86223ca4be5421f843ecac62feb1a2e5e92e7c70eda50
- MD5 ff714375dc1f1ab2bd4c847055d1f78e
- SHA1 8dd5a8798873e1175f386577d27c69d7983d5cef
- SHA512 32427ee8771ae060ac4b1e8978756808b95a188b6f189f56693f7c647c51fbdad001d1bc93a1235d0a096056bd2e8de25854c89138ceaab05ea8bb2bbe82ce89
- SSDEEP 1536:VT6dRfAgP9WSJLeI620hCYCARk4YIAO8xocgL50Gd0VIOblgzYr:VT6fAWpeJDPAOSocgLaGOBblgEr
- TLSH T16EA35B2473D84B22C73E92FC85978981E730F1E31362D2CF1559D9891E8BBC69B7612B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Collections.dll
- Size 253KB
- SHA256 f0fe3fc9cecf713d5c29a2fecdf6aafc50b41efb8130a56af54b8c9330c1ffc1
- MD5 5e013ce9a5a3cb2840b4a0d56f86c849
- SHA1 ce783a1bc6c03b5082059d6935cecfed6944da8c
- SHA512 8041a3486e1e72079a111c2354f242dd74a43ce1ab4e5dc76b05e24e17bc2654f1ad462358be14e2ea2bcc921e79a17c3ccdfecd2398783f95ed0d499989afcd
- SSDEEP 6144:SnxoXLkDXDiKNYX8qTKfAyryS1rIgH3iPt:axCkDXDiQ+jTURrhFXi1
- TLSH T119444A2A778C4E12F56F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6055
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.ComponentModel.Primitives.dll
- Size 77KB
- SHA256 3dc8bfbf3b542c45646a7057d3e945374c7b85db69c37f2a16794e88091a5b06
- MD5 32ca30c430324b105ded9c880e2e9453
- SHA1 1f0945383954c26312190f2059d71ef1591e95a1
- SHA512 02c242e540dd9ff34ef8da2cb9f0d33adc17f8fefc7bf804a7d5904789d95bafb96d9dabceba70c92c6029bd2fb92252515315b9af0c12711dfe5120078473d1
- SSDEEP 1536:+95/UZMu4zhd+Cv8A/oqevD2olsOnbktXzDv:+w43+S85qKD2omOnIv
- TLSH T114734B1823EC0126FBBD46BC9573A821A575F6831713D9CF4AA0D90E1F5BBC2E27152E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Configuration.ConfigurationManager.dll
- Size 1.0MB
- SHA256 74e8df5c1fa4cc47fe46df540d0bb4e463dd92b426cf74436d82a5c352bb4063
- MD5 f225f298861011a44c64a37828cc1a23
- SHA1 fdcf1bded5ed47b6bb3184e4e5d5bb41bdab9e70
- SHA512 72c273fb825493921c50526b8a85b8bfb27b16c3a897c48d96f72d4c0a15cf4417563f736a7cb2db8aad3f3b55f18c0e383dca5523b3fe0dcf62df385c15e279
- SSDEEP 12288:BPHP0JcnrfOsdV0Z8oApKK1sPTdokGH5OTNWLOdN2ZyhtAVv5d6wGGDSxw0aY1Ef:BUmnuEy/6TlGGD6zaIE16r9BH1uB
- TLSH T132354A2663D44B1AF3AA567CC5265501DAF8F8830323C2CF0595BD4E3FA7BC296B1627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Diagnostics.Debug.dll
- Size 15KB
- SHA256 0d321fb174f9acbeec32d9f9b87f1364989b517a5f7a3b30d96a8e0ef0805389
- MD5 5e180898e0cc2120963c0a4923e4dc5d
- SHA1 0cbd12f2bce340aede9d429d6314820f0d939a25
- SHA512 9552ecbf0b7cb4c05284f54f27ac2a93c15563a0263091129aad997c296825d8016fc9342eab4135ed12d8a9464d8d647db80683ecdcaa0a46e9ee9d24b1f698
- SSDEEP 192:GfRxA68OW2fmW0WCWKie1BzBWsea4WQZIR3JKX01k9z3AWkAV:SgOW2fmWYZlNuZR9zTkS
- TLSH T1F7625B96CB7C5213FDEB6D7086A8DD833C39A7C64C60966A06D5F6091C237C0EB32639
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.IO.Packaging.dll
- Size 285KB
- SHA256 d808143e0dac808df22b437fe66ac0477ceee5db51e444ab8478c28daa8bb73a
- MD5 71e9643cfbf6b1d5e0a1ac85f56ffa49
- SHA1 d135a8b15187c9c29e1e8b1973439db0eb16ff51
- SHA512 c16a1318309728d8cadf1c9e04c4be47f678e6f12434b0436f4b29aa40981630b942f0af8faab43ab337ad81f44582957f459ac1bf0ea6d2e9c65846af0f191e
- SSDEEP 6144:G9bGGgTmHmNRF7bLn8qsEYk7GkB1dhjX/:G9FXmNXn8qR7GC5/
- TLSH T12654282677E80607FBBB9A789573E011E638B4921761C3DF46E4948D0F97BC18E71B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Memory.dll
- Size 153KB
- SHA256 4d6fe7d23c06b4e81748d83a1314218f31bb1e4ce9b6d1ebc7ba8a78a342833c
- MD5 4807ee6fb0ab7ed7d308d67657af7ed5
- SHA1 c8eb5f273d03097957cd99eb1cd28bd3defa5981
- SHA512 15c4cca2bda3fde1de51e2783afe7dcb4f4d430a16d132594cb4fbe46ebde25eddccea27cab9de2a6e5b83d7aaeed6de2c2f7bf5a7cb3d1dcd494227a5a99725
- SSDEEP 3072:hsyymN/j+0sbFbqX63vwZuIBo7M5F8966oYdACBuqmwvhtTihdNj:gmCb6oIBo7qDGACBuwh0
- TLSH T12DF35B17E2980657DA3FDAFAAD225302D7B36142672192CB4CE4DA441E53BD0FF738A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Net.WebClient.dll
- Size 165KB
- SHA256 bd7f9573782982e9bbc797f2995ce26d5c43553b65f596bec459bfd87a80459e
- MD5 4b0362ecf4a3124b0e47de284eedea4a
- SHA1 8d9426c11bc7834bafce4057d9f634a0a05e9f67
- SHA512 6e04f937f934538a1dc38800e705fc0f5d659e1c9ab278337f6fc0dff9cee56e9ae3c76742f1fd8633083975ab3eb0dd917095a7c270feb288806d5b0725559e
- SSDEEP 3072:E86InCMQ8/qNIJ55jOpC2poY3ykJ9riw5FpR/HrgEY:WXMv/8IJOvp3FHH9Y
- TLSH T191F35B2787982697D71F81BCC4A76240E7B380960301D7CBA9A895740EC3BC2BF7756E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Private.CoreLib.dll
- Size 12.6MB
- SHA256 7f48a9493a1d9f6c64a51c3ec357cf8534874ea62240a54c2a1570a5913148a4
- MD5 3f64c06a7c0a7aaf48e7f95b11e16e59
- SHA1 09022ca6e7be1ea52d1cc54af362ec7d915f74a3
- SHA512 5214985658e7a6e3dba89154f57fb759884dc962ab70b5e19189cab2d288cdd459e69265f36dfadd64f41fb03f1ae4588e18c1719f360fa8efcfb113388e1b58
- SSDEEP 196608:zmhH8mtl5F/v/u5ks5OtsFnyQvoNT/k9B5f:lglb/vG5L5OtsFtoNTaJ
- TLSH T186D69E11B3C89F16E56EC27DC2635285F3B1F4A2135296CF980DEA882F13BC15B7B265
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Private.Uri.dll
- Size 253KB
- SHA256 7ce81174fdba93a1e12c596ea3e1ad4bcc9e798710292e1629cbe827ee34458b
- MD5 fad0d4747aa546861652bcb7d37237aa
- SHA1 96c67f217aed07466e4a1b571286939fbab6fa58
- SHA512 bf8ba7d5bc35c3b7ef71b7c2d26217485c495a8963c45101e910ac70c4072cc44e019fe0332a10152bca50ed43d5e7f959dc848e7c3c9cecc38b7dd4b38c4bd0
- SSDEEP 6144:1fAAcZQInBPKCeDc6Ci9MG3CMeVmtG+FsGu6MyN:aFODciMG3HamtG+fuVi
- TLSH T1A7448C25E3844E67F73DC2B981D3D112EAB270665315F7CB0AB5E1821F177C2AA36863
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Private.Xml.dll
- Size 7.6MB
- SHA256 9f4783f9f82217dc44aae218a5d203b314313305b64ec97a0f8caf4fc53e7d86
- MD5 d598f2bc03f3f5109df8fd334297c696
- SHA1 a50a896fae041166ae51082e7d90c0c659c3d2b2
- SHA512 16c77f54d5ea2f2d7dd9d9ce9afdd66ff84d21eb6c16caeb837bbd2382fac66abd57752ed9cf09b40e811ca7a3f41f60cb075ddf560246662eef1f89d495344e
- SSDEEP 49152:OQu//hGMR1H4kgI5Uymd+YItx2TOMAKfW0rMZDSO3EzwAanU54BQcezIEBopjszZ:OxxRemUo0rFagxVmIwo2uaas5WtF6cg+
- TLSH T193868C24B3D40A15C73F827D8272A625E2FAF453139697CF0458EAD91F837C1A67A1B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Runtime.CompilerServices.VisualC.dll
- Size 29KB
- SHA256 1e0d66e081a78b06ef7a9597c8f6926181c417d006059b04a43b48352edd3f2b
- MD5 29a1a4c1a6f0088f144cff595413009d
- SHA1 0a9557131dfdf83132ad14efa1897909d96705cf
- SHA512 5b72e6595e181dcbd5f47db4864286e4528d08d5ee23c016fc3ac452d24a84c890180740916b21b47b7b889d9d167849243c72562736e5d378af54cbff201eda
- SSDEEP 192:XWswLWawXpjGa3HVilUFzExH1lzWViYa3WF+GBTBWsea8WM1UHWX01k9z3AyMTbN:XWswLW1pjxoeSVtulN61jR9zHU
- TLSH T106D27BB19B9CC222DEA70CB98AB5E7433D39F3855B529BDB009DE1065C627C48B31735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Runtime.Extensions.dll
- Size 17KB
- SHA256 57152f7af36bfa9ab33719b25d11940992cf4261edb6ba73fbd24c15e2f3e75b
- MD5 e47d9737f5a29f6fa7472e287f4a45fa
- SHA1 6a53223232158544c8d6651c8be75153407bec9e
- SHA512 c214006402e4ac9c6550af4c55233686f989b96255f32e008666b4a768bf4351795cf5793c17010048f513bd89ecba0051ab0b94a48ca86d4578142e70571ed8
- SSDEEP 192:GEG/Sj5r0SZ7r1x+4xAlW8SNWaWF+GBTBWseaAW7cpTsX01k9z3AZTCdWB:a/Sj5rt9x+WuW8SNWrlNkoR9z6GdQ
- TLSH T11C825B92DE9C8153DEAB5FB05AB6CA8339B873C25DB1957F40D6E0044853788E73272E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Runtime.InteropServices.dll
- Size 93KB
- SHA256 74a2dd12e1c0f3d9aca3f11e160a1de7a5bd4447ed8be3071377217a516f6874
- MD5 67e5ef7bb29712cd647c9117ae76e48e
- SHA1 0d590615d7d2216ff8a6c6b45f9e15586f4a141d
- SHA512 41541cd2bab6517e79e71480289ab85d8c401238d359326267fcbeb25aac928081bd7a9f3e807c8d256b6572ea0eea76647cf71dccd7445e4906d38163914940
- SSDEEP 1536:nDA6UupEelCtJfKS6+67NspnSPM+l5+ZkmVUKWH0ozkt:nU6p3lCto+dSPM+rCkm+N0o4t
- TLSH T154935A2437D84666CA2A473C8C375D50D9B2F6C613A2E6DF5781885E1D9B7C0C3B23EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Runtime.dll
- Size 42KB
- SHA256 1b56f3da3567ff55f013332ae17796ac6cd067018878d8f322f8425b04b70720
- MD5 987f0dd92a97fb1be99df665ec6dc7cf
- SHA1 1e74284c11aff202de0b52ff2cde89b12ac77db3
- SHA512 0e8142ba5274b9cd60fd2b956d2a392e47287c041d0831621674998ecb5642c7d62aed50299a726444245882ef36e8457f183e73f9346bef133a8e4cfa5941cc
- SSDEEP 768:99q+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoQ:99uB/LuYdy50b4b7RSH9Z+BzJ
- TLSH T1BA13C4A5AE485333CD8AAB719C73AC811DF233C4047A5D7ED88FE51913867A48236B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Threading.Thread.dll
- Size 15KB
- SHA256 565346c61faca21110027638e7af298e0162d587afc3f5bdcb993c80922a1cf0
- MD5 3c67056e3eea95b2f0c8312b012c23cf
- SHA1 09f80cc380cfd32aa7d6189d3a93e64dd0c2a94d
- SHA512 5476a4e3592dac5511c2c71e1a1f8b296c5f1516ad78a4f6b46b7b2e73f2eb5869f64d6dc82b922a58cc6c0f05ad7c98d10fe631d22c0c76ad4f67e0f3378e2b
- SSDEEP 384:uyQv4z2Ee0Z8zWcQ7WllNvGNXuifSR9ziiabS:uvvOGcDlfe9zqO
- TLSH T14C625CD28BAC8183ECA76E7095F8CA433C7977C68C65D61A05D6F05818273C8DF31A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Threading.dll
- Size 81KB
- SHA256 76900e5c96b72e6e74477a90897f86c9f8b78eb2169010298cd4aecec5466ae3
- MD5 a512c2446cdc301ba4598d5f5963bfaf
- SHA1 7b6a72484dad6c24cb4b3f157bffa4c9b0aa9ebd
- SHA512 19f4fe27372e1d4d9373b594013b6557c0fcb74641921c3e47e7ccf5d5a09bd3b5bc5fc0687fe658dbe1d382df5bdcbc458312f0a5ef6c5371c50d9b8bcc319b
- SSDEEP 1536:U+goICPLFImrmODZcUBeZ8j0GEH9wdN3SGRm3LGgCRzy:U+go9PLCFtZ8j0GEH9wdN7R4GgI+
- TLSH T1F0835A1A7BE80416FA7B47F9EA729946C472FCD20710C6DF9059900C2E67BC1DAB2277
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Xaml.dll
- Size 1.4MB
- SHA256 70892fb3431d9bbdca6efde6083e951d8a167c452a9d956ad8d0f83e3ee52713
- MD5 142cdfb67fc4a2d7496cec1bae7ca943
- SHA1 bf870e6e2ebf99344f8f83a37f920608c312d395
- SHA512 d1c164dad547d44be737264a582f3599b1138e301c837b9be333fafb909ade5ddd5957d048dca93664b5270d084183b5e5e5ddd78bfc2cfc35d24d8045c0c61c
- SSDEEP 24576:lUNeQWY7d3p2Zz+I6hMza1IOME36EPQs8dqE+d:lUNaY7d3p8a/FqGQ0
- TLSH T1A1655A2BABD88615CB7A83FD86A28521D5B1E1472321C1CF4411DEDD2F877C3AB7216B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\System.Xml.ReaderWriter.dll
- Size 21KB
- SHA256 32151d8d938eb388a6a0abc05ab955430f21aba92e960bdb6e5c6029a45d2f34
- MD5 f3858c240850eaa0a1ad5bcdb0e8ccd2
- SHA1 5e2d868ecee6f8fcd80dc30e28a4b8525f98650c
- SHA512 a68e07ee2a39d2c1bdbeecdf3863f49aeeb5b081186aee9b5a57b505d7a8f5133605e42ff7882adc60595600f465df4ee1f33ab13b93547768357baaaebb7606
- SSDEEP 384:t+1G5qkxK67ex4FCNtW1ZAWvZlNJ4rj/R9zuh:y6LeGmrjZ9z2
- TLSH T1ABA20891CE78DE13EDAABBB0C59BE4C33BF5629120718B35E585950B88637C0A737724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\Tables\is-7OHB8CRSXX.tmp
- Size 385KB
- SHA256 86a60750e5d56f7ac6a68a7695c30de354f93273b08bf9d6596dd8d26de236f9
- MD5 b6a8d72dcdef2170357604e3e315ce03
- SHA1 76020b827db1f5c00615c417242c36b05094bf73
- SHA512 b6e1ac5e419a149be2e5f5fc07cbc2a2d5f8289fd17ab17e6f95f07175c95123c79c1613d6ed504ac43d0c8ab20d44b9beb90b1f593df1dcfd05904d54f53ef5
- SSDEEP 12288:E5cjTD236GRm2BTJm//DWvvLEa1aQqv5Q7u32Ik7GEa7OqEaTeAEaOMEa8dEa4yl:ljT636GRm2BTJm//DWvvYgaQqv5Q7u3M
- TLSH T14884F6045CCB7224A9B7499F8DE90C4EEE21834360AA4454BCDDDA1B2F74AFD48B7F64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\Tables\is-YMKE0N4ZWL.tmp
- Size 364KB
- SHA256 073ad7181a0d68633b4d5887cd5ba75f6d6b1648e5db95be00e1bf9adeb32740
- MD5 11f094610532d349f4bd76f9dbcfeb22
- SHA1 abe7b72454532c3f37b3b78dce91eaedff58fe6f
- SHA512 5340cb377464515e83e12ab5727ededb65142edc4ae99089994ec9c0c503caa16882362e650c076ae26c64a721c097c08e85717e744c6e0dbefb1f6c25cb6ca8
- SSDEEP 6144:IXfh+PDWkN5VtnAfTsazh/5ByPgUd8T1yp6raVoJ5L7Z82GvaiEaK8EaQ1caM9HH:I5EWk5tnAfTsazh/5ByPgUd8TUp6raVt
- TLSH T1C48408041CC3B26496F346AB8DE59C09EE32934355EA44207CDED65B2F789ED48B7FA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\WindowsBase.dll
- Size 2.2MB
- SHA256 dbc4af0ac938eddc236ffeb5070370a0a723d537f0911da9fcea274f490a3ea3
- MD5 29f8b8b4bafbbfd400772f784b0036b2
- SHA1 2bbf27f4f86c105e416eac20a9a2ab5fc8db3854
- SHA512 573b365e2a17a1b1de666cab25974b2746e63d78f964879aee781fa3869576b495cc68715903dc5005e62d85b95a944c749cc76596c160de31cb8d34b18db6c5
- SSDEEP 49152:aSgZ/oZzKTYMebksxP6AjRIOuou82SxVGG2hFGYrB45gkQ+H:lgfW6A6ou82SxVGG2hFGY8H
- TLSH T1B9A58D1573C40B16CABA86BC91778101E1B1F8525312D6CFAC49EA3D6FD7FC18B7A262
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\clrjit.dll
- Size 1.7MB
- SHA256 93fb93cd74774247d6382d098b228f504373ef2710fe29a32fd9fb086a3182ff
- MD5 29d7843301ca74c6ca6322de811eadcb
- SHA1 6e02eccc0cb5f65fd71f492b1fcce3b247be015b
- SHA512 e2b63f9bf9e88178d039634e1256088e6b2923c66fec716371532ae1b5663239702a339e7e5c231132e641603d5c80ea04cc5e2624e8d775036d9bfffc79d604
- SSDEEP 49152:IQYb2p2Jg/i1yt39nNwE1Q+tLk5YGhJIQioX/8G0EOX4RA1xda:HU+vJ9nO+dMYobDX/8G0EOot
- TLSH T18185AE42A2F845FCD0AF9534C6174A1FEBB2B45913609FCF42F40A96AF237E2162E715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\coreclr.dll
- Size 4.8MB
- SHA256 817a9a5e0ea19ec205e3e0792320b8e03b77955a17953f3ab787db1426b0d930
- MD5 e88e0534557fa57664ff28e1fd41eff3
- SHA1 422e9b9c8d4434a3aed0b631d00f76ada4e62d19
- SHA512 4b0f460bf4f2e932785765fb4248f334bd1ba90a7f0e6db3382c1eccf6231bc3808e7e009772b3d31f528e770d0b78fc2f3828afb920234bc94a20f4fdfcc336
- SSDEEP 98304:LwVUSpxaoKPdZ4tJOkZuMHmXI7nrgAREx+8:3dZwJtuqmXI7nkAREx+8
- TLSH T1E3368D56F2AD00ACC4BAC0B9CAD31A27FBB178591738DBEF06644A651F237D16A3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\hostfxr.dll
- Size 357KB
- SHA256 99bdd77e4fe14ab284c4a335ac13affae11c840506b032462d26273143f0b767
- MD5 214f2e859995128c7ff52c2d3ee52aed
- SHA1 009d8a3a13d2a73d6db26b5b218545e786f3849b
- SHA512 859c39d176a4ac637f14a43b6fcbd20386cf496928048f37da783f0f97eb28871b2fd0371172b740ff4f07b8d012738a2b0bfff04843670343577464df23a7d0
- SSDEEP 6144:UE7Djww5R1Gv0crFfeUtJ9NZFSKJGDjq/2n1NonJLSHD6DPDh+vJpmE0SfxrTZ6g:fMjrFPJ+OyUriJ4ElntXZPt
- TLSH T1CA741816D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PotaTools Trainer\hostpolicy.dll
- Size 397KB
- SHA256 a2f6f864b9a41c56ad22490ea882ece574539eb7b23f8913c943613990818e89
- MD5 80bb6eda76ce06e8c4cc0fd0fc65b332
- SHA1 fdf25c9dc5507debd5018030a9dfcbce348d4b1b
- SHA512 824424e5756ed4a5b1ad8f6342b4baf138e30437803bc152dd444764cfb5174e82028374199e06b49b3d3652bef90a0ca62d764d2360411f9ed535a74605b2a1
- SSDEEP 6144:9/P1pnG2PGDYdnPkLoem0Z+1zlBVec2cKTjlMTd4PKkvCG78teytpQDZXadtYyKh:9G25cL0LfecMUZLK4bUyGbCTXoyFrg1
- TLSH T177842916D6AC007CF0B7E6798AB38941EB72784D47B196DF1390896A1F73BD09E39312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-4G5FYFZ9ZT.tmp\PotaToolsTrainer-Setup-0.1.0.tmp
- Size 4.2MB
- SHA256 61fea95941c755f2849a0cc0c8e0f138259aa71ef64c2ea4908faa9078361b1d
- MD5 da1c06d082cce782cbed221aefc0239e
- SHA1 db8d00b27ca753b8d2e2a46036b3a31416ccdabe
- SHA512 28f1372903d2606c970a585918152f0fb33ca8880d4445b0f7f19ca2ef896cfd45b1a15002cca23e53298635d56936e33dd4df79add9937e82865f1c072e1a67
- SSDEEP 98304:Q9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JX3333:nItJj90Z6RgKw8
- TLSH T153168F03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
- MD5 SHA1 SHA512 SSDEEP TLSH