# E12. Attribution and build-artifact assessment

## Evidence classes

The case records account and repository relationships, repeated public identifiers, registration data, a path embedded in a decrypted Python docstring, and build/archive metadata. These are attribution leads with different strengths. This report evaluates their evidentiary role without reproducing personal contact values, the workstation path or provider-account identifiers. [S1–S3]

## Embedded development path

Usage examples in the Python payload retain a development-directory path and references to supporting scripts. Its presence in decrypted source can connect artifacts through shared text. It does not prove that the path came from the machine that compiled or deployed the malware: examples can be copied, templated or deliberately fabricated. The master report's description of the path as unforgeable is not sustained. [S1, S3]

## Archive clock settings

The timezone analysis compares local DOS timestamps with UTC extended-timestamp fields where both are present. It reports approximately UTC−4 for one Windows-agent archive and UTC−7 for the VSIX and nested native-agent archive. DOS timestamps have two-second precision, which can account for small apparent differences. These comparisons describe stored time fields and possible packaging offsets; they do not uniquely identify two physical hosts or geographic locations. [S2]

A concentration of activity during business hours in a selected timezone is weak national-attribution evidence. Automated builds, repackaging, remote machines, chosen clock settings and the small selected sample all complicate interpretation. A cgo-enabled macOS arm64 build constrains the build environment but does not identify an individual workstation.

## Identity and financial boundaries

Names, mailbox suffixes and persona reuse can guide further comparison but are not proof of civil identity. Registration records may provide provider-side leads; they do not establish who supplied payment or controlled an account at a relevant time. Likewise, a funding relationship or exchange association is not evidence of victim cash-out. The separate development application in E13 cannot fill that gap. [S1]

## Assessment

Artifact reuse and corroborated account relationships warrant investigation. Real-world operator identity, nationality, physical location and quantified victim loss remain unestablished. No new provider inquiry, identity search or financial transaction analysis was performed for this report.