Analysis

  • max time kernel
    149s
  • max time network
    114s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/04/2026, 10:36

General

  • Target
    malware.ps1
  • Size 788B
  • Sample260405-mnfensas3v
  • SHA256 53597a21f78b4a76f4d716802b8ab9b8d54939f59b27369ff61f61bfe7ebc765
  • MD5 SHA1 SHA512 TLSH
Score
8/10

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 13 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\malware.ps1
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\JeffreyEpstein.exe
      "C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\JeffreyEpstein.exe" C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\JeffreyEpstein.py
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3040

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _hashlib.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\DLLs\_hashlib.pyd
        • Size 67KB
        • SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JeffreyEpstein.exe

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\JeffreyEpstein.exe
        • Size 101KB
        • SHA256 d72294fb338bc2fc8896d25a7395a4db466425427e1559e77185d5135a830681
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JeffreyEpstein.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\JeffreyEpstein.py
        • Size 10KB
        • SHA256 b55ba2c6f0bab5a9ec1e293912f48fa14f7742557f9b4faec9bd263156198505
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _weakrefset.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\_weakrefset.cpython-312.pyc
        • Size 11KB
        • SHA256 90a923ba8eeb903d7dfd39a1e34ebfa0f186ab9da6b117b3230389225e07a34b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base64.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\base64.cpython-312.pyc
        • Size 23KB
        • SHA256 f372329f189db702c2385050e956a633423c174208da071ccbe7644bd41eeb79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bisect.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\bisect.cpython-312.pyc
        • Size 3KB
        • SHA256 79e67c1af691ab67a48cb03a5f32afc4ddd3d53d1150e584565f8419844c8165
        • MD5 SHA1 SHA512 TLSH

        copyreg.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\copyreg.cpython-312.pyc
        • Size 7KB
        • SHA256 7fd2dd44b7123dea24725546f9dab742ba66019fe2dc853d7f03357de077ced4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        enum.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\enum.cpython-312.pyc
        • Size 78KB
        • SHA256 ab676e83cb130df613b5d72ce015c2eb64b5f85131504d6024be4e7c58c404ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        functools.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\functools.cpython-312.pyc
        • Size 39KB
        • SHA256 02d3cb879dd751a4b0f73fda8c0865c5f62c221e54409b27ca7fcdce97555444
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hashlib.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\hashlib.cpython-312.pyc
        • Size 7KB
        • SHA256 3b2ea657d2802d47f427c2c912558e4cb4b08312c56769aa13a9eeabcb8a1edd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keyword.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\keyword.cpython-312.pyc
        • Size 1KB
        • SHA256 dad5967fd5cfac6b50ea1d913be3fdfe646a73796501b620d6ca3fad831a671f
        • MD5 SHA1 SHA512 TLSH

        operator.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\operator.cpython-312.pyc
        • Size 16KB
        • SHA256 61742e3c6dcdf971e90d2a77ab7dd0f72d1c7d2ad0e48eea1d1ee5995441f86f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        reprlib.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\reprlib.cpython-312.pyc
        • Size 10KB
        • SHA256 f9e3f78eefcc5cf2692a07d43f6eeca2d727e2e232eb91446789252d7d9186eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        struct.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\struct.cpython-312.pyc
        • Size 349B
        • SHA256 535ccfe89ea819079172a76277bbea88b892da164c166185476e52d6e145605c
        • MD5 SHA1 SHA512 TLSH

        threading.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\threading.cpython-312.pyc
        • Size 63KB
        • SHA256 9866bde78f1274d38532539262a67a934be2849a161b52ac77447e284d270304
        • MD5 SHA1 SHA512 SSDEEP TLSH

        types.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\__pycache__\types.cpython-312.pyc
        • Size 14KB
        • SHA256 3e77eb30eca8803090f636c65e1e6db5fd860c60b6939c292e888008eaa64161
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _weakrefset.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\_weakrefset.py
        • Size 5KB
        • SHA256 cf8031a6e21150438f3d2964c4152615b91a03894616d5b6930e0f14f44dabda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base64.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\base64.py
        • Size 20KB
        • SHA256 366e287224862a59d1416aa17b2259827d46a55c8406ae3f178f9ee7dc3c6f5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bisect.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\bisect.py
        • Size 3KB
        • SHA256 085dad54dd1a00d68aaa5361031c0c4bff5efbd281d1a02ddc8f317c519e540b
        • MD5 SHA1 SHA512 TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\collections\__init__.py
        • Size 52KB
        • SHA256 58d1f234b7845ff280f8a195a795f206bc62ce42732caecaf06e6a133ddd6f15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\collections\__pycache__\__init__.cpython-312.pyc
        • Size 71KB
        • SHA256 2d8499e8ec9c5c1c148902804c63a0922178e1d6d90daf75a44a7544bbac9924
        • MD5 SHA1 SHA512 SSDEEP TLSH

        copyreg.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\copyreg.py
        • Size 7KB
        • SHA256 ea2363638fe83e8e5b007013a821841371a615d99414b3c2f8f19152ca109a07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\email\__init__.py
        • Size 1KB
        • SHA256 f4b71b7b51a7eebc46bbb6470cf6da746cbb5e9548a6bc2a57b84f451efd9769
        • MD5 SHA1 SHA512 TLSH

        __init__.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\email\__pycache__\__init__.cpython-312.pyc
        • Size 1KB
        • SHA256 f3fdd06e39267e103c063167a2be7b519c524184cad32de39f2b71b0f853679f
        • MD5 SHA1 SHA512 TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\__init__.py
        • Size 5KB
        • SHA256 8b997e9f7beef09de01c34ac34191866d3ab25e17164e08f411940b070bc3e74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\__pycache__\__init__.cpython-312.pyc
        • Size 5KB
        • SHA256 9b1fe86cb935e4b056e78a7815e4c53a9780084507582a7cfc840a699e3039cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aliases.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\__pycache__\aliases.cpython-312.pyc
        • Size 12KB
        • SHA256 acfdfd341003d7c4ec0822115fbd032c6091b155e76ef50fa59ab6cb6ebbc741
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cp1252.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\__pycache__\cp1252.cpython-312.pyc
        • Size 3KB
        • SHA256 c3f8dc018982b5aff7d06c83b7d48365e7b75f961e633f8a2699b9cdd28e5b1b
        • MD5 SHA1 SHA512 TLSH

        utf_8.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\__pycache__\utf_8.cpython-312.pyc
        • Size 2KB
        • SHA256 3d6d643408086c74c14dfd301d6459c8ae8f5222b4caf6339ba354e4b737d1d7
        • MD5 SHA1 SHA512 TLSH

        utf_8_sig.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\__pycache__\utf_8_sig.cpython-312.pyc
        • Size 6KB
        • SHA256 daf748f0f75b3e5b52142d174510d83e3f89a9e3de6efe356d3a57ab7872f6f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aliases.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\aliases.py
        • Size 15KB
        • SHA256 1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cp1252.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\cp1252.py
        • Size 13KB
        • SHA256 7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519
        • MD5 SHA1 SHA512 SSDEEP TLSH

        utf_8.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\utf_8.py
        • Size 1KB
        • SHA256 9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e
        • MD5 SHA1 SHA512 TLSH

        utf_8_sig.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\encodings\utf_8_sig.py
        • Size 4KB
        • SHA256 21a95bb95448f2f064f08aa2c89e843b87a20a5a13c45c6c47c288f2be5219a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        enum.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\enum.py
        • Size 81KB
        • SHA256 5f6126ee55609a8fc27be206803703597e2efdcaad1fb80ab975ecd0e63cd6aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        functools.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\functools.py
        • Size 38KB
        • SHA256 f0ca5dd563498f8971e410fe9f37083cfcff2052a0f48efcfbe07d6975754864
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hashlib.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\hashlib.py
        • Size 9KB
        • SHA256 f0c8900585062c567a283cb782c3c867f86c38516e30f1f98a04ffa775b9a013
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keyword.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\keyword.py
        • Size 1KB
        • SHA256 1f28f509383273238ad86eda04a96343fa0dc10eeaf3189439959d75cdac0a0b
        • MD5 SHA1 SHA512 TLSH

        operator.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\operator.py
        • Size 11KB
        • SHA256 c57b6816cfddfa6e4a126583fca0a2563234018daec2cfb9b5142d855546955c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\__init__.py
        • Size 16KB
        • SHA256 778cdca1fe51cddb7671d7a158c6bdecee1b7967e9f4a0ddf41cfb5320568c42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\__pycache__\__init__.cpython-312.pyc
        • Size 17KB
        • SHA256 dff03cda455b04dc36b8847fdfd72fe1a232763945579a2e01c3507cc6e96371
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _casefix.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\__pycache__\_casefix.cpython-312.pyc
        • Size 1KB
        • SHA256 90ad927047c5bbd40cb7db09afcdefcaba6be6f90935a10b8133a9670f8e3e13
        • MD5 SHA1 SHA512 TLSH

        _compiler.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\__pycache__\_compiler.cpython-312.pyc
        • Size 25KB
        • SHA256 f0e9ba34fd973fc6d8560b3d94d37f270e3d020ed2754a70d8d389d79c6062f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _constants.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\__pycache__\_constants.cpython-312.pyc
        • Size 5KB
        • SHA256 58c091de940d89d2e921ab97a35e7c5f34fda3ebc26bc7947e48702359f82154
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _parser.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\__pycache__\_parser.cpython-312.pyc
        • Size 40KB
        • SHA256 2f9e70a8c0d2de8dbb56dbae2cdc019d69803d74de6af377b8b4561b59fc9f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _casefix.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\_casefix.py
        • Size 5KB
        • SHA256 b0dee234e5f8096fc9c1b035ec52d0b1b50cc1f3aea20b360b8be902e53ac752
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _compiler.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\_compiler.py
        • Size 26KB
        • SHA256 618f17add086b1dc5314a4e68e9b02a7072cbfb0a401791fd5963dabcd03098c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _constants.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\_constants.py
        • Size 6KB
        • SHA256 8df304954ca75dcd98b9f1f5e3cb5347adc6eaccfc461a94ab914e1b0085e9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _parser.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\re\_parser.py
        • Size 41KB
        • SHA256 bcc84f06d54e2d28506350a60bc1aaaa0efda4221f4ceeb05b2d0f48c712c479
        • MD5 SHA1 SHA512 SSDEEP TLSH

        reprlib.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\reprlib.py
        • Size 7KB
        • SHA256 53c0c775acd2c7ea3405271e2b8619a5fdc0567a63f263199d594626616184cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\_distutils_hack\__init__.py
        • Size 6KB
        • SHA256 df81e6bcba34ee3e3952f776551fb669143b9490fdd6c4caeb32609f97e985b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-312.pyc
        • Size 10KB
        • SHA256 c71528938e0ac336ea3e47c119c201521e7eb3de480fbec5830074ef24589c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        distutils-precedence.pth

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\distutils-precedence.pth
        • Size 151B
        • SHA256 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224
        • MD5 SHA1 SHA512 TLSH

        _manylinux.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\packaging\_manylinux.py
        • Size 9KB
        • SHA256 b78cbff9d4ce71faf7ea02d8fb3b623a9c7124518eda2902d751e07f2b06c623
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _musllinux.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\packaging\_musllinux.py
        • Size 2KB
        • SHA256 a7d66a35888e22d19e7bc29c64578717f61c76157018774aeabfbc9608b1bc64
        • MD5 SHA1 SHA512 TLSH

        _parser.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\packaging\_parser.py
        • Size 9KB
        • SHA256 8187e78f4a511df955738447662b75dca353c8df62895714d915021a2db60703
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _spdx.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\packaging\licenses\_spdx.py
        • Size 47KB
        • SHA256 a009b5ced3c5c25b2608a7bb94002cbff38839f4b57160eef5b34191ebbeda7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metadata.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\packaging\metadata.py
        • Size 33KB
        • SHA256 f08644aea4109cd9b9ddd659b98ab8146538fdda728a731e1f540504858891f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        requirements.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\packaging\requirements.py
        • Size 2KB
        • SHA256 818c9148075bac8c8a0d8ebaba02035108d132fc641f600b8a84e65f7b672faa
        • MD5 SHA1 SHA512 TLSH

        tags.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\packaging\tags.py
        • Size 22KB
        • SHA256 e35b3ded6f596adaead8477b45cdea7810da1def2928abd8ab69868f06a17d79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        utils.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\packaging\utils.py
        • Size 4KB
        • SHA256 d05dc787d385b9182b8538066549792b6d85bf560fdad665d73ff680eea42620
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dependency_links.txt

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\pkg_resources\tests\data\my-test-package_unpacked-egg\my_test_package-1.0-py3.7.egg\EGG-INFO\dependency_links.txt
        • Size 1B
        • SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
        • MD5 SHA1 SHA512

        top_level.txt

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\setuptools\_vendor\jaraco.collections-5.1.0.dist-info\top_level.txt
        • Size 7B
        • SHA256 d099cddcb7d71f82c845f5cbf9014e18227341664edc42f1e11d5dfe5a2ea103
        • MD5 SHA1 SHA512

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\setuptools\_vendor\packaging-24.2.dist-info\LICENSE
        • Size 197B
        • SHA256 cad1ef5bd340d73e074ba614d26f7deaca5c7940c3d8c34852e65c4909686c48
        • MD5 SHA1 SHA512 TLSH

        LICENSE.APACHE

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\setuptools\_vendor\packaging-24.2.dist-info\LICENSE.APACHE
        • Size 9KB
        • SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE.BSD

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\setuptools\_vendor\packaging-24.2.dist-info\LICENSE.BSD
        • Size 1KB
        • SHA256 b70e7e9b742f1cc6f948b34c16aa39ffece94196364bc88ff0d2180f0028fac5
        • MD5 SHA1 SHA512 TLSH

        py.typed

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\setuptools\_vendor\tomli\py.typed
        • Size 26B
        • SHA256 f0f8f2675695a10a5156fb7bd66bafbaae6a13e8d315990af862c792175e6e67
        • MD5 SHA1 SHA512

        WHEEL

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\setuptools\_vendor\typing_extensions-4.12.2.dist-info\WHEEL
        • Size 81B
        • SHA256 1196c6921ec87b83e865f450f08d19b8ff5592537f4ef719e83484e546abe33e
        • MD5 SHA1 SHA512 TLSH

        _structures.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\setuptools\_vendor\wheel\vendored\packaging\_structures.py
        • Size 1KB
        • SHA256 ab77953666d62461bf4b40e2b7f4b7028f2a42acffe4f6135c500a0597b9cabe
        • MD5 SHA1 SHA512 TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\setuptools\_vendor\zipp-3.19.2.dist-info\LICENSE
        • Size 1023B
        • SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
        • MD5 SHA1 SHA512 TLSH

        WHEEL

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\setuptools\_vendor\zipp-3.19.2.dist-info\WHEEL
        • Size 92B
        • SHA256 189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
        • MD5 SHA1 SHA512 TLSH

        INSTALLER

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\sqlite_bro-0.13.1.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512

        WHEEL

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\site-packages\wheel-0.45.1.dist-info\WHEEL
        • Size 82B
        • SHA256 0a950253178741b44de54191407611268acee407fe432fdf1cc72d710f034862
        • MD5 SHA1 SHA512 TLSH

        struct.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\struct.py
        • Size 272B
        • SHA256 eadbcc540c3b6496e52449e712eca3694e31e1d935af0f1e26cff0e3cc370945
        • MD5 SHA1 SHA512 TLSH

        threading.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\threading.py
        • Size 60KB
        • SHA256 feb12e11fd550b71869a8960d6e8c0151e3b1fdc7a2df08a4bf5900affc11c8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        types.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\types.py
        • Size 11KB
        • SHA256 d7ce485ecd8d4d1531d8f710e538b4d1a49378afacb6ff9231e48c645a9fa95e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __init__.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\urllib\__pycache__\__init__.cpython-312.pyc
        • Size 159B
        • SHA256 2239389d6b983e99c9d0805f58491a4f8051ecc10d9503f0026ee072c8af91b4
        • MD5 SHA1 SHA512 TLSH

        request.cpython-312.pyc

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\urllib\__pycache__\request.cpython-312.pyc
        • Size 112KB
        • SHA256 c5fbde81da2a7a2248f88c2298c961c2b07521c470cbf24d6f6cf7757fa99d63
        • MD5 SHA1 SHA512 SSDEEP TLSH

        request.py

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Lib\urllib\request.py
        • Size 103KB
        • SHA256 b732a8436aa661928334f032fb27f557167c9d1dc17e0f42df101b10ac6d5b2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wheel.exe

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\Scripts\wheel.exe
        • Size 105KB
        • SHA256 bbba8990f333551aa45442b6a9231d29243e83315ecfb7862ad6de615c36d3da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python3.DLL

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\python3.DLL
        • Size 68KB
        • SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python312.dll

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\python312.dll
        • Size 6.6MB
        • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
        • MD5 SHA1 SHA512 SSDEEP TLSH

        script_output_1.log

        • Path C:\Users\Admin\AppData\Local\Temp\JeffreyEpstein\script_output_1.log
        • Size 56B
        • SHA256 51f8801cab1af5bf46e29fccbba9adbf09d15d8cd94758fa87301b7803bb8ceb
        • MD5 SHA1 SHA512 TLSH

        __PSScriptPolicyTest_3wonxom4.5wq.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3wonxom4.5wq.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH

        memory/4940-9997-0x0000013D1EE40000-0x0000013D1EE4C000-memory.dmp

        memory/4940-11-0x0000013D374D0000-0x0000013D374DA000-memory.dmp

        memory/4940-12-0x0000013D37510000-0x0000013D37522000-memory.dmp

        memory/4940-9-0x0000013D37530000-0x0000013D37540000-memory.dmp

        memory/4940-9205-0x0000013D37530000-0x0000013D37540000-memory.dmp

        memory/4940-8-0x0000013D37450000-0x0000013D37472000-memory.dmp

        memory/4940-0-0x0000013D37530000-0x0000013D37540000-memory.dmp

        memory/4940-1-0x0000013D37530000-0x0000013D37540000-memory.dmp

        memory/4940-9998-0x0000013D1F090000-0x0000013D1F0A2000-memory.dmp