976ab0de3eb1754230e6cb1fe49bddc55cdd48da0553745a1bc9ca2e959e32af

Analysis

max time kernel
149s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Epsilon.Updater.Install.exe
Size 27KB
Sample260805-w11e2stcnd
SHA256 976ab0de3eb1754230e6cb1fe49bddc55cdd48da0553745a1bc9ca2e959e32af
MD5 185924800e6d6c7e804562f19a4cea83
SHA1 efb53cb8366c2068d844c477433478584e823da2
SHA512 a60121ef1dfb4e480909ee4387d2b87daa367ed738bc3c2123e42aaff8949eb5f4ccacbf1f55cfd99cc0ed6399b95860126546df1ce684836a6c9c7e3071d2a4
SSDEEP 768:oeil5hX9Eh3SEBtYcFSVc6Kaw/Hz3iPmbL0o:oeilDahCExSVclaw/Hb7so
TLSH
T186D27C423AD01271D9EE4A747CA74722CE31B7A37925864B34EC454A5FB27C493236AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	5316	Epsilon.Updater.Service.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	Epsilon.Updater.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB	Epsilon.Updater.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB	Epsilon.Updater.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_200E34A691ABFCDB8F8FB0E4F494DDCC	Epsilon.Updater.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_200E34A691ABFCDB8F8FB0E4F494DDCC	Epsilon.Updater.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	Epsilon.Updater.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	Epsilon.Updater.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	Epsilon.Updater.Service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 8 IoCs

pid	Process
780	Setup.24.3.7.0.exe
5184	Epsilon.Updater.Service.exe
4876	Epsilon.Updater.Install.exe
5736	Epsilon.Updater.Service.exe
3668	vc_redist.x86.exe
5100	vc_redist.x86.exe
2528	vc_redist.x64.exe
5220	vc_redist.x64.exe

Loads dropped DLL 4 IoCs

pid	Process
780	Setup.24.3.7.0.exe
780	Setup.24.3.7.0.exe
5100	vc_redist.x86.exe
5220	vc_redist.x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.24.3.7.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Epsilon.Updater.Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	Epsilon.Updater.Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Epsilon.Updater.Install.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Epsilon.Updater.Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Epsilon.Updater.Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Epsilon.Updater.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	Epsilon.Updater.Install.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	Epsilon.Updater.Uninstall.exe
4560	Epsilon.Updater.Uninstall.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5316	Epsilon.Updater.Service.exe
Token: SeDebugPrivilege	4560	Epsilon.Updater.Uninstall.exe
Token: SeDebugPrivilege	5736	Epsilon.Updater.Service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 780	5316	Epsilon.Updater.Service.exe	91
PID 780 wrote to memory of 4560	780	Setup.24.3.7.0.exe	92
PID 780 wrote to memory of 5184	780	Setup.24.3.7.0.exe	96
PID 780 wrote to memory of 4876	780	Setup.24.3.7.0.exe	97
PID 780 wrote to memory of 3668	780	Setup.24.3.7.0.exe	101
PID 3668 wrote to memory of 5100	3668	vc_redist.x86.exe	102
PID 780 wrote to memory of 2528	780	Setup.24.3.7.0.exe	103
PID 2528 wrote to memory of 5220	2528	vc_redist.x64.exe	104

C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Install.exe
"C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Install.exe"
1⤵
PID:2420

C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Service.exe
C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Service.exe
1⤵
- Downloads MZ/PE file
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Users\Admin\AppData\Local\Temp\Repositories\$eUpdater\Setup.24.3.7.0.exe
  "C:\Users\Admin\AppData\Local\Temp\Repositories\$eUpdater\Setup.24.3.7.0.exe" /S /D=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Uninstall.exe" /ProductName="Epsilon Updater" /ProductVersion=${VERSION_SHORT}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Service.exe
    "C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Service.exe" /INSTALL
    3⤵
    - Executes dropped EXE
    PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Install.exe" /ProductName="Epsilon Updater" /ProductVersion=${VERSION_SHORT}
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:4876
- - C:\Windows\TEMP\vc_redist.x86.exe
    "C:\Windows\TEMP\vc_redist.x86.exe" /passive /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\TEMP\vc_redist.x86.exe
      "C:\Windows\TEMP\vc_redist.x86.exe" /passive /norestart -burn.unelevated BurnPipe.{62643FFC-E502-4847-BF20-72DF8E800F5A} {9FF2FC78-F089-4828-ABB6-5FB5D9DB4B8D} 3668
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5100
- - C:\Windows\TEMP\vc_redist.x64.exe
    "C:\Windows\TEMP\vc_redist.x64.exe" /passive /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\TEMP\vc_redist.x64.exe
      "C:\Windows\TEMP\vc_redist.x64.exe" /passive /norestart -burn.unelevated BurnPipe.{7BC1996C-CA0E-448E-8746-9B0C8A4DDB27} {81B2DFC6-020F-4701-81E7-B56F5E0E4DC7} 2528
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5220

C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Service.exe
C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Service.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

749b2fc3-1dd3-4f37-b14c-e6aa41852733.xml

Path C:\Users\Admin\AppData\Local\Temp\749b2fc3-1dd3-4f37-b14c-e6aa41852733.xml
Size 248B
SHA256 8ef3aa45492fbf80c6f370ac4ab8fd7a68a0d3b871117bfc2207f6d66e1af29e
MD5 0b05ef479df190e8bb6f265778fe003f
SHA1 0082a76033c5a19739a43edc50ca6766df008c09
SHA512 a1a6b2ac7d786cc843e6be45d40f6a9bfbbb9814d48c6f90a8404f7e132824aa70b731c39f709591068e90698a54a105c042c78259a310cb9620987ef6097b47
TLSH
T174D0A7CD916895214BAA8B26F2F8CA093531F39192D54CE8F0FE985A52150C1228354B
MD5 SHA1 SHA512 TLSH

Submit Download

Epsilon.Updater.Install.exe

Path C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Install.exe
Size 27KB
SHA256 976ab0de3eb1754230e6cb1fe49bddc55cdd48da0553745a1bc9ca2e959e32af
MD5 185924800e6d6c7e804562f19a4cea83
SHA1 efb53cb8366c2068d844c477433478584e823da2
SHA512 a60121ef1dfb4e480909ee4387d2b87daa367ed738bc3c2123e42aaff8949eb5f4ccacbf1f55cfd99cc0ed6399b95860126546df1ce684836a6c9c7e3071d2a4
SSDEEP 768:oeil5hX9Eh3SEBtYcFSVc6Kaw/Hz3iPmbL0o:oeilDahCExSVclaw/Hb7so
TLSH
T186D27C423AD01271D9EE4A747CA74722CE31B7A37925864B34EC454A5FB27C493236AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Epsilon.Updater.Libs.dll

Path C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Libs.dll
Size 273KB
SHA256 fd0198644db645a44f4118d63edbdc4c2b60b2d2d9ad38c2a0a1bb2bc697e5a6
MD5 6945f66f7dc9ba8c2c7a12482e2af386
SHA1 f15d0fd0b517daf1d466794c2a29dfd433ed3f29
SHA512 f9497c8e9233dbad12b32513e331ff290d2424b1e0dfb3cfb9d5e2225c90feb8ec1e260e65aac28a532edef45ca6b4e5b332cf0d1a5115b4faf06c453efb81fc
SSDEEP 3072:mIYauGGiNiSPnMYEGV3Hz+rcOKnkHecsbMDfgtpKNK3zxr+K8rHh+Hqel9/2Rodg:mPBiNiRYvHSn47J6KjxrO4Ke4CLk/mK
TLSH
T19A548F3C63FC8B71C6AF1FB8D111901443F4D25BB152E35D8E8475DC19637A2EA22AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Epsilon.Updater.Service.exe

Path C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Service.exe
Size 30KB
SHA256 1692fbf9e26db5449ed4245e3d082c3a5511f5640b66335001eb350823b3743c
MD5 5f9795a3fbda5fff4eaa32df1c7c12b2
SHA1 bddd592199da83a488942de9e228ce03d6cec3c5
SHA512 75a2f77209f12be02c6a4fed07c481cef13a14dc2ba2107c82f8267ef4961fa5cea524eeb9b40c9a9042a2ff78da0b864e78419fb0248d6c79b701e471f1f335
SSDEEP 768:0R33oOuSgj6EtYcFSVc6KRw/H3G3iPmbL3M:0R3Jz+64SVclRw/H347vM
TLSH
T1CFD28D4337E052B1DEAA0AB8B4B507124B31F7A33C268A5A75DC015D1FDB789931366F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Epsilon.Updater.Service.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.Service.exe.config
Size 970B
SHA256 70d09b63a1585387a68b93d8bd378d6fd7dea2028c3de1b36a3b1464c8375433
MD5 194a34e80de061af435e2d4fe6101101
SHA1 63217384c7e5eac1f2da803f9b643c34db3d2e86
SHA512 f3260443777c3955f07bb067c659d5fdac2d4ca9103fbd6df37cd391dc97ea7541b1103a8849dfd6a241dcec80d314069cba20d4451a2ef1d73a915ade5ca1d6
TLSH
T1E5112B11B19C7FF58F424DE33A7B9078837F47722A5C064ED0B6A97B930635A2200276
MD5 SHA1 SHA512 TLSH

Submit Download

Epsilon.Updater.UI.exe

Path C:\Users\Admin\AppData\Local\Temp\Epsilon.Updater.UI.exe
Size 1.0MB
SHA256 12614e10ce4f2e366d78e84792132aa42aae3e820985ef8bc5128d0f409d3839
MD5 e869c77cb71f72fdd6273860f0112cc3
SHA1 15471fbb2595e0e0512d1ce868e93006b557bf47
SHA512 2f776f451c53b099f3a33bd834b236ef70a8abb3583997eb4947e4f1b5a60a85ca347fb6bb94b62dbc106b6e729f059dbd81fb03841f97e1450c5f0745712a67
SSDEEP 6144:BqaoojQqcC/hY/HFQ1FxwFvhXxukt+Mq9F0I6FQHq9F0I6FQoq9F0IkHXtqqKi7P:wiQV9QhwFaf30IU30Il30IvDi7P
TLSH
T1FB35A7213AAB414FD86A0770A835C1F443763E697A48DE4E94D43D4EFD722638B31AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\Users\Admin\AppData\Local\Temp\Logs\log.txt
Size 3KB
SHA256 efbf0c389d7b079f33255cd52cf67796b3478b37b641fb4b8567cf67585da714
MD5 25e20a1b9656960d4aa784194bbf649e
SHA1 0a307e02793a1a897a4f9215a14fb99258dacf76
SHA512 6f10fd44f5d18f7ac3f573a3c431cb6366f2abf0f096c9ea2cec987db100e66552be9bdfbecf35c569eefaf328c0668881d7c65e2d4551c295c315658d2b2fbc
TLSH
T1ED715055A12EC1F2AA53062CCE01095956B21614A20EE041F6FA520E6BFB639C37F7EF
MD5 SHA1 SHA512 TLSH

Submit Download

NLog.config

Path C:\Users\Admin\AppData\Local\Temp\NLog.config
Size 670B
SHA256 168bac05fc94f3c4ce3f2998b1013a7b1719679325e4c668d4024c9f549fdb38
MD5 51bdf20a85c7c3c21cac42d9e9f26333
SHA1 8a1c8c8058072bde490c8f5ae360d447369a2ba3
SHA512 8984de37a0429b8cf63bb126787a6261c767a8f83e1bb7dc8369070a3a132b17a7a41674be0b418b469de13a2867e23be937fa7fadf0a6ad5381e41b56d917f9
TLSH
T11701D3C5B30E5E7189116163D97595F3520FE3B399FC18C3F1F4E277665241229D0305
MD5 SHA1 SHA512 TLSH

Submit Download

NLog.dll

Path C:\Users\Admin\AppData\Local\Temp\NLog.dll
Size 853KB
SHA256 151de9860bfc5c0f6ff3263a308abf44200ca9d5d5876ec08e9f4c6a8afa8e83
MD5 5ab6a621a1b53f0e607979f36dcdaf10
SHA1 6372da96386bddfa9d6a6d28c00c07975dba0f42
SHA512 8970e19c78cf1fd637271236bd155aee4e683462505753460d620845c6d1ff86ef26d4bbec76bb7f16ff1499a9608b72821c28885d080b9bead553ee30c20516
SSDEEP 24576:b1m1A9mdkN+9aQbCG99/J/gnjQ1boUo/yOvz6loEbcXEdJErKUTqnBrAscCwDvUR:b1m1A9mdkN+9aQ3dyWLnbc
TLSH
T185054A5233E8C62AD19F67B1E470152553F4FC1A3A62D78F5A01F59E3CB2B265C00BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll
Size 683KB
SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
MD5 6815034209687816d8cf401877ec8133
SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
TLSH
T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.24.3.7.0.exe

Path C:\Users\Admin\AppData\Local\Temp\Repositories\$eUpdater\Setup.24.3.7.0.exe
Size 29.2MB
SHA256 d2cb2b1b89dfeb565e0ae3ed1cba7d00186eadf3820f330cf03d0bb4231ac61a
MD5 6f095eab04a3f52fd97161ea4b8c4db7
SHA1 de9cbf1006e690b4eb2987d0a45a84b6bf3c700b
SHA512 7fec84c6358492beb809b9e907625157fe33d8758c348baa90f637c0251bd9934973b5a12ddf4cda73757ffeed0d596fc427e6a7571ac7a05712168049b30910
SSDEEP 786432:U0ay2tMT8mWDACjI421oykeL0Z40kB0kPel8Z6yiMtx:U0ctYHXCE4qLuZxkiK
TLSH
T10E673326F318C716C84354328F9BB65947947E3AED5588B5EB443B1EEE7A083823C64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.xml

Path C:\Users\Admin\AppData\Local\Temp\UninstallInstall\data.xml
Size 2KB
SHA256 6daa63e1eaddf5544f294e4f7890c5f8d73bf9cf177dade2983b5181bdae1db1
MD5 c12554efaa15b12e52beb79216b3bbcc
SHA1 4b7cb89768b328d2d1d5cdb5e3fa0ab4f486c584
SHA512 fa2fab0c624c9efa49ced29caa590b964bddbcd78062bed5ec9a1a513bdaf8cedc9c98adf33c71e366ba1ae0f7a8c42231e9490f33658d0dd97730582565d0f1
TLSH
T1164107CA71C1ED0209360D397A623B4DEE44527302A83D50FAEC6637EF36AC129677B1
MD5 SHA1 SHA512 TLSH

Submit Download

eb9eb5a1-33a8-4cc3-bd71-da4de845510e.xml

Path C:\Users\Admin\AppData\Local\Temp\eb9eb5a1-33a8-4cc3-bd71-da4de845510e.xml
Size 2KB
SHA256 6d4bfcb450627baecf55676ccf5489545d9e14b82bc32dd23f2775e51ebe95f4
MD5 06754b8426dcb30c4456eb36a21afef2
SHA1 d47ef2a362c8da9577e0c5a9ae47971879d39ec2
SHA512 d980dbe228012efe566bb6ce50e04d66a3f589696b7b17ebe7beac7e42305b43b3d70fc91ce8480cc55f197d5bd1025d33986a46919b5abafc19e896925589fa
TLSH
T12C41DF6496C2F97528350623F102CE85DD15C2DF888F0865B9DE421F2FFA45E478FA67
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetChecker.dll

Path C:\Windows\Temp\nsm5403.tmp\DotNetChecker.dll
Size 84KB
SHA256 39c43d67f546fc898f7406d213b73dcb1bc30fc811ddfa3a02b6b50c29d11f91
MD5 f18364fa5084add86c6e73e457404f18
SHA1 6d87c4b9dbf78af88fddf0d4d5febe845c8e4e6a
SHA512 716892492390fe4314f3289286f733d07b8b84de1f5af0676b26e68c0be01808682d35ad2bb9e9491247b7bb5a0ea297a6850e26de9baf88621c789206107db3
SSDEEP 1536:AZBjgSXlkq8su+OudgGpGlmQSMqJS4HGsorJKQUDs0OsWPIcdGbk2HeJ:AYvo7PMqEuiKQGbk2HeJ
TLSH
T14D835B1076D0C1B5E57F1D3948A6D661076EB810EFE4CDEB279A03690E702C1BE3AE23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Windows\Temp\nsm5403.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\vc_redist.x64.exe
Size 13.9MB
SHA256 5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3
MD5 27b141aacc2777a82bb3fa9f6e5e5c1c
SHA1 3155cb0f146b927fcc30647c1a904cd162548c8c
SHA512 7789eabb6dd4a159bb899d2e6d6df70addb3df239bda6f9ead8c1d2a2ac2062fce3a495814b48a3c2bec12f13800ad0703e2c61c35158b0912011b914f098011
SSDEEP 393216:xTPq5dCsKSR65cX7Eyd/qnejOX3L8T8KYfU3j:VP5iw56oyleejcL8T8fc3
TLSH
T131E63332E6644227C6D30973ED65E2246EBCA22D7F108476C784AE1DBDAC4D393B7217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x86.exe

Path C:\Windows\Temp\vc_redist.x86.exe
Size 13.1MB
SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
MD5 1a15e6606bac9647e7ad3caa543377cf
SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
TLSH
T189D63336A3648126C5E30573EE15E1206F687329BB1488FBD3447E1D3E69587A3BB34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll
Size 118KB
SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
MD5 4d20a950a3571d11236482754b4a8e76
SHA1 e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c
SHA512 8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2
SSDEEP 1536:nw7WzpopAuJhsVuThs5cXyeM6JUOfPGSpeBxm946ITADDwYkH/1d9chyP7iN6p:pmAuJhAyZFpem90iw//1d9chwG6
TLSH
T17AC35C113BF08072E2E6163D5925A3215A7FBA3199B0D9CF6B484E6E2E711C1DF76323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 765B
SHA256 ff16419fed5b468514c9fa548fb1a017f2244f560292aea965c8a1d3f7fa45b9
MD5 676fc7699206d2f8233fbcf598dfd6b1
SHA1 44f00f7f12037b56e0f1137a13ffa588756dab85
SHA512 a5515dfe10004266a373087c28279386eb9fae8fb8b2eb261196f311ed54aa508ff09cc31dbe9841d01bcb6e03db2347a5a4511abbe485919100772a3291c00f
TLSH
T16401201B0E566B6ABF5448F586E0F965E5083B2774F8066B7CBE9241080AE23C67606C
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_200E34A691ABFCDB8F8FB0E4F494DDCC

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_200E34A691ABFCDB8F8FB0E4F494DDCC
Size 638B
SHA256 cb71a3fc37bbdee9b90a3810bf528b76c8bf8e89626cd3c4140c870cb5fb3faa
MD5 7e8ff4c7637c91e2679cad4d5a04d6f5
SHA1 ed2ec7f8108432226d4467eff57176532a620ad1
SHA512 70a453742bb5cdc3ceea9114b7a9a956229b39ac3c9cf6ad223e4b02801d4c5e204ca877f383a669a7ce5b1e16e238aa02b1111fc9661f3175882625fbe8b911
TLSH
T172F023819EACDAAEF1E3C54385B9D0B128C1A21979C0D34BAA79219350A6399655230D
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 a0d6ce27684a757d37eab3719f249b191a0479b5e63a1ec2be4bd6779ff85ad4
MD5 c0b4f7a55f44500152fdf5d834e9b66e
SHA1 1d8608e3403296cc60a7685e22ad243d004a0138
SHA512 6e040d6531cf12ec13f9f902c161e3807b781ae8ae96e193e5391c22a7c4c597bc7303548ba8b2465f559829dcc3add5869347466926401a6f23a1196096d289
TLSH
T19C31C6D36EA87831ED088DC4585DCFF27CB025AAF45808743498C56AA9A3FE46C4A81D
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 484B
SHA256 e23ca59796ed098423accd6f5cefac0743bc4fe952effded102becf95de8203a
MD5 e664b1168f8bacba95237d9981c2f239
SHA1 d7420be0ad437728834a13ead1f065e26e5f311a
SHA512 6f25bb62125e073b359ec0f0b93a3134e6947ca16e4fc184854a40db3ed81ae91f00cf9c8a5679a94de3de90ae5142d05c9661a22b007a9ac92bd6b3e288c7f5
TLSH
T1DDF0AB3408FE007EF2B69CB69BD4B5A7BC0AF203100105F50AE32358060BACA1CD24BD
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_200E34A691ABFCDB8F8FB0E4F494DDCC

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_200E34A691ABFCDB8F8FB0E4F494DDCC
Size 484B
SHA256 bf6b5cbb69cd8d3af410f9ebb1aa55e0b00ca0de42be80cb087eff1540c9a49a
MD5 a33cec3ce9d7968c0724ecb9747149d8
SHA1 9951d060729fa6a6e81a4d9441ddc9af70e0b05d
SHA512 f5ac6e3da402fbe659debc8265d2cad863f8668576dbd20b30a1ffe7f310c1200cc8c2fdc06278b044c990a42d4e2dbf541a2dac13cafa12d8b3a5de7311586e
TLSH
T1EFF0AB3C26EE405EF1B7F93942ED8A715816F12F314A53AD0BD403527B05F40BD82A26
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 359dc854ed08a185acd716ff2c7cb84200bb97ee6cdba109c8bfe209da247f24
MD5 ee348ca1424e98140bfac0992505a4d0
SHA1 bc28d13bb6964881a20d0c5c32ed6879c3fdb2b9
SHA512 b5d69d1a5153ed5c8afeec645a80c665c77a96412a65189469fe5c6dea0b36236702837b04265617fea4f0f64143b8ca24781d1de731e657f502ec3531099775
TLSH
T102F02B2827FA902CE13B9A38CAC5A3675DBCF30268000162075003036F0B6C20E48133
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2420-3-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/2420-4-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/2420-32-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/2420-2-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/2420-1-0x00000184F5B40000-0x00000184F5B4A000-memory.dmp

Download

memory/2420-8-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/2420-11-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/2420-21-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/2420-0-0x00007FF9CF09F000-0x00007FF9CF0A0000-memory.dmp

Download

memory/4560-70-0x000001B978D60000-0x000001B978D68000-memory.dmp

Download

memory/5316-30-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/5316-74-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/5316-73-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/5316-69-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/5316-37-0x000001F3E6830000-0x000001F3E6852000-memory.dmp

Download

memory/5316-36-0x000001F3E6C00000-0x000001F3E6CB0000-memory.dmp

Download

memory/5316-34-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/5316-33-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/5316-31-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/5316-25-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/5316-7-0x000001F3E6530000-0x000001F3E660C000-memory.dmp

Download

memory/5316-6-0x000001F3CDB80000-0x000001F3CDBCA000-memory.dmp

Download

memory/5316-5-0x000001F3CD250000-0x000001F3CD25A000-memory.dmp

Download