file_path

%TEMP%\epsilon-<username>

discovered 2026-06-01

Main staging directory for all Epsilon Stealer exfil data. <username> replaced with victim's Windows username.