sha256
bc46e88b1fdf8c27e3404146306b4651f69728f7d8d939a219dfbcb5a23ef69a
discovered 2026-06-01
Stage 4 hello.exe. PE32 NSIS self-extracting installer, 86,235,515 bytes (~86MB). Contains electron-builder Electron app with Epsilon Stealer in resources/app.asar -> src/index.js (3,360 lines). NSIS header references www.inkscape.org (decoy).
