0fadd6191e5bbc27b5e85ff8e602af434d965bbdda5e10e462375c565fc8f637

Analysis

max time kernel
150s
max time network
78s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
exodus-windows-x64-26.6.4.exe
Size 193.9MB
Sample260626-sd6rrsct31
SHA256 0fadd6191e5bbc27b5e85ff8e602af434d965bbdda5e10e462375c565fc8f637
MD5 2fcffa08bea8de677332cd643647b6b5
SHA1 94aa8a2e0d95e5b0b23383b2e22cb698ef56c617
SHA512 c4a9646bee61edbe087289f19a7309a26928ef40dc76e52c3238dd78d96062af796587df89fe5cc5e7ed1c8dad98d75537efbb7f08b8ac6cd08bb4c94d59da81
SSDEEP 6291456:sbmXGGm9/70FNp1bardQPrWO/3CLG98CX32xgzQ4:siXc9UERiC7G98CXmOQ4
TLSH
T124A833671D38FE8FF2486DB6C1F28AB2770559550C66C412AD1127238BBB076EB1378E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 9 IoCs

pid	Process
3544	Update.exe
4060	Squirrel.exe
2364	Exodus.exe
5648	Update.exe
248	Exodus.exe
5068	Exodus.exe
2032	Exodus.exe
5320	Exodus.exe
712	Exodus.exe

Loads dropped DLL 12 IoCs

pid	Process
5068	Exodus.exe
5068	Exodus.exe
5068	Exodus.exe
5068	Exodus.exe
5068	Exodus.exe
5068	Exodus.exe
712	Exodus.exe
712	Exodus.exe
712	Exodus.exe
712	Exodus.exe
712	Exodus.exe
712	Exodus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exodus-windows-x64-26.6.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Squirrel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\exodus	Exodus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\exodus\URL Protocol	Exodus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\exodus\ = "URL:exodus"	Exodus.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\exodus\shell\open\command	Exodus.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\exodus\shell	Exodus.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\exodus\shell\open	Exodus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\exodus\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\exodus\\app-26.6.4\\Exodus.exe\" -- \"%1\""	Exodus.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3544	Update.exe
3544	Update.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2364	Exodus.exe
Token: SeCreatePagefilePrivilege	2364	Exodus.exe
Token: SeShutdownPrivilege	2364	Exodus.exe
Token: SeCreatePagefilePrivilege	2364	Exodus.exe
Token: SeShutdownPrivilege	2032	Exodus.exe
Token: SeCreatePagefilePrivilege	2032	Exodus.exe
Token: SeDebugPrivilege	3544	Update.exe
Token: SeShutdownPrivilege	2032	Exodus.exe
Token: SeCreatePagefilePrivilege	2032	Exodus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3544	Update.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 3544	5956	exodus-windows-x64-26.6.4.exe	89
PID 3544 wrote to memory of 4060	3544	Update.exe	90
PID 3544 wrote to memory of 2364	3544	Update.exe	91
PID 2364 wrote to memory of 5648	2364	Exodus.exe	92
PID 2364 wrote to memory of 5068	2364	Exodus.exe	93
PID 2364 wrote to memory of 248	2364	Exodus.exe	94
PID 2364 wrote to memory of 5068	2364	Exodus.exe	93
PID 3544 wrote to memory of 2032	3544	Update.exe	96
PID 2032 wrote to memory of 5320	2032	Exodus.exe	97
PID 2032 wrote to memory of 712	2032	Exodus.exe	98
PID 2032 wrote to memory of 712	2032	Exodus.exe	98

C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-26.6.4.exe
"C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-26.6.4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Squirrel.exe
    "C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4060
- - C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe
    "C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe" --squirrel-install 26.6.4
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Users\Admin\AppData\Local\exodus\Update.exe
      C:\Users\Admin\AppData\Local\exodus\Update.exe --createShortcut=Exodus.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5648
  - - C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe
      "C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,3473250889488757317,13580496863545225717,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1700,i,12701463812331946159,5013792962402155798,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1692 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5068
  - - C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe
      "C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --field-trial-handle=1696,i,3473250889488757317,13580496863545225717,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1700,i,12701463812331946159,5013792962402155798,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1964 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:248
- - C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe
    "C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe" --squirrel-firstrun
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe
      "C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --field-trial-handle=1784,i,8323709201356820377,11743410066067647361,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,9991718287081338037,12785180723015040212,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1816 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:5320
  - - C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe
      "C:\Users\Admin\AppData\Local\exodus\app-26.6.4\Exodus.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,8323709201356820377,11743410066067647361,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,9991718287081338037,12785180723015040212,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1780 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 78B
SHA256 e736fd4d635ecef0eb44cc97b8f57cd740b30d5726f082ec0d57f2f95ce12586
MD5 4c4dc60745b8566815dc82659b714f8e
SHA1 03f27c6b43e09df46b93fa5da798c325089cd97c
SHA512 cada895613c6128243d1232b073020cee251cc66befb96e22e69f1dc993a0eee4f7511410730ef3282a84c6ced68f9559ead27ea3473477741847b7447ffeea2
TLSH
T165A012A4CC002258489255DF4C0C02C02B01D03601A063C45000F905109940420011C4
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.7MB
SHA256 dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4
MD5 c5f6cda4976ae38cd9fba3d1e5ebd244
SHA1 2006c37f01d010963a4331c42e579b87a2d16039
SHA512 a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d
SSDEEP 24576:ANMFwWMK8zptHroPjSWijyJsVB3Fm27jmHxefUFU7+KgJhzV31s6:CWfqoPj6cxefUFU5gJht
TLSH
T17C856C11B7DC9F2BE5AE26BAE030045927F2E5866372F78B2B4CB5791B837544E01363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 12.6MB
SHA256 d2da6ed0e7754975a11047344b92e324afbc0bee4f4de2dd3dcc6b241e875a70
MD5 0d56d260733a55eed3ea648f9e295f51
SHA1 71856a649f04acb705d7eb4359a956ca501c7323
SHA512 ae19adf7424792c5ef11437b1cbcf79db3a6dd8113bee2a718271d6a7c8d8e915b58f565ba90cf6b8705cf652b8c4adec71b343368cfe37e4f5ea5f6faeaffb0
SSDEEP 196608:+g8iWtmBHAFVvW0MIslwk7LDKlqYI21jrz9hmQnsJ9uRaa1gB6t6qP:RhsjuDKlqD2FBYQnsGRTDgI
TLSH
T10FD633179429670FB618C5A4EB7FCDD96D88F0A28F2BEBA086947305513363B6B501CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 352KB
SHA256 381905c1421a53741029db9ac3b9544bc39daabc8e14a8883ab0b64c5c0d2ca3
MD5 f4fd06cc518f26026049ccce65a4ec81
SHA1 6298ba68c06b31f1ec19e7ce757c26ff3e6df3f7
SHA512 e53583d6a33b8f4b8d9d71aa19b1027b2152e35bc1595ee62916be3f1eb95015b4b1ca70d6bdeaa54742c11a374ccd663062229ce22410dc3d2b96bf8d6538d2
SSDEEP 1536:ZaOd5fJefKmSlKdtSce4exOuVu1uquu8ucuujuHuXup0ruYuqQDuQugutuBuVJUQ:MO3hCKpIdtHO1qeGAhY5dqkBfybo
TLSH
T1F67463273FB9DE48C11CBD7A69F18737B7318A250D4A05117E122E73D671DA8FB82688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Exodus.exe

Path C:\Users\Admin\AppData\Local\exodus\Exodus.exe
Size 599KB
SHA256 b939e06d57426b39c0be68b8aa9c50bf6d765fabe2b119fa7ce214c4950942a2
MD5 8e072ec057e2acfdedbb76bd97c533da
SHA1 baad24f1baf04244be231a269d5b04863aefcbc1
SHA512 55ec840330f0f85da9d6f0e02bca0851e16071212f8e9c4c2afe34f9ef10b3215ab3e8ec8cdddc0047184a56896d930c78a513779d6562f4c7f00443fd58f7db
SSDEEP 6144:kraXZLrtHteAO/MkeIdtuE5dqkBfyboaZV:kmpHepjqkBfyTZV
TLSH
T17CD4F5233FA5DD98C1187D3A69F18737B7368E250D4605237E123F339A71DA8EB92684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\d3dcompiler_47.dll
Size 4.5MB
SHA256 6b13723cec361be90ab91a90894489f822c4a413d63ea27b6f5b674c8d4b5e93
MD5 249e720b1148d2656f93f92685cba302
SHA1 cc72911d8cffaa702c8589df0c20ca89cfe7a159
SHA512 699fa5b4687c4f34901b0ddb494604b091ef4b9eed5be262cde1c7c5bc650bc62b7590818dc2035cf211139fa9211302d4db642bd9e231a0de8f6baebb0532a5
SSDEEP 49152:5SHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqd:cuktcrfNlTyj5byqSm
TLSH
T10E268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\dxcompiler.dll
Size 24.5MB
SHA256 938386525ef4d9eb3bff860063b0a44401f20d791e2c692fe739a5de3f6dabbf
MD5 5b7f2088ecf8eaddd58a1106ba571caa
SHA1 6287ad15d39dd0119600310cc4fe3a468d658e67
SHA512 17893a729baf504e1cadb81d211ec4865e44af1cd54d7aa799375e9d24c638a2885443f39fe509b8a46c8445e87722d1f9c581f73e91960f07ac9c7609eb2bb5
SSDEEP 393216:fUTn+V5ObvlrOM6ONrkCoXAroHeOKxM6ex:Peb4eCVwM6ex
TLSH
T1A5473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\dxil.dll
Size 1.4MB
SHA256 51531abdabd74d7d0aa6cd46fcbb032b5f70b55984808eea966dc7c00bf3841b
MD5 ff0d616c58ee80c6fa330257d6d983bd
SHA1 07b7d086e2a606eb7ec587e35623e62cb951c2a8
SHA512 aac2c41162b71c730f3bfe4b9602fa75b046155cc2be22539fddfb87975eb8994109b39fe54c15a7e912920d03fc2898571601856b8f227a78045564cbcb5dca
SSDEEP 24576:9Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Ka5:WiTMYxy0Sy66Zh7Sh/cyvS5n
TLSH
T157657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\libegl.dll
Size 518KB
SHA256 6880a32ab610c9dad5a17e83c4b6531d55abc5f1ba48d5bc5263d3d999af822a
MD5 c5bd711637da232066ad0e3e688682b0
SHA1 4786daa6d74157726f6c62f77d70fe6d8b17b3f1
SHA512 8cba249bc36c5f79641f9168fbd25126c271ee9c46e02761cf0dd0107a97e38e6577f1d7a5a7fb92b83e01684e7226fc7ba5d3a39a9330a03bea2f8240eda4c6
SSDEEP 12288:3162HbwE8+Tj5I9dWnQccIu+GwhugaD2w:l221IKu+5OD2w
TLSH
T1EBB48E15F3E84BA8D07AC1348A438646EB7174921B65F9EF02E052352F3BBE45B7E325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\libglesv2.dll
Size 7.6MB
SHA256 c8bc7e0258b633dcdfcc82be03b5326448c298481e55ee0f0246b63817544438
MD5 53b2062caf93388443a30ec2852db222
SHA1 76239b63dcdf9e7d1f85587a5b578dc38afc28da
SHA512 4d70b84de59381b1fd6dafb45919f1751843c20afbad11b95b16f21f1a2ed3f2434155f2c1e9352fa1fccf5fa0b2679966a12debbb539a94c7cf9d8dbb9a3aa6
SSDEEP 98304:YSqq37sgK2EEDXCrfI8g++OGwBeAM4HdBGG:ZqQ74KDzTO5CGdBGG
TLSH
T156867C03F68641D9C05DE2749B67A223FB34B4450724B7CF2AA457162F6AFE0AB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\locales\en-US.pak
Size 548KB
SHA256 a15a41f74f809ae908b95645565c34b151483a5c04a94265b44aee12fd413b55
MD5 0bdc9ee1a9ddc83a008c4072993734d2
SHA1 6d99d0dd57100072fd26f0bd620757b69f031188
SHA512 8d9f28e48255e433e2f4ff968fb7d7c467b096f33978132dda53eda987ebd22225c8eef51f3946013b9bba4f8d8d65b757c8cbeb9b5786cefc154b711d4f5d9d
SSDEEP 6144:wtobk+PcOYHfYOMJxjScMP9sQqblfaYQhp1B1OjRng98//Swf:k2vPc5HfiZM6Qqbg0jSwf
TLSH
T1DDC44D1FF744112A05A352A2BF0995B2FF32D06CA35112563CBD812C33B6B6693B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\resources.pak
Size 6.4MB
SHA256 302671ba7bf6d6352773d34de852793027d389c4afde1db0977e1b76e39d5938
MD5 225717135d7853f4f79372a197eb1a5f
SHA1 aa8627b1e66fde80e812bef290aefa657643c487
SHA512 0edaf8862f7e7350a602c0d5d20e84bd2e2a4f6dff88944357ddc82345aa226c8151fcdffcea468d0304f89be1b41fdb3424c871b8a3a5adbef447abf7839650
SSDEEP 196608:4EVBRafszNQoCmkrB0QMguFBgt3m06Rw+Ki:4EVTaV9mkr4jFWBm0iw+h
TLSH
T1D06633DB72352C4FC54883FE4528417A786CA7A53D8591A2159C6228CC3E34F7EC9ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\squirrel.exe
Size 2.1MB
SHA256 55f4fdbd5fc93ded3565dd1af4d16479be3a27dab565243464107d8a1b114685
MD5 5341b31761b38bb6a42cb155aaea8661
SHA1 46a98e293a2596d51c8d4171b39fa2549def9d96
SHA512 906583cd16ef56dfe13c44fbb4556a0d7d9160e63ab0e6d798d526f5cb7466812a6bbabe95448d339bf8a7ef740229ce39964d2502880ad996dba418d0da6080
SSDEEP 24576:oNMFwWMK8zptHroPjSWijyJsVB3Fm27jmHxefUFU7+KgJhzV31szBfyQ:qWfqoPj6cxefUFU5gJht
TLSH
T147A57D12BFECDE2AD15D3E7AB071012633B2DA861726E7473F0839765AA3B549E01353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\v8_context_snapshot.bin
Size 698KB
SHA256 ef9f068c5a1494a02acff29f7c7cdde1a2d10d4ac46ca15b735124e8b48ddace
MD5 14df63236be0e1572557b5674656d77c
SHA1 a68588d42238582b053ccb443f0d8ffd4d69d3fd
SHA512 855bfe650247fb7b79f9891aa00309d2864fbfde321063edd22267b6b11d59c2dcae58ff86ee4e5629ed73872983bae49933b6818ad522092aeb2631d7025ccd
SSDEEP 6144:m/V4XptgO5X8t+HlbFYPf7xR2Nyuuh1hDEkisIIdukchKYNcPK:m8D5Xv4fVR2NyikuIIv/H
TLSH
T1BBE4A7A1FB0A8F3AC5453BBD8DE647463A30B18E9E86E20B7405773D78B96704D3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.6.4\vk_swiftshader.dll
Size 5.4MB
SHA256 aa2871462b630c534fe41a56c53cebdc591ee59143ad4c8e91b54734940dc373
MD5 55b43fd22b0b237c9460d2f789583b82
SHA1 0d47a5793afbffaf482593abbafe31c0ccdee207
SHA512 25554746aa365e0053bf19b936cfcc6726670de9dc404ddd710f4ce49170a3eb74de1dfcab5b5ec847e66ea6fe3d9db4dbf4c8e8c02f880eef12e737c67feefa
SSDEEP 49152:kRZF8bmJ97oauOJZcdNwME/LE71roLHP3qfCsEnTQxkWIgPAvtkPt3MA+Iqr1kWP:2b8bO3XG6zjvtQ4nTZt
TLSH
T1B7464903F28681E9C06DE579875FA623F631F8850B2276DF56A00F192E66FE0A73D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Exodus\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 52e9088136a8006f25becd50274da4b64cfbc05a5647bf892be8922a143d31bd
MD5 dab9be17286f6251f98be7cff3979ab6
SHA1 91c2bd262dd2896bded944a26b4dc950f2bbeb7e
SHA512 68518ce2554d4b941bbba319754823424fd455b90106930ef65907094fe93267f4172baae2a5a8f0e3e33fc406d56fe6fda4f8c7aef8839fac599fb086ff1e98
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Exodus\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Exodus\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 7ffc1fbe6a53e661f84c730654ae5b1da94fab3eb8b417866c377f7fa7829eb3
MD5 f38e3961a36d46360c7bfe140b2b355d
SHA1 86447ae67744f0613f7df5f7d961eedc0fbdc5cf
SHA512 475fbc7d195e5396d878cd78f01d0742df446f817d75cd7e3e96458360eba510f7046484a359b12c705765b688dcb0d5a4080785b3dbe717fe366244ac086452
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Exodus\Local State
Size 434B
SHA256 336415c88c24f139483fd4d6c6e791951b7585e203ec0ddf8079be95dea0c433
MD5 80b23ba45600b55e6925b522eb3f6815
SHA1 c73eda1d189ed5b32f506e325c0cccc8580398fc
SHA512 34f51c7ff6c9293585e98d95fd21ad68ce1bdc74c291ec30c87884795681783c23efa637b010b5041bf12452cffaf39fc611cdd59ace1b555a10ed84c7c72611
TLSH
T1B9E0ABB1A6A16EBA5D389A60751D2A581F3920B341E852488ADC460187B3852C518D3A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\000003.log
Size 30B
SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
MD5 7e957d693bbab6ad7dec1d3aa28bd69b
SHA1 50369f74c280d83046d6b779ecbde129b8ac3b98
SHA512 0228357b6c4b73f3ef20a333b7afe71fb589efe438bc28a3e04df3fb64f367b7b463dc9c9792921c531124b7bde600524827b40f2cc5aeddbc1df8b3ed822cbf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\LOG
Size 243B
SHA256 5b7f053ef3e37eb474677eda162c8fccce6a29424cfa41cff142a43f302fe3be
MD5 1130093a3b0b651b823a2fcd758e2b27
SHA1 d814c25870698526244c01f928758d19d3b7dbe4
SHA512 efc05e671aba70b7e3c934e537ab5ada772a4cf51a1c77e48111ab2d670a8cee5648f700cffde6faefe5c7aee2b01854e11eac7d88a30734f1e0b1a284631acb
TLSH
T10DD05E36C5EEC35E624680EBD77BB35ECB747115AEC92B4D8E80F889B1886089E411C3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Exodus\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Exodus\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\Exodus\Network\Trust Tokens
Size 36KB
SHA256 fe03fb82cfe74a64c7094c810f9e8167c3b61c254c27569cc6b7db5ed84b0b18
MD5 c3e47f014a4bb58a64a57890314786ae
SHA1 ff572da2509f042cfd7ee8245f90c76105e27c89
SHA512 fc5c8206b6ff078fed3c2481360d0f638e828669f972710b1b0fdec071c0fdcaa481cf3a48b95df014943b9aed3b97da808c5567765ad6a226488aad4ab2e16b
SSDEEP 24:TL03lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tw31DtX5nDOvyKDhU1cSB
TLSH
T115F2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Exodus\Preferences
Size 127B
SHA256 48f74c5bd5249d54a8585e64dd065ddb737dfd1520d329aa45b5d63a93a5339c
MD5 1ab0656b7a7565ba2c2e1c9db610367e
SHA1 33042bea16c83db21352b4ea913b9d44686ba509
SHA512 3ad7117b61412d5d87b612f50543ad243bf62ec6df77ba1c7211d3540a5453cf5e8d7bdbcacda66f1028db4b1bb0fdf1c6f1bb85e8958c4ef933c45fa52387ec
TLSH
T11AB02B133C00503203091954001AC24A34BE00250B471A0120C4E3CF442EE0C08C7017
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Exodus\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 e5d87c42376da222d6dbf24cca72f45a5f5cbc4eb874121eecfa326a8b2cfe90
MD5 297366a253a9ee396041a54927a480c3
SHA1 f523004c7affd19ac1b69cad26737d02b24a6480
SHA512 6031ecb792b38d452087d36b90918949b5bcbab19b087f5d782ac5342a5261f5a6b97dc9b03e9415584f483067cee1b216acd758b0ee1e9caad709f7dee353c9
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Exodus\Shared Dictionary\db
Size 44KB
SHA256 9dfba1d139c9933668e58e9c7777804c8ae01b2942dcc2dfaaa65ac139853a59
MD5 726d6140f181f7300ea50c13070a5903
SHA1 5a78b8a7db3078a7ca5a81e4fb78ed35ca476515
SHA512 6d48e90d26205be87925543a1645036971b9419785e0e8ba5987cc27c7926a53c71338dc2336878c649d186142239ed8be93309a7f2e695409119a624c2b3e9c
SSDEEP 24:TL6lgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:TBOIy4m1b3fbUdeqSB
TLSH
T11013AA0F1E187551D1BD0235E9E64E6B2E7E205C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3544-98-0x000000000B370000-0x000000000B3AE000-memory.dmp

Download

memory/3544-195-0x0000000006C30000-0x0000000006CC2000-memory.dmp

Download

memory/3544-99-0x000000000B340000-0x000000000B34E000-memory.dmp

Download

memory/3544-10-0x0000000000190000-0x0000000000354000-memory.dmp

Download

memory/4060-110-0x0000000000360000-0x000000000057C000-memory.dmp

Download

memory/5648-140-0x0000000002BB0000-0x0000000002BD0000-memory.dmp

Download