d2becdf4657a8ceaa7e679d7b2264909995feea95482179e3755d18d0b14b3ad

Analysis

user interaction
yes
max time kernel
149s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 19:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
exodus-windows-x64-26.8.27.exe
Size 193.9MB
Sample260913-x6sstssepc
SHA256 d2becdf4657a8ceaa7e679d7b2264909995feea95482179e3755d18d0b14b3ad
MD5 716acfe236958619d5c8ee6a059011b2
SHA1 fc0e59c991e3621fb9b78bdc292b902b27e92054
SHA512 93fe63e5416d94ec4570387fe14fe5de97c0f74dcaa929bbb19ebf5f7389f2cec0409b361620131b5234306a891fa46cb89bbeb4abe140d68eac81616acd9fc7
SSDEEP 6291456:IbOR4TQuTRhXHqKBm4n13gUJrhwSFW+jKqb2:IcuzqKBrDRFWbqb2
TLSH
T1FAA833692D74DE8ED318DCB514F38FD27617E6B31E1F81208E5223255B3B639EA2168C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Exodus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Exodus.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 9 IoCs

pid	Process
1052	Update.exe
2728	Squirrel.exe
4024	Exodus.exe
2108	Update.exe
3480	Exodus.exe
4028	Exodus.exe
3532	Exodus.exe
4232	Exodus.exe
4452	Exodus.exe

Loads dropped DLL 12 IoCs

pid	Process
4028	Exodus.exe
4028	Exodus.exe
4028	Exodus.exe
4028	Exodus.exe
4028	Exodus.exe
4028	Exodus.exe
4452	Exodus.exe
4452	Exodus.exe
4452	Exodus.exe
4452	Exodus.exe
4452	Exodus.exe
4452	Exodus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exodus-windows-x64-26.8.27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Squirrel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\exodus\ = "URL:exodus"	Exodus.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\exodus\shell\open\command	Exodus.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\exodus\shell	Exodus.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\exodus\shell\open	Exodus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\exodus\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\exodus\\app-26.8.27\\Exodus.exe\" -- \"%1\""	Exodus.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\exodus	Exodus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\exodus\URL Protocol	Exodus.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1052	Update.exe
1052	Update.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4024	Exodus.exe
Token: SeCreatePagefilePrivilege	4024	Exodus.exe
Token: SeShutdownPrivilege	4024	Exodus.exe
Token: SeCreatePagefilePrivilege	4024	Exodus.exe
Token: SeShutdownPrivilege	4024	Exodus.exe
Token: SeCreatePagefilePrivilege	4024	Exodus.exe
Token: SeDebugPrivilege	1052	Update.exe
Token: SeShutdownPrivilege	3532	Exodus.exe
Token: SeCreatePagefilePrivilege	3532	Exodus.exe
Token: SeShutdownPrivilege	3532	Exodus.exe
Token: SeCreatePagefilePrivilege	3532	Exodus.exe
Token: SeShutdownPrivilege	3532	Exodus.exe
Token: SeCreatePagefilePrivilege	3532	Exodus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1052	Update.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1052	2276	exodus-windows-x64-26.8.27.exe	90
PID 1052 wrote to memory of 2728	1052	Update.exe	91
PID 1052 wrote to memory of 4024	1052	Update.exe	92
PID 4024 wrote to memory of 2108	4024	Exodus.exe	93
PID 4024 wrote to memory of 3480	4024	Exodus.exe	94
PID 4024 wrote to memory of 4028	4024	Exodus.exe	95
PID 4024 wrote to memory of 4028	4024	Exodus.exe	95
PID 1052 wrote to memory of 3532	1052	Update.exe	96
PID 3532 wrote to memory of 4452	3532	Exodus.exe	98
PID 3532 wrote to memory of 4232	3532	Exodus.exe	99
PID 3532 wrote to memory of 4452	3532	Exodus.exe	98

C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-26.8.27.exe
"C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-26.8.27.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Squirrel.exe
    "C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2728
- - C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe
    "C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe" --squirrel-install 26.8.27
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Users\Admin\AppData\Local\exodus\Update.exe
      C:\Users\Admin\AppData\Local\exodus\Update.exe --createShortcut=Exodus.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2108
  - - C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe
      "C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --field-trial-handle=1712,i,734717342322782537,16534466119761853980,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,18064998682411464966,13289933286189863067,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1964 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:3480
  - - C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe
      "C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1712,i,734717342322782537,16534466119761853980,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,18064998682411464966,13289933286189863067,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1708 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4028
- - C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe
    "C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe" --squirrel-firstrun
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe
      "C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1688,i,13348715493237720927,11028061921740829212,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1692,i,2656332700564130407,1719293907880848903,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1676 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4452
  - - C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe
      "C:\Users\Admin\AppData\Local\exodus\app-26.8.27\Exodus.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Exodus" --field-trial-handle=1688,i,13348715493237720927,11028061921740829212,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1692,i,2656332700564130407,1719293907880848903,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1936 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update.exe.log
Size 1KB
SHA256 e96331392d474ca0fbc51036c7d55aa3a37aae6b074d50ebd106a277b0cb4097
MD5 6eb96c16eb677b6a8c1df381a0497a1a
SHA1 d4596baadc2d4bee89d57e1718ab30c0b7d563ec
SHA512 3d472d56ceb73a3df3f65eff6af088b3a81ab553153cbda925091500a6543cf83e84872f2bc81f218deddecd8f3c9868d784c2fe08ece95f915138becaecfb0b
TLSH
T1F0310F312271B0D88D133F53193C258563EF4358FA505F187519624FEA3A00B6F261F3
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 79B
SHA256 5a750f7faae9fc7915048a168c5741dbbae38263dd881e4566e1125b01939c98
MD5 a7b32e279b79da674860a7e7a7c2b09b
SHA1 59f9339cbf0d763a11f3367821771610788421d9
SHA512 8de881c33f0dfac5cc061d0108ce713a04b248198f9a094f075cc6902880c9d0fc452598bfe93ac5710fe55647bea36b3dc6d37d37048efa8f96a22d85753d7f
TLSH
T1CCA012CC84401CE88A93D3C4100501D10C01101217C03319C4585B8418254413204292
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.7MB
SHA256 dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4
MD5 c5f6cda4976ae38cd9fba3d1e5ebd244
SHA1 2006c37f01d010963a4331c42e579b87a2d16039
SHA512 a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d
SSDEEP 24576:ANMFwWMK8zptHroPjSWijyJsVB3Fm27jmHxefUFU7+KgJhzV31s6:CWfqoPj6cxefUFU5gJht
TLSH
T17C856C11B7DC9F2BE5AE26BAE030045927F2E5866372F78B2B4CB5791B837544E01363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 12.6MB
SHA256 d2da6ed0e7754975a11047344b92e324afbc0bee4f4de2dd3dcc6b241e875a70
MD5 0d56d260733a55eed3ea648f9e295f51
SHA1 71856a649f04acb705d7eb4359a956ca501c7323
SHA512 ae19adf7424792c5ef11437b1cbcf79db3a6dd8113bee2a718271d6a7c8d8e915b58f565ba90cf6b8705cf652b8c4adec71b343368cfe37e4f5ea5f6faeaffb0
SSDEEP 196608:+g8iWtmBHAFVvW0MIslwk7LDKlqYI21jrz9hmQnsJ9uRaa1gB6t6qP:RhsjuDKlqD2FBYQnsGRTDgI
TLSH
T10FD633179429670FB618C5A4EB7FCDD96D88F0A28F2BEBA086947305513363B6B501CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 352KB
SHA256 381905c1421a53741029db9ac3b9544bc39daabc8e14a8883ab0b64c5c0d2ca3
MD5 f4fd06cc518f26026049ccce65a4ec81
SHA1 6298ba68c06b31f1ec19e7ce757c26ff3e6df3f7
SHA512 e53583d6a33b8f4b8d9d71aa19b1027b2152e35bc1595ee62916be3f1eb95015b4b1ca70d6bdeaa54742c11a374ccd663062229ce22410dc3d2b96bf8d6538d2
SSDEEP 1536:ZaOd5fJefKmSlKdtSce4exOuVu1uquu8ucuujuHuXup0ruYuqQDuQugutuBuVJUQ:MO3hCKpIdtHO1qeGAhY5dqkBfybo
TLSH
T1F67463273FB9DE48C11CBD7A69F18737B7318A250D4A05117E122E73D671DA8FB82688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Exodus.exe

Path C:\Users\Admin\AppData\Local\exodus\Exodus.exe
Size 599KB
SHA256 11e50f88499ead9da9d4b0b6c062651181f28df1bf1078c5d69bdf55a836b370
MD5 212d6f0d9e544c346f8dae39d0acd06d
SHA1 5b84c04a9c2f24d7eb911b452b1d4db045db0f82
SHA512 9c588fb30d487e13c88e500f35285ed071bcd544231b049410a31beea01810b7915c758a26e6c57013a04e46dca7cab3486c1b231fdd48d736d8e1050d7e1cad
SSDEEP 6144:kraXZLrtHteAO/MkeIdtuE5dqkBfyboyZV:kmpHepjqkBfybZV
TLSH
T189D4F5233FA5DD98C1187D3A69F18737B7368E250D4605237E123F339A71DA8EB92684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\d3dcompiler_47.dll
Size 4.5MB
SHA256 f4d913e1f364be4291a8cd8d43e1c908650cc6b745d022824031663166832980
MD5 fafe0d5d7414f73402c1b95eb7b81a87
SHA1 805264e2ada5547f0e8fe053c3625ea8ac8a397b
SHA512 6ef68232adc408e2af00e6e7fcc139b1f7fe405bdc527823ff96c093cef173aec6bbdd965bd5b2fe06d97f4c52c992b163f27947e5f1479fd60edadff7031e66
SSDEEP 49152:FSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqn:IuktcrfNlTyj5byqSo
TLSH
T194268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\dxcompiler.dll
Size 24.5MB
SHA256 f6dc046e92bf10699be397585662679e1c21a7c4923635dcd119f7dd68287a55
MD5 b50b9a84003b277792419780f338e48b
SHA1 6cae728a2575173f9eb70219b566bdb77170bd37
SHA512 9ab2bfbd1a4b1b0f1df1759fcdd910d4f8d7e87d3a2600de28d12e79f0fd2243d905aea35ce0fc1f60f3c8dc5ee5df931e57d7eb056add0abe1f01c7e65ffe8b
SSDEEP 393216:fUTn+V5ObvlrOM6ONrkCoXAroHeOKxM6el:Peb4eCVwM6el
TLSH
T160473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\dxil.dll
Size 1.4MB
SHA256 b0058115b95a0f83f04be38e4168fe5dd72b76554040ad8042ddf713a6ee761d
MD5 6332b8bf6f64ae428d297613e2c3bbf4
SHA1 0000550f7280805719e0641b5a45a8b62b8aeac0
SHA512 3a5aabf9da54dfda27559781f87c54e812891197fc5c8f9ffd2dafa5329b2d6e95f11edc714255f447c2eb7e02ffca235f2c4a68a21d05d64e55670c9b229e7d
SSDEEP 24576:nY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kau:YiTMYxy0Sy66Zh7Sh/cyvS5w
TLSH
T11D657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\libegl.dll
Size 518KB
SHA256 f326a29789955d7e82d8c5f5e29e28df9e71f77e11dd5002843574f79d1718f2
MD5 383a9d0973aee714cb8e04fb54d16779
SHA1 f336a3f5c33aa8d20fdbd2fc5e7a797e5ae636df
SHA512 7c9679cb5985d34192c387aa1efb1573d8dca3e5c91239d86eb684595a4fc895cc5d7ae4d2995d9b01e8efc7509e72e32872b1391748afa7c26cb1fc3edc18cc
SSDEEP 12288:+162HbwE8+Tj5I9dWnQccIu+GwhugaD2EH:G221IKu+5OD2EH
TLSH
T133B48E15F3E84BA8D07AC1348A438646DB7178921B65F9EF02E052352F3BBE45B7E325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\libglesv2.dll
Size 7.6MB
SHA256 59f5bb7fd797a2574e3bc2a3b14191268802495cedb94962a8de32b964aa496c
MD5 aa01b94aa9b2a4490863c884d014f0b8
SHA1 e1fe54c8a32f15d367b60116ba3931d0477d93e9
SHA512 c56417fc02c19207b85f21bedacab99d388c042692f764d7f37ffd80a8a391f30ef3598c92544fc70c22abf526c836ca84b5ce2e9438804390d2393d93a9dc60
SSDEEP 98304:dSqq37sgK2EEDXCrfI8g++OGwBeAM4HdBGO:8qQ74KDzTO5CGdBGO
TLSH
T194867C03F68641D9C05DE2749B67A223FB34B4450724B7CF2AA457162F6AFE0AB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\locales\en-US.pak
Size 548KB
SHA256 a15a41f74f809ae908b95645565c34b151483a5c04a94265b44aee12fd413b55
MD5 0bdc9ee1a9ddc83a008c4072993734d2
SHA1 6d99d0dd57100072fd26f0bd620757b69f031188
SHA512 8d9f28e48255e433e2f4ff968fb7d7c467b096f33978132dda53eda987ebd22225c8eef51f3946013b9bba4f8d8d65b757c8cbeb9b5786cefc154b711d4f5d9d
SSDEEP 6144:wtobk+PcOYHfYOMJxjScMP9sQqblfaYQhp1B1OjRng98//Swf:k2vPc5HfiZM6Qqbg0jSwf
TLSH
T1DDC44D1FF744112A05A352A2BF0995B2FF32D06CA35112563CBD812C33B6B6693B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\resources.pak
Size 6.4MB
SHA256 302671ba7bf6d6352773d34de852793027d389c4afde1db0977e1b76e39d5938
MD5 225717135d7853f4f79372a197eb1a5f
SHA1 aa8627b1e66fde80e812bef290aefa657643c487
SHA512 0edaf8862f7e7350a602c0d5d20e84bd2e2a4f6dff88944357ddc82345aa226c8151fcdffcea468d0304f89be1b41fdb3424c871b8a3a5adbef447abf7839650
SSDEEP 196608:4EVBRafszNQoCmkrB0QMguFBgt3m06Rw+Ki:4EVTaV9mkr4jFWBm0iw+h
TLSH
T1D06633DB72352C4FC54883FE4528417A786CA7A53D8591A2159C6228CC3E34F7EC9ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\squirrel.exe
Size 2.1MB
SHA256 e7b4324ba2d5f712d99ea77d3cd572630d5500ae79a9a8e3f1718c9b85a9d2b9
MD5 6a1b0e4f6d5f340762012fb319963256
SHA1 260abe101a58030e26621fcd96b57764e6392644
SHA512 7c473b3d064e6be0f4c530494d21b9660b59ad973cb25d4a8d78249c1539cad0f2332dd428d5e3f996e7a44eeb3a5287294bfc32b3fe16c755c351ffaf56aab5
SSDEEP 24576:MNMFwWMK8zptHroPjSWijyJsVB3Fm27jmHxefUFU7+KgJhzV31sGBfyu:+WfqoPj6cxefUFU5gJht
TLSH
T1C9A57D12BFECDE2AD15D3E7AB071012633B2DA861726E7473F0839765AA3B549E01353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\v8_context_snapshot.bin
Size 698KB
SHA256 ef9f068c5a1494a02acff29f7c7cdde1a2d10d4ac46ca15b735124e8b48ddace
MD5 14df63236be0e1572557b5674656d77c
SHA1 a68588d42238582b053ccb443f0d8ffd4d69d3fd
SHA512 855bfe650247fb7b79f9891aa00309d2864fbfde321063edd22267b6b11d59c2dcae58ff86ee4e5629ed73872983bae49933b6818ad522092aeb2631d7025ccd
SSDEEP 6144:m/V4XptgO5X8t+HlbFYPf7xR2Nyuuh1hDEkisIIdukchKYNcPK:m8D5Xv4fVR2NyikuIIv/H
TLSH
T1BBE4A7A1FB0A8F3AC5453BBD8DE647463A30B18E9E86E20B7405773D78B96704D3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\exodus\app-26.8.27\vk_swiftshader.dll
Size 5.4MB
SHA256 883cdaaf846685d558b4fe487a590a43570ead54699627bf1468bebe5938e535
MD5 872a2764c18cd09dcd9831a50cdd4cdb
SHA1 05b59849276dc9932df73652b0d17cbf6a56873e
SHA512 62d4bb7b34f9bf1868b0305a5db841fbc22cc56a1a8b78f60a0af65b7dac3d5ab54f7dc4aec44721644ec63e0e3414e773a78f8c4d15286aca399a667cd4f8ab
SSDEEP 49152:+RZF8bmJ97oauOJZcdNwME/LE71roLHP3qfCsEnTQxkWIgPAvtkPt3MA+Iqr1kW2:wb8bO3XG6zjvtQ4nTZs
TLSH
T19E464903F28681E9C06DE579875FA623F631F8850B2276DF56A00F192E66FE0A73D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Exodus\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 eb7bdaa859aae7085749ef378e0c21b767a737034633e222d8c8e6a6ab64b699
MD5 997bce5bda13c2229de7c5440b43c7bb
SHA1 92c88f2b4296dbbfaf9aca3f9bf914641a52d108
SHA512 9e35c770bcc7ad2555463a15d84256e81fa686275eb378d3b6907f8c26b3ecd64d7dc95fbe97591786b599619e6385ca9cf8e6f6837f2fc23cc1c8487eb4c377
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Exodus\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Exodus\Local State
Size 434B
SHA256 3099c1a4b40b05ada45993596362b7c12959915cf33323614ffa663ab111279b
MD5 f42de6002e5f13881f4d7e9006eced1e
SHA1 6a183b6e0221c0fc9fc6057ac18e8a246c1c0ae4
SHA512 ed00ddbdbafdc73ae7de30ee410e0ea6c647ce2aca497af77396dc67e8ac8df732cc55fbc5b8fb5c28d1272c2e66be637ad4b663d037261506d89a82fcb86f09
TLSH
T119E0A37379707EA6666F4CA91602E2560F081D77844683E05E54422212EB99D8B11D37
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\000003.log
Size 30B
SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
MD5 7e957d693bbab6ad7dec1d3aa28bd69b
SHA1 50369f74c280d83046d6b779ecbde129b8ac3b98
SHA512 0228357b6c4b73f3ef20a333b7afe71fb589efe438bc28a3e04df3fb64f367b7b463dc9c9792921c531124b7bde600524827b40f2cc5aeddbc1df8b3ed822cbf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\LOG
Size 243B
SHA256 0099f4f6d94054047207afb866f5ff0feb3a1a4a3ba6638730904dc797c863cc
MD5 f657b86309665367181287593e9b3ab0
SHA1 94a0b529f97dfd4991fe49204258ac48f83e6337
SHA512 06661b8026796e15ff118ee7ccefc6af9764cb8924060bd4878621f7cf2b16bfbd71521d4b540b4769d708680dc6456e3781ec5982f6b609ec7e0322be47d981
TLSH
T199D05E3A44D9DB5E629581EBD637771ACB3036416E8C2F0D4E91F488718A008A9514C2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Exodus\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Exodus\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Exodus\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\Exodus\Network\Trust Tokens
Size 36KB
SHA256 fe03fb82cfe74a64c7094c810f9e8167c3b61c254c27569cc6b7db5ed84b0b18
MD5 c3e47f014a4bb58a64a57890314786ae
SHA1 ff572da2509f042cfd7ee8245f90c76105e27c89
SHA512 fc5c8206b6ff078fed3c2481360d0f638e828669f972710b1b0fdec071c0fdcaa481cf3a48b95df014943b9aed3b97da808c5567765ad6a226488aad4ab2e16b
SSDEEP 24:TL03lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tw31DtX5nDOvyKDhU1cSB
TLSH
T115F2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Exodus\Preferences
Size 127B
SHA256 48f74c5bd5249d54a8585e64dd065ddb737dfd1520d329aa45b5d63a93a5339c
MD5 1ab0656b7a7565ba2c2e1c9db610367e
SHA1 33042bea16c83db21352b4ea913b9d44686ba509
SHA512 3ad7117b61412d5d87b612f50543ad243bf62ec6df77ba1c7211d3540a5453cf5e8d7bdbcacda66f1028db4b1bb0fdf1c6f1bb85e8958c4ef933c45fa52387ec
TLSH
T11AB02B133C00503203091954001AC24A34BE00250B471A0120C4E3CF442EE0C08C7017
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Exodus\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 0f4520488310dfa4dfe34ad70e9e1ea712361991a67cc7c801dcdec5b82e3b6d
MD5 894e7bbfea3ed26e107085654da81479
SHA1 572a005a84db9ef415d75e2d4c67e466492bcb44
SHA512 64ed2c2fc08992fd92bd5c07f0082afe7de90ba656f88650354c02c45f7fabb5a2a68c232cd0522219357701c07b062a1aac42dd9a90f9f183fc6a904ce0761c
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Exodus\Shared Dictionary\db
Size 44KB
SHA256 9dfba1d139c9933668e58e9c7777804c8ae01b2942dcc2dfaaa65ac139853a59
MD5 726d6140f181f7300ea50c13070a5903
SHA1 5a78b8a7db3078a7ca5a81e4fb78ed35ca476515
SHA512 6d48e90d26205be87925543a1645036971b9419785e0e8ba5987cc27c7926a53c71338dc2336878c649d186142239ed8be93309a7f2e695409119a624c2b3e9c
SSDEEP 24:TL6lgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:TBOIy4m1b3fbUdeqSB
TLSH
T11013AA0F1E187551D1BD0235E9E64E6B2E7E205C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-178-0x0000000014F50000-0x0000000014FE2000-memory.dmp

Download

memory/1052-89-0x0000000005D30000-0x0000000005D3E000-memory.dmp

Download

memory/1052-88-0x0000000005D50000-0x0000000005D88000-memory.dmp

Download

memory/1052-8-0x0000000000AD0000-0x0000000000C94000-memory.dmp

Download

memory/2108-136-0x0000000004AA0000-0x0000000004AC0000-memory.dmp

Download

memory/2728-110-0x00000000009E0000-0x0000000000BFC000-memory.dmp

Download

memory/4452-216-0x00000159BB220000-0x00000159BCAA5000-memory.dmp

Download