Exodus Wallet
Named by 3 kept items in this workspace.
Search every workspace for Exodus Wallet. It matches the name as written, so it can find other things that share it.
The items that name it 3
Targeted by extractCryptoWallets() via exodus.wallet path
Legitimate cryptocurrency wallet application whose genuine installer/files were bundled with malicious code; original installer ~190MB vs tampered MSI ~201MB (210,767,872 bytes)
server.exodus.io targeted; vault/seed-extraction keys and scrypt KDF params harvested
All technologies in this workspace.