Coinomi Desktop 1.0.4 for Windows: what the archived installer contains
Analysis of 30 October 2026 (UTC), Avoid Coinomi case file, https://avoid-coinomi.com/

Nothing below was executed. The installer was unpacked and its files were read and searched.
Every hash can be recomputed by anyone with the archived installer and the commands at the end.

1. The file analysed
   files/coinomi-wallet-1.0.4-win64_UNSIGNED.exe
   size    98,081,120 bytes
   SHA-256 3d95bab665e65914ef1962e611c54c9d62bd6ace3514dee4a0a775f7fcfe7482  (the hash published since 2019)
   format  Inno Setup installer; unpacked with innoextract 1.9 (Debian 13 package)

2. What it installs (relevant files)
   app/Coinomi.exe                 SHA-256 9bef2aded7126e572797cf2aa4f81b4850d70c67aa112ad2a1910759cc279b9b
   app/coinomi-wallet-win64.jar    SHA-256 ac2c75ebb7a6f585842ef373fee2294d3e7bf6ff559a653cd97c36ba4f4ae331, 61,111,810 bytes
   app/config.json                 mainClass "com.coinomi.desktop.CoinomiWallet"

3. The embedded browser is TeamDev JxBrowser 6.22.1, licensed to Coinomi Ltd.
   jar entry com/teamdev/jxbrowser/chromium/product.info
       SHA-256 d2221b35e995f40e945416dc594b4b9958fa14fb2c6b47a6d97ee33bb39f1445
       content: product.version=6.22.1
   jar entry META-INF/teamdev.licenses
       SHA-256 b6a0e7b7d898153ef4e6159eb30ac9faa4a9fccc3eccdc3cabbf1638ed0868f6
       lines quoted (license keys and signatures are not reproduced here):
       Product: JxBrowser
       Version: 6.x
       License type: Development
       Generation date: 20-04-2018
       Company name: Coinomi Ltd.
   JxBrowser 6.22.1 was released on 7 December 2018:
       https://teamdev.com/jxbrowser/releases/2018/v6-22-1/

4. browsercore64.exe, the process in figure 1, is JxBrowser's Chromium engine
   jar entry com/teamdev/jxbrowser/chromium/internal/chromium.win64.properties
       SHA-256 26f10026d8e822858752199352d74203e11fdd52bfbb7aa4c21b8ea8234501e1
       header: #Thu Dec 06 10:43:28 EET 2018
       lists:  browsercore64.exe=785952, browsercore64.dll=98263552
   jar entry chromium-win64.7z (45,310,206 bytes)
       SHA-256 e5f047f49156ad598725c60851ba6c417822198a249956d9c05d21c68a114157

5. The shipped Chromium engine contains the spelling request seen in figure 1
   browsercore64.dll from chromium-win64.7z
       SHA-256 d40eadb743051edad32a27557d77ef3b0c7be3eee828a7a8fd8fbc21f8340e33, 98,263,552 bytes
   Text found in it (strings of 8 or more printable characters):
       Chrome/64.0.3282.24
       https://www.googleapis.com/rpc
       {"method":"spelling.check","apiVersion":"v%d","params":{"text":%s,"language":"%s","originCountry":"%s","key":%s}}
       dummytoken
       https://redirector.gvt1.com/edgedl/chrome/dict/
   These are the endpoint, the request template, the placeholder key and the dictionary server of figure 1.
   Chromium's own source code for that exact version (tag 64.0.3282.24) holds the same request template:
       https://chromium.googlesource.com/chromium/src/+/refs/tags/64.0.3282.24/components/spellcheck/browser/spelling_service_client.cc
   and defines the placeholder key used when no Google API key is built in:
       https://chromium.googlesource.com/chromium/src/+/refs/tags/64.0.3282.24/google_apis/google_api_keys.cc
       #define DUMMY_API_TOKEN "dummytoken"   /   #define GOOGLE_API_KEY DUMMY_API_TOKEN

6. Coinomi's own code never changed the spell-check setting
   The jar holds 6,516 compiled classes.
   Classes outside com/teamdev (Coinomi's code and its other libraries) that contain the text "spell",
   in any letter case: 0
   Control, classes inside com/teamdev (JxBrowser) that contain it: 20
       (so the search finds the text where it exists; JxBrowser's spell-check API is SpellCheckerService)
   Classes or files that contain "disable-google-traffic" (the switch JxBrowser 6.23 added on 21 Feb 2019): 0
   So version 1.0.4 ran JxBrowser's default, which its documentation states:
       "By default spell checker is enable and configured to use English (en-US) language. Chromium engine
        checks text in all text fields and text areas on the loaded web page"
       https://teamdev.com/jxbrowser/docs/6/guides/spell-checker/

7. Coinomi's own interface code: the recovery-phrase boxes do not switch spell check off
   The wallet's screens are a web application inside the jar, written by Coinomi:
   jar entry ui/static/js/app.667c2ad68355c1d62a0e.js
       SHA-256 4cab18d18a4303b0b341f5a0c85104109839314301583fd2d70890c7b88b1946
   The "Restore wallet" screen (class "restore-wallet", heading "Restore wallet") creates its input as:
       s("textarea",{directives:[{name:"model",rawName:"v-model",value:e.seed,expression:"seed"},
         {name:"focus",rawName:"v-focus"}],class:{invalid:e.invalid},domProps:{value:e.seed}, ...
   A second recovery-phrase box (shown after "Forgot password?") is created as:
       s("textarea",{directives:[{name:"model",rawName:"v-model",value:e.seed,expression:"seed"},
         {name:"focus",rawName:"v-focus"}],attrs:{placeholder:e.$t("Type your recovery phrase here")}, ...
   Neither sets the HTML attribute spellcheck="false", which tells a browser engine not to spell-check a
   field. The word "spellcheck" occurs 0 times in this file. (It occurs once in the bundled Vue framework,
   vendor.a2fd9db1e130d068ede6.js, only in Vue's list of known attribute names.) The box's contents are
   held in a variable named "seed".
   The behaviour of the second box was not tested in 2019; it uses the same unprotected kind of field.

8. The signed build users downloaded is the same program
   files/coinomi-wallet-1.0.4-win64_signed.exe
       SHA-256 3d790fffcc72130d9b98b9fa21a6bc670b5775e9b3227537c5097eee9c75313e
   Both installers unpack to the same 108 files under app/. Three differ in bytes:
       app/Coinomi.exe                  Windows code signature added
       app/coinomi-wallet-win64.jar     7,343 entries unsigned, 7,345 signed: the two added entries are
                                        META-INF/COINOMI_.RSA and META-INF/COINOMI_.SF (the jar signature)
                                        and META-INF/MANIFEST.MF changed; every other entry has the same CRC
       app/jre/lib/rt.jar               same 18,513 entries with the same CRCs, repacked
   So the signed release contains the same JxBrowser 6.22.1 engine and the same interface code.

9. How to repeat it (Linux)
   innoextract -s -d out coinomi-wallet-1.0.4-win64_UNSIGNED.exe
   sha256sum out/app/coinomi-wallet-win64.jar
   unzip -p out/app/coinomi-wallet-win64.jar com/teamdev/jxbrowser/chromium/product.info
   unzip -p out/app/coinomi-wallet-win64.jar com/teamdev/jxbrowser/chromium/internal/chromium.win64.properties | grep browsercore
   unzip -o out/app/coinomi-wallet-win64.jar chromium-win64.7z && 7z x chromium-win64.7z browsercore64.dll
   strings -n 8 browsercore64.dll | grep -E 'googleapis.com/rpc|spelling.check|^dummytoken$|Chrome/64'
   mkdir classes && cd classes && unzip -q ../out/app/coinomi-wallet-win64.jar -x chromium-win64.7z
   find . -name '*.class' | wc -l
   grep -rli -a spell --include='*.class' . | grep -vc '^./com/teamdev/'
   grep -rli -a spell --include='*.class' com/teamdev | wc -l
   grep -o 's("textarea",{[^}]*}[^}]*}[^}]*}' ui/static/js/app.667c2ad68355c1d62a0e.js
   grep -ci spellcheck ui/static/js/app.667c2ad68355c1d62a0e.js