Bitcoin Forum
May 07, 2024, 11:49:41 AM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: strange metadata in wallet-qt  (Read 276 times)
bumbacoin (OP)
Legendary
*
Offline Offline

Activity: 1638
Merit: 1036



View Profile
September 23, 2017, 04:00:24 AM
 #1

i just pulled apart a windows wallet.exe and am very surprised to find a large bunch of random metadata inside.
i'm wondering why such metadata might be in there ??



the file is bitcoinplanet-qt.zip
i've uploaded to https://drive.google.com/open?id=0B5j8d4FSc7drd0l6a0JraFJzTVE

original version here https://bitcointalk.org/index.php?topic=1971728.0

virustotal https://www.virustotal.com/#/file/ba67f73ce7d4f0dd73acb88bda26e7c784d8f42a2ab5f3494b6b2fc7bf7701a1/detection


using 7zip option to extract data from bitcoinplanet-qt.exe
i then opened the file .rdata in wordpad.

for large extract see https://pastebin.com/zYJQNfbN

and here's a sample of text/metadata (the pastebin is much larger)

Quote
  Cannot remove source file  QFile::copy: Empty or null file name Cannot open %1 for input %1/qt_temp.XXXXXX Cannot open for output Failure to write block Cannot create %1 for output   .. . *  default QDir::mkdir: Empty or null file name    QDir::rmdir: Empty or null file name    QDir::mkpath: Empty or null file name   QDir::rmpath: Empty or null file name   QDir::remove: Empty or null file name   QDir::exists: Empty or null file name // ../ . * NoFilter Dirs AllDirs Files Drives NoSymLinks NoDot NoDotDot AllEntries Readable Writable Executable Modified Hidden System CaseSensitive QDir::Filters( QDir( , nameFilters = { },  QDir::SortFlags(NoSort) Name Time Size Unsorted DirsFirst DirsLast IgnoreCase LocaleAware Type QDir::SortFlags( .. :/..   QDir::setSearchPaths: Prefix must be longer than 1 character    QDir::setSearchPaths: Prefix can only contain letters or numbers    QDir::rename: Empty or null file name(s)    \x \u \U 0123456789ABCDEF :: QFlags< >( QFlags(         sakae.chiba.jp equipment.aero bjerkreim.no gyeonggi.kr jeep chieti.it landrover genoa.it ugim.gov.pl rishirifuji.hokkaido.jp tomiya.miyagi.jp foodnetwork bananarepublic krødsherad.no swiftcover wtc unusualperson.com unazuki.toyama.jp wtf forgot.his.name dyndns.org ma.leg.br cci.fr الاردن hiroo.hokkaido.jp showa.gunma.jp yawata.kyoto.jp help name.vn cagliari.it game-host.org 埼玉.jp trust dagestan.ru pokrovsk.su cmw.ru tokamachi.niigata.jp hirono.fukushima.jp forlicesena.it tsushima.nagasaki.jp sci.eg 箇人.hk kawaba.gunma.jp ookuwa.nagano.jp masuda.shimane.jp xbox servep2p.com portal.museum blog.br dagestan.su fukushima.jp newholland merseine.nu ditchyourip.com iraq.museum bronnoy.no ogasawara.tokyo.jp furukawa.miyagi.jp takayama.nagano.jp name.tj mb.ca koto.tokyo.jp loyalist.museum gdansk.pl chosei.chiba.jp nagawa.nagano.jp cheltenham.museum casadelamoneda.museum name.tr dønna.no name.tt futuremailing.at al.no trentinoa-adige.it herad.no kizu.kyoto.jp Ã¥krehamn.no katagami.akita.jp østre-toten.no johana.toyama.jp kawasaki.miyagi.jp cc.in.us dnsdojo.com cc.de.us 手表 toki.gifu.jp georgia.museum gs.tr.no ri.it an.it house.museum is-a-musician.com servehttp.com oto.fukuoka.jp å¾®åš mtpc nordkapp.no boxfuse.io shell.museum alipay mt.eu.org æ±äº¬.jp softbank yashio.saitama.jp mutsuzawa.chiba.jp nowtv ina.ibaraki.jp hembygdsforbund.museum xin loppa.no judygarland.museum here scjohnson firm.ht suita.osaka.jp assn.lk saikai.nagasaki.jp mo-i-rana.no spiegel sites.static.land skydiving.aero homegoods hino.tokyo.jp phoenix.museum kvalsund.no firm.in k12.ia.us heguri.nara.jp name.qa guru lego florø.no name.pr 長野.jp palermo.it control.aero verona.it traniandriabarletta.it takamori.kumamoto.jp skedsmo.no kyotamba.kyoto.jp itami.hyogo.jp clubmed star ginowan.okinawa.jp name.na griw.gov.pl name.mv mormon name.ng fvg.it name.my tomsk.ru altoadige.it school.museum gs.jan-mayen.no md.ci firm.co andøy.no mari-el.ru lib.az.us wanouchi.gifu.jp higashiyamato.tokyo.jp textile.museum kitakami.iwate.jp mansions.museum randaberg.no chrysler udm.ru cc.ny.us is-a-guru.com eisenbahn.museum eun.eg herøy.møre-og-romsdal.no praxi firm.dk domains parachuting.aero mb.it ap.it travel muko.kyoto.jp tsukiyono.gunma.jp freiburg.museum higashiyama.kyoto.jp 愛知.jp al.us kamagaya.chiba.jp ibaraki.ibaraki.jp chikuhoku.nagano.jp mima.tokushima.jp noheji.aomori.jp edu.ac redirectme.net tahara.aichi.jp edu.af taxi.br name.mk med.br edu.al nishitosa.kochi.jp stpetersburg.museum salon edu.ba edu.ar edu.bb gyeongnam.kr *.0emm.com shimoichi.nara.jp civilaviation.aero edu.au la-spezia.it seiyo.ehime.jp edu.bh is-very-bad.org edu.bi edu.az k12.ct.us b.ssl.fastly.net edu.bm name.jo edu.bo dyndns-wiki.com edu.br ë‹·ì»´ edu.bs flog.br edu.bt onjuku.chiba.jp otoyo.kochi.jp benevento.it edu.ci in-addr.arpa edu.bz art.br history.museum brother med.ec meteorapp.com agr.br edu.cn med.ee naka.hiroshima.jp kamimine.saga.jp edu.co rishiri.hokkaido.jp edu.cu shinjo.nara.jp nesset.no edu.cw click é¤åŽ… lib.ga.us كوم is-a-bookkeeper.com samara.ru ainan.ehime.jp edu.dm edu.do cc.ok.us fujisawa.iwate.jp edu.ec vlog.br edu.ee hamatonbetsu.hokkaido.jp datsun my.eu.org edu.eg football art.do rm.it lt.it edu.dz ar.it juedisches.museum e4.cz a.prod.fastly.net ri.us norddal.no art.dz edu.es edu.et geisei.kochi.jp kasaoka.okayama.jp bergen.no kujukuri.chiba.jp ochi.kochi.jp ladbrokes foundation ven.it style edu.ge okayama.jp takahama.aichi.jp shimofusa.chiba.jp family godaddy read edu.gh imakane.hokkaido.jp edu.gi shioya.tochigi.jp გე edu.gl skjak.no med.ht gifu.jp edu.gn culturalcenter.museum edu.gp is-a-llama.com edu.gr skanland.no edu.gt inagi.tokyo.jp mobara.chiba.jp creditunion edu.gy community osaka.jp historisch.museum edu.hk bálát.no press.aero pri.ee edu.hn sa.au ulvik.no barreau.bj edu.ht asaka.saitama.jp birkenes.no evje-og-hornnes.no pomorze.pl firm.ve siena.it nysa.pl est-a-la-maison.com paris.eu.org brussels withgoogle.com ikawa.akita.jp Ã¥mot.no credit art.ht midori.gunma.jp kazo.saitama.jp komatsushima.tokushima.jp edu.in pavia.it mihara.kochi.jp aridagawa.wakayama.jp transport.museum sodegaura.chiba.jp edu.iq edunet.tn edu.is lib.md.us امارات edu.it kawakita.ishikawa.jp go.ci 石å·.jp accountants act.edu.au xj.cn kurgan.ru s3-us-gov-west-1.amazonaws.com yashiro.hyogo.jp sa.cr alabama.museum pasadena.museum ro.im gs.svalbard.no go.cr edu.jo ap-northeast-2.compute.amazonaws.com sakai.fukui.jp ro.it miyama.fukuoka.jp extraspace memorial.museum at.it nl.eu.org edu.kg xxx بيتك us-west-2.compute.amazonaws.com toya.hokkaido.jp edu.ki suldal.no kurgan.su enebakk.no groks-the.info edu.km tiffany 佛山 edu.kn anthropology.museum baghdad.museum edu.kp edu.la edu.lb med.ly تونس edu.lc kafjord.no ueno.gunma.jp edu.ky vinnytsia.ua xyz edu.kz edu.lk misato.saitama.jp mus.br monza.it torahime.shiga.jp ichikai.tochigi.jp katori.chiba.jp edu.lr shikama.miyagi.jp vestnes.no banamex edu.me edu.lv edu.mg edu.ly orientexpress team edu.mk inderøy.no ru.com se.com edu.ml taiki.hokkaido.jp edu.mn nyc.museum firm.ro from-fl.com varese.it edu.mo isumi.chiba.jp a.ssl.fastly.net edu.ms imari.saga.jp edu.mt edu.mv med.om edu.mw edu.ng edu.mx amot.no lom.it edu.my edu.ni hiji.oita.jp edu.mz med.pa goto.nagasaki.jp freebox-os.fr yamazoe.nara.jp 天主教 

💦☔️🐳💚💖💛
go to
cryptobetfair.com
ask for a voucher

████████████████
██████████████
█████████████
██████████████
██████████████
███████████
█████████
███████████
████████████
████████████
███████████
█████████████
██████████████
███████████████
████████████████
████████████████
🐠👻🍗🌳🐵
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
bumbacoin (OP)
Legendary
*
Offline Offline

Activity: 1638
Merit: 1036



View Profile
September 23, 2017, 04:21:25 AM
 #2


i was just looking for other windows qt's (that i just happen to have on my hd) to look at and have found similar in this qt

https://github.com/TorCoinProject/torcoin/tree/master/release



💦☔️🐳💚💖💛
go to
cryptobetfair.com
ask for a voucher

████████████████
██████████████
█████████████
██████████████
██████████████
███████████
█████████
███████████
████████████
████████████
███████████
█████████████
██████████████
███████████████
████████████████
████████████████
🐠👻🍗🌳🐵
bumbacoin (OP)
Legendary
*
Offline Offline

Activity: 1638
Merit: 1036



View Profile
September 23, 2017, 12:49:28 PM
 #3


i did a search on the hdd for one string i pulled from the list, and it seems to appear in many qt5 files

Quote
~$ sudo grep -R "kisarazu" ./


Binary file ./mxe/usr/i686-w64-mingw32.static/bin/test-qt5.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/bin/test-qtbase-pkgconfig.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/bin/test-qttools.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/lib/libQt5Core.a matches
./mxe/usr/i686-w64-mingw32.static/qt5/include/QtCore/5.7.0/QtCore/private/qurltlds_p.h:"kisarazu.chiba.jp\0"
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/qdbusviewer.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/dumpcpp.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/qml.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/idc.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/qtpaths.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/xmlpatternsvalidator.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/qtplugininfo.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/qmltestrunner.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/qdbus.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/xmlpatterns.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/dumpdoc.exe matches
Binary file ./mxe/usr/i686-w64-mingw32.static/qt5/bin/qtdiag.exe matches

along with probably all the wallets i've compiled on the system.

💦☔️🐳💚💖💛
go to
cryptobetfair.com
ask for a voucher

████████████████
██████████████
█████████████
██████████████
██████████████
███████████
█████████
███████████
████████████
████████████
███████████
█████████████
██████████████
███████████████
████████████████
████████████████
🐠👻🍗🌳🐵
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!