Suspicious activity

[gamethrower]

Why does builder from releases behave differently from one I compiled myself? Your release contacts some IPs and domains. For some reason it launches Firefox.

[UnamSanctam]

No it doesn't.

[gamethrower]

[UnamSanctam]

You can decompile the program with something like ILSpy and look at the code yourself. I don't know what you're checking it with but it might be clicking these or something:

    private void labelGitHub_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
    {
        Process.Start("https://github.com/UnamSanctam/SilentXMRMiner");
    }

    private void labelHackforums_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
    {
        Process.Start("https://hackforums.net/showthread.php?tid=5995773");
    }

    private void labelWiki_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
    {
        Process.Start("https://github.com/UnamSanctam/SilentXMRMiner/wiki");
    }

[gamethrower]

It's VirusTotal Behavior check. When I upload builder that I compiled myself it doesn't do anything like this.

[UnamSanctam]

You would have to ask VirusTotal, you can check the code in with ILSpy and you'll see that it's an exact copy of when you compile it.

[UnamSanctam]

Maybe our compile settings are different or something, like in the folder .vs

[UnamSanctam]

I've reuploaded a build after I cleared the Visual Studio settings, you can test that one.

[Khizhniak]

👀

[gamethrower]

I've reuploaded a build after I cleared the Visual Studio settings, you can test that one.

Where? You didn't upload anything.

[UnamSanctam]

I replaced the current version.

[gamethrower]

It says last update was 26 days ago.

[UnamSanctam]

Yes but I replaced the .zip file of that release. Try it and see.

[UnamSanctam]

Since it's not a new release but just a compile of the current one without the Visual Studio settings that contacted those servers which I would guess is something like Microsofts telemetry.

[gamethrower]

Now it's identical to my version. I hope it wasn't stealer or something.

[UnamSanctam]

You can check the code of the .exe like I said earlier with something like ILSpy, it's not obfuscated. And the miner is 2 years old now without anything like it.

[Khizhniak]

🎉I knew UnamSanctam is great guy!

[Khizhniak]

@gamethrower You already can close this issue.