Newbie trying to import electrum file to electrum wallet

pooya87

legendary

Activity: 3472

Merit: 10611

Keep in mind that wallets never use text files (.txt) for their wallet file. They always use .dat, .json or in case of Electrum no extension (even though the file is a json). If you have text files with plain text in them then they weren't created by any wallet.

And to be honest the file you have looks like one of those scam files they sell on the internet promising that there is a fortune in it but in reality they are fake.
If you don't recall creating this file and you used to buy stuff in the darknet there is a good chance this file is one of them.

Quote from: alexislennon on March 11, 2021, 06:50:23 PM

how can i upload a zip file to here

Mega allows you to share a folder on your account with others with a special link. You won't need to upload it anywhere else, just move that solo file to another folder and share the link to that.
You can double check the link is not sharing too much by opening it yourself in private browsing (incognito).

alexislennon

newbie

Activity: 8

Merit: 0

I was just going to upload the zip file with only the password decoder file in it

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: 20kevin20 on March 11, 2021, 06:03:20 AM

I would suggest not uploading the executable file yet. Perhaps PasswordDecoder is a TXT file (or some other format) that has had just its extension edited. I used to do that before to camouflage some text, lol. Might contain sensitive info.

Not possible in this case. OP has file extensions turned off so if this was actually a text file, it would've been called PasswordDecoder.exe but have a notepad icon on it.

Besides, all Windows programs start with the hex string "0x50 0x45 0x00 0x00", somebody can use a text editor to easily verify this is the case for this executable as well.

Quote from: 20kevin20 on March 11, 2021, 06:03:20 AM

Do you have any antivirus installed? When you unzip an archive, Windows usually automatically removes files that are considered suspicious. Check Windows Defender (or any other antivirus that you might have installed) and see if the PasswordDecoder file has been quarantined (or removed) by it.

The antivirus does not mark downloaded internet files as suspicious, Windows itself does. Files downloaded using the programming API of Windows have an Alternate Data Stream (ADS) created inside the file that marks the file as "Downloaded from the internet" and then shows the "This file cannot be verified" warning when you try to run a program with this ADS inside (it has no special meaning for regular files files and folders). If a ZIP folder that has this Alternate Data Stream inside it, then all files you extract from it also get this ADS tagged on it. It never ever passes through an antivirus unless is has some real-time protection thingy turned on.

https://hshrzd.wordpress.com/2016/03/19/introduction-to-ads-alternate-data-streams/

^--- this is additional information, you do not need to understand it to solve this problem!

Quote from: 20kevin20 on March 11, 2021, 06:03:20 AM

If your AV has quarantined the file, restore it. Right click the file and go to "Open with -> Notepad". Is there any intelligible text in it or just random, weird characters?

Blue part is a bad idea (and not because you disagreed with me above) because Notepad will freeze if you open files that are several megabytes large.

Quote from: alexislennon on March 11, 2021, 06:50:23 PM

how can i upload a zip file to here

You need to use a file uploading service.

Gofile (https://gofile.io/) is my preferred file uploaded because it automatically deletes the files after a certain period of time if nobody downloads from them.

I still do not recommend uploading the entire ZIP file just yet (despite what other people said above) let's see what happens when the EXE is uploaded by itself and what it actually does. Then once we find out you can PM the other files to some trusted members on this board.

My worry is that the files could have private keys hidden inside them that someone could steal if you post them publicly.

HCP

legendary

Activity: 2086

Merit: 4363

Quote from: alexislennon on March 11, 2021, 06:50:23 PM

how can i upload a zip file to here

You can't directly host files here... you will need to upload it to a file hosting service of some description and then post the link here.

alexislennon

newbie

Activity: 8

Merit: 0

how can i upload a zip file to here

HCP

legendary

Activity: 2086

Merit: 4363

Quote from: 20kevin20 on March 11, 2021, 06:03:20 AM

Do you have any antivirus installed? When you unzip an archive, Windows usually automatically removes files that are considered suspicious. Check Windows Defender (or any other antivirus that you might have installed) and see if the PasswordDecoder file has been quarantined (or removed) by it.

If your AV has quarantined the file, restore it. Right click the file and go to "Open with -> Notepad". Is there any intelligible text in it or just random, weird characters?

Not entirely sure telling someone to override an AV quarantine on an executable file of dubious origins is really a good idea unless they know exactly what they're doing and how to deal with it properly... it's just as likely that the entire .zip file was actually "acquired" from a scammer/phishing site promising "bIg DoLlaZ!!!11!!1!!!" and that the passworddecoder is actually malware designed to install a RAT or clipboard hijacker or steal private keys/wallets etc.

Granted, Windows Defender can be a bit overzealous at times (it still often flags Electrum as being "suspect", regardless of how many times I report it as "Safe" Undecided

)... but still, unless the OP has a VM they can play with it in... they should not just be blindly removing files from quarantine.

20kevin20

legendary

Activity: 1134

Merit: 1599

I would suggest not uploading the executable file yet. Perhaps PasswordDecoder is a TXT file (or some other format) that has had just its extension edited. I used to do that before to camouflage some text, lol. Might contain sensitive info.

Do you have any antivirus installed? When you unzip an archive, Windows usually automatically removes files that are considered suspicious. Check Windows Defender (or any other antivirus that you might have installed) and see if the PasswordDecoder file has been quarantined (or removed) by it.

If your AV has quarantined the file, restore it. Right click the file and go to "Open with -> Notepad". Is there any intelligible text in it or just random, weird characters?

Would you mind counting how many characters the long string of characters the "bitcoin" file contains? PS: don't use a website to help you count the characters!)

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: alexislennon on March 11, 2021, 05:27:26 AM

In regards to the password decoder, I can only see that file in the zipped folder. once I unzip it it is no longer there- how can i use it to decode the files?

This is an unknown program so don't run it on your laptop in case it is actually a virus.

My suggestion is to upload the "PasswordDecoder" file (only that one, not any of the others) using some file upload service and post it here for us to inspect.

I have a sandboxed Windows virtual machine which I can run it on.

alexislennon

newbie

Activity: 8

Merit: 0

awhile back i used it to purchase soe stuff on the dark web if i remember correctly.

that was on a different computer that i no longer own. at some point i started using mega.nz to store my files but forgot about it until recently.

none of the strings of letters in this file begin with "5H" "5J" "5K" There are no 12 words strings or anything that begins with 1, 3 or bc 1

In regards to the password decoder, I can only see that file in the zipped folder. once I unzip it it is no longer there- how can i use it to decode the files?

HCP

legendary

Activity: 2086

Merit: 4363

Quote from: alexislennon on March 11, 2021, 03:22:44 AM

I can barely figure out how to use this forum

I tried to add a screenshot in my last post but the system removed it. I unzipped the solder and it has the same contents
those files are

FILE NAME FILE TYPE contents of file

bitcoin text doc long string of letters and numbers beginning with 8fr
bitgo text doc long string of letters and numbers beginning with j8z
eth text doc long string of letters and numbers beginning with FVE
keys text doc long string of letters and numbers beginning with SCO
passworddecoder application This file is not showing in the unzipped folder, only shows in the zipped
private text doc long string of letters and numbers beginning with XWW

Quote from: alexislennon on March 11, 2021, 03:40:16 AM

Here is the screen shot of the zipped folder contents

Honestly, none of that looks like it has anything to do with Electrum... The "Bitcoin" one might be an encrypted wallet file, but I suspect that it's likely just encrypted text (possibly private keys or the seed) which you need to use the "passworddecoder" app to decrypt.

Do you have any memory of how you created this .zip file and/or how it ended up in your mega.nz account? Huh

dkbit98

legendary

Activity: 2212

Merit: 7064

Quote from: alexislennon on March 11, 2021, 03:33:22 AM

well this file was stored on my mega.nz account. its like google drive/dropbox

Keeping wallet files or backup phrase on cloud, mega, dropbox or google drive is a terrible idea, and some of those files from your screenshot are unrelated with Electrum.

As you are using Windows OS you can find Electrum datadir folder in this location after you enable hidden files:

\Users\YourUserName\AppData\Roaming\Electrum
or
%APPDATA%\Electrum

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: alexislennon on March 11, 2021, 03:40:16 AM

Here is the screen shot of the zipped folder contents
https://ibb.co/m0TLKt8

Yeah, you have to post a link to the image if you are a newbie. Only Jr. Members and above can directly post images.

First of all, do you remember where you got this ZIP file from before you put it on Mega? It sounds like you may have have created it yourself from looking at the file names, but if you didn't and you didn't receive it from a trusted friend either, but instead received it from a random place on the internet, the keys in there (if there are any) could already be compromised and known to some hacker.

Do you see any text beginning with "5H" "5J" "5K" or something like that? (Do not post them here: They are your private keys which might hold money).

Do you see any line that has twelve English words in it? (Do not post it either - that's a seed phrase which you import into a wallet and contains many private keys).

Does it have any lines beginning with 1, 3, or bc1? (This is safe, it is just your public address).

I think you get the point, don't paste the contents of the files if you believe they could contain secrets.

alexislennon

newbie

Activity: 8

Merit: 0

Here is the screen shot of the zipped folder contents
https://ibb.co/m0TLKt8

alexislennon

newbie

Activity: 8

Merit: 0

well this file was stored on my mega.nz account. its like google drive/dropbox . does that answer your question? No I havent tried metamask or importing to a wallet app- i dont know what meta mask is honestly I dont know much about this stuff

Quote from: joniboini on March 11, 2021, 03:29:55 AM

Sounds like you used an encryption app to encrypt your files and then move them to a zip folder? Can't you recall anything from it? Maybe an encryption app you like in the past or something like that. Have you tried importing the "text doc" file to a wallet app, like "eth" to MetaMask or something to check if you changed the file extension?

The passworddecoder doesn't ring a bell, at least for me. Try using imgbb or imgurl to upload your image.

joniboini

legendary

Activity: 2170

Merit: 1789

Sounds like you used an encryption app to encrypt your files and then move them to a zip folder? Can't you recall anything from it? Maybe an encryption app you like in the past or something like that. Have you tried importing the "text doc" file to a wallet app, like "eth" to MetaMask or something to check if you changed the file extension?

The passworddecoder doesn't ring a bell, at least for me. Try using imgbb or imgurl to upload your image.

alexislennon

newbie

Activity: 8

Merit: 0

I can barely figure out how to use this forum

I tried to add a screenshot in my last post but the system removed it. I unzipped the solder and it has the same contents
those files are

FILE NAME FILE TYPE contents of file

bitcoin text doc long string of letters and numbers beginning with 8fr
bitgo text doc long string of letters and numbers beginning with j8z
eth text doc long string of letters and numbers beginning with FVE
keys text doc long string of letters and numbers beginning with SCO
passworddecoder application This file is not showing in the unzipped folder, only shows in the zipped
private text doc long string of letters and numbers beginning with XWW

alexislennon

newbie

Activity: 8

Merit: 0

This is a screen shot of the folders contents

https://photos.app.[Suspicious link removed]/yDiM5jQfVDH3baWs7

Quote from: HCP on March 11, 2021, 02:49:39 AM

Firstly... make a couple of copies of that .zip file as backup... Then you can experiment to your hearts content. Wink

If the files don't have any extensions to them... they *might* be wallet files... but that .zip is certainly not just the contents of the Electrum data directory zipped up... it's missing a lot of stuff... Are you able to take a screenshot of the contents of the .zip file... upload it to somewhere like imgur.com and then paste the link here?

It'll give everyone a much better idea of what we're dealing with.

BlackHatCoiner

legendary

Activity: 1512

Merit: 7340

Farewell, Leo

I guess you don't have the mnemonic phrase and thus I'll ask, inside the zip, do you have any file that contains the private keys on a wallet import format? Examples:

Code:

p2pkh: KwYsP3vaUcBT4uwZrTJigGtZA5e9t3Hj4q2rJv7eunym578EBRjo
p2pkh: KyjrcCZhFKbmNpfS75Y4UMrWWE5xKKKfBVR7FKBojcF3wipK4LTz
p2pkh: L4biJQ3Po475ejEigqsQLWcBkWazVxemrgNi7MjpyK1z1CDQKkSP
...

Code:

p2wpkh-p2sh: L2o2Z3dyqC5PcKVz2kFS1YiLmHKK2hcbXdYgzM2K9z1hmVfC7oNi
p2wpkh-p2sh: L1yFVKfpfUJ4EsdZbUCScGo8X5PLyh2cHaWZFnaW7w8oVWVWnwfY
p2wpkh-p2sh: L5kRriZcmPmSqDr5RJxdZSKJrhWzU4HpqMiwtJYQevXGKeUDKmS3
...

Code:

p2wpkh: KwF6QeysGrgxNSgqvA1X6jTtKMAExDywp3pRTf1hPTftb4t9m6Lm
p2wpkh: KyLR8kvH8jouPCN7GwbNJAwuS5M1QCgoSeMeTCh3Vv9TkJWh8FXq
p2wpkh: L29QniFbZyQXPVLV69bBU3fAxWTUHwDtZcvrkDRutVm1d5gVDqFx
...

If you do, then open your electrum, click "File" -> "New/Restore" -> Name your wallet -> "Import Bitcoin addresses or private keys" -> paste your private keys on that text field and hit "Next".

If you don't, then you may have your wallet backed up on a file without extension. Electrum probably allowed you to name that wallet file and if you open it with notepad it looks like that:

Code:

{
    "addr_history": {
        "bc1q20nh9hg3hphhj8wlq46kxm2457d3m42k0qa67u": [],
        "bc1q2rv3uwuhse7p95zs6evvygl6d9f6qpw3syyw8j": [],
        "bc1q3wdmt9zwju88hkqhfmfd6gzgxfu8nex8q4s66z": [],
        "bc1q6nze4ymafxwd604jha9hwjtunggwrhmjy6pdl9": [],
        "bc1q7ua3efyk8lzr4sq0fat0ykygz4dcm0hrs6jjvs": [],
        "bc1q8d9rydl3kpcv5tr63j93gvv8xmaxpfz26gvy8l": [],
        "bc1qa9cxqksu5wgj0774guqqefsvvzk29d8dj2mnnm": [],
        "bc1qcpk4p290xxvt6z8vcuhye2k408yqhgvtr6v28v": [],
        "bc1qctyr29wt6kc5mqn6cw0qy6dnlkh5jag92empvw": [],
        "bc1qf3n2r7dtle700dn8xg58tmqsu63f6593nvherc": [],
        "bc1qf84lg2y9zfltg9rnpptgkgst0fwvvyr43vsex6": [],
        "bc1qflpjcdfdr2z4rhu44klsqvn2sntgaj3dng4zrv": [],
        "bc1qghnqw0tye4n6m8t025glwjj08xmga3q48f3z6z": [],
        "bc1qgmvqf7zd9d70hh76eh8d2m27kpfk2uekkt2y0t": [],
        "bc1qh7y9je4mhqt5gx22anhayfasj5ekxy8fjdp9lq": [],
        "bc1qjp0rck7nt0jpjnegmyyd87zvc8vcn77a06hnpg": [],
        "bc1ql9mzrm8k70a89svtw6sexwfjh8akxsamztjgqu": [],
        "bc1qlspsh0et7gqnzhne0qymf67zxl725rr742jk95": [],
        "bc1qmjp4ec6cje5zc575rxnrllylehxmh8dm5d7zzr": [],
        "bc1qmy6t2gqxmm2h2lv02u3j9jdx9f43a8sxtnxwzw": [],
        "bc1qnltt9raarllfaxqzs9ku35g9kvslqky4xlztc5": [],
        "bc1qrw3z8phx3d9ku65rqkr5lvehqd4k6thaua6fk2": [],
        "bc1qsqs96utjpyl7ws3vxmvmcgrqcypwdenhfa9j7u": [],
        "bc1qt5kkc728y92e3evdr3sy97rwxkk2jrl9f2vg3x": [],
        "bc1qw0kpz4j7duj9hvqs29hnhl0f52qyku2dlrkstc": [],
        "bc1qwc67vyscqwm75tcech7h6rd9cx2x5g5g55zt7g": [],
        "bc1qx2a77mvddf7vazmw5r3y0sgx6p6tdh0t9nwlep": [],
        "bc1qx447sdgjk4ev23cs3cp9w64t9y8z5akrh5s9t5": [],
        "bc1qz40eqgzc37lxdn6nvq3ygk08aa3ya6uy0x2k5g": [],
        "bc1qz552fmlgdxphfdzcguxw835j5tu7njyvzqsxdg": []
    },
    "addresses": {
        "change": [
            "bc1qjp0rck7nt0jpjnegmyyd87zvc8vcn77a06hnpg",
            "bc1qf3n2r7dtle700dn8xg58tmqsu63f6593nvherc",
            "bc1qmy6t2gqxmm2h2lv02u3j9jdx9f43a8sxtnxwzw",
            "bc1qsqs96utjpyl7ws3vxmvmcgrqcypwdenhfa9j7u",
            "bc1qctyr29wt6kc5mqn6cw0qy6dnlkh5jag92empvw",
            "bc1qx447sdgjk4ev23cs3cp9w64t9y8z5akrh5s9t5",
            "bc1q2rv3uwuhse7p95zs6evvygl6d9f6qpw3syyw8j",
            "bc1q6nze4ymafxwd604jha9hwjtunggwrhmjy6pdl9",
            "bc1qlspsh0et7gqnzhne0qymf67zxl725rr742jk95",
            "bc1qw0kpz4j7duj9hvqs29hnhl0f52qyku2dlrkstc"
        ],
        "receiving": [
            "bc1q20nh9hg3hphhj8wlq46kxm2457d3m42k0qa67u",
            "bc1qghnqw0tye4n6m8t025glwjj08xmga3q48f3z6z",
            "bc1q7ua3efyk8lzr4sq0fat0ykygz4dcm0hrs6jjvs",
            "bc1q3wdmt9zwju88hkqhfmfd6gzgxfu8nex8q4s66z",
            "bc1q8d9rydl3kpcv5tr63j93gvv8xmaxpfz26gvy8l",
            "bc1qmjp4ec6cje5zc575rxnrllylehxmh8dm5d7zzr",
            "bc1qz40eqgzc37lxdn6nvq3ygk08aa3ya6uy0x2k5g",
            "bc1qf84lg2y9zfltg9rnpptgkgst0fwvvyr43vsex6",
            "bc1ql9mzrm8k70a89svtw6sexwfjh8akxsamztjgqu",
            "bc1qnltt9raarllfaxqzs9ku35g9kvslqky4xlztc5",
            "bc1qrw3z8phx3d9ku65rqkr5lvehqd4k6thaua6fk2",
            "bc1qgmvqf7zd9d70hh76eh8d2m27kpfk2uekkt2y0t",
            "bc1qx2a77mvddf7vazmw5r3y0sgx6p6tdh0t9nwlep",
            "bc1qcpk4p290xxvt6z8vcuhye2k408yqhgvtr6v28v",
            "bc1qa9cxqksu5wgj0774guqqefsvvzk29d8dj2mnnm",
            "bc1qt5kkc728y92e3evdr3sy97rwxkk2jrl9f2vg3x",
            "bc1qh7y9je4mhqt5gx22anhayfasj5ekxy8fjdp9lq",
            "bc1qflpjcdfdr2z4rhu44klsqvn2sntgaj3dng4zrv",
            "bc1qwc67vyscqwm75tcech7h6rd9cx2x5g5g55zt7g",
            "bc1qz552fmlgdxphfdzcguxw835j5tu7njyvzqsxdg"
        ]
    },
    "channel_backups": {},
    "fiat_value": {},
    "invoices": {},
    "keystore": {
        "derivation": "m/0'",
        "pw_hash_version": 1,
        "root_fingerprint": "41bd2529",
        "seed": "void student sugar dice divert expose buffalo service sheriff size oppose wreck",
        "type": "bip32",
        "xprv": "zprvAZ3hVcaU1cvoxexDGTgft4EGA7uQfQXTVwCavz3g71HfDMENptQo4YMUoMzByqACHcuZaLUdjjXG8vjuudKbdo4vAGDQCHi8Wa7yGuQruRL",
        "xpub": "zpub6n33u87MqzV7B92gNVDgFCAzi9ju4sFJsA8BjNTHfLpe69ZXNRj3cLfxedEnnnEgcwrde2vpvmNYJDR5wXPWihVVF6TwzFqCgR2HicLzrkZ"
    },
    "labels": {},
    "payment_requests": {},
    "prevouts_by_scripthash": {},
    "seed_type": "segwit",
    "seed_version": 32,
    "spent_outpoints": {},
    "transactions": {},
    "tx_fees": {},
    "txi": {},
    "txo": {},
    "use_encryption": false,
    "verified_tx3": {},
    "wallet_type": "standard"
}

You just open that file with electrum.

You may receive private messages from users that "want to help you". It may be meaningless to mention, but:

Never reveal any private key(s).
Never reveal any seed or mnemonic phrase.
Never give your wallet file to anyone.
Do not download any "legit" program that will "help" you recover your funds.

HCP

legendary

Activity: 2086

Merit: 4363

Firstly... make a couple of copies of that .zip file as backup... Then you can experiment to your hearts content. Wink

If the files don't have any extensions to them... they *might* be wallet files... but that .zip is certainly not just the contents of the Electrum data directory zipped up... it's missing a lot of stuff... Are you able to take a screenshot of the contents of the .zip file... upload it to somewhere like imgur.com and then paste the link here?

It'll give everyone a much better idea of what we're dealing with.

ranochigo

legendary

Activity: 3038

Merit: 4418

Crypto Swap Exchange

Electrum backups are not in zip files. It was probably archived as a zip file by the user. Do you happen to have 12 word phrases or seeds?

Try extracting it to a directory and finding files without any extension. You can try importing them into Electrum by selecting "Choose..." when it prompts you to create a new wallet and select the file that you think is from an older Electrum backup.

alexislennon

newbie

Activity: 8

Merit: 0

I have an electrum.zip file from a couple years ago. I have not unzipped it but I can see inside that the zip file has a few files .
Those files are
Bitcoin
Bitgo
Eth
Keys
password decoder
Private

I have downloaded the electrum wallet from electrum org but I am very confused what to do next. I have been reading this forum for hours but im having a hard time understanding what to do. Would you mind explaining to me, in the simplest terms possible, instructions so I can access this wallet?

Topic: Newbie trying to import electrum file to electrum wallet (Read 179 times)