Sorry for bumping, I found some new information...
A new link got added about a Bitcoin generator on some Tor forum.

"Bitcoin generator.exe" 51.735    bytes.
SHA256: 1f39c2b55839ffb833f653c44a6274230f6e61710c03153356911cd8cdd42f7b
Virustotal: https://www.virustotal.com/file/1f39c2b55839ffb833f653c44a6274230f6e61710c03153356911cd8cdd42f7b/analysis/

I found this thread due the fact he still uses c:\windows\mcfartietrby.exe
I also found this email in the binary data: seren1ty0wns@gmail.com

Threatexpert for the file: http://www.threatexpert.com/report.aspx?md5=ede9632fc341e0279bb3f8a49b8730f1