Question regarding infected configs

[15]

sorry if wrong category, looked around but couldnt find anywhere else to post.

I am aware that there already are threads regarding infected configs and even a tool to scan for them but im looking for a list of red flags to avoid, please post any if you can.
for example 
base64, chromedriver.exe request header, webhooks
thanks in advance

[24]

no problem, thank you!

[1.554]

A clipper, as referenced here, would access your clipboard and attempt to swap crypto addresses when you try to paste them. The examples I've seen attempt to persist on a system by copying code to the user's %appdata% or %localappdata% then modify the registry to add itself as a startup item.

If you don't know what you're looking at in a config, either use a detection tool or RTFM.