OP 29 November, 2021 - 09:55 PM
Thursday 11/25/2021, I downloaded a program called TSP DorkGen V15 and it contained a BTC clipper, and thankfully I noticed. Making this thread so yall could be informed and to stay safe. (I TSP in sandboxed, but the clipper somehow escaped).
Clipper Details -
Command line of the clipper: "C:\Windows\IMF\Runtime Explorer.exe"
Current Directory: C:\Sandbox\User\DefaultBox\drive\C\Windows\IMF\
PEB address: 0x32e000 (32-bit: 0x32f000)
Parent Process: Windows Services.exe (58796)
It runs as a unverified version of a Microsoft Windows Process
Be careful, Stay safe.
Clipper Details -
Command line of the clipper: "C:\Windows\IMF\Runtime Explorer.exe"
Current Directory: C:\Sandbox\User\DefaultBox\drive\C\Windows\IMF\
PEB address: 0x32e000 (32-bit: 0x32f000)
Parent Process: Windows Services.exe (58796)
It runs as a unverified version of a Microsoft Windows Process
Be careful, Stay safe.