Navigation X
ALERT
Click here to register with a few steps and explore all our cool stuff we have to offer!



   592

BTC Clipper (BE CAREFUL)

by ethanperrine - 29 November, 2021 - 09:55 PM
This post is by a banned member (ethanperrine) - Unhide
80
Posts
13
Threads
6 Years of service
#1
Thursday 11/25/2021, I downloaded a program called TSP DorkGen V15 and it contained a BTC clipper, and thankfully I noticed. Making this thread so yall could be informed and to stay safe. (I TSP in sandboxed, but the clipper somehow escaped).


Clipper Details -
Command line of the clipper: "C:\Windows\IMF\Runtime Explorer.exe"
Current Directory: C:\Sandbox\User\DefaultBox\drive\C\Windows\IMF\
PEB address: 0x32e000 (32-bit: 0x32f000)
Parent Process: Windows Services.exe (58796)
It runs as a unverified version of a Microsoft Windows Process
Be careful, Stay safe.
Hashbase is officially back, better than ever!
Selling a Dehasher With over 13 Hashtypes! With over 2,000,000,000 unique passwords currently, and 20,000,000,000 more passwords that will be added shortly.
It will be over triple the size of our nearest competitor with nearly 270B+ hashes

Telegram
Shop Link
This post is by a banned member (mcr) - Unhide
This post is by a banned member (Spooky) - Unhide
Spooky  
Godlike
2.160
Posts
795
Threads
6 Years of service
#3
[font]Clipboards go over Sandboxes, thats why you can copy something on ur main pc and paste in ur VM.
So it didn't really get on ur pc, its just connected.[/font]
This post is by a banned member (pruned) - Unhide
pruned  
Godlike
841
Posts
132
Threads
6 Years of service
#4
(29 November, 2021 - 09:55 PM)ethanperrine Wrote: Show More
Thursday 11/25/2021, I downloaded a program called TSP DorkGen V15 and it contained a BTC clipper, and thankfully I noticed. Making this thread so yall could be informed and to stay safe. (I TSP in sandboxed, but the clipper somehow escaped).


Clipper Details -
Command line of the clipper: "C:\Windows\IMF\Runtime Explorer.exe"
Current Directory: C:\Sandbox\User\DefaultBox\drive\C\Windows\IMF\
PEB address: 0x32e000 (32-bit: 0x32f000)
Parent Process: Windows Services.exe (58796)
It runs as a unverified version of a Microsoft Windows Process
Be careful, Stay safe.

yes there are a lot thats hwy u need a VM
Thanks Everyone  for Rep+ and Like

[Image: GQvTjMu.gif]  Fake Traffic to Earn Money [Image: GQvTjMu.gif]
Pruned#4956 

Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
or
Sign in
Already have an account? Sign in here.


Forum Jump:


Users browsing this thread: 1 Guest(s)