not an issue , process doing the copy ?

[faheemadam]

not an issue, but is it not possible to have a feature or option where you can see what process is actually copying or replacing in the clipboard ? i have a malware which is replacing the crypto addresses and this tool is ideal to assist in identifying what process is replacing the copied address. i know sysmon can do this also but sysmon fails to detect any process information

[Willy-Kimura]

You can try using the ClipboardChanged event and accessing the e.SourceApplication.Name event argument to capture the name of the executable copying text from the clipboard. Furthermore with the e.SourceApplication event argument, you can capture such details as the executable's process ID and path. Here's an example:

private void ClipboardChanged(Object sender, SharpClipboard.ClipboardChangedEventArgs e)
{
    // Gets the executable's name.
    Debug.WriteLine(e.SourceApplication.Name);

    // Gets the executable's window title.
    Debug.WriteLine(e.SourceApplication.Title);

    // Gets the executable's process ID.
    Debug.WriteLine(e.SourceApplication.ID.ToString());

    // Gets the executable's path.
    Debug.WriteLine(e.SourceApplication.Path);
}