The code in question is here: https://pastebin.com/raw/mc7psaNF
It appears to be normal Adform code plus two appended chunks at the end.
Bitcoin: bc1qmplgt0hcg62jc2guz86wn2sms7tqrsulkkrrls
Ethereum: 0xE7983E69df17079ADb0aD7b3458488Cac0dBc573
TRON: TW4AgGnDc2Pk6YAynCtjCKzoKYWPg7nJe (?)
~$110k bitcoin
https://www.blockchain.com/explorer/addresses/btc/bc1qmplgt0...
~$55k in ETH
https://www.blockchain.com/explorer/addresses/eth/0xE7983E69...
It's absolutely nuts that there's so much volume of low effort cryptocurrency transfers that replacing clipboard contents with a different wallet address on people not blocking ads on a specific ad network nets anything at all
The bitcoin one has moved the bulk of the funds (minus like $500) to this address: https://www.blockchain.com/explorer/addresses/BTC/bc1qjekyd0...