67bff6608e898dc46685c36616fa6d41096ea4ef5eb66d854f4237c2ed4b7eed

Analysis

user interaction
yes
max time kernel
1s
max time network
31s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solara.bat
Size 722B
Sample260930-ty4nksch55
SHA256 67bff6608e898dc46685c36616fa6d41096ea4ef5eb66d854f4237c2ed4b7eed
MD5 47b6ce46aa79bffa9ef9e061f1c3a12f
SHA1 179ebbf3a36f8ff0ac86a7fbba86f6cf0b827038
SHA512 9a9ffc840a36a7125ed82ae120015bedb904b20fd6affe5b0fb0dcfb51dccea39abc5d4013b65b718f041be8d056dc29ff3e299f4ab10c6f61d72630fff6e0ef
TLSH
T148016403AD4F8C4AD54E20E081F6A3C2E48BC05BD8682EE0D5D1243435A4284C3E7FEE
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
9948	cmd.exe
9624	cmd.exe
8560	cmd.exe
11504	cmd.exe
9828	cmd.exe
9756	cmd.exe
42136	Process not Found
41856	Process not Found
11324	cmd.exe
6672	cmd.exe
14488	cmd.exe
13452	cmd.exe
12984	cmd.exe
9276	cmd.exe
9040	cmd.exe
1704	cmd.exe
41840	Process not Found
43332	Process not Found
42192	Process not Found
13836	cmd.exe
31080	cmd.exe
4760	cmd.exe
41952	Process not Found
14520	cmd.exe
9372	cmd.exe
8660	cmd.exe
1160	cmd.exe
42224	Process not Found
41872	Process not Found
11252	cmd.exe
11148	cmd.exe
8848	cmd.exe
7288	cmd.exe
2900	cmd.exe
41800	Process not Found
42936	Process not Found
14124	cmd.exe
13640	cmd.exe
13372	cmd.exe
10048	cmd.exe
9288	cmd.exe
7300	cmd.exe
41880	Process not Found
12616	cmd.exe
10208	cmd.exe
7184	cmd.exe
6088	cmd.exe
32980	Process not Found
45176	Process not Found
11020	cmd.exe
12644	cmd.exe
11684	cmd.exe
2616	cmd.exe
45316	Process not Found
11340	cmd.exe
42320	Process not Found
12264	cmd.exe
11092	cmd.exe
1820	cmd.exe
1252	cmd.exe
12432	cmd.exe
13388	cmd.exe
6944	cmd.exe
13296	cmd.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
34912	Process not Found
4092	taskkill.exe
30220	taskkill.exe
30484	taskkill.exe
35204	Process not Found
35564	Process not Found
37040	Process not Found
41388	Process not Found
464	taskkill.exe
29812	taskkill.exe
31192	taskkill.exe
35724	Process not Found
21428	Process not Found
41416	Process not Found
30260	taskkill.exe
3700	taskkill.exe
33952	Process not Found
36892	Process not Found
37012	Process not Found
44804	Process not Found
5420	taskkill.exe
30280	taskkill.exe
35968	Process not Found
41364	Process not Found
4100	taskkill.exe
30600	taskkill.exe
35016	Process not Found
35756	Process not Found
35816	Process not Found
36564	Process not Found
36780	Process not Found
36992	Process not Found
30592	taskkill.exe
38628	Process not Found
40624	Process not Found
41552	Process not Found
43020	Process not Found
47320	Process not Found
33660	Process not Found
46060	Process not Found
35552	Process not Found
34600	Process not Found
35328	Process not Found
33564	Process not Found
36472	Process not Found
37340	Process not Found
38080	Process not Found
45052	Process not Found
30452	taskkill.exe
30652	taskkill.exe
31328	taskkill.exe
36216	Process not Found
45756	Process not Found
36132	Process not Found
33124	Process not Found
35748	Process not Found
36396	Process not Found
37268	Process not Found
37648	Process not Found
32304	Process not Found
44916	Process not Found
44872	Process not Found
41672	Process not Found
43620	Process not Found

Runs net.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	464	taskkill.exe
Token: SeDebugPrivilege	4092	taskkill.exe
Token: SeDebugPrivilege	5420	taskkill.exe
Token: SeDebugPrivilege	3700	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 5116	3104	cmd.exe	90
PID 5116 wrote to memory of 4076	5116	net.exe	91
PID 3104 wrote to memory of 4100	3104	cmd.exe	92
PID 3104 wrote to memory of 1492	3104	cmd.exe	94
PID 3104 wrote to memory of 464	3104	cmd.exe	95
PID 3104 wrote to memory of 4092	3104	cmd.exe	96
PID 3104 wrote to memory of 5420	3104	cmd.exe	306
PID 3104 wrote to memory of 3700	3104	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\system32\taskkill.exe
  taskkill /f /im discord.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\system32\taskkill.exe
  taskkill /f /im steam.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5420
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3700
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4180
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3624
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:27476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:30220
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4248
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3804
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31012
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5172
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2432
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31708
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5772
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:23404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:29812
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4460
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3928
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:24928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:30652
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3860
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1188
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31832
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:108
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:240
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30540
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31320
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:256
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1216
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33584
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4580
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2304
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31556
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4952
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1252
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33148
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1260
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1732
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32932
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1936
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4648
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:29660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:30592
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4960
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4928
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31936
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4400
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1328
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33420
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5556
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:2616
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30672
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31696
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2904
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2856
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:30356
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4216
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4512
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:29652
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:30484
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2120
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4704
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:25508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:28788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:31328
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4480
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:6088
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4176
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:30452
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4668
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1988
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33092
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:568
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4780
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33328
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33800
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5276
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:888
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32672
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5128
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3092
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33136
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1828
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5648
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33120
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3876
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4072
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33080
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5152
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2080
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:29692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:30600
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1456
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2740
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32512
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5180
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4320
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33128
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4900
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1192
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31236
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3232
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2328
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4124
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6044
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32300
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2812
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4160
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33724
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2588
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2084
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:28848
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:29364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:30280
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1872
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3640
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:19120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:28688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:31192
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6124
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4368
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3184
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4528
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5980
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2732
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:28688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:30260
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2772
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:912
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:1160
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4336
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33300
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3264
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1444
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31424
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32272
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:32552
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5632
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:4760
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32756
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3784
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33108
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2344
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2764
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2024
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5296
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33532
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2204
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5364
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4504
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4076
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1392
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3356
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1820
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:1704
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:628
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:2900
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2232
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1276
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4564
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5456
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5420
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32620
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5908
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3380
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32092
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33308
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1756
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32764
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3228
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1976
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33396
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6152
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6180
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33292
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6204
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6228
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6236
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6260
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6268
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6292
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6308
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6328
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6336
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6356
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6372
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6392
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6400
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6440
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33548
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6464
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6488
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6500
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6520
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6536
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6568
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32624
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6576
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6604
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32836
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6612
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6636
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6648
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:6672
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6688
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6736
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6752
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6768
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6780
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6804
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6820
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6844
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6864
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6880
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1808
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6920
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6936
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:6944
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6960
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6992
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7012
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7028
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7048
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7060
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7080
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7100
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7128
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7144
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7160
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:952
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2712
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4992
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7176
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:7184
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7204
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7228
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7252
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7260
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:7288
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:7300
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7328
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7336
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7372
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7412
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7428
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7448
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7460
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7492
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7508
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7540
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7556
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7584
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7596
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7624
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7632
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7668
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7680
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7720
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7728
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7748
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7760
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7792
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7824
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7840
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7848
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7888
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7904
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7920
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7932
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7964
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7976
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8012
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8036
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8052
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8076
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8100
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8128
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8296
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8320
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8332
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8356
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8368
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8396
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8420
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8436
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8444
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8472
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8496
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8520
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8528
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8552
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:8560
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8596
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8608
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8632
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8640
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:8660
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8672
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8696
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8720
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8736
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8768
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8788
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8808
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8828
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:8848
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8880
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8888
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8908
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8916
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8940
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8960
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8988
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9012
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9032
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:9040
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9060
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9068
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9096
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9120
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9136
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9168
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9184
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6556
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6460
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5944
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:948
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4632
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9220
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9256
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9264
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:9276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:9288
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9312
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9340
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9356
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:9372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9388
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9396
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9412
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9428
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9452
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9464
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9484
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9500
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9536
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9544
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9568
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9576
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9604
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9612
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:9624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9640
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9648
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9668
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9676
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9692
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9708
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9728
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9748
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:9756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9764
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9776
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9800
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9808
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:9828
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9836
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9852
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9860
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9876
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9892
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9908
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9924
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9940
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:9948
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9964
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9972
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10004
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10020
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10028
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:10048
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10056
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10072
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10080
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10096
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10124
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10188
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10224
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10236
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10252
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10260
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10276
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10284
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10300
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10308
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10324
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10608
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10644
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10660
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10700
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10708
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10736
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10772
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10828
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10836
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10868
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10876
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10892
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10900
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10920
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10928
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10956
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10964
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10988
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11012
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:11020
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11048
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11056
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11072
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11084
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:11092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11108
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11124
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11140
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:11148
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11164
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11172
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11192
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11208
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11228
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11236
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:11252
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11260
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11276
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11288
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11308
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11316
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:11324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11332
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:11340
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11372
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11384
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11400
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11408
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11424
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11432
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11460
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11472
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11488
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11496
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:11504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11516
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11528
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11552
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11560
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11584
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11592
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11612
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11624
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11644
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11652
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11668
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11676
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:11684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11700
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11716
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11744
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11760
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11776
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11784
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11800
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11824
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11852
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11868
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11888
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11896
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11916
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11928
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11952
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11964
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:11976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:11988
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12012
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12020
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12036
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12044
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12060
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12072
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12096
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12136
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12148
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12164
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12176
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12196
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12208
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12240
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12252
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:12264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12284
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:10208
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12300
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12316
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12332
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12344
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12360
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12372
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12392
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12400
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12416
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12424
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:12432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12440
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12448
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12464
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12472
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12488
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12496
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12512
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12520
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12536
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12544
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12560
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12568
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12584
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12592
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12608
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:12616
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12636
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:12644
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12660
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12668
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12688
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12700
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12724
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12732
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12760
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12772
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12788
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12796
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12812
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12820
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12840
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12848
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12864
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12872
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12896
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12904
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12932
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12940
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12956
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12968
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:12984
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13020
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13032
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13056
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13068
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13092
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13124
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13132
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13156
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13176
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13192
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13200
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13220
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13228
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13244
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13252
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13268
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13280
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:13296
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13304
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5520
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8048
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7140
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10400
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13316
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13332
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13340
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13356
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13364
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:13372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:13388
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13404
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13412
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13428
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13436
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:13452
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13460
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13480
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13488
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13504
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13516
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13540
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13552
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13576
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13588
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13608
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13624
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:13640
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13660
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13684
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13692
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13708
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13716
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13732
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13740
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13756
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13764
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13780
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13788
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13804
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13812
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13828
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:13836
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13852
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13860
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13876
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13884
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13900
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13916
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13940
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13952
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13968
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13980
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14004
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14020
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14032
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14048
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14060
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14076
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14084
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14100
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14108
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:14124
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14132
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14148
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14156
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14176
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14184
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14200
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14208
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14224
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14232
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14248
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14276
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14300
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14308
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14324
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14332
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:10408
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10420
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14348
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14356
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14372
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14388
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14404
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14412
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14428
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14436
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14452
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14460
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14480
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:14488
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14504
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14512
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:14520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14528
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:17040
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:9744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:26176
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28896
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29728
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:31080
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:32660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:33016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads