67bff6608e898dc46685c36616fa6d41096ea4ef5eb66d854f4237c2ed4b7eed

Analysis

user interaction
yes
max time kernel
150s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solara.bat
Size 722B
Sample260930-tyysbsxtcs
SHA256 67bff6608e898dc46685c36616fa6d41096ea4ef5eb66d854f4237c2ed4b7eed
MD5 47b6ce46aa79bffa9ef9e061f1c3a12f
SHA1 179ebbf3a36f8ff0ac86a7fbba86f6cf0b827038
SHA512 9a9ffc840a36a7125ed82ae120015bedb904b20fd6affe5b0fb0dcfb51dccea39abc5d4013b65b718f041be8d056dc29ff3e299f4ab10c6f61d72630fff6e0ef
TLSH
T148016403AD4F8C4AD54E20E081F6A3C2E48BC05BD8682EE0D5D1243435A4284C3E7FEE
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	10360	Process not Found
11	10360	Process not Found
17	10360	Process not Found

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
13152	powershell.exe
1408	powershell.exe
14168	powershell.exe
14684	powershell.exe
14396	powershell.exe
14684	powershell.exe
13164	powershell.exe
12536	powershell.exe
12348	powershell.exe
14888	powershell.exe
14372	powershell.exe
10128	powershell.exe
11936	powershell.exe
11112	powershell.exe
14076	powershell.exe
5960	powershell.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1368	Process not Found
2732	cmd.exe
1040	cmd.exe
9736	cmd.exe
9020	cmd.exe
12808	cmd.exe
16284	cmd.exe
14580	cmd.exe
14848	cmd.exe
15876	cmd.exe
6488	Process not Found
14596	Process not Found
8648	cmd.exe
14704	cmd.exe
15024	cmd.exe
6936	cmd.exe
2020	Process not Found
1868	cmd.exe
16144	Process not Found
16016	Process not Found
14364	cmd.exe
10496	cmd.exe
14832	Process not Found
800	Process not Found
10164	cmd.exe
14368	cmd.exe
12424	cmd.exe
10708	cmd.exe
10228	cmd.exe
14492	Process not Found
4356	cmd.exe
2808	cmd.exe
9376	Process not Found
4720	Process not Found
14892	Process not Found
5736	cmd.exe
8644	cmd.exe
12216	cmd.exe
6084	Process not Found
14772	Process not Found
15616	Process not Found
13924	cmd.exe
8224	cmd.exe
10844	cmd.exe
15108	cmd.exe
616	Process not Found
14312	Process not Found
9108	Process not Found
7420	Process not Found
15784	cmd.exe
3648	cmd.exe
16276	cmd.exe
1748	Process not Found
12388	Process not Found
4704	Process not Found
8572	cmd.exe
4960	cmd.exe
8900	Process not Found
3796	Process not Found
5484	Process not Found
12528	cmd.exe
13440	Process not Found
8324	cmd.exe
2020	cmd.exe

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5964	taskkill.exe
4752	taskkill.exe
6972	taskkill.exe
9476	taskkill.exe
12476	taskkill.exe
1312	taskkill.exe
7812	taskkill.exe
4884	taskkill.exe
15488	taskkill.exe
15408	taskkill.exe
3276	taskkill.exe
7488	taskkill.exe
6176	taskkill.exe
6964	taskkill.exe
9672	taskkill.exe
1804	taskkill.exe
8376	taskkill.exe
9172	taskkill.exe
6980	taskkill.exe
11004	taskkill.exe
14248	taskkill.exe
6992	taskkill.exe
9092	taskkill.exe
8148	taskkill.exe
11176	taskkill.exe
15648	taskkill.exe
5712	taskkill.exe
13232	taskkill.exe
14444	taskkill.exe
6876	taskkill.exe
1788	taskkill.exe
7244	taskkill.exe
10540	taskkill.exe
11508	taskkill.exe
1960	taskkill.exe
10884	taskkill.exe
7264	taskkill.exe
8692	taskkill.exe
7752	taskkill.exe
9016	taskkill.exe
12376	taskkill.exe
6632	taskkill.exe
9508	taskkill.exe
8680	taskkill.exe
11736	taskkill.exe
15604	taskkill.exe
14632	taskkill.exe
7016	taskkill.exe
9488	taskkill.exe
10896	taskkill.exe
8052	taskkill.exe
7136	taskkill.exe
11608	taskkill.exe
16080	taskkill.exe
7248	taskkill.exe
3364	taskkill.exe
9208	taskkill.exe
2428	taskkill.exe
7436	taskkill.exe
7752	taskkill.exe
9912	taskkill.exe
9904	taskkill.exe
12792	taskkill.exe
6672	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
13164	powershell.exe
13164	powershell.exe
11112	powershell.exe
12536	powershell.exe
11112	powershell.exe
12536	powershell.exe
11936	powershell.exe
11936	powershell.exe
13152	powershell.exe
13152	powershell.exe
1408	powershell.exe
1408	powershell.exe
13152	powershell.exe
13152	powershell.exe
13164	powershell.exe
13164	powershell.exe
1408	powershell.exe
1408	powershell.exe
14168	powershell.exe
14168	powershell.exe
12536	powershell.exe
12536	powershell.exe
11936	powershell.exe
11936	powershell.exe
14396	powershell.exe
14396	powershell.exe
14888	powershell.exe
14168	powershell.exe
14396	powershell.exe
14396	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
4344	Process not Found
12388	Process not Found
15672	Process not Found
11104	Process not Found
2804	Process not Found
15732	Process not Found
14672	Process not Found
14668	Process not Found
9640	Process not Found
7576	Process not Found
2988	Process not Found
9904	Process not Found
3748	Process not Found
8444	Process not Found
8880	Process not Found
10760	Process not Found
15108	Process not Found
16244	Process not Found
15912	Process not Found
16280	Process not Found
6992	Process not Found
6132	Process not Found
15188	Process not Found
15664	Process not Found
3176	Process not Found
3364	Process not Found
4844	Process not Found
15596	Process not Found
14132	Process not Found
7120	Process not Found
4380	Process not Found
14596	Process not Found
7124	Process not Found
8492	Process not Found
4728	Process not Found
6212	Process not Found
13984	Process not Found
9716	Process not Found
3884	Process not Found
12436	Process not Found
9528	Process not Found
13684	Process not Found
8000	Process not Found
7560	Process not Found
14728	Process not Found
12312	Process not Found
14832	Process not Found
7568	Process not Found
8124	Process not Found
7816	Process not Found
1588	Process not Found
12152	Process not Found
15072	Process not Found
4028	Process not Found
15556	Process not Found
7276	Process not Found
10880	Process not Found
5124	Process not Found
13624	Process not Found
16016	Process not Found
4632	Process not Found
4144	Process not Found
16284	Process not Found
16140	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5572	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	4752	taskkill.exe
Token: SeDebugPrivilege	5744	taskkill.exe
Token: SeDebugPrivilege	5776	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	5780	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	4324	taskkill.exe
Token: SeDebugPrivilege	3016	taskkill.exe
Token: SeDebugPrivilege	2056	taskkill.exe
Token: SeDebugPrivilege	4048	taskkill.exe
Token: SeDebugPrivilege	4752	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	4852	taskkill.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	3432	taskkill.exe
Token: SeDebugPrivilege	1420	taskkill.exe
Token: SeDebugPrivilege	6176	taskkill.exe
Token: SeDebugPrivilege	6672	taskkill.exe
Token: SeDebugPrivilege	6704	taskkill.exe
Token: SeDebugPrivilege	6868	taskkill.exe
Token: SeDebugPrivilege	6876	taskkill.exe
Token: SeDebugPrivilege	6952	taskkill.exe
Token: SeDebugPrivilege	6972	taskkill.exe
Token: SeDebugPrivilege	6964	taskkill.exe
Token: SeDebugPrivilege	7104	taskkill.exe
Token: SeDebugPrivilege	6308	taskkill.exe
Token: SeDebugPrivilege	7136	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	6276	taskkill.exe
Token: SeDebugPrivilege	4920	taskkill.exe
Token: SeDebugPrivilege	6980	taskkill.exe
Token: SeDebugPrivilege	7012	taskkill.exe
Token: SeDebugPrivilege	7116	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	6356	taskkill.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	7132	taskkill.exe
Token: SeDebugPrivilege	6964	taskkill.exe
Token: SeDebugPrivilege	7016	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	7332	taskkill.exe
Token: SeDebugPrivilege	7316	taskkill.exe
Token: SeDebugPrivilege	7364	taskkill.exe
Token: SeDebugPrivilege	7400	taskkill.exe
Token: SeDebugPrivilege	7436	taskkill.exe
Token: SeDebugPrivilege	7660	taskkill.exe
Token: SeDebugPrivilege	7628	taskkill.exe
Token: SeDebugPrivilege	7700	taskkill.exe
Token: SeDebugPrivilege	7796	taskkill.exe
Token: SeDebugPrivilege	7744	taskkill.exe
Token: SeDebugPrivilege	7820	taskkill.exe
Token: SeDebugPrivilege	7812	taskkill.exe
Token: SeDebugPrivilege	7996	taskkill.exe
Token: SeDebugPrivilege	8052	taskkill.exe
Token: SeDebugPrivilege	8188	taskkill.exe
Token: SeDebugPrivilege	7264	taskkill.exe
Token: SeDebugPrivilege	7136	taskkill.exe
Token: SeDebugPrivilege	8148	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6048 wrote to memory of 6000	6048	cmd.exe	85
PID 6000 wrote to memory of 2712	6000	net.exe	86
PID 6048 wrote to memory of 5572	6048	cmd.exe	87
PID 6048 wrote to memory of 1620	6048	cmd.exe	89
PID 6048 wrote to memory of 2560	6048	cmd.exe	90
PID 6048 wrote to memory of 4752	6048	cmd.exe	91
PID 6048 wrote to memory of 5744	6048	cmd.exe	92
PID 6048 wrote to memory of 5776	6048	cmd.exe	221
PID 6048 wrote to memory of 3760	6048	cmd.exe	94
PID 6048 wrote to memory of 1996	6048	cmd.exe	95
PID 6048 wrote to memory of 5616	6048	cmd.exe	98
PID 6048 wrote to memory of 1708	6048	cmd.exe	100
PID 6048 wrote to memory of 3216	6048	cmd.exe	102
PID 6048 wrote to memory of 6060	6048	cmd.exe	103
PID 6048 wrote to memory of 5068	6048	cmd.exe	104
PID 6048 wrote to memory of 536	6048	cmd.exe	105
PID 6048 wrote to memory of 2348	6048	cmd.exe	106
PID 6048 wrote to memory of 6120	6048	cmd.exe	107
PID 6048 wrote to memory of 1592	6048	cmd.exe	108
PID 6048 wrote to memory of 948	6048	cmd.exe	109
PID 6048 wrote to memory of 4672	6048	cmd.exe	110
PID 6048 wrote to memory of 940	6048	cmd.exe	111
PID 6048 wrote to memory of 3436	6048	cmd.exe	112
PID 6048 wrote to memory of 5736	6048	cmd.exe	113
PID 6048 wrote to memory of 5652	6048	cmd.exe	114
PID 6048 wrote to memory of 5060	6048	cmd.exe	115
PID 6048 wrote to memory of 3660	6048	cmd.exe	116
PID 6048 wrote to memory of 2080	6048	cmd.exe	117
PID 6048 wrote to memory of 5816	6048	cmd.exe	118
PID 6048 wrote to memory of 5548	6048	cmd.exe	119
PID 6048 wrote to memory of 900	6048	cmd.exe	120
PID 6048 wrote to memory of 2832	6048	cmd.exe	121
PID 6048 wrote to memory of 4900	6048	cmd.exe	122
PID 6048 wrote to memory of 5472	6048	cmd.exe	123
PID 6048 wrote to memory of 2732	6048	cmd.exe	124
PID 6048 wrote to memory of 2036	6048	cmd.exe	125
PID 6048 wrote to memory of 3800	6048	cmd.exe	126
PID 6048 wrote to memory of 5000	6048	cmd.exe	127
PID 6048 wrote to memory of 4624	6048	cmd.exe	128
PID 6048 wrote to memory of 632	6048	cmd.exe	129
PID 6048 wrote to memory of 1716	6048	cmd.exe	130
PID 6048 wrote to memory of 3548	6048	cmd.exe	131
PID 6048 wrote to memory of 5952	6048	cmd.exe	132
PID 6048 wrote to memory of 1816	6048	cmd.exe	133
PID 6048 wrote to memory of 5996	6048	cmd.exe	134
PID 6048 wrote to memory of 1720	6048	cmd.exe	135
PID 6048 wrote to memory of 5600	6048	cmd.exe	136
PID 6048 wrote to memory of 5800	6048	cmd.exe	172
PID 6048 wrote to memory of 3104	6048	cmd.exe	174
PID 6048 wrote to memory of 2584	6048	cmd.exe	176
PID 5616 wrote to memory of 760	5616	cmd.exe	178
PID 6048 wrote to memory of 5116	6048	cmd.exe	179
PID 760 wrote to memory of 2276	760	net.exe	256
PID 6048 wrote to memory of 3784	6048	cmd.exe	182
PID 6048 wrote to memory of 1040	6048	cmd.exe	184
PID 5816 wrote to memory of 2576	5816	cmd.exe	186
PID 2576 wrote to memory of 3804	2576	net.exe	187
PID 1040 wrote to memory of 560	1040	cmd.exe	188
PID 6048 wrote to memory of 4544	6048	cmd.exe	189
PID 6048 wrote to memory of 4256	6048	cmd.exe	190
PID 6048 wrote to memory of 5888	6048	cmd.exe	191
PID 6048 wrote to memory of 4284	6048	cmd.exe	192
PID 1716 wrote to memory of 5480	1716	cmd.exe	193
PID 2732 wrote to memory of 4520	2732	cmd.exe	194

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2712
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\taskkill.exe
  taskkill /f /im discord.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\system32\taskkill.exe
  taskkill /f /im steam.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5776
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3760
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2276
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7132
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:6236
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:6332
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6952
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:7340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8572
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10700
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11148
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:13044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      PID:8376
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      PID:14052
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      PID:5484
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:8292
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:8592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:7448
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11836
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11568
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      PID:1804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      PID:15480
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      PID:15108
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im steam.exe
      4⤵
      PID:3520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      PID:13844
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:13816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:12612
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:13924
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:12784
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:12424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:5004
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:15048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      Executes a command shell one-liner
      PID:10228
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10088
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:9464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10684
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:12348
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:9920
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:11740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12180
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:9928
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12996
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14392
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:11216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:1408
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13048
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:4356
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:15736
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:15416
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:4864
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13756
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:11812
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:2784
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1708
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6060
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4268
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7136
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:7792
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:8120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:7984
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6876
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7536
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:8680
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      PID:4292
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      PID:12476
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:10124
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:8068
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7132
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:8296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:8724
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10796
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:10308
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:13232
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      PID:14232
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im steam.exe
      4⤵
      PID:9640
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:6188
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:9128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:9236
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12976
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:13060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:11936
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:9396
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10832
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11308
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:13352
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      PID:4884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:13032
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:16356
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:14792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:16124
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:3500
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10860
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:9344
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12460
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14728
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:11608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12272
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14804
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      PID:15604
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      PID:14632
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      PID:5940
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:6504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:12376
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:14436
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:14396
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        
        PID:5724
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im chrome.exe
        5⤵
        
        PID:15124
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        5⤵
        Kills process with taskkill
        
        PID:6992
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im discord.exe
        5⤵
        
        PID:9528
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        
        PID:15784
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im firefox.exe
        5⤵
        Kills process with taskkill
        
        PID:16080
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:15660
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:11856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:14332
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:2020
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:12832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:6936
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:3636
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:5608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:16172
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:8376
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:10880
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:4940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:15556
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        Executes a command shell one-liner
        
        PID:16276
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:15656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:7164
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:16284
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:4880
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:14532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:16000
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:6668
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:2752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:15652
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:1216
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:2140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:4704
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:15156
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:2896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:6504
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:12812
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:8080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:15024
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:14372
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:3500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:5572
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:13404
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:14792
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:16240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:9632
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:14172
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:12072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:14044
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:13848
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        Executes a command shell one-liner
        
        PID:12216
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:13344
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:16268
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:5096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:3140
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:1076
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:1316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:12296
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:11564
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        Executes a command shell one-liner
        
        PID:2808
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:11676
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:15032
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:15748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:3272
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:7284
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:3772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:7968
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:15768
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:12536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:8
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:15108
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:14832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:10760
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:4728
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:7960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:13396
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:3748
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:12852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:15676
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        Executes a command shell one-liner
        
        PID:15876
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:7276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:8160
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:7560
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:16260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:4880
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:4028
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:14872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:10880
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:3636
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        Executes a command shell one-liner
        
        PID:6936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:15500
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:5200
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:12656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:5712
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:12824
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:14312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:3428
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:14428
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:13500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:14876
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:6420
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo ACCESS DENIED && color 4f"
        5⤵
        
        PID:13776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
        5⤵
        
        PID:13740
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /k "echo SYSTEM LOCKED && color 0c"
        5⤵
        
        PID:16092
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      Executes a command shell one-liner
      PID:15108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:14056
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:10028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:16224
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:2140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:3500
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:4616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:14816
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13528
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15960
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:15784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12860
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2348
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5684
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2616
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:7484
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:8640
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:9476
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10900
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:9384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10812
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:13524
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:14892
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      PID:15912
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:9652
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:4572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:16172
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    - Executes a command shell one-liner
    PID:12528
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10096
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:1364
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14104
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:5248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10752
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    - Executes a command shell one-liner
    PID:16284
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:16300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:16324
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:11108
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:4108
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:2020
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:4144
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15656
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14668
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:10708
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6120
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:948
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6964
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:7256
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:9208
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:9764
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10032
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1408
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10420
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:8232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:11872
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14768
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:176
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:9428
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      PID:15664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im steam.exe
      4⤵
      PID:4788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:14536
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:820
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:9720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:7300
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:14288
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:2988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:15852
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:12808
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:4844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:12388
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:16008
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13144
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14968
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10360
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4672
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3436
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:8136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:7348
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:7760
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7244
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:8952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:9436
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12956
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:13012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:13008
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:8688
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10992
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:11316
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12644
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14852
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:11132
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:9488
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:5736
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5060
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6672
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8148
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:7768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:9092
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10320
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:8764
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12200
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14624
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12088
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12296
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13796
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13416
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14760
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15724
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:14704
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      PID:10492
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      PID:6924
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:2580
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:14276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:14020
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:5940
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:15420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:4836
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:1052
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:1704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:4752
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:2116
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:2144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:3796
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:15156
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10824
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3660
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6176
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:7144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Kills process with taskkill
    PID:7752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:8900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:11132
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5548
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2832
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7820
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:8040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    - Kills process with taskkill
    PID:9172
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:10128
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10648
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:11908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12384
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13704
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:15060
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15000
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      PID:15408
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      PID:8376
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im steam.exe
      4⤵
      Kills process with taskkill
      PID:3276
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      PID:14052
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14468
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:15424
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4900
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1584
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:7244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:8676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:9920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:11680
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14796
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5960
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:14436
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14984
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:1228
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2036
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5000
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6132
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6276
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:7804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:8800
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:9904
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    - Executes a command shell one-liner
    PID:10164
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:11624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:11972
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:14304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:14888
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12360
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4624
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2376
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6964
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:7488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Kills process with taskkill
    PID:8692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:9864
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:11608
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13608
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:16344
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:15760
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      PID:14504
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      PID:4540
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:16040
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:10896
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:1180
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:9304
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:13412
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:6632
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      PID:5964
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:15900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:14236
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:14944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:12152
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:4328
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:15772
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:2068
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:11488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:8060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5960
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:2428
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:9300
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:15556
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3548
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1816
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5820
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7436
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:8128
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:7936
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:8324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:8752
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:9308
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:12244
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      PID:14224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im steam.exe
      4⤵
      Kills process with taskkill
      PID:12376
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:16280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:15512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14372
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:14944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:13752
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:9832
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:4728
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:4940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:6592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14684
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:6552
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:11104
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:8512
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:8644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:9264
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12948
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:10460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:11112
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:8488
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:13152
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:11148
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:14396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14624
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:14852
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:9644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:5980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:14684
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5600
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5776
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:7884
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:8768
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:9612
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:9224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:13164
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:11168
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:9260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:11576
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10096
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:13540
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:9268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:13448
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:11596
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:9364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:15788
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:13552
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:1704
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:14720
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12856
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:14076
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12604
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5800
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2584
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6308
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:6876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:7248
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:7312
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:8580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:9348
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12880
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:12536
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:8052
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Enumerates connected drives
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:14168
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:11100
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12540
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:12560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Solara.bat' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10128
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:11680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13272
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      PID:15648
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      PID:12228
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      PID:3580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:16008
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:2712
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:380
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:13760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:13660
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:2908
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:15916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:14580
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13352
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14908
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5116
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4108
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7628
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7264
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:7892
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7812
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:8008
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:8024
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:9572
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9892
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:10884
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      Kills process with taskkill
      PID:2428
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:7584
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:8236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    - Executes a command shell one-liner
    PID:8648
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:10808
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9344
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:13224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      PID:12008
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      PID:16124
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:12780
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:15188
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:1748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:15940
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:14720
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:6572
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:7804
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:8224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:7736
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:11984
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11308
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:12068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      PID:14216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      PID:15488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      PID:6016
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im steam.exe
      4⤵
      Kills process with taskkill
      PID:14444
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      PID:11488
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:2376
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:16076
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:9780
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:7536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    - Executes a command shell one-liner
    PID:9736
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:13296
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:11864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1312
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im steam.exe
      4⤵
      PID:13604
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      PID:16244
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:9824
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:9672
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:11884
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13152
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13716
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:14580
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4544
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5888
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:7780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:7256
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:10892
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:13036
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4284
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3556
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7324
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7528
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:7120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:8580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:9488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:10392
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:14184
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14224
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14380
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:16364
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3480
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3472
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7672
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:7316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:8848
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:9912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:11488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:12228
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10064
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:16360
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:6460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:16160
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13952
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3716
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:7396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:7836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:9016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:10968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    - Kills process with taskkill
    PID:11508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:14348
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4184
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3672
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:8108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7288
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:7580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:9012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:10764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Kills process with taskkill
    PID:12792
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:13396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:16264
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1660
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1784
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:8012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:6988
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:6676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:9732
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:11812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:14240
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13424
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:11176
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:5976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:5272
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:9892
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:16288
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15928
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:2804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15928
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1688
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5344
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:8100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7568
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:7524
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:7752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:10540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Kills process with taskkill
    PID:11736
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:10896
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13688
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:1408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:10228
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12604
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:11608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    - Executes a command shell one-liner
    PID:14848
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1580
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1500
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:11808
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:10496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:11132
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14716
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:11488
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12160
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13648
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14520
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:11040
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    - Executes a command shell one-liner
    PID:14364
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:12580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12808
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12424
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14928
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14704
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15092
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14464
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12444
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5568
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3872
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:8024
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:3692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:8412
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:8232
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    - Kills process with taskkill
    PID:11176
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:12196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:4028
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10768
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3368
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3812
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:8032
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:7064
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:7320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:10260
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:12316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:12752
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:3780
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:13528
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:10276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:11132
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12424
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14464
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:15896
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:15936
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13796
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:6420
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4868
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6160
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7272
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7484
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:7388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:8612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    PID:9672
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:10224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im steam.exe
    3⤵
    PID:12568
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:14504
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13176
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:15680
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:15588
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6168
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2056
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7640
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:7708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:8916
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:9928
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:11600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:14248
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:13472
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:15796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15564
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6672
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7352
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7656
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:8528
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:9508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:10460
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14400
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:14368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14948
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14460
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13636
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1804
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:15364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15988
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    - Executes a command shell one-liner
    PID:14704
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:3748
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    - Executes a command shell one-liner
    PID:2020
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:16372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:3592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:6696
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      PID:5188
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im discord.exe
      4⤵
      PID:15984
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im steam.exe
      4⤵
      PID:3832
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      PID:2040
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:4540
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:12372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
      4⤵
      PID:12960
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo SYSTEM LOCKED && color 0c"
      4⤵
      PID:15912
  - - C:\Windows\system32\cmd.exe
      cmd.exe /k "echo ACCESS DENIED && color 4f"
      4⤵
      PID:15548
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:5132
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:3648
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:3148
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:2292
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12804
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:1948
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:9528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:12628
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:12876
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    - Executes a command shell one-liner
    PID:13924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15528
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7860
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1880
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7016
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:9008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:9200
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:9964
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:11560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:4292
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:13952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    PID:12712
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:10056
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13668
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7224
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7788
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7796
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:9272
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:9748
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:10096
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:12040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:13904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15948
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:11352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15056
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:15448
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:9400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:15740
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14076
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6252
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7192
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7980
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:9460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:9824
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:10124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:9424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    PID:5712
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7676
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:8792
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:11000
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:9796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:11004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:9300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im discord.exe
    3⤵
    PID:15592
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:6372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:14964
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:15644
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:13164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:4932
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14800
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:14628
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:14676
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:5576
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo ACCESS DENIED && color 4f"
    3⤵
    PID:9904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:6488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    PID:13584
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7064
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9320
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:12772
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:10692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:12860
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:1316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12424
- - C:\Windows\system32\cmd.exe
    cmd.exe /k "echo SYSTEM LOCKED && color 0c"
    3⤵
    PID:15712
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:9028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7836
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:10312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:10844
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:12932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:12836
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:9020
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12480
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:11980
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:12320
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:12172
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14572

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 12168 -s 316
1⤵
PID:11980

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:13324

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:14884

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 1312 -ip 1312
1⤵
PID:12996

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:10708

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:11216

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:15616

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:15480

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:16044

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:9268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3c6d5ecae46dd9f6756e444bc51635cdd9696f3ed9fe0601cf41059a04085f88
MD5 25d7ac29d798600ddc5fd880b162958b
SHA1 a2ba91e14155cfa5c26670e17ac606f3f28b0be2
SHA512 d91a9028c0fdf3761edbccddaa460573281b7d390efc7dfe3ebef46ce5ede53d36a7148c523e312b5daedc91c11cdb2cc8d0f8b475339cd35dba044595778d45
TLSH
T15731CE3133B5A0D889163F471E3855C053BF4355F694AF48B688626ED9324179F221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 88e5ffe18fd4a772efce68f1b0db839846cafc42d36415508ad5356a44d38f32
MD5 eb6332ae9e8fec69c2236355e2638f9d
SHA1 71500d57fb304979afd6756f06d4b9a59f995eb7
SHA512 e87c864ba79bd7a10a62b55ad564cf3acb090e7d85707a6967497deeef5fcde1f0b4608ea8791bf81363ec583a0101d470d8f3cd2172ced8d4071d7f6c674aed
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 1f3711df6686fdabe769d41fda005dbbad865ce09d26715c00bc3bc385ad99e4
MD5 2f56593c4c7976dc20c4b9c40a9bc20c
SHA1 a0ad8441e69651f819c93e1459a774c346bc66d1
SHA512 2610b3a3dd6e45d59d5b25a5cf96b77ec84bf5f1abc119f5e0c91714a3b8b2644e285bb0dbc53b27e3ee1164aba432592d0f3a3c3e26e76025e0abc17e63b8d1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8
MD5 96ff1ee586a153b4e7ce8661cabc0442
SHA1 140d4ff1840cb40601489f3826954386af612136
SHA512 3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569
TLSH
T127112223F38C89A1CC861639509DAC5172B686CB81AEDEDF7FC0C210E1AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i1ukb2ld.rwd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1ukb2ld.rwd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2988-110-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/3520-95-0x00007FFD0D9B0000-0x00007FFD0DB94000-memory.dmp

Download

memory/3796-106-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/4292-2-0x00007FFD0D9B0000-0x00007FFD0DB94000-memory.dmp

Download

memory/4540-105-0x00007FFD0D9B0000-0x00007FFD0DB94000-memory.dmp

Download

memory/4940-100-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/5004-109-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/5712-101-0x00007FFD0D9B0000-0x00007FFD0DB94000-memory.dmp

Download

memory/6592-108-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/6632-98-0x00007FFD2A670000-0x00007FFD2A865000-memory.dmp

Download

memory/11884-3-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/11936-4-0x000001FC58370000-0x000001FC58392000-memory.dmp

Download

memory/12296-1-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/12752-87-0x00007FFD0D9B0000-0x00007FFD0DB94000-memory.dmp

Download

memory/12848-93-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/12876-97-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/13448-67-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/13552-103-0x00007FFD2A670000-0x00007FFD2A865000-memory.dmp

Download

memory/13952-102-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/14792-104-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/14800-96-0x00007FFD2A670000-0x00007FFD2A865000-memory.dmp

Download

memory/15048-107-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/15896-88-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download

memory/16160-99-0x00007FF6837F0000-0x00007FF683857000-memory.dmp

Download