67bff6608e898dc46685c36616fa6d41096ea4ef5eb66d854f4237c2ed4b7eed

Analysis

max time kernel
2s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solara.bat
Size 722B
Sample260930-tyysbsxtcs
SHA256 67bff6608e898dc46685c36616fa6d41096ea4ef5eb66d854f4237c2ed4b7eed
MD5 47b6ce46aa79bffa9ef9e061f1c3a12f
SHA1 179ebbf3a36f8ff0ac86a7fbba86f6cf0b827038
SHA512 9a9ffc840a36a7125ed82ae120015bedb904b20fd6affe5b0fb0dcfb51dccea39abc5d4013b65b718f041be8d056dc29ff3e299f4ab10c6f61d72630fff6e0ef
TLSH
T148016403AD4F8C4AD54E20E081F6A3C2E48BC05BD8682EE0D5D1243435A4284C3E7FEE
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3340	cmd.exe
4568	cmd.exe
21176	Process not Found
13860	Process not Found
6876	cmd.exe
4784	cmd.exe
5324	cmd.exe
19808	cmd.exe
19528	cmd.exe
19052	cmd.exe
11084	Process not Found
12160	cmd.exe
7292	cmd.exe
6684	cmd.exe
468	cmd.exe
3236	cmd.exe
4276	cmd.exe
6852	cmd.exe
3004	cmd.exe
29528	cmd.exe
4464	cmd.exe
1336	cmd.exe
29724	cmd.exe
29480	cmd.exe
29024	cmd.exe
10888	Process not Found
2180	cmd.exe
4064	cmd.exe
19892	cmd.exe
25992	cmd.exe
2640	cmd.exe
27704	cmd.exe
9020	cmd.exe
1620	cmd.exe
4600	cmd.exe
7256	cmd.exe
18396	cmd.exe
29844	cmd.exe
29032	cmd.exe
28856	cmd.exe
7460	cmd.exe
5476	cmd.exe
19140	cmd.exe
18548	cmd.exe
29200	cmd.exe
32400	cmd.exe
16608	cmd.exe
7484	cmd.exe
14236	cmd.exe
1656	cmd.exe
19760	cmd.exe
28936	cmd.exe
33172	cmd.exe
2096	cmd.exe
5832	cmd.exe
4376	cmd.exe
2596	cmd.exe
1564	cmd.exe
3920	cmd.exe
2736	cmd.exe
19940	cmd.exe
7136	cmd.exe
6416	cmd.exe
18684	cmd.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
24344	Process not Found
36528	Process not Found
22440	Process not Found
28100	Process not Found
2996	Process not Found
19372	taskkill.exe
21380	taskkill.exe
33112	Process not Found
37020	Process not Found
37868	Process not Found
36128	Process not Found
4132	Process not Found
4380	taskkill.exe
9320	Process not Found
20448	taskkill.exe
20884	taskkill.exe
16452	taskkill.exe
24416	Process not Found
11396	Process not Found
2908	taskkill.exe
15564	taskkill.exe
21828	taskkill.exe
24908	taskkill.exe
35828	Process not Found
23180	Process not Found
20916	Process not Found
11700	Process not Found
31324	Process not Found
11576	Process not Found
17028	taskkill.exe
31704	taskkill.exe
32104	Process not Found
17636	Process not Found
18968	taskkill.exe
21852	taskkill.exe
26576	taskkill.exe
31760	Process not Found
19400	taskkill.exe
24988	taskkill.exe
23936	taskkill.exe
26540	taskkill.exe
29984	taskkill.exe
22904	taskkill.exe
26688	Process not Found
17232	taskkill.exe
18756	taskkill.exe
26104	taskkill.exe
20996	Process not Found
21448	Process not Found
20488	taskkill.exe
17604	taskkill.exe
25416	taskkill.exe
26724	taskkill.exe
17000	Process not Found
37252	Process not Found
30420	Process not Found
10652	Process not Found
20756	taskkill.exe
25704	taskkill.exe
22804	Process not Found
24284	Process not Found
25092	taskkill.exe
16468	taskkill.exe
19224	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	4380	taskkill.exe
Token: SeDebugPrivilege	3772	taskkill.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 4188	780	cmd.exe	90
PID 4188 wrote to memory of 5068	4188	net.exe	91
PID 780 wrote to memory of 2908	780	cmd.exe	92
PID 780 wrote to memory of 4100	780	cmd.exe	94
PID 780 wrote to memory of 2844	780	cmd.exe	95
PID 780 wrote to memory of 2264	780	cmd.exe	310
PID 780 wrote to memory of 4380	780	cmd.exe	314
PID 780 wrote to memory of 3772	780	cmd.exe	318
PID 780 wrote to memory of 2040	780	cmd.exe	99
PID 780 wrote to memory of 3588	780	cmd.exe	100
PID 780 wrote to memory of 4808	780	cmd.exe	101
PID 780 wrote to memory of 3756	780	cmd.exe	102
PID 780 wrote to memory of 4836	780	cmd.exe	103
PID 780 wrote to memory of 5936	780	cmd.exe	106
PID 780 wrote to memory of 1912	780	cmd.exe	108
PID 780 wrote to memory of 2096	780	cmd.exe	109
PID 780 wrote to memory of 2736	780	cmd.exe	110
PID 780 wrote to memory of 3340	780	cmd.exe	111
PID 780 wrote to memory of 364	780	cmd.exe	113
PID 780 wrote to memory of 52	780	cmd.exe	115
PID 780 wrote to memory of 244	780	cmd.exe	116
PID 780 wrote to memory of 256	780	cmd.exe	117
PID 780 wrote to memory of 4600	780	cmd.exe	118
PID 780 wrote to memory of 1620	780	cmd.exe	119
PID 780 wrote to memory of 5868	780	cmd.exe	120
PID 780 wrote to memory of 6136	780	cmd.exe	122
PID 780 wrote to memory of 588	780	cmd.exe	123
PID 780 wrote to memory of 1228	780	cmd.exe	124
PID 780 wrote to memory of 3652	780	cmd.exe	125
PID 780 wrote to memory of 3236	780	cmd.exe	126
PID 780 wrote to memory of 4904	780	cmd.exe	128
PID 780 wrote to memory of 4880	780	cmd.exe	129
PID 780 wrote to memory of 5080	780	cmd.exe	130
PID 780 wrote to memory of 5508	780	cmd.exe	131
PID 780 wrote to memory of 3704	780	cmd.exe	133
PID 780 wrote to memory of 5948	780	cmd.exe	134
PID 780 wrote to memory of 1388	780	cmd.exe	135
PID 780 wrote to memory of 1692	780	cmd.exe	136
PID 780 wrote to memory of 1624	780	cmd.exe	137
PID 780 wrote to memory of 3920	780	cmd.exe	138
PID 780 wrote to memory of 2248	780	cmd.exe	139
PID 780 wrote to memory of 5224	780	cmd.exe	141
PID 780 wrote to memory of 3220	780	cmd.exe	142
PID 780 wrote to memory of 1564	780	cmd.exe	144
PID 780 wrote to memory of 3028	780	cmd.exe	145
PID 780 wrote to memory of 2596	780	cmd.exe	147
PID 780 wrote to memory of 4896	780	cmd.exe	148
PID 780 wrote to memory of 5592	780	cmd.exe	149
PID 780 wrote to memory of 3080	780	cmd.exe	150
PID 780 wrote to memory of 2584	780	cmd.exe	151
PID 780 wrote to memory of 4740	780	cmd.exe	153
PID 780 wrote to memory of 3160	780	cmd.exe	155
PID 780 wrote to memory of 5476	780	cmd.exe	156
PID 780 wrote to memory of 4448	780	cmd.exe	158
PID 780 wrote to memory of 3436	780	cmd.exe	160
PID 780 wrote to memory of 5688	780	cmd.exe	161
PID 780 wrote to memory of 5760	780	cmd.exe	162
PID 780 wrote to memory of 972	780	cmd.exe	163
PID 780 wrote to memory of 1704	780	cmd.exe	164
PID 780 wrote to memory of 5996	780	cmd.exe	166

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im discord.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\system32\taskkill.exe
  taskkill /f /im steam.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3772
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2040
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4808
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:11344
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:12244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:14312
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:19372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    PID:19376
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3756
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5936
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:20708
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1912
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:2736
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:13264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16032
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:22908
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:3340
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:52
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16800
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17412
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:20520
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:244
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:4600
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:13600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:13952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:17232
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:20756
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:1620
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6136
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26000
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:588
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3652
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:15552
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:17936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:14244
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:3236
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4880
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:15560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:16948
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5080
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3704
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:17328
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5948
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1692
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:12656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:13260
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:16024
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:16812
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1624
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:3920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2248
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17892
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18640
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5224
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1564
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:18916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:19012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:20540
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3028
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4896
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:19348
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:31704
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5592
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2584
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:23440
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:25420
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4740
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:5476
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20552
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:21288
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4448
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5688
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:18756
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5760
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1704
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:13248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:13536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:15876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:18420
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3596
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:26724
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3420
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1420
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:18572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18792
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18492
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4496
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5908
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17148
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:19420
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4468
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4712
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:25672
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5348
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:19224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:28068
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1424
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5540
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17684
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18640
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:16200
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4756
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4608
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26956
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4084
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2536
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:15564
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:4064
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4128
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:17524
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1932
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3276
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:21708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:26576
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4060
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1844
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17608
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:16732
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1716
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:2640
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26096
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4200
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:2180
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:22904
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5836
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3512
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:18064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18644
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1628
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3360
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:18308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18940
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:21680
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5468
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2848
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:18948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:19140
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:20448
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4696
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5052
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:25012
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:512
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5244
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16928
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:18968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:24908
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1632
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3352
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:19996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26480
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4336
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5552
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:17604
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5860
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2372
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:23008
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:20444
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3488
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:468
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:18180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17504
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:20696
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4320
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4300
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21092
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:24004
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2888
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3688
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:21548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:20388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:26540
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5528
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4540
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17156
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18436
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6132
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4636
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18288
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:20412
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:4376
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5380
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:17576
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:5324
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1656
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22696
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24664
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:25408
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4176
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4908
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:20344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:21852
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5240
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:516
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20848
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:23420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:24996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5744
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5960
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:21024
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:23056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18820
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:4784
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:816
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:22536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:25092
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4536
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:19192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17160
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:22964
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4548
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4144
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:21116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21632
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:19004
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:5832
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4380
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:23000
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:20768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:26104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2756
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4340
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:18076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18532
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:19400
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3772
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:3052
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17288
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:19296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:10100
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6012
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:4464
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:21700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21792
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26548
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4592
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:2952
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:17044
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:572
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6152
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:21380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6168
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6184
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21512
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:21988
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6200
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6224
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:20488
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6240
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6260
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24672
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:25684
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6272
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6312
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:25876
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6336
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6368
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18556
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:6416
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:19736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:21128
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6436
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6460
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16184
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:17028
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6468
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6484
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18516
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6492
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6512
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:24920
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6532
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6548
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18524
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:20380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6556
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6572
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24656
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:20884
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6588
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6608
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:20404
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6616
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6644
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:25416
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6652
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:6684
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24720
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:21996
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6696
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6712
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:21692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:23456
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26704
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6740
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6768
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26384
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6784
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6812
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20364
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21452
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:23936
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6828
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:6852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6868
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24584
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:24560
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:6876
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6892
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:19024
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26928
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6904
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:6928
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:23956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:24988
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:6952
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:6972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7000
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:20864
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26512
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7036
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7088
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:20612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26392
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7124
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24728
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:21544
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:7136
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7160
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17320
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18660
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2244
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7184
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    PID:24232
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7208
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7232
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18584
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:21104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7248
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:7256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7272
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22984
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26356
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7280
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:7292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7304
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:17560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18544
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:20532
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7324
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7352
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:27280
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7368
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:7380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7412
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22940
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24736
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:25704
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:7436
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:7460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:7476
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22704
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:21828
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:7484
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:9120
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:20816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:23940
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26600
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:8700
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:12160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:12932
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:16844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:21388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26608
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13020
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:13084
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:23012
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:13964
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:13984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:14236
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:22976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:24764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:26916
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14976
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:16856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18300
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:19448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16944
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:22880
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19332
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:16636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:18548
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18992
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:17384
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30684
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1672
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:29984
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:17300
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:17720
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18692
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:17424
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30744
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18392
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:17348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:16344
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19088
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:5792
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:9956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:9512
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:16452
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18764
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18828
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:7708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:13932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:16468
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18900
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18588
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18760
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:17704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18796
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:9452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:7224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:14440
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18668
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:17960
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:17272
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:18396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18792
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18712
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:4276
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:16612
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19060
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2288
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18976
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:18684
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1336
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4148
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:30364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:13936
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1332
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:19052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18720
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18988
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:17488
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:8316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:14432
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19132
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18200
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18728
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18612
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18732
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:19140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19056
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18932
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18716
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:29984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:13396
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18288
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18512
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18656
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:2444
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:4056
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:30460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:9964
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:14348
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:17744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:17136
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:17896
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:18080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18324
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:9672
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18496
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:16736
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:3804
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:17132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:4568
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:29920
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:4140
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:18388
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:18752
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19100
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19008
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19460
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16980
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19472
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19488
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31024
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:3824
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19496
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19512
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19520
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:19528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19536
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:28620
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:9544
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19544
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19560
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29908
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:13140
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19568
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19584
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:25988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:26424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:28244
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19592
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19608
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:10180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19616
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19632
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:13016
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19640
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19656
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:13580
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19664
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19680
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19688
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19704
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:26120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:26172
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:31720
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19712
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19728
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:31728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:32636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:9344
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19744
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:19760
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33084
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:7456
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19768
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19784
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:30252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:10932
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19792
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:19808
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:18860
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19816
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19836
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:27036
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18448
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:30436
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19844
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19860
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:32392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:31756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:28432
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19868
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19884
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:33700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:14428
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:19892
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19908
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19916
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19932
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:29924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:30056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:17444
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:19940
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19956
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:27296
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:18332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:31176
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19964
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19980
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:33700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:16548
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:21148
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:21780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:22608
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:17568
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:23972
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:23980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:25052
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:26276
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:26636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:26980
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:27476
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:25992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:26176
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:26424
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:26172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:26200
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:26168
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:19440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:27656
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:27664
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:27672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:27680
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:27688
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:27696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:27704
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:27712
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:27720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:27728
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28252
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:27792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:27872
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28680
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28696
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28704
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28720
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28728
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28744
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28764
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28784
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28800
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28816
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28824
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28840
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28848
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:28856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28864
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28872
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28888
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28896
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28912
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28920
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:28936
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28944
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28960
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28968
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:28976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28984
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28992
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29008
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29016
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:29024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:29032
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29040
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29056
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29064
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29080
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29088
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29104
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29112
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29128
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29136
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29152
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29160
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29176
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29184
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:29200
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29208
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29224
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29232
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29248
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29256
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29272
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29280
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29296
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29304
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29320
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29328
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29356
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29364
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29380
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29388
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29404
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29412
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29428
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29440
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29464
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29472
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:29480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29488
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29496
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29512
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29520
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:29528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29536
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29544
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29568
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29576
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29592
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29600
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29616
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29624
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29640
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29648
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29664
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29672
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29688
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:28544
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29708
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29716
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:29724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29732
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29740
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29756
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29764
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29780
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29796
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29812
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29820
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29836
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:29844
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29860
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29868
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:29884
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:29892
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:29900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:33596
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:10020
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:8828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:28128
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:5532
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  - Executes a command shell one-liner
  PID:32400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:1212
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:31048
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:14860
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:1796
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:14876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:16368
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:16608
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:16616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  - Executes a command shell one-liner
  PID:33172
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:16672
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:16680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19036
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  - Executes a command shell one-liner
  PID:9020
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:16692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:19040
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo SYSTEM LOCKED && color 0c"
  2⤵
  PID:19044
- C:\Windows\system32\cmd.exe
  cmd.exe /k "echo ACCESS DENIED && color 4f"
  2⤵
  PID:16684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Solara.bat"
  2⤵
  PID:16472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads