8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
Size 1.9MB
Sample261022-xjrl9atthv
SHA256 8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844
MD5 70868e22e61dba75f71b243dec3d33a3
SHA1 6c9eaff49c963a100b8a253afbc6658c6c5db374
SHA512 2269b8241b3eb2c82833a1ba890233c34ca6ce6cb762c06500d08cc75aa22acb55f7f6bb7e457dce5c619fdcbd98110ce8b35829ae47594fa47be2253f563914
SSDEEP 49152:vt1+Q8HJUk5j3rwsWPVO2xiNWAXIU6isA60L:vb3I7MBxUC+sO
TLSH
T1FD956C03F69580FCC55EC07887479632EA22BC8D092576EB2BD09B653E76F909F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Helper 530 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe"	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Monitor 175 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe"	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
3	api.ipify.org
8	api.ipify.org

Executes a command shell one-liner 1 TTPs 56 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1576	cmd.exe
2764	cmd.exe
3876	cmd.exe
5980	cmd.exe
4740	cmd.exe
4368	cmd.exe
4952	cmd.exe
1564	cmd.exe
2772	cmd.exe
1592	cmd.exe
4552	cmd.exe
1112	cmd.exe
936	cmd.exe
2576	cmd.exe
3956	cmd.exe
468	cmd.exe
760	cmd.exe
1156	cmd.exe
2836	cmd.exe
1456	cmd.exe
5392	cmd.exe
5764	cmd.exe
3140	cmd.exe
4852	cmd.exe
1424	cmd.exe
2300	cmd.exe
4372	cmd.exe
2520	cmd.exe
3560	cmd.exe
4344	cmd.exe
4692	cmd.exe
1780	cmd.exe
3180	cmd.exe
1572	cmd.exe
3468	cmd.exe
4388	cmd.exe
5904	cmd.exe
4648	cmd.exe
6068	cmd.exe
1240	cmd.exe
1832	cmd.exe
2220	cmd.exe
4056	cmd.exe
3336	cmd.exe
4080	cmd.exe
2296	cmd.exe
5776	cmd.exe
4912	cmd.exe
4220	cmd.exe
5840	cmd.exe
3800	cmd.exe
704	cmd.exe
2756	cmd.exe
2372	cmd.exe
4636	cmd.exe
5164	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe

Gathers network information 2 TTPs 56 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6116	ipconfig.exe
5876	ipconfig.exe
4716	ipconfig.exe
4272	ipconfig.exe
2488	ipconfig.exe
6060	ipconfig.exe
556	ipconfig.exe
2328	ipconfig.exe
1280	ipconfig.exe
5364	ipconfig.exe
4852	ipconfig.exe
1872	ipconfig.exe
3872	ipconfig.exe
3680	ipconfig.exe
2308	ipconfig.exe
2792	ipconfig.exe
6100	ipconfig.exe
4656	ipconfig.exe
2644	ipconfig.exe
2584	ipconfig.exe
3180	ipconfig.exe
4148	ipconfig.exe
1288	ipconfig.exe
5688	ipconfig.exe
5932	ipconfig.exe
696	ipconfig.exe
5416	ipconfig.exe
5012	ipconfig.exe
4520	ipconfig.exe
2972	ipconfig.exe
3684	ipconfig.exe
1224	ipconfig.exe
4296	ipconfig.exe
4984	ipconfig.exe
244	ipconfig.exe
1276	ipconfig.exe
4788	ipconfig.exe
2528	ipconfig.exe
3168	ipconfig.exe
1776	ipconfig.exe
5448	ipconfig.exe
3360	ipconfig.exe
3340	ipconfig.exe
1296	ipconfig.exe
4440	ipconfig.exe
5648	ipconfig.exe
4336	ipconfig.exe
3192	ipconfig.exe
3476	ipconfig.exe
3304	ipconfig.exe
3916	ipconfig.exe
2632	ipconfig.exe
2912	ipconfig.exe
2916	ipconfig.exe
1208	ipconfig.exe
6024	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 2300	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	90
PID 2300 wrote to memory of 244	2300	cmd.exe	91
PID 5244 wrote to memory of 4368	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	94
PID 4368 wrote to memory of 2584	4368	cmd.exe	95
PID 5684 wrote to memory of 2296	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	96
PID 2296 wrote to memory of 5416	2296	cmd.exe	97
PID 5244 wrote to memory of 2372	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	98
PID 2372 wrote to memory of 556	2372	cmd.exe	99
PID 5684 wrote to memory of 4952	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	100
PID 4952 wrote to memory of 3180	4952	cmd.exe	101
PID 5244 wrote to memory of 1564	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	102
PID 1564 wrote to memory of 4852	1564	cmd.exe	103
PID 5684 wrote to memory of 4636	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	104
PID 4636 wrote to memory of 3304	4636	cmd.exe	105
PID 5244 wrote to memory of 5776	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	106
PID 5776 wrote to memory of 3916	5776	cmd.exe	107
PID 5684 wrote to memory of 2772	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	108
PID 2772 wrote to memory of 1872	2772	cmd.exe	109
PID 5244 wrote to memory of 4648	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	110
PID 4648 wrote to memory of 3872	4648	cmd.exe	111
PID 5684 wrote to memory of 1456	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	112
PID 1456 wrote to memory of 3680	1456	cmd.exe	113
PID 5244 wrote to memory of 6068	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	114
PID 6068 wrote to memory of 2308	6068	cmd.exe	115
PID 5684 wrote to memory of 5164	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	117
PID 5164 wrote to memory of 4148	5164	cmd.exe	118
PID 5244 wrote to memory of 5392	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	119
PID 5392 wrote to memory of 3340	5392	cmd.exe	120
PID 5684 wrote to memory of 1576	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	121
PID 1576 wrote to memory of 6116	1576	cmd.exe	122
PID 5244 wrote to memory of 1592	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	123
PID 1592 wrote to memory of 2632	1592	cmd.exe	124
PID 5684 wrote to memory of 4552	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	125
PID 4552 wrote to memory of 5012	4552	cmd.exe	126
PID 5244 wrote to memory of 1240	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	127
PID 1240 wrote to memory of 5876	1240	cmd.exe	128
PID 5684 wrote to memory of 2764	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	129
PID 2764 wrote to memory of 4520	2764	cmd.exe	130
PID 5244 wrote to memory of 1112	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	131
PID 1112 wrote to memory of 4716	1112	cmd.exe	132
PID 5684 wrote to memory of 4372	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	133
PID 4372 wrote to memory of 1276	4372	cmd.exe	134
PID 5244 wrote to memory of 936	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	135
PID 936 wrote to memory of 2912	936	cmd.exe	136
PID 5684 wrote to memory of 1832	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	137
PID 1832 wrote to memory of 2328	1832	cmd.exe	138
PID 5244 wrote to memory of 2576	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	139
PID 2576 wrote to memory of 1288	2576	cmd.exe	140
PID 5684 wrote to memory of 2520	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	141
PID 2520 wrote to memory of 4788	2520	cmd.exe	142
PID 5244 wrote to memory of 1572	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	143
PID 1572 wrote to memory of 1296	1572	cmd.exe	144
PID 5684 wrote to memory of 2220	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	145
PID 2220 wrote to memory of 2528	2220	cmd.exe	146
PID 5244 wrote to memory of 3956	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	147
PID 3956 wrote to memory of 2644	3956	cmd.exe	148
PID 5684 wrote to memory of 3468	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	149
PID 3468 wrote to memory of 4272	3468	cmd.exe	150
PID 5244 wrote to memory of 468	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	151
PID 468 wrote to memory of 5688	468	cmd.exe	152
PID 5684 wrote to memory of 4912	5684	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	153
PID 4912 wrote to memory of 2792	4912	cmd.exe	154
PID 5244 wrote to memory of 4220	5244	8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe	155
PID 4220 wrote to memory of 6100	4220	cmd.exe	156

C:\Users\Admin\AppData\Local\Temp\8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
"C:\Users\Admin\AppData\Local\Temp\8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:244
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5416
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3180
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3304
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1872
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3680
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4148
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6116
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5012
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4520
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1276
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2328
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4788
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2528
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4272
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2792
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5840
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2972
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5764
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1776
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4056
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1280
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3876
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2916
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1156
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6024
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:704
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5648
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4344
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3684
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4692
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1224
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4080
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:696
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1780
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3180
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4984
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2836
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3192

C:\Users\Admin\AppData\Local\Temp\8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
C:\Users\Admin\AppData\Local\Temp\8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2584
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:556
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4852
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3916
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3872
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2308
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3340
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2632
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5876
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4716
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2912
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1288
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1296
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2644
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5688
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:760
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3168
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3800
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4656
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3336
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4440
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5980
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1208
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3560
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2488
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4740
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5932
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3140
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5364
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4388
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5448
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5904
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3360
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2756
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4336
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4852
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6060
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1424
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3476