bdff003f47f176d4c685a032ffdb7db5e482c812bcd0c7e58acc76327f317a36

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bdff003f47f176d4.bin.exe
Size 2.0MB
Sample261024-dzb2ysfv5s
SHA256 bdff003f47f176d4c685a032ffdb7db5e482c812bcd0c7e58acc76327f317a36
MD5 491fee22edfa785911d113c4118c7a30
SHA1 61b08489f490887c33c95bcc133041f138ef16ea
SHA512 773f565542378788c96d6b2d2ac83c095bab7a32aef55377c4b82911ada401afe7b0416419b01d36b1e315484f9b036d9f98159c6dde730d21ef26608c5dd21f
SSDEEP 24576:6+APnoYtzk6DwUGGD4UQ6ZbKvDuhxlu+W5LWH99FjaNNdGVqdOmTVIH06iy9FM:6Fno+I6NKUQ6xju++KH99FarFBIU6is
TLSH
T16B957C47E69580FCD49EC078C3579732EA22BC8D0920B6AB27D09B653E76F506F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Monitor 141 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bdff003f47f176d4.bin.exe"	bdff003f47f176d4.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Helper 741 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bdff003f47f176d4.bin.exe"	bdff003f47f176d4.bin.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
3	api.ipify.org
7	api.ipify.org

Executes a command shell one-liner 1 TTPs 55 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4836	cmd.exe
1624	cmd.exe
1200	cmd.exe
4480	cmd.exe
4692	cmd.exe
4560	cmd.exe
1132	cmd.exe
4412	cmd.exe
5904	cmd.exe
4808	cmd.exe
5488	cmd.exe
1628	cmd.exe
5528	cmd.exe
3952	cmd.exe
756	cmd.exe
1248	cmd.exe
4812	cmd.exe
264	cmd.exe
4388	cmd.exe
4072	cmd.exe
2908	cmd.exe
2868	cmd.exe
3644	cmd.exe
1812	cmd.exe
2504	cmd.exe
4676	cmd.exe
2232	cmd.exe
1752	cmd.exe
4592	cmd.exe
1804	cmd.exe
5536	cmd.exe
4440	cmd.exe
5548	cmd.exe
3264	cmd.exe
3576	cmd.exe
52	cmd.exe
1028	cmd.exe
4172	cmd.exe
5376	cmd.exe
5048	cmd.exe
1368	cmd.exe
3716	cmd.exe
3772	cmd.exe
5860	cmd.exe
2476	cmd.exe
4436	cmd.exe
1088	cmd.exe
4740	cmd.exe
4316	cmd.exe
2664	cmd.exe
5696	cmd.exe
5492	cmd.exe
4584	cmd.exe
2636	cmd.exe
4140	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bdff003f47f176d4.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bdff003f47f176d4.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bdff003f47f176d4.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bdff003f47f176d4.bin.exe

Gathers network information 2 TTPs 55 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1112	ipconfig.exe
856	ipconfig.exe
4216	ipconfig.exe
4280	ipconfig.exe
1256	ipconfig.exe
2448	ipconfig.exe
300	ipconfig.exe
2688	ipconfig.exe
5352	ipconfig.exe
3932	ipconfig.exe
3436	ipconfig.exe
200	ipconfig.exe
6076	ipconfig.exe
4196	ipconfig.exe
5844	ipconfig.exe
5728	ipconfig.exe
5568	ipconfig.exe
2592	ipconfig.exe
1496	ipconfig.exe
3592	ipconfig.exe
1508	ipconfig.exe
4816	ipconfig.exe
5896	ipconfig.exe
2496	ipconfig.exe
2172	ipconfig.exe
4444	ipconfig.exe
1096	ipconfig.exe
3628	ipconfig.exe
3124	ipconfig.exe
4348	ipconfig.exe
1248	ipconfig.exe
1628	ipconfig.exe
1344	ipconfig.exe
920	ipconfig.exe
936	ipconfig.exe
1600	ipconfig.exe
2264	ipconfig.exe
3908	ipconfig.exe
5540	ipconfig.exe
6052	ipconfig.exe
4704	ipconfig.exe
2720	ipconfig.exe
1624	ipconfig.exe
2856	ipconfig.exe
2768	ipconfig.exe
2884	ipconfig.exe
1944	ipconfig.exe
936	ipconfig.exe
1224	ipconfig.exe
1104	ipconfig.exe
5992	ipconfig.exe
4296	ipconfig.exe
1100	ipconfig.exe
2972	ipconfig.exe
2492	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4908	bdff003f47f176d4.bin.exe
4908	bdff003f47f176d4.bin.exe
4908	bdff003f47f176d4.bin.exe
4908	bdff003f47f176d4.bin.exe
4908	bdff003f47f176d4.bin.exe
4908	bdff003f47f176d4.bin.exe
4908	bdff003f47f176d4.bin.exe
4908	bdff003f47f176d4.bin.exe
4276	bdff003f47f176d4.bin.exe
4276	bdff003f47f176d4.bin.exe
4276	bdff003f47f176d4.bin.exe
4276	bdff003f47f176d4.bin.exe
4276	bdff003f47f176d4.bin.exe
4276	bdff003f47f176d4.bin.exe
4276	bdff003f47f176d4.bin.exe
4276	bdff003f47f176d4.bin.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4908	bdff003f47f176d4.bin.exe
Token: SeDebugPrivilege	4908	bdff003f47f176d4.bin.exe
Token: SeLoadDriverPrivilege	4276	bdff003f47f176d4.bin.exe
Token: SeDebugPrivilege	4276	bdff003f47f176d4.bin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 5492	4908	bdff003f47f176d4.bin.exe	89
PID 5492 wrote to memory of 4216	5492	cmd.exe	91
PID 4276 wrote to memory of 2504	4276	bdff003f47f176d4.bin.exe	95
PID 2504 wrote to memory of 1628	2504	cmd.exe	97
PID 4908 wrote to memory of 4812	4908	bdff003f47f176d4.bin.exe	99
PID 4812 wrote to memory of 1104	4812	cmd.exe	101
PID 4276 wrote to memory of 5904	4276	bdff003f47f176d4.bin.exe	102
PID 5904 wrote to memory of 5992	5904	cmd.exe	104
PID 4908 wrote to memory of 264	4908	bdff003f47f176d4.bin.exe	105
PID 264 wrote to memory of 5728	264	cmd.exe	107
PID 4276 wrote to memory of 4584	4276	bdff003f47f176d4.bin.exe	108
PID 4584 wrote to memory of 5896	4584	cmd.exe	110
PID 4908 wrote to memory of 4172	4908	bdff003f47f176d4.bin.exe	111
PID 4172 wrote to memory of 4280	4172	cmd.exe	113
PID 4276 wrote to memory of 4480	4276	bdff003f47f176d4.bin.exe	114
PID 4480 wrote to memory of 1256	4480	cmd.exe	116
PID 4908 wrote to memory of 4692	4908	bdff003f47f176d4.bin.exe	117
PID 4692 wrote to memory of 1344	4692	cmd.exe	119
PID 4276 wrote to memory of 5376	4276	bdff003f47f176d4.bin.exe	120
PID 5376 wrote to memory of 920	5376	cmd.exe	122
PID 4908 wrote to memory of 4676	4908	bdff003f47f176d4.bin.exe	123
PID 4676 wrote to memory of 5568	4676	cmd.exe	125
PID 4276 wrote to memory of 2636	4276	bdff003f47f176d4.bin.exe	126
PID 2636 wrote to memory of 5844	2636	cmd.exe	128
PID 4908 wrote to memory of 4560	4908	bdff003f47f176d4.bin.exe	130
PID 4560 wrote to memory of 1248	4560	cmd.exe	132
PID 4276 wrote to memory of 1132	4276	bdff003f47f176d4.bin.exe	133
PID 1132 wrote to memory of 1624	1132	cmd.exe	135
PID 4908 wrote to memory of 4808	4908	bdff003f47f176d4.bin.exe	136
PID 4808 wrote to memory of 2448	4808	cmd.exe	138
PID 4276 wrote to memory of 5488	4276	bdff003f47f176d4.bin.exe	139
PID 5488 wrote to memory of 2856	5488	cmd.exe	141
PID 4908 wrote to memory of 1804	4908	bdff003f47f176d4.bin.exe	142
PID 1804 wrote to memory of 4296	1804	cmd.exe	144
PID 4276 wrote to memory of 5048	4276	bdff003f47f176d4.bin.exe	145
PID 5048 wrote to memory of 2496	5048	cmd.exe	147
PID 4908 wrote to memory of 2476	4908	bdff003f47f176d4.bin.exe	148
PID 2476 wrote to memory of 1100	2476	cmd.exe	150
PID 4276 wrote to memory of 4436	4276	bdff003f47f176d4.bin.exe	151
PID 4436 wrote to memory of 2768	4436	cmd.exe	153
PID 4908 wrote to memory of 4140	4908	bdff003f47f176d4.bin.exe	154
PID 4140 wrote to memory of 936	4140	cmd.exe	156
PID 4276 wrote to memory of 4388	4276	bdff003f47f176d4.bin.exe	157
PID 4388 wrote to memory of 2172	4388	cmd.exe	159
PID 4908 wrote to memory of 1628	4908	bdff003f47f176d4.bin.exe	160
PID 1628 wrote to memory of 2592	1628	cmd.exe	162
PID 4276 wrote to memory of 1088	4276	bdff003f47f176d4.bin.exe	163
PID 1088 wrote to memory of 4444	1088	cmd.exe	165
PID 4908 wrote to memory of 5536	4908	bdff003f47f176d4.bin.exe	166
PID 5536 wrote to memory of 300	5536	cmd.exe	168
PID 4276 wrote to memory of 4072	4276	bdff003f47f176d4.bin.exe	169
PID 4072 wrote to memory of 3436	4072	cmd.exe	171
PID 4908 wrote to memory of 4740	4908	bdff003f47f176d4.bin.exe	172
PID 4740 wrote to memory of 3908	4740	cmd.exe	174
PID 4276 wrote to memory of 5528	4276	bdff003f47f176d4.bin.exe	175
PID 5528 wrote to memory of 2972	5528	cmd.exe	177
PID 4908 wrote to memory of 3952	4908	bdff003f47f176d4.bin.exe	178
PID 3952 wrote to memory of 2884	3952	cmd.exe	180
PID 4276 wrote to memory of 2232	4276	bdff003f47f176d4.bin.exe	181
PID 2232 wrote to memory of 1096	2232	cmd.exe	183
PID 4908 wrote to memory of 756	4908	bdff003f47f176d4.bin.exe	184
PID 756 wrote to memory of 1496	756	cmd.exe	186
PID 4276 wrote to memory of 1368	4276	bdff003f47f176d4.bin.exe	187
PID 1368 wrote to memory of 3628	1368	cmd.exe	189

C:\Users\Admin\AppData\Local\Temp\bdff003f47f176d4.bin.exe
"C:\Users\Admin\AppData\Local\Temp\bdff003f47f176d4.bin.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4216
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1104
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5728
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4280
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1344
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5568
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1248
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2448
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1100
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:936
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2592
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5536
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:300
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3908
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2884
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1496
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4316
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2492
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4440
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:856
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1624
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:200
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2908
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1600
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4412
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5352
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3576
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:936
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3716
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3592
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3644
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4816
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1752
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6052
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5696
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4196
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3772
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1224
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5860
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2264

C:\Users\Admin\AppData\Local\Temp\bdff003f47f176d4.bin.exe
C:\Users\Admin\AppData\Local\Temp\bdff003f47f176d4.bin.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1628
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5992
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5896
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1256
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:920
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5844
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1624
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2856
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2496
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2768
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2172
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4444
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3436
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2972
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1096
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3628
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4836
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1112
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1248
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2688
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2664
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5540
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5548
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1944
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3264
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3932
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2868
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3124
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1200
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1508
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:52
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4348
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1812
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6076
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1028
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4704
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4592
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2720