d1ab5c35e09e0d0bcfeea6a9c612169551e593957599260bce88c879efbb05af

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1ab5c35e09e0d0b.bin.exe
Size 2.0MB
Sample261024-dzb2ysfv5t
SHA256 d1ab5c35e09e0d0bcfeea6a9c612169551e593957599260bce88c879efbb05af
MD5 4902f4ba2bd67972289fbd9ce15ba560
SHA1 b0da124d0516528253f93109f57ab11c2ddc6c0b
SHA512 e17f44762fbd2e38602931f62971ce252be23aeb7feab8a6ec7ad8f7c5768fe8cf95f7c1de9e01aee95fd517c390ad49a563789aa6b0d9b14a3d4da58dfe2827
SSDEEP 24576:n+APnoYvzI6DwUGGD4UQ6ZbKvDuhxlu+W5LWH99FjaNNEqdOmTVIH06iy9FM:nFno8k6NKUQ6xju++KH99Far9BIU6is
TLSH
T18C957C03E69581FCD49EC078C7579632EA22BC8E0920B6BB27D09B253E66F505F1DB1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Helper 602 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ab5c35e09e0d0b.bin.exe"	d1ab5c35e09e0d0b.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Helper 247 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ab5c35e09e0d0b.bin.exe"	d1ab5c35e09e0d0b.bin.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
7	api.ipify.org

Executes a command shell one-liner 1 TTPs 56 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4872	cmd.exe
2520	cmd.exe
5672	cmd.exe
4700	cmd.exe
4212	cmd.exe
4204	cmd.exe
252	cmd.exe
2392	cmd.exe
4964	cmd.exe
4364	cmd.exe
2436	cmd.exe
1636	cmd.exe
5444	cmd.exe
4944	cmd.exe
5072	cmd.exe
1352	cmd.exe
260	cmd.exe
5720	cmd.exe
1072	cmd.exe
4256	cmd.exe
4732	cmd.exe
2872	cmd.exe
4676	cmd.exe
4608	cmd.exe
3324	cmd.exe
4504	cmd.exe
4920	cmd.exe
2708	cmd.exe
4836	cmd.exe
4688	cmd.exe
4932	cmd.exe
5920	cmd.exe
4356	cmd.exe
2944	cmd.exe
5964	cmd.exe
1064	cmd.exe
6140	cmd.exe
5836	cmd.exe
2572	cmd.exe
3112	cmd.exe
4668	cmd.exe
2532	cmd.exe
2112	cmd.exe
2080	cmd.exe
2712	cmd.exe
4900	cmd.exe
5480	cmd.exe
1260	cmd.exe
5688	cmd.exe
2132	cmd.exe
5456	cmd.exe
2484	cmd.exe
4432	cmd.exe
5780	cmd.exe
4576	cmd.exe
1584	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	d1ab5c35e09e0d0b.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	d1ab5c35e09e0d0b.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	d1ab5c35e09e0d0b.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	d1ab5c35e09e0d0b.bin.exe

Gathers network information 2 TTPs 55 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1868	ipconfig.exe
4508	ipconfig.exe
4168	ipconfig.exe
3120	ipconfig.exe
4904	ipconfig.exe
1244	ipconfig.exe
5160	ipconfig.exe
4656	ipconfig.exe
1600	ipconfig.exe
5028	ipconfig.exe
4656	ipconfig.exe
2544	ipconfig.exe
1320	ipconfig.exe
1460	ipconfig.exe
1260	ipconfig.exe
5816	ipconfig.exe
2540	ipconfig.exe
4716	ipconfig.exe
4164	ipconfig.exe
3512	ipconfig.exe
4284	ipconfig.exe
5708	ipconfig.exe
1600	ipconfig.exe
2224	ipconfig.exe
4672	ipconfig.exe
4980	ipconfig.exe
5208	ipconfig.exe
4324	ipconfig.exe
4900	ipconfig.exe
4736	ipconfig.exe
5452	ipconfig.exe
4544	ipconfig.exe
4224	ipconfig.exe
1844	ipconfig.exe
4148	ipconfig.exe
1984	ipconfig.exe
3976	ipconfig.exe
1844	ipconfig.exe
2912	ipconfig.exe
2088	ipconfig.exe
2884	ipconfig.exe
1328	ipconfig.exe
1104	ipconfig.exe
2076	ipconfig.exe
5168	ipconfig.exe
716	ipconfig.exe
3196	ipconfig.exe
6040	ipconfig.exe
2276	ipconfig.exe
4748	ipconfig.exe
2492	ipconfig.exe
4436	ipconfig.exe
5616	ipconfig.exe
4924	ipconfig.exe
1540	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3172	d1ab5c35e09e0d0b.bin.exe
3172	d1ab5c35e09e0d0b.bin.exe
3172	d1ab5c35e09e0d0b.bin.exe
3172	d1ab5c35e09e0d0b.bin.exe
3172	d1ab5c35e09e0d0b.bin.exe
3172	d1ab5c35e09e0d0b.bin.exe
3172	d1ab5c35e09e0d0b.bin.exe
3172	d1ab5c35e09e0d0b.bin.exe
1612	d1ab5c35e09e0d0b.bin.exe
1612	d1ab5c35e09e0d0b.bin.exe
1612	d1ab5c35e09e0d0b.bin.exe
1612	d1ab5c35e09e0d0b.bin.exe
1612	d1ab5c35e09e0d0b.bin.exe
1612	d1ab5c35e09e0d0b.bin.exe
1612	d1ab5c35e09e0d0b.bin.exe
1612	d1ab5c35e09e0d0b.bin.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	3172	d1ab5c35e09e0d0b.bin.exe
Token: SeDebugPrivilege	3172	d1ab5c35e09e0d0b.bin.exe
Token: SeLoadDriverPrivilege	1612	d1ab5c35e09e0d0b.bin.exe
Token: SeDebugPrivilege	1612	d1ab5c35e09e0d0b.bin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 4964	3172	d1ab5c35e09e0d0b.bin.exe	89
PID 4964 wrote to memory of 2076	4964	cmd.exe	91
PID 1612 wrote to memory of 4688	1612	d1ab5c35e09e0d0b.bin.exe	95
PID 3172 wrote to memory of 4872	3172	d1ab5c35e09e0d0b.bin.exe	97
PID 4872 wrote to memory of 5708	4872	cmd.exe	99
PID 1612 wrote to memory of 260	1612	d1ab5c35e09e0d0b.bin.exe	100
PID 260 wrote to memory of 4900	260	cmd.exe	102
PID 3172 wrote to memory of 2484	3172	d1ab5c35e09e0d0b.bin.exe	103
PID 2484 wrote to memory of 4736	2484	cmd.exe	105
PID 1612 wrote to memory of 4432	1612	d1ab5c35e09e0d0b.bin.exe	106
PID 4432 wrote to memory of 5452	4432	cmd.exe	108
PID 3172 wrote to memory of 5720	3172	d1ab5c35e09e0d0b.bin.exe	109
PID 5720 wrote to memory of 4748	5720	cmd.exe	111
PID 1612 wrote to memory of 4932	1612	d1ab5c35e09e0d0b.bin.exe	112
PID 4932 wrote to memory of 4544	4932	cmd.exe	114
PID 3172 wrote to memory of 1072	3172	d1ab5c35e09e0d0b.bin.exe	115
PID 1072 wrote to memory of 1600	1072	cmd.exe	117
PID 1612 wrote to memory of 5920	1612	d1ab5c35e09e0d0b.bin.exe	118
PID 5920 wrote to memory of 3976	5920	cmd.exe	120
PID 3172 wrote to memory of 2080	3172	d1ab5c35e09e0d0b.bin.exe	121
PID 2080 wrote to memory of 1868	2080	cmd.exe	123
PID 1612 wrote to memory of 4364	1612	d1ab5c35e09e0d0b.bin.exe	124
PID 4364 wrote to memory of 5160	4364	cmd.exe	126
PID 3172 wrote to memory of 3324	3172	d1ab5c35e09e0d0b.bin.exe	128
PID 3324 wrote to memory of 5168	3324	cmd.exe	130
PID 1612 wrote to memory of 2712	1612	d1ab5c35e09e0d0b.bin.exe	131
PID 2712 wrote to memory of 1460	2712	cmd.exe	133
PID 3172 wrote to memory of 4256	3172	d1ab5c35e09e0d0b.bin.exe	134
PID 4256 wrote to memory of 1260	4256	cmd.exe	136
PID 1612 wrote to memory of 2520	1612	d1ab5c35e09e0d0b.bin.exe	137
PID 2520 wrote to memory of 1844	2520	cmd.exe	139
PID 3172 wrote to memory of 4356	3172	d1ab5c35e09e0d0b.bin.exe	140
PID 4356 wrote to memory of 4656	4356	cmd.exe	142
PID 1612 wrote to memory of 4504	1612	d1ab5c35e09e0d0b.bin.exe	143
PID 4504 wrote to memory of 716	4504	cmd.exe	145
PID 3172 wrote to memory of 2944	3172	d1ab5c35e09e0d0b.bin.exe	146
PID 2944 wrote to memory of 2224	2944	cmd.exe	148
PID 1612 wrote to memory of 5672	1612	d1ab5c35e09e0d0b.bin.exe	149
PID 5672 wrote to memory of 2912	5672	cmd.exe	151
PID 3172 wrote to memory of 1064	3172	d1ab5c35e09e0d0b.bin.exe	152
PID 1064 wrote to memory of 5816	1064	cmd.exe	154
PID 1612 wrote to memory of 6140	1612	d1ab5c35e09e0d0b.bin.exe	155
PID 6140 wrote to memory of 2540	6140	cmd.exe	157
PID 3172 wrote to memory of 5836	3172	d1ab5c35e09e0d0b.bin.exe	158
PID 5836 wrote to memory of 2088	5836	cmd.exe	160
PID 1612 wrote to memory of 2572	1612	d1ab5c35e09e0d0b.bin.exe	161
PID 2572 wrote to memory of 2884	2572	cmd.exe	163
PID 3172 wrote to memory of 4700	3172	d1ab5c35e09e0d0b.bin.exe	164
PID 4700 wrote to memory of 2492	4700	cmd.exe	166
PID 1612 wrote to memory of 4900	1612	d1ab5c35e09e0d0b.bin.exe	167
PID 4900 wrote to memory of 4672	4900	cmd.exe	169
PID 3172 wrote to memory of 2436	3172	d1ab5c35e09e0d0b.bin.exe	170
PID 2436 wrote to memory of 4508	2436	cmd.exe	172
PID 1612 wrote to memory of 3112	1612	d1ab5c35e09e0d0b.bin.exe	173
PID 3112 wrote to memory of 3196	3112	cmd.exe	175
PID 3172 wrote to memory of 5780	3172	d1ab5c35e09e0d0b.bin.exe	176
PID 5780 wrote to memory of 4980	5780	cmd.exe	178
PID 1612 wrote to memory of 5480	1612	d1ab5c35e09e0d0b.bin.exe	179
PID 5480 wrote to memory of 1600	5480	cmd.exe	181
PID 3172 wrote to memory of 4668	3172	d1ab5c35e09e0d0b.bin.exe	182
PID 4668 wrote to memory of 5208	4668	cmd.exe	184
PID 1612 wrote to memory of 4920	1612	d1ab5c35e09e0d0b.bin.exe	185
PID 4920 wrote to memory of 4224	4920	cmd.exe	187
PID 3172 wrote to memory of 4212	3172	d1ab5c35e09e0d0b.bin.exe	188

C:\Users\Admin\AppData\Local\Temp\d1ab5c35e09e0d0b.bin.exe
"C:\Users\Admin\AppData\Local\Temp\d1ab5c35e09e0d0b.bin.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2076
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5708
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4736
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1600
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1868
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5168
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1260
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4656
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2224
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5816
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2088
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2492
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4508
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4980
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5208
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4212
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5028
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2532
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1328
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5444
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5616
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5688
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4656
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2132
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2544
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4944
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3120
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5072
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4924
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2872
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4148
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5456
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4904
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1584
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1244
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1352
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2276
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2708
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1104

C:\Users\Admin\AppData\Local\Temp\d1ab5c35e09e0d0b.bin.exe
C:\Users\Admin\AppData\Local\Temp\d1ab5c35e09e0d0b.bin.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4688
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4900
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5452
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4544
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3976
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5160
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1460
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1844
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:716
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2912
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2540
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2884
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4672
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3196
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1600
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4224
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1636
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4436
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2112
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4716
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1260
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1844
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4576
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4164
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5964
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4168
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4732
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1320
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4204
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6040
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:252
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1984
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2392
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4324
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4676
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3512
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4608
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1540
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4836
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4284