Which of the following will help identify the source internet protocol (IP) address of malware being exected on a computer?

A list of open network connections (viewed via tools like 'netstat -an') shows all active and listening TCP/UDP connections, including the remote (foreign) IP addresses and ports that a process is communicating with. Since malware typically beacons out to a command-and-control server, the remote IP address in an established connection tied to a suspicious process directly identifies the malware's source or destination IP address.

Displaying TCP/IP network configuration (e.g., 'ipconfig' or 'ifconfig') shows the local machine's own IP address, subnet mask, and gateway settings, not remote addresses of external systems communicating with the host.

A list of running processes identifies what programs are executing on the system but does not reveal the network addresses those processes are communicating with; you would need to correlate process IDs with network connections for that detail.

The ARP table maps local IP addresses to MAC addresses on the same network segment and does not reveal remote internet IP addresses used by malware communicating over the internet.