Edit tour

Windows Analysis Report
njrat.exe

Overview

General Information

Sample name:	njrat.exe
Analysis ID:	1553745
MD5:	5d383eaaf20033cf6202982b4fba4211
SHA1:	3e2981a44353633ef9fdf680282dfc013edbe879
SHA256:	9c2410a93a496b8b04015ab38a40b54acc289eed2ba363b52f349552af54e4fb
Infos:

Detection

BrowserPasswordDump Tool, Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected BrowserPasswordDump Tool by SecurityXploded

Yara detected Njrat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Creates an autostart registry key pointing to binary in C:\Windows

Creates autostart registry keys with suspicious names

Drops PE files to the startup folder

Drops executables to the windows directory (C:\Windows) and starts them

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Protects its processes via BreakOnTermination flag

Sample uses process hollowing technique

Sigma detected: Potentially Suspicious Malware Callback Communication

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Instant Messenger accounts or passwords

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

njrat.exe (PID: 2676 cmdline: "C:\Users\user\Desktop\njrat.exe" MD5: 5D383EAAF20033CF6202982B4FBA4211)

server.exe (PID: 5828 cmdline: "C:\Windows\server.exe" MD5: 5D383EAAF20033CF6202982B4FBA4211)

netsh.exe (PID: 332 cmdline: netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vbc.exe (PID: 1144 cmdline: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\user\AppData\Local\Temp\1129210" MD5: D881DE17AA8F2E2C08CBB7B265F928F9)

conhost.exe (PID: 1888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

server.exe (PID: 5552 cmdline: "C:\Windows\server.exe" .. MD5: 5D383EAAF20033CF6202982B4FBA4211)

server.exe (PID: 6748 cmdline: "C:\Windows\server.exe" .. MD5: 5D383EAAF20033CF6202982B4FBA4211)

server.exe (PID: 6952 cmdline: "C:\Windows\server.exe" .. MD5: 5D383EAAF20033CF6202982B4FBA4211)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "51.103.213.187", "Port": "5552", "Version": "im523", "Campaign ID": "dfir.ch", "Install Name": "server.exe", "Install Dir": "WinDir"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
njrat.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
njrat.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efe:$a3: Download ERROR 0x81f0:$a5: netsh firewall delete allowedprogram "
njrat.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e6:$a1: netsh firewall add allowedprogram 0x82e0:$b1: [TAP] 0x8286:$b2: & exit 0x8252:$c1: md.exe /k ping 0 & del
njrat.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81f0:$s1: netsh firewall delete allowedprogram 0x80e6:$s2: netsh firewall add allowedprogram 0x8250:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7eda:$s4: Execute ERROR 0x7f3a:$s4: Execute ERROR 0x7efe:$s5: Download ERROR 0x8296:$s6: [kl]

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\server.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Windows\server.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efe:$a3: Download ERROR 0x81f0:$a5: netsh firewall delete allowedprogram "
C:\Windows\server.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e6:$a1: netsh firewall add allowedprogram 0x82e0:$b1: [TAP] 0x8286:$b2: & exit 0x8252:$c1: md.exe /k ping 0 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efe:$a3: Download ERROR 0x81f0:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e6:$a1: netsh firewall add allowedprogram 0x82e0:$b1: [TAP] 0x8286:$b2: & exit 0x8252:$c1: md.exe /k ping 0 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81f0:$s1: netsh firewall delete allowedprogram 0x80e6:$s2: netsh firewall add allowedprogram 0x8250:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7eda:$s4: Execute ERROR 0x7f3a:$s4: Execute ERROR 0x7efe:$s5: Download ERROR 0x8296:$s6: [kl]
C:\Windows\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81f0:$s1: netsh firewall delete allowedprogram 0x80e6:$s2: netsh firewall add allowedprogram 0x8250:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7eda:$s4: Execute ERROR 0x7f3a:$s4: Execute ERROR 0x7efe:$s5: Download ERROR 0x8296:$s6: [kl]
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1653664845.0000000000152000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1653664845.0000000000152000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x62c1:$a1: get_Registry 0x7cfe:$a3: Download ERROR 0x7ff0:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1653664845.0000000000152000.00000002.00000001.01000000.00000003.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ee6:$a1: netsh firewall add allowedprogram 0x80e0:$b1: [TAP] 0x8086:$b2: & exit 0x8052:$c1: md.exe /k ping 0 & del
0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_Tool	Yara detected BrowserPasswordDump Tool by SecurityXploded	Joe Security
00000001.00000002.4121788498.0000000002F61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: njrat.exe PID: 2676	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: server.exe PID: 5828	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: vbc.exe PID: 1144	JoeSecurity_BrowserPasswordDump_Tool	Yara detected BrowserPasswordDump Tool by SecurityXploded	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 51.103.213.187, DestinationIsIpv6: false, DestinationPort: 5552, EventID: 3, Image: C:\Windows\server.exe, Initiated: true, ProcessId: 5828, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Windows\server.exe" .., EventID: 13, EventType: SetValue, Image: C:\Windows\server.exe, ProcessId: 5828, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\495a56e87a9043e1648a2f6d33cf682f

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\server.exe, ProcessId: 5828, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Windows\server.exe" .., EventID: 13, EventType: SetValue, Image: C:\Windows\server.exe, ProcessId: 5828, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\495a56e87a9043e1648a2f6d33cf682f

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:09:28.710866+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:09:28.710866+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP

ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:09:50.770403+0100	2019214	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:11.945941+0100	2019214	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP

ET MALWARE njrat ver 0.7d Malware CnC Callback (Get Passwords)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:10:30.627595+0100	2022063	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP

ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:09:46.484157+0100	2022060	1	Malware Command and Control Activity Detected	192.168.2.4	49737	51.103.213.187	5552	TCP

ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:09:48.172538+0100	2022061	1	Malware Command and Control Activity Detected	192.168.2.4	49737	51.103.213.187	5552	TCP
2024-11-11T17:09:48.329128+0100	2022061	1	Malware Command and Control Activity Detected	192.168.2.4	49737	51.103.213.187	5552	TCP
2024-11-11T17:09:48.391346+0100	2022061	1	Malware Command and Control Activity Detected	192.168.2.4	49737	51.103.213.187	5552	TCP
2024-11-11T17:09:48.532136+0100	2022061	1	Malware Command and Control Activity Detected	192.168.2.4	49737	51.103.213.187	5552	TCP
2024-11-11T17:09:49.012342+0100	2022061	1	Malware Command and Control Activity Detected	192.168.2.4	49737	51.103.213.187	5552	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:09:34.125572+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:18.610708+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:18.844793+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:19.157262+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:21.048297+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:28.486000+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:28.736085+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:29.923372+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.048376+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.365086+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.370736+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.387241+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.395365+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.407366+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.413998+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.431713+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.438184+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.508841+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.514006+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.528844+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.533731+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.569734+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.627595+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.634651+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.651474+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.656452+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.675858+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.680895+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.696525+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.701489+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.721825+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.726719+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.746940+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.751809+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.774960+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.779849+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.879370+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.885872+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.905692+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.913770+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.941773+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.949602+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.961239+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.969610+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:30.980977+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.025619+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.032463+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.049399+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.056111+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.075351+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.081577+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.096283+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.101596+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.227618+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.233609+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.266779+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.271811+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.296664+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.301651+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.318383+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.323951+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.337431+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.345665+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.362215+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.369716+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.382124+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.389613+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.406379+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.413624+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.427227+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.432633+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.453718+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.458602+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.480015+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.485062+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.531080+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.537182+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.562871+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.568365+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.585243+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.590200+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.615494+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.621595+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.632614+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.638382+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.655279+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.660350+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.673943+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.679684+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.697157+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.703027+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.718408+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.725622+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.743234+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.749617+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.761067+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.769635+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.780461+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.788693+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.804845+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.813609+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.822709+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.829662+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.873003+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.881629+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.898328+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.905623+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.920166+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.925621+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.939611+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.944646+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.958080+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.963076+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:31.981699+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.026739+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.031604+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.053966+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.058966+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.104060+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.109204+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.155808+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.161722+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.197515+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.202630+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.242438+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.247293+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.273714+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.278656+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.290635+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.295756+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.308191+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.313129+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.328410+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.333391+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.346217+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.351183+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.364600+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.369719+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.388451+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.393302+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.406498+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.413224+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.429465+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.435006+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.454571+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.459489+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.476688+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.483118+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.497364+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.502297+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.520365+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.525374+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.551163+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.556151+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.575070+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.579936+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.599317+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.604413+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.620111+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.624969+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.651617+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.656637+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.670051+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.675003+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.706998+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.711959+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.728134+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.733104+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.757208+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.764631+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.778993+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.784150+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.801709+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.806786+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.821864+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.830141+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.850188+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.855154+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.868284+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.874109+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.888539+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.893625+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:32.928000+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.354629+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.359632+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.378501+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.383831+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.398199+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.403765+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.419354+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.425647+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.444343+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.451728+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.464105+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.471813+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.487053+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.495835+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.509584+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.515661+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.529807+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.535791+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.559503+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.567776+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.578492+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.583717+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.606349+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.611721+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.622821+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.631647+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.639771+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.649644+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.657220+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.675065+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.683725+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.691650+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.699648+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.715220+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.720316+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.732975+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.739862+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.750585+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.759729+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.770409+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.775724+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.793034+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.798700+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.818624+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.823543+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.842365+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.847665+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.891009+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.897601+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.976019+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.980867+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.015850+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.021139+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.026195+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.038641+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.043872+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.062076+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.067007+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.090640+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.095640+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.110490+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.116890+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.133449+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.138461+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.152645+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.157787+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.183504+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.188394+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.206162+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.211159+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.231299+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.236276+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.281154+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.286141+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.304555+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.310102+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.322578+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.327424+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.340555+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.345698+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.360008+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.364898+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.380020+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.384909+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.415527+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.420387+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.434753+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.439743+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.480177+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.485174+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.519155+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.525487+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.587919+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.593252+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.632907+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.638006+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.658956+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.707932+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.718192+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.732338+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.737214+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.769468+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.774514+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.790320+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.795934+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.818991+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.824409+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.843154+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.848537+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.860439+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.865510+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.881590+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.887508+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.909823+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.915300+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.947275+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.961051+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.975340+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.983822+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.039667+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.062876+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.071846+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.091750+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.099768+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.111794+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.128051+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.133868+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.155995+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.161048+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.176266+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.181423+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.202881+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.213300+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.302698+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.336122+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.398666+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.403701+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.423896+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.428958+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.444006+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.451690+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.462668+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.467736+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.482850+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.491746+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.501923+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.507821+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.520315+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.528043+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.539862+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.549302+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.562668+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.567717+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.581381+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.587739+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.601264+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.608158+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.619497+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.643698+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.650740+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.661676+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.673789+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.685665+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.700698+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.709671+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.721676+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.739174+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.745671+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.760779+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.769777+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.796724+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.805683+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.824063+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.829008+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.841633+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.846520+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.862150+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.867189+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.883978+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.891894+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.907470+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.916207+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:35.969919+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.038356+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.071770+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.076911+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.091449+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.096735+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.116046+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.121195+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.134320+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.139284+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.156459+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.161473+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.180694+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.185865+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.212015+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.216957+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.239516+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.244338+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.278979+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.286401+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.340872+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.345734+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.365939+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.370913+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.385955+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.390770+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.408876+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.413771+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.432247+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.437146+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.452508+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.459980+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.494460+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.499413+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.516379+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.523846+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.541397+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.546225+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.592915+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.600043+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.697568+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.702523+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.719489+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.724370+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.740108+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.744975+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.771039+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.775995+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.275630+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.280493+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.307097+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.312066+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.337235+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.342041+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.384505+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.389304+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.411960+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.416901+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.437617+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.443149+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.514247+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.524706+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.576296+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.587074+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.621425+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.626322+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.649711+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.654686+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.674991+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.685908+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.725864+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.730983+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.749254+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.754390+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.778848+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.783982+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.821006+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:37.826095+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.245196+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.250042+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.273586+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.281729+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.291943+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.297706+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.313397+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.324315+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.358953+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.364485+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.413418+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.421537+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.451741+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.456541+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.495659+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.500581+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.519289+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.524745+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.547156+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.552116+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.571276+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.577706+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.589336+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.597732+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.607163+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.613738+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.627382+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.633721+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.662767+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.669730+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.681982+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.687726+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.701770+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.708228+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.734797+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.741732+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.754618+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.761722+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.774068+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.780232+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.798022+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.804268+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.817527+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.825725+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.838249+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.845731+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.857224+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.864333+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.874062+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.880008+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.891513+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.897734+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.911557+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.921739+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.932895+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.939271+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.961469+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.966344+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.992907+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.045887+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.051038+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.124855+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.133972+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.157325+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.165021+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.193190+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.198052+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.219748+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.224675+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.245113+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.250183+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.282484+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.289095+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.306372+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.311371+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.336133+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.341119+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.375369+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.382248+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.425570+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.430896+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.453248+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.458487+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.477632+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.482523+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.506195+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.511731+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.525560+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.530519+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.545900+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.551237+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.565645+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.571339+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.589240+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.594858+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.615737+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.620765+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.638346+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.643633+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.661179+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.666185+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.686789+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.692978+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.834632+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.850095+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.888461+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.893805+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.917881+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.923301+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.937252+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.942273+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.958226+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.963773+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.983953+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.031760+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.043723+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.052144+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.092599+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.100243+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.165527+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.171783+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.188260+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.193383+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.214570+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.219881+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.238147+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.244689+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.264313+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.269277+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.299464+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.304616+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.321722+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.327915+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.343806+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.351879+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.370675+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.375644+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.391902+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.397591+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.417353+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.829622+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.835974+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.850459+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.857760+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.868519+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.873758+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.897812+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.903835+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.921469+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.927831+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.941490+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.947870+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.959934+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.965096+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:40.980180+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.033604+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.042094+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.069469+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.074395+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.091327+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.096788+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.119432+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.124391+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.148972+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.155380+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.173357+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.184427+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.205362+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.210404+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.231901+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.237292+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.278418+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.283448+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.306195+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.327426+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.338382+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.345079+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.372202+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.378039+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.397841+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.402807+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.420591+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.425535+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.447258+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.453270+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.495859+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.503475+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.512777+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.518946+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.537076+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.542222+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.555860+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.560945+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.575349+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.580909+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.598347+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.604339+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.627175+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.632211+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.651422+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.657643+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.687390+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.694329+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.718175+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.723110+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.741078+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.747960+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.764238+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.771258+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.788124+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.227770+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.232778+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.281922+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.288764+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.309392+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.317796+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.328791+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.333788+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.356048+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.360905+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.375248+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.381783+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.394654+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.401777+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.411954+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.417781+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.429074+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.437779+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.448229+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.453777+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.465653+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.473787+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.497101+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.505813+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.529107+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.537787+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.550450+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.557788+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.569088+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.577792+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.588902+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.594376+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.608495+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.613786+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.649701+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.655359+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.672420+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.677520+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.698742+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.704566+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.723237+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.729233+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.743256+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.748187+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.763437+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.769802+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.794439+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.800405+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.824716+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.830485+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.864026+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.874696+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.895219+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.901798+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.919027+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.925890+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.946057+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.953802+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.968513+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.973788+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.991241+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.036045+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.058122+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.063905+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.086349+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.092072+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.104742+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.111923+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.121922+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.127883+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.144150+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.152244+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.171903+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.180239+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.205389+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.210481+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.245616+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.250603+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.275172+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.281457+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.309153+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.317442+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.342949+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.350976+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.389932+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.395534+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.465782+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.471286+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.490493+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.495898+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.512832+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.918509+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.924010+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.939771+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.948112+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.966145+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.971125+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.995882+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.000901+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.021808+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.026900+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.043309+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.048292+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.096306+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.104834+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.140038+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.148739+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.183300+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.188658+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.217339+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.222302+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.289471+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.294285+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.313486+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.318483+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.332239+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.337323+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.351032+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.355910+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.371620+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.376588+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.390274+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.395170+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.416659+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.421972+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.434004+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.439294+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.452696+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.457595+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.472772+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.477810+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.490190+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.495061+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.506843+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.511742+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.531497+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.540869+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.563820+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.576275+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.595021+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.600993+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.620986+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.626039+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.650167+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.655032+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.681345+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:44.686408+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.098582+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.104808+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.121490+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.129867+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.140963+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.147873+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.166866+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.176453+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.235602+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.300165+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.351420+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.361860+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.377205+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.385927+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.399867+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.409841+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.429897+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.445958+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.451872+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.457834+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.479210+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.484846+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.526172+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.531541+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.584048+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.590191+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.699589+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.704632+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.730818+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.736939+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.755216+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.763885+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.775329+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.781839+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.842770+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.848322+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.969123+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.976862+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.011092+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.027890+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.033847+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.039868+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.053807+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.060858+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.076080+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.117426+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.168109+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.177867+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.195530+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.201843+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.218672+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.223700+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.257947+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.263500+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.342400+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.347717+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.385985+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.390976+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.431486+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.437850+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.473447+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.479455+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.526864+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.535895+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.593412+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.601245+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.648880+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.653811+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.793817+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.813372+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.874122+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.882164+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.952881+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:46.983773+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.217499+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.225530+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.281290+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.288961+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.376265+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.400188+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.405522+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.435450+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.443896+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.464375+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.472318+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.486630+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.492748+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.513105+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.518347+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.541550+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.548145+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.588878+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.595283+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.609816+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.617293+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.640376+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.647960+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.694289+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.700009+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.723203+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.731986+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.753422+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.759986+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.778075+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.783898+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.817464+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.823327+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.872791+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.879822+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.911418+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.920229+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.936615+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:47.941724+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.063746+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.081583+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.136731+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.143987+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.183969+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.192069+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.215468+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.224117+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.245984+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.250941+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.285201+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.290816+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.323361+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.328505+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.415962+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.427099+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.484680+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.491915+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.506402+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.513062+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.533435+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.540215+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.564771+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.572336+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.594109+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.599990+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.615226+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.624051+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.639877+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.647996+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.665807+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.672101+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.710443+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.120095+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.125465+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.144041+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.149005+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.167423+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.172541+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.192835+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.199166+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.217233+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.222611+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.243121+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.247997+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.288404+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.303512+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.328274+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.333240+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.357563+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.362825+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.432810+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.437977+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.461235+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.466272+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.487063+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.492177+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.509134+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.514680+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.533562+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.538756+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.556984+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.562283+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.586269+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.591540+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.655781+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.664244+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.712355+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:49.717240+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:09:28.715831+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity Sending Screenshot (CAP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:09:29.914694+0100	2825565	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:09:35.479803+0100	2825565	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:09:39.526053+0100	2825565	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:09:42.588635+0100	2825565	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:09:45.651054+0100	2825565	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:09:48.715930+0100	2825565	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:09:53.882878+0100	2825565	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:09:59.945479+0100	2825565	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP

ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:10:32.155808+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:33.529807+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:34.718192+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:36.156459+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:38.235944+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:39.525560+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:41.069469+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:42.465653+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:43.918509+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:45.429897+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP
2024-11-11T17:10:48.215468+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP

ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T17:09:28.715831+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49730	51.103.213.187	5552	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: njrat.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\server.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen

Found malware configuration

Source: 00000001.00000002.4121788498.0000000002F61000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Njrat {"Host": "51.103.213.187", "Port": "5552", "Version": "im523", "Campaign ID": "dfir.ch", "Install Name": "server.exe", "Install Dir": "WinDir"}

Yara detected Njrat

Source: Yara match	File source: njrat.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1653664845.0000000000152000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4121788498.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: njrat.exe PID: 2676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 5828, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\server.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe	Joe Sandbox ML: detected
Source: C:\Windows\server.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: njrat.exe

Joe Sandbox ML: detected

Source: njrat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\njrat.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Source: njrat.exe, 00000000.00000000.1653664845.0000000000152000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: njrat.exe, 00000000.00000000.1653664845.0000000000152000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: njrat.exe, 00000000.00000002.1718621800.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: njrat.exe, 00000000.00000002.1718621800.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: server.exe, 00000001.00000002.4121788498.0000000002F61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: server.exe, 00000001.00000002.4121788498.0000000002F61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: njrat.exe	Binary or memory string: autorun.inf
Source: njrat.exe	Binary or memory string: [autorun]
Source: 495a56e87a9043e1648a2f6d33cf682f.exe.1.dr	Binary or memory string: autorun.inf
Source: 495a56e87a9043e1648a2f6d33cf682f.exe.1.dr	Binary or memory string: [autorun]
Source: server.exe.0.dr	Binary or memory string: autorun.inf
Source: server.exe.0.dr	Binary or memory string: [autorun]

Source: C:\Windows\server.exe	File opened: C:\Windows\SysWOW64\avicap32.dll	Jump to behavior
Source: C:\Windows\server.exe	File opened: C:\Windows\SysWOW64\MSVFW32.dll	Jump to behavior
Source: C:\Windows\server.exe	File opened: C:\Windows\SysWOW64\en-US\MSVFW32.dll.mui	Jump to behavior
Source: C:\Windows\server.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097	Jump to behavior
Source: C:\Windows\server.exe	File opened: C:\Windows\SysWOW64\en-US\avicap32.dll.mui	Jump to behavior
Source: C:\Windows\server.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097\gdiplus.dll	Jump to behavior

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49730 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49730 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49730 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49730 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2825565 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity Sending Screenshot (CAP) : 192.168.2.4:49730 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2022060 - Severity 1 - ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop) : 192.168.2.4:49737 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49730 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2022061 - Severity 1 - ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) : 192.168.2.4:49737 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2019214 - Severity 1 - ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture) : 192.168.2.4:49730 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2022063 - Severity 1 - ET MALWARE njrat ver 0.7d Malware CnC Callback (Get Passwords) : 192.168.2.4:49730 -> 51.103.213.187:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:49730 -> 51.103.213.187:5552

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:49738
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49731

Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187
Source: unknown	TCP traffic detected without corresponding DNS query: 51.103.213.187

Source: server.exe, 00000001.00000002.4124389201.0000000005CE0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: ERR%WindowsLive:name=*%http://hotmail.com9Software\ooVoo\Settings\UserUserQhttp://www.oovoo.com/?Encrypted PasswordPass equals www.hotmail.com (Hotmail)
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.facebook.com/https://www.facebook.com/http://twitter.com/https://twitter.com/https://login.yahoo.com/config/loginhttps://pinterest.com/login/http://www.linkedin.com/https://my.screenname.aol.com/_cqr/login/login.psphttps://www.amazon.com/ap/signin/190-9059340-4656153https://signin.ebay.com/ws/ebayisapi.dllhttps://accounts.google.com/serviceloginhttps://www.google.com/accounts/serviceloginhttp://digg.comhttp://www.myspace.comhttps://myspace.comhttps://www.amazon.com/gp/css/homepage.htmlhttp://www.stumbleupon.com/sign_up.phphttp://slashdot.org/bookmark.plhttp://www.reddit.com/loginB equals www.facebook.com (Facebook)
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.facebook.com/https://www.facebook.com/http://twitter.com/https://twitter.com/https://login.yahoo.com/config/loginhttps://pinterest.com/login/http://www.linkedin.com/https://my.screenname.aol.com/_cqr/login/login.psphttps://www.amazon.com/ap/signin/190-9059340-4656153https://signin.ebay.com/ws/ebayisapi.dllhttps://accounts.google.com/serviceloginhttps://www.google.com/accounts/serviceloginhttp://digg.comhttp://www.myspace.comhttps://myspace.comhttps://www.amazon.com/gp/css/homepage.htmlhttp://www.stumbleupon.com/sign_up.phphttp://slashdot.org/bookmark.plhttp://www.reddit.com/loginB equals www.linkedin.com (Linkedin)
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.facebook.com/https://www.facebook.com/http://twitter.com/https://twitter.com/https://login.yahoo.com/config/loginhttps://pinterest.com/login/http://www.linkedin.com/https://my.screenname.aol.com/_cqr/login/login.psphttps://www.amazon.com/ap/signin/190-9059340-4656153https://signin.ebay.com/ws/ebayisapi.dllhttps://accounts.google.com/serviceloginhttps://www.google.com/accounts/serviceloginhttp://digg.comhttp://www.myspace.comhttps://myspace.comhttps://www.amazon.com/gp/css/homepage.htmlhttp://www.stumbleupon.com/sign_up.phphttp://slashdot.org/bookmark.plhttp://www.reddit.com/loginB equals www.myspace.com (Myspace)
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.facebook.com/https://www.facebook.com/http://twitter.com/https://twitter.com/https://login.yahoo.com/config/loginhttps://pinterest.com/login/http://www.linkedin.com/https://my.screenname.aol.com/_cqr/login/login.psphttps://www.amazon.com/ap/signin/190-9059340-4656153https://signin.ebay.com/ws/ebayisapi.dllhttps://accounts.google.com/serviceloginhttps://www.google.com/accounts/serviceloginhttp://digg.comhttp://www.myspace.comhttps://myspace.comhttps://www.amazon.com/gp/css/homepage.htmlhttp://www.stumbleupon.com/sign_up.phphttp://slashdot.org/bookmark.plhttp://www.reddit.com/loginB equals www.twitter.com (Twitter)
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.facebook.com/https://www.facebook.com/http://twitter.com/https://twitter.com/https://login.yahoo.com/config/loginhttps://pinterest.com/login/http://www.linkedin.com/https://my.screenname.aol.com/_cqr/login/login.psphttps://www.amazon.com/ap/signin/190-9059340-4656153https://signin.ebay.com/ws/ebayisapi.dllhttps://accounts.google.com/serviceloginhttps://www.google.com/accounts/serviceloginhttp://digg.comhttp://www.myspace.comhttps://myspace.comhttps://www.amazon.com/gp/css/homepage.htmlhttp://www.stumbleupon.com/sign_up.phphttp://slashdot.org/bookmark.plhttp://www.reddit.com/loginB equals www.yahoo.com (Yahoo)

Source: njrat.exe, kl.cs	.Net Code: VKCodeToUnicode
Source: server.exe.0.dr, kl.cs	.Net Code: VKCodeToUnicode
Source: 495a56e87a9043e1648a2f6d33cf682f.exe.1.dr, kl.cs	.Net Code: VKCodeToUnicode

Source: njrat.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: njrat.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: njrat.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1653664845.0000000000152000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1653664845.0000000000152000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Windows\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Windows\server.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Windows\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\Desktop\njrat.exe	File created: C:\Windows\server.exe			Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	File created: C:\Windows\server.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2692:120:WilError_03
Source: C:\Windows\server.exe	Mutant created: NULL
Source: C:\Windows\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\495a56e87a9043e1648a2f6d33cf682f
Source: C:\Windows\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1888:120:WilError_03

Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: select * from logins where blacklisted_by_user=0;
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: select * from moz_logins;
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: Login Data.11.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: vbc.exe, 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: unknown	Process created: C:\Users\user\Desktop\njrat.exe "C:\Users\user\Desktop\njrat.exe"
Source: C:\Users\user\Desktop\njrat.exe	Process created: C:\Windows\server.exe "C:\Windows\server.exe"
Source: C:\Windows\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\server.exe "C:\Windows\server.exe" ..
Source: unknown	Process created: C:\Windows\server.exe "C:\Windows\server.exe" ..
Source: unknown	Process created: C:\Windows\server.exe "C:\Windows\server.exe" ..
Source: C:\Windows\server.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\user\AppData\Local\Temp\1129210"
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\njrat.exe	Process created: C:\Windows\server.exe "C:\Windows\server.exe"	Jump to behavior
Source: C:\Windows\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE	Jump to behavior
Source: C:\Windows\server.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\user\AppData\Local\Temp\1129210"	Jump to behavior

Source: C:\Users\user\Desktop\njrat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: njrat.exe, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: server.exe.0.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 495a56e87a9043e1648a2f6d33cf682f.exe.1.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe			Jump to dropped file
Source: C:\Users\user\Desktop\njrat.exe	File created: C:\Windows\server.exe			Jump to dropped file

Source: C:\Windows\server.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 495a56e87a9043e1648a2f6d33cf682f	Jump to behavior
Source: C:\Windows\server.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 495a56e87a9043e1648a2f6d33cf682f	Jump to behavior
Source: C:\Windows\server.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 495a56e87a9043e1648a2f6d33cf682f	Jump to behavior
Source: C:\Windows\server.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 495a56e87a9043e1648a2f6d33cf682f	Jump to behavior

Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\njrat.exe	Memory allocated: B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Memory allocated: 27D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\njrat.exe	Memory allocated: B00000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 1060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 4F60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 2780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 2780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 4780000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 11E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 4CF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 2F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\server.exe	Memory allocated: 4F30000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\njrat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\server.exe	Window / User API: threadDelayed 901	Jump to behavior
Source: C:\Windows\server.exe	Window / User API: threadDelayed 2956	Jump to behavior
Source: C:\Windows\server.exe	Window / User API: threadDelayed 4046	Jump to behavior
Source: C:\Windows\server.exe	Window / User API: foregroundWindowGot 403	Jump to behavior
Source: C:\Windows\server.exe	Window / User API: foregroundWindowGot 1308	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report njrat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\njrat.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log

C:\Users\user\AppData\Local\Temp\1129210

C:\Users\user\AppData\Local\Temp\Login Data

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe:Zone.Identifier

C:\Windows\server.exe

C:\Windows\server.exe:Zone.Identifier

\Device\ConDrv

Static File Info

Windows Analysis Report
njrat.exe

Source: C:\Users\user\Desktop\njrat.exe TID: 1720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\server.exe TID: 2672	Thread sleep time: -901000s >= -30000s	Jump to behavior
Source: C:\Windows\server.exe TID: 2672	Thread sleep time: -4046000s >= -30000s	Jump to behavior
Source: C:\Windows\server.exe TID: 5724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\server.exe TID: 5304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\server.exe TID: 648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: netsh.exe, 00000003.00000002.1792891520.0000000001158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|
Source: server.exe, 00000001.00000002.4121149649.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf

Source: C:\Windows\server.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process token adjusted: Debug			Jump to behavior

Source: njrat.exe, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: njrat.exe, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: njrat.exe, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Source: C:\Windows\server.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000	Jump to behavior
Source: C:\Windows\server.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 43B000	Jump to behavior
Source: C:\Windows\server.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 471000	Jump to behavior
Source: C:\Windows\server.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 305008	Jump to behavior

Source: server.exe, 00000001.00000002.4121149649.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000001.00000002.4121788498.0000000003458000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4121788498.0000000003191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: server.exe, 00000001.00000002.4121788498.0000000003191000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4121788498.000000000323E000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4121788498.0000000003182000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.
Source: server.exe, 00000001.00000002.4121788498.0000000003182000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4121788498.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4121788498.0000000003288000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program manager
Source: server.exe, 00000001.00000002.4121788498.0000000003458000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4121788498.000000000323E000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4121788498.0000000003288000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9

Source: C:\Windows\server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: Yara match	File source: 0000000B.00000002.2319099670.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1144, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior