Edit tour

Windows Analysis Report
download.bin.exe

Overview

General Information

Sample name:	download.bin.exe
Analysis ID:	1592198
MD5:	beaa68e5cc534b255a5a7f50580fc92a
SHA1:	1f0278d90302bd11a53366bdb78fa353b4b1ea58
SHA256:	81d37764ce48e1f76d1de50ee831094117ffc239e287e40806801dd0bba097d2
Tags:	backdoorexelojadasmetas-com-brxreduser-johnk3r
Infos:

Detection

Njrat, XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Njrat

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Potentially Suspicious Malware Callback Communication

Uses dynamic DNS services

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

download.bin.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\download.bin.exe" MD5: BEAA68E5CC534B255A5A7F50580FC92A)

._cache_download.bin.exe (PID: 7376 cmdline: "C:\Users\user\Desktop\._cache_download.bin.exe" MD5: FF9F2B483371EFF47FABFAA87EB0BD50)

Synaptics.exe (PID: 7420 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: B2B36F3E560521D53BD607DD291E3C08)

WerFault.exe (PID: 11528 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 35196 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 12128 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 35164 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 12136 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 35104 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 12144 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 7696 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 12152 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 34744 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 7464 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 3652 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

Synaptics.exe (PID: 7980 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: B2B36F3E560521D53BD607DD291E3C08)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Threatname: Njrat

{"Host": "191.243.161.177", "Port": "5552", "Version": "0.7d By Pjoao1578", "Registry Name": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "teste 06dezembro", "Network Seprator": "|'|'|"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
download.bin.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
download.bin.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
download.bin.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
download.bin.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0xb5e1c:$a1: get_Registry 0xb69fc:$a3: Download ERROR 0xb694c:$a4: cmd.exe /c ping 0 -n 2 & del "
download.bin.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0xb694c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0xb69d8:$s4: Execute ERROR 0xb6a34:$s4: Execute ERROR 0xb69fc:$s5: Download ERROR 0xb6644:$s6: [kl]

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\._cache_download.bin.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\Desktop\._cache_download.bin.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x49e4:$a1: get_Registry 0x55c4:$a3: Download ERROR 0x5514:$a4: cmd.exe /c ping 0 -n 2 & del "
C:\Users\user\Desktop\._cache_download.bin.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x5514:$x1: cmd.exe /c ping 0 -n 2 & del " 0x55e2:$s3: Executed As 0x55c4:$s6: Download ERROR
C:\Users\user\Desktop\._cache_download.bin.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5514:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x55a0:$s4: Execute ERROR 0x55fc:$s4: Execute ERROR 0x55c4:$s5: Download ERROR 0x520c:$s6: [kl]
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0xb5e1c:$a1: get_Registry 0xb69fc:$a3: Download ERROR 0xb694c:$a4: cmd.exe /c ping 0 -n 2 & del "
C:\ProgramData\Synaptics\Synaptics.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0xb694c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0xb69d8:$s4: Execute ERROR 0xb6a34:$s4: Execute ERROR 0xb69fc:$s5: Download ERROR 0xb6644:$s6: [kl]
C:\Users\user\Documents\DTBZGIOOSO\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\DTBZGIOOSO\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\RCX46B1.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCX46B1.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 8 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1654288511.00000000004A5000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1654288511.00000000004A5000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1661c:$a1: get_Registry 0x171fc:$a3: Download ERROR 0x1714c:$a4: cmd.exe /c ping 0 -n 2 & del "
00000000.00000003.1659782895.000000000071C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000003.1659782895.000000000071C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000003.1659782895.000000000071C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x26da4:$a1: get_Registry 0x27984:$a3: Download ERROR 0x278d4:$a4: cmd.exe /c ping 0 -n 2 & del "
00000000.00000003.1659837893.000000000070D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000003.1659837893.000000000070D000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x496c:$a1: get_Registry 0x554c:$a3: Download ERROR 0x549c:$a4: cmd.exe /c ping 0 -n 2 & del "
00000002.00000003.1714487206.000000000059E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000001.00000000.1658202526.0000000000722000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000001.00000000.1658202526.0000000000722000.00000002.00000001.01000000.00000005.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x47e4:$a1: get_Registry 0x53c4:$a3: Download ERROR 0x5314:$a4: cmd.exe /c ping 0 -n 2 & del "
00000000.00000000.1654165484.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1654165484.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: download.bin.exe PID: 7324	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: download.bin.exe PID: 7324	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: ._cache_download.bin.exe PID: 7376	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Synaptics.exe PID: 7420	JoeSecurity_XRed	Yara detected XRed	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.._cache_download.bin.exe.720000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
1.0.._cache_download.bin.exe.720000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x49e4:$a1: get_Registry 0x55c4:$a3: Download ERROR 0x5514:$a4: cmd.exe /c ping 0 -n 2 & del "
1.0.._cache_download.bin.exe.720000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x5514:$x1: cmd.exe /c ping 0 -n 2 & del " 0x55e2:$s3: Executed As 0x55c4:$s6: Download ERROR
1.0.._cache_download.bin.exe.720000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5514:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x55a0:$s4: Execute ERROR 0x55fc:$s4: Execute ERROR 0x55c4:$s5: Download ERROR 0x520c:$s6: [kl]
0.0.download.bin.exe.4b6c38.1.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.download.bin.exe.4b6c38.1.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x2be4:$a1: get_Registry 0x37c4:$a3: Download ERROR 0x3714:$a4: cmd.exe /c ping 0 -n 2 & del "
0.0.download.bin.exe.4b6c38.1.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x3714:$x1: cmd.exe /c ping 0 -n 2 & del " 0x37e2:$s3: Executed As 0x37c4:$s6: Download ERROR
0.0.download.bin.exe.4b6c38.1.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x3714:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x37a0:$s4: Execute ERROR 0x37fc:$s4: Execute ERROR 0x37c4:$s5: Download ERROR 0x340c:$s6: [kl]
0.3.download.bin.exe.73e3c0.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.3.download.bin.exe.73e3c0.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x2be4:$a1: get_Registry 0x37c4:$a3: Download ERROR 0x3714:$a4: cmd.exe /c ping 0 -n 2 & del "
0.3.download.bin.exe.73e3c0.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x3714:$x1: cmd.exe /c ping 0 -n 2 & del " 0x37e2:$s3: Executed As 0x37c4:$s6: Download ERROR
0.3.download.bin.exe.73e3c0.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x3714:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x37a0:$s4: Execute ERROR 0x37fc:$s4: Execute ERROR 0x37c4:$s5: Download ERROR 0x340c:$s6: [kl]
0.3.download.bin.exe.73e3c0.0.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.3.download.bin.exe.73e3c0.0.raw.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x49e4:$a1: get_Registry 0x55c4:$a3: Download ERROR 0x5514:$a4: cmd.exe /c ping 0 -n 2 & del "
0.3.download.bin.exe.73e3c0.0.raw.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x5514:$x1: cmd.exe /c ping 0 -n 2 & del " 0x55e2:$s3: Executed As 0x55c4:$s6: Download ERROR
0.3.download.bin.exe.73e3c0.0.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5514:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x55a0:$s4: Execute ERROR 0x55fc:$s4: Execute ERROR 0x55c4:$s5: Download ERROR 0x520c:$s6: [kl]
0.0.download.bin.exe.4b6c38.1.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.download.bin.exe.4b6c38.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.download.bin.exe.4b6c38.1.raw.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x49e4:$a1: get_Registry 0x55c4:$a3: Download ERROR 0x5514:$a4: cmd.exe /c ping 0 -n 2 & del "
0.0.download.bin.exe.4b6c38.1.raw.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x5514:$x1: cmd.exe /c ping 0 -n 2 & del " 0x55e2:$s3: Executed As 0x55c4:$s6: Download ERROR
0.0.download.bin.exe.4b6c38.1.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5514:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x55a0:$s4: Execute ERROR 0x55fc:$s4: Execute ERROR 0x55c4:$s5: Download ERROR 0x520c:$s6: [kl]
0.0.download.bin.exe.400000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.download.bin.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
0.0.download.bin.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0.0.download.bin.exe.400000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0xb5e1c:$a1: get_Registry 0xb69fc:$a3: Download ERROR 0xb694c:$a4: cmd.exe /c ping 0 -n 2 & del "
0.0.download.bin.exe.400000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0xb694c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0xb69d8:$s4: Execute ERROR 0xb6a34:$s4: Execute ERROR 0xb69fc:$s5: Download ERROR 0xb6644:$s6: [kl]
Click to see the 21 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 191.243.161.177, DestinationIsIpv6: false, DestinationPort: 5552, EventID: 3, Image: C:\Users\user\Desktop\._cache_download.bin.exe, Initiated: true, ProcessId: 7376, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\download.bin.exe, ProcessId: 7324, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\?????

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 7420, TargetFilename: C:\Users\user\AppData\Local\Temp\GZGKlhB9.xlsm

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T22:31:01.081535+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.243.161.177	5552	TCP
2025-01-15T22:31:22.133027+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:43.610365+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:32:05.095316+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.613543+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:48.255434+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:33:10.377381+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T22:31:01.081535+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.243.161.177	5552	TCP
2025-01-15T22:31:22.133027+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:43.610365+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:32:05.095316+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.613543+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:48.255434+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:33:10.377381+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T22:31:01.861846+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.243.161.177	5552	TCP
2025-01-15T22:31:09.881853+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.243.161.177	5552	TCP
2025-01-15T22:31:10.843024+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.243.161.177	5552	TCP
2025-01-15T22:31:17.914414+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.243.161.177	5552	TCP
2025-01-15T22:31:18.788356+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.243.161.177	5552	TCP
2025-01-15T22:31:22.397956+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:27.006942+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:27.960009+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:34.147682+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:34.459957+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:35.022814+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:41.478360+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:42.226320+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:44.444919+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:31:47.569476+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:31:48.194529+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:31:52.741365+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:31:53.247298+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:31:56.069618+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:31:56.444511+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:31:59.783295+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:32:00.038343+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:32:02.616568+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:32:02.866604+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:32:05.116238+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:05.366347+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:05.616632+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:07.241499+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:07.382120+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:08.413602+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:08.538129+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:09.553840+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:09.678942+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:10.554040+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:10.678913+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:11.678764+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:11.804179+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:13.164832+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:13.288205+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:14.163222+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:14.288541+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:15.304305+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:15.494861+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:16.678794+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:16.803756+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:17.803779+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:17.929077+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:19.054183+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:19.178873+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:20.178839+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:20.382762+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:21.600688+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:21.725755+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.725633+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.859771+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.918715+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.923757+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.928674+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.950059+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.954984+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.959942+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.981798+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:22.986835+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.284397+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.289252+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.321384+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.329379+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.474037+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.478905+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.525270+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.530140+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.580138+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.585104+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.603747+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.608589+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.623449+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.628383+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.663576+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.669080+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.683272+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.688261+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.695934+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.700843+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.708564+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.713390+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.722156+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.727106+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.736576+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.741478+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.784224+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.789245+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.833050+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.838548+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.890607+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.897410+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.912471+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.942375+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.952003+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.956997+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.969170+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.974523+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.979374+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.986432+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.991265+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:23.996155+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.001492+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.010204+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.015095+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.020312+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.026569+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.031504+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.036512+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.044714+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.049520+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.054342+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.061099+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.066006+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.071407+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.079332+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.085866+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.094319+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.101934+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.106812+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.112284+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.117913+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.123229+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.132768+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.139889+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.146407+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.151275+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.158534+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.165869+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.170739+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.176001+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.181297+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.186755+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.194114+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.199427+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.204401+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.209474+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.216074+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.223106+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.228002+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.233050+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.238824+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.244007+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.249369+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.255621+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.260951+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.267173+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.272508+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.283857+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.289417+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.294299+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.299292+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.306713+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.311733+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.316661+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.321641+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.326912+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.331807+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.338016+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.342902+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.347756+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.352668+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.357760+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.362788+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.367723+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.386207+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.391112+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.396111+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.400910+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.406144+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.410998+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.415988+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.420904+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.428061+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.433351+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.438353+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.443257+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.448178+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.699372+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.704357+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.709239+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.717441+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.722352+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.728491+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.733400+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.749131+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.754169+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.774303+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.779323+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.799404+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.804258+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:24.833519+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.005496+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.010564+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.016614+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.021465+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.026384+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.031499+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.036428+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.041867+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.046873+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.051804+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.056828+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.061696+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.067757+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.073172+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.078452+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.084779+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.089724+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.094963+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.101433+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.106392+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.111318+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.121277+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.126294+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.131135+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.136621+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.141542+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.146476+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.153369+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.158273+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.163259+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.169285+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.174713+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.180359+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.185376+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.190804+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.196215+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.201873+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.206869+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.212358+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.217457+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.222487+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.227326+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.232180+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.239047+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.243950+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.248934+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.255792+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.260724+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.266141+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.271074+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.275973+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.282573+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.287549+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.299077+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.304116+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.308992+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.315360+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.321450+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.327561+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.333617+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.340389+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.345276+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.350329+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.355303+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.360210+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.365246+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.370186+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.377719+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.382684+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.387704+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.393414+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.398264+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.406463+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.411331+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.418367+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.423290+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.429674+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.435777+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.445757+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.450658+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.456274+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.461362+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.466242+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.473238+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.478327+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.483941+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.488945+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.493807+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.498961+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.503933+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.510681+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.515583+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.520828+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.528086+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.534724+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.539669+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.544554+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.549934+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.554781+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.559830+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.567333+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.572353+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.577487+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.582395+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.597051+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.601931+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.610857+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.615843+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.623288+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.628319+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.633403+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.638336+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.643321+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.648259+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.706703+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.711675+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.716566+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.721868+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.726743+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.735739+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.740790+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.745718+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.751129+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.756344+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.761176+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.767633+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.772512+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.777424+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.782501+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.787728+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.792596+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.797777+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.802821+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.807707+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.813566+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.818452+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.823270+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.829813+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.834836+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.839738+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.845696+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.850616+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.855509+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.861725+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.867010+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.871913+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.903454+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.908784+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.914889+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.919882+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.924790+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.929817+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.934687+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.939711+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.948136+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.953097+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.957998+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.969461+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.974457+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.985541+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.990521+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.996580+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.001632+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.007779+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.013118+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.018643+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.023656+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.029704+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.034769+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.039712+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.047607+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.052590+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.060409+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.065415+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.072337+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.077288+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.082902+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.087783+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.092592+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.100920+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.105777+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.130631+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.135663+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.140694+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.145640+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.152542+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.157593+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.162583+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.178166+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.184989+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.190036+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.195076+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.200130+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.205418+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.211462+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.216587+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.230793+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.235749+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.240623+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.245540+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.250444+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.255684+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.260586+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.265460+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.270861+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.276004+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.281001+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.286008+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.290904+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.295907+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.302656+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.307578+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.314431+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.319322+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.324241+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.329096+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.333999+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.340144+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.346078+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.350947+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.355824+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.362019+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.366901+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.371868+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.376810+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.381758+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.386583+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.391576+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.396442+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.401301+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.407166+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.412067+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.416933+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.425535+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.430407+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.435267+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.440137+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.446244+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.451368+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.456210+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.461067+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.466075+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.470947+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.475751+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.480792+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.485762+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.494311+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.626486+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.631360+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.655728+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.660687+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.679679+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.689450+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.701477+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.706688+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.713636+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.718553+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.724654+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.729463+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.734506+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.740401+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.745212+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.750937+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.756652+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.761604+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.767194+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.773547+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.778433+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.783264+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.790575+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.797357+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.802344+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.807264+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.814100+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.818942+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.823762+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.828629+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.834322+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.839270+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.846625+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.851602+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.856435+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.862091+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.866950+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.871921+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.900178+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.905029+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.909973+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.914805+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.919678+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.924527+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.930030+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.935120+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.940029+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.944917+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.949818+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.956075+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.961250+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.967026+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.971861+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.979080+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.984037+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.988911+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:26.995573+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.000546+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.005406+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.015879+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.020731+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.025623+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.030506+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.035374+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.040867+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.045674+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.051601+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.061833+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.066688+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.071531+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.076408+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.081247+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.086074+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.091045+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.095880+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.100931+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.105950+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.110815+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.116778+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.121614+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.126509+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.131586+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.136673+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.141569+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.146779+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.154371+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.159232+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.164178+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.169847+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.174643+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.184326+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.189222+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.194204+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.199162+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.204183+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.209024+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.213841+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.219524+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.224591+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.230194+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.237261+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.242136+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.247194+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.254214+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.259139+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.266639+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.271638+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.277123+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.281961+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.286893+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.291765+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.297531+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.302486+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.310851+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.315726+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.322972+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.327865+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.332843+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.341015+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.346208+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.351061+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.358610+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.363558+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.380142+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.385013+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.389818+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.397443+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.402406+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.407250+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.412116+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.416949+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.422985+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.427833+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.432723+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.437609+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.442554+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.447392+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.452402+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.457258+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.462141+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.467318+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.472253+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.477725+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.484338+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.489299+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.494195+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.499878+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.504847+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.509776+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.514627+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.519455+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.524300+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.529197+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.534083+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.538947+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.543762+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.550156+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.555070+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.562037+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.566921+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.571791+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.577184+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.582058+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.586989+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.592081+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.596949+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.603812+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.608672+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.613547+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.619554+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.624405+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.630265+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.635135+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.650453+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.655597+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.661140+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.666215+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.671172+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.676046+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.681000+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.685949+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.691101+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.696117+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.701519+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.706456+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.711372+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.716215+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.722041+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.726880+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.731745+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.737085+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.741981+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.746815+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.753245+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.758215+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.763094+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.769419+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.774441+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.779838+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.784874+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.789709+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.794521+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.799529+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.806322+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.811226+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.816350+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.824404+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.829522+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.835904+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.840789+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.847378+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.852271+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.857601+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.862439+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.867995+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.899640+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.904453+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.910357+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.915210+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.923091+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.927981+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.932859+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.945593+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.950429+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.955583+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.961485+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.966325+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.971196+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.977731+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.982702+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.987649+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.993804+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.999199+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.004019+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.013141+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.018103+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.023115+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.029692+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.047324+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.052178+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.057159+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.062967+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.071900+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.081280+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.086177+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.091085+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.096763+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.101608+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.106476+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.111344+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.116163+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.121648+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.126472+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.133936+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.138884+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.143730+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.154964+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.160329+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.165262+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.170994+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.175810+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.181439+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.189738+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.194657+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.202727+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.207559+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.214257+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.219058+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.224066+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.228915+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.233874+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.239867+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.244715+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.249575+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.254402+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.259234+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.264488+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.269393+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.277618+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.284390+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.292536+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.299212+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.304486+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.311556+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.316356+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.321234+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.326072+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.333516+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.340154+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.346961+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.353661+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.360655+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.367290+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.372135+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.378867+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.390839+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.397564+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.403776+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.408653+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.413482+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.418469+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.423355+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.428263+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.435383+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.440205+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.445068+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.457524+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.462536+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.467577+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.472443+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.477316+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.482613+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.487470+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.492329+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.497146+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.501987+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.506798+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.511841+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.670234+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.675092+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.680019+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.684833+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.690319+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.695201+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.700047+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.705374+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.710351+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.715204+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.722974+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.727925+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.732767+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.738658+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.746566+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.762196+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.770748+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.778269+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.786806+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.801818+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.810330+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.818062+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.824833+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.829945+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.837057+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.853915+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.862232+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.867266+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.902000+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.910255+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.918020+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.924879+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.929814+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.935985+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.940996+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.950887+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.956693+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.966235+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.983810+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.991805+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.997555+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.002395+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.007254+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.012326+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.017190+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.022190+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.029343+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.036735+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.041617+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.046502+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.051380+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.057475+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.064718+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.069598+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.074450+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.082958+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.089794+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.097100+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.103722+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.108574+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.114703+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.119832+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.124724+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.132255+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.137102+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.145765+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.151781+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:48.269875+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.276330+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.281573+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.286980+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.293731+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.300104+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.305071+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.329859+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.335075+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.345306+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.354248+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.362789+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.370248+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.378764+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.383664+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.388519+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.393429+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.398987+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.405205+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.410185+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.415189+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.420105+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.426705+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.432045+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.436910+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.445319+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.450252+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.455191+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.460088+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.465363+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.470246+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.475127+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.480235+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.486296+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.495684+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.500577+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.505501+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.510422+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.515413+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.520363+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.525257+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.530180+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.535063+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.545935+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.551864+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.559874+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.568544+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.575973+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.583868+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.591918+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.597937+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.602840+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.609979+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.617739+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.625948+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.635886+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.643403+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.651974+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.659728+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.667962+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.675025+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.682290+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.687292+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.693627+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.701974+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.710602+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.725693+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.736008+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.743890+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.750554+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.758006+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.766068+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.788844+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.796034+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.803863+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.811889+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.819885+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.829273+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.834566+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.842223+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.847333+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.854004+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.862014+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.866927+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.879572+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.904103+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.911283+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.916155+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.920991+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.926514+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.933800+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.941023+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.948373+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.953944+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.960564+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.967049+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.974694+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.981797+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.991279+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:48.998442+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.006179+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.014393+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.021405+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.031883+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.039648+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.047872+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.056037+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.063884+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.071885+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.079879+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:32:49.085924+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51720	191.243.161.177	5552	TCP
2025-01-15T22:33:10.387876+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.392779+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.397729+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.403327+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.408215+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.413163+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.421467+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.426391+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.431354+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.439569+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.444518+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.449537+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.457132+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.462015+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.467186+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.472327+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.477329+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.485299+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.490213+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.495270+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.500272+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.505199+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.510101+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.514945+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.519996+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.525119+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.530046+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.534910+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.539832+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.544797+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.549734+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.554828+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.559720+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.564657+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.569515+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.584507+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.597664+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.612263+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.617216+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.626351+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.631341+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.638638+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.643556+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.650703+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.655589+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.662479+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.667361+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.677930+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.687617+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.694481+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP
2025-01-15T22:33:10.702136+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	51816	191.243.161.177	5552	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T22:31:01.086862+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.243.161.177	5552	TCP
2025-01-15T22:31:22.138001+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:43.615291+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:32:05.100158+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T22:31:07.554327+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.4	49740	69.42.215.252	80	TCP

ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T22:32:24.443257+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.005496+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.423290+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:25.914889+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:26.376810+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP
2025-01-15T22:32:27.457258+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:27.867995+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.353661+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:28.722974+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP
2025-01-15T22:32:29.114703+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	51517	191.243.161.177	5552	TCP

ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T22:31:01.086862+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.243.161.177	5552	TCP
2025-01-15T22:31:22.138001+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	49822	191.243.161.177	5552	TCP
2025-01-15T22:31:43.615291+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	51168	191.243.161.177	5552	TCP
2025-01-15T22:32:05.100158+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.4	51297	191.243.161.177	5552	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: download.bin.exe	Avira: detected
Source: download.bin.exe	Avira: detected
Source: download.bin.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SSLLibrary.dl$	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/Synaptics.rarH	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\._cache_download.bin.exe	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCX46B1.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCX46B1.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: download.bin.exe	Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}
Source: 1.0.._cache_download.bin.exe.720000.0.unpack	Malware Configuration Extractor: Njrat {"Host": "191.243.161.177", "Port": "5552", "Version": "0.7d By Pjoao1578", "Registry Name": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "teste 06dezembro", "Network Seprator": "\|'\|'\|"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\RCX46B1.tmp	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\Desktop\._cache_download.bin.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Source: download.bin.exe	Virustotal: Detection: 87%			Perma Link
Source: download.bin.exe	ReversingLabs: Detection: 92%

Yara detected Njrat

Source: Yara match	File source: download.bin.exe, type: SAMPLE
Source: Yara match	File source: 1.0.._cache_download.bin.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.download.bin.exe.4b6c38.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.download.bin.exe.73e3c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.download.bin.exe.73e3c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.download.bin.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.download.bin.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1654288511.00000000004A5000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1659782895.000000000071C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1659837893.000000000070D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1658202526.0000000000722000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: download.bin.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ._cache_download.bin.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\._cache_download.bin.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\._cache_download.bin.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\DTBZGIOOSO\~$cache1	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCX46B1.tmp	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: download.bin.exe

Joe Sandbox ML: detected

Source: download.bin.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51211 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51255 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51308 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51312 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51335 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51376 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51378 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51423 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51421 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51466 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51468 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51476 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51487 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51486 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51505 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51504 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51508 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51533 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51531 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51562 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51564 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51573 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51594 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51592 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51593 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51606 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51607 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51634 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51643 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51650 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51651 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51657 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51665 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51671 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51676 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51679 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51678 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51677 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.161:443 -> 192.168.2.4:51921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:51926 version: TLS 1.2

Source: download.bin.exe, 00000000.00000003.1659782895.000000000071C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: download.bin.exe, 00000000.00000003.1659782895.000000000071C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: download.bin.exe, 00000000.00000003.1659782895.000000000071C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: download.bin.exe, 00000000.00000000.1654165484.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: download.bin.exe, 00000000.00000000.1654165484.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: download.bin.exe, 00000000.00000000.1654165484.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000002.00000003.1714487206.000000000059E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000002.00000003.1714487206.000000000059E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000002.00000003.1714487206.000000000059E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: download.bin.exe	Binary or memory string: [autorun]
Source: download.bin.exe	Binary or memory string: [autorun]
Source: download.bin.exe	Binary or memory string: autorun.inf
Source: ~$cache1.2.dr	Binary or memory string: [autorun]
Source: ~$cache1.2.dr	Binary or memory string: [autorun]
Source: ~$cache1.2.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: autorun.inf
Source: RCX46B1.tmp.0.dr	Binary or memory string: [autorun]
Source: RCX46B1.tmp.0.dr	Binary or memory string: [autorun]
Source: RCX46B1.tmp.0.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\download.bin.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49730 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49730 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49730 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49730 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49730 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.4:49740 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49822 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49822 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:49822 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:49822 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51168 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49822 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51168 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:51168 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:51168 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51168 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51297 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51297 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:51297 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:51297 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51297 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51517 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51517 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51517 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:51297 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:51517 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51720 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51720 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51720 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51816 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51816 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51816 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:51720 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51910 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:51816 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51910 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51910 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51932 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51932 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51932 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:51910 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51938 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51938 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51938 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:51932 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51939 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51939 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51939 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51940 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51940 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.4:51940 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.4:51940 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51940 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:51938 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:51939 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:51933 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:51933 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:51933 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:51933 -> 191.243.161.177:5552
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49736 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49771 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49748 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49741 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49776 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49782 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49788 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49781 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49737 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49760 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49752 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49772 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49768 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49743 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49790 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49792 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49761 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49766 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49775 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49786 -> 142.250.181.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49746 -> 142.250.181.238:443

Source: Malware configuration extractor	URLs: xred.mooo.com
Source: Malware configuration extractor	IPs: 191.243.161.177

Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177
Source: unknown	TCP traffic detected without corresponding DNS query: 191.243.161.177

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 53.210.109.20.in-addr.arpa

Source: download.bin.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: download.bin.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 1.0.._cache_download.bin.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.0.._cache_download.bin.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 1.0.._cache_download.bin.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.download.bin.exe.4b6c38.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.download.bin.exe.4b6c38.1.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.download.bin.exe.4b6c38.1.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.3.download.bin.exe.73e3c0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.3.download.bin.exe.73e3c0.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.3.download.bin.exe.73e3c0.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.3.download.bin.exe.73e3c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.3.download.bin.exe.73e3c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.3.download.bin.exe.73e3c0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.download.bin.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.download.bin.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.download.bin.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.download.bin.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.download.bin.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1654288511.00000000004A5000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000003.1659782895.000000000071C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000003.1659837893.000000000070D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000001.00000000.1658202526.0000000000722000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\Desktop\._cache_download.bin.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\Desktop\._cache_download.bin.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\Desktop\._cache_download.bin.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Source: GZGKlhB9.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: XZXHAVGRAG.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Source: C:\Users\user\Desktop\._cache_download.bin.exe	Code function: 1_2_010D4828	1_2_010D4828
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Code function: 1_2_04F7D020	1_2_04F7D020
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Code function: 1_2_04F75560	1_2_04F75560
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Code function: 1_2_04F767D0	1_2_04F767D0
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Code function: 1_2_04F703E0	1_2_04F703E0
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Code function: 1_2_04F74C90	1_2_04F74C90
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Code function: 1_2_04F718AC	1_2_04F718AC
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Code function: 1_2_04F74948	1_2_04F74948

Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: GZGKlhB9.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: XZXHAVGRAG.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Synaptics\RCX46B1.tmp B950370DE86A4496DA5959653B7370C9A8FFA6481698D463997951F534442CF9
Source: Joe Sandbox View	Dropped File: C:\Users\user\Documents\DTBZGIOOSO\~$cache1 B950370DE86A4496DA5959653B7370C9A8FFA6481698D463997951F534442CF9

Source: download.bin.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: download.bin.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCX46B1.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: download.bin.exe, 00000000.00000003.1659895731.00000000006E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName. vs download.bin.exe
Source: download.bin.exe, 00000000.00000003.1661567334.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName. vs download.bin.exe
Source: download.bin.exe, 00000000.00000003.1661567334.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs download.bin.exe
Source: download.bin.exe, 00000000.00000000.1654288511.00000000004A5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameServer.exe4 vs download.bin.exe
Source: download.bin.exe, 00000000.00000003.1659782895.000000000071C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameServer.exe4 vs download.bin.exe
Source: download.bin.exe, 00000000.00000002.1662960474.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs download.bin.exe
Source: download.bin.exe, 00000000.00000003.1659837893.000000000070D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameServer.exe4 vs download.bin.exe
Source: download.bin.exe, 00000000.00000000.1654165484.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs download.bin.exe
Source: ._cache_download.bin.exe, 00000001.00000000.1658202526.0000000000722000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenameServer.exe4 vs download.bin.exe
Source: ._cache_download.bin.exe, 00000001.00000002.4129062721.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs download.bin.exe
Source: ._cache_download.bin.exe, 00000001.00000002.4130067067.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs download.bin.exe
Source: download.bin.exe	Binary or memory string: OriginalFileName vs download.bin.exe
Source: download.bin.exe	Binary or memory string: OriginalFilenameServer.exe4 vs download.bin.exe
Source: ._cache_download.bin.exe.0.dr	Binary or memory string: OriginalFilenameServer.exe4 vs download.bin.exe

Source: C:\Users\user\Desktop\._cache_download.bin.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7420
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X

Source: C:\Users\user\Desktop\download.bin.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: unknown	Process created: C:\Users\user\Desktop\download.bin.exe "C:\Users\user\Desktop\download.bin.exe"
Source: C:\Users\user\Desktop\download.bin.exe	Process created: C:\Users\user\Desktop\._cache_download.bin.exe "C:\Users\user\Desktop\._cache_download.bin.exe"
Source: C:\Users\user\Desktop\download.bin.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 35196
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 35164
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 35104
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 7696
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 34744
Source: C:\Users\user\Desktop\download.bin.exe	Process created: C:\Users\user\Desktop\._cache_download.bin.exe "C:\Users\user\Desktop\._cache_download.bin.exe"	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll

Source: C:\Users\user\Desktop\download.bin.exe	File created: C:\ProgramData\Synaptics\RCX46B1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\download.bin.exe	File created: C:\Users\user\Desktop\._cache_download.bin.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download.bin.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\DTBZGIOOSO\~$cache1	Jump to dropped file

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report download.bin.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: XRed

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
download.bin.exe

Source: C:\Users\user\Desktop\download.bin.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ?????			Jump to behavior
Source: C:\Users\user\Desktop\download.bin.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ?????			Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\._cache_download.bin.exe	Memory allocated: 1090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\._cache_download.bin.exe	Window / User API: threadDelayed 1681	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Window / User API: threadDelayed 3718	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Window / User API: threadDelayed 1601	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Window / User API: foregroundWindowGot 1771	Jump to behavior
Source: C:\Windows\splwow64.exe	Window / User API: threadDelayed 9963

Source: C:\Users\user\Desktop\._cache_download.bin.exe TID: 7380	Thread sleep count: 1681 > 30	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe TID: 7380	Thread sleep time: -168100s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe TID: 7408	Thread sleep count: 3718 > 30	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe TID: 7380	Thread sleep count: 1601 > 30	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe TID: 7380	Thread sleep time: -160100s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7764	Thread sleep count: 130 > 30	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7764	Thread sleep time: -7800000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 11456	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Synaptics.exe, 00000002.00000002.3778510078.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1756414901.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3778510078.000000000058D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ._cache_download.bin.exe, 00000001.00000002.4130067067.0000000000C81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: ._cache_download.bin.exe, 00000001.00000002.4148007925.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\^q
Source: ._cache_download.bin.exe, 00000001.00000002.4148007925.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerH
Source: ._cache_download.bin.exe, 00000001.00000002.4130067067.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp, ._cache_download.bin.exe, 00000001.00000002.4148007925.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: ._cache_download.bin.exe, 00000001.00000002.4130067067.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager.
Source: ._cache_download.bin.exe, 00000001.00000002.4130067067.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerN
Source: ._cache_download.bin.exe, 00000001.00000002.4130067067.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagermK5

Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\Users\user\Desktop\._cache_download.bin.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_download.bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior