Sandbox traffic matches two configured C2 destinations

Two sandbox reports recorded traffic to the same pair of IP addresses on TCP port 11110. Those addresses also appear in the analyzed file’s extracted configuration as command-and-control destinations. The match raises a more useful question than whether the addresses have a malicious reputation: does the file actually use the destinations embedded in its configuration? The evidence supports that connection at the sandbox-report level.