For darkcomet -> sort the "First Execution" bar
For BlackShades -> sort the "Installed Date" bar
Why we need count this?
Because easy for trace, the server is FUD runtime everyday or have been detected.
How to trace?
Example :> today check client at 5.00 PM, tomorrow check at same time (5.00 PM). Do repeatedly untill you saw drastic less server installed compared average.Mean your server have been detected by AV Runtime
