Play interactive tourEdit tour

Windows Analysis Report
https://www.cyderes.com/e3t/Ctc/ON+113/cpWbt04/VX4GLN83B5sSVcgNxQ2Ps5TgVfQRxk5l9kHPN48YK9C5m_5PW50kH_H6lZ3pVW8y4rsC3Frq3xW6yS46B81vNwBW7nKjzX7rlDGLW8Pgnsm2TMWP7W8BGJ3S7v4twJW4Frjvh65WTfKVTz5h-5gQP1gMVRZvWxc0gFW70YCkf5Yr5gxW4_ym5p4kM2HWW8XQLRs2fQKTSW6H8zL35wntpYW2g-lt23Pgmr-W5tJKtK3hc6rbW6CjtL61FP38F

Overview

General Information

Sample URL:	https://www.cyderes.com/e3t/Ctc/ON+113/cpWbt04/VX4GLN83B5sSVcgNxQ2Ps5TgVfQRxk5l9kHPN48YK9C5m_5PW50kH_H6lZ3pVW8y4rsC3Frq3xW6yS46B81vNwBW7nKjzX7rlDGLW8Pgnsm2TMWP7W8BGJ3S7v4twJW4Frjvh65WTfKVTz5h-5gQP1gMV
Analysis ID:	1514467
Infos:

Detection

Follina CVE-2022-30190

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Microsoft Office Exploit Follina CVE-2022-30190

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

Yara signature match

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Exploits

Yara detected Microsoft Office Exploit Follina CVE-2022-30190

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: dropped/chromecache_736, type: DROPPED
Source: Yara match	File source: dropped/chromecache_406, type: DROPPED

Phishing

HTML page contains hidden javascript code

Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email

HTTP Parser: Base64 decoded: !nu961,*;p,@

HTML page is missing a favicon

Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No favicon
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No favicon
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No favicon
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No favicon
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.foundationsoft.com/	HTTP Parser: No favicon
Source: https://www.huntress.com/blog-categories/response-to-incidents	HTTP Parser: No favicon

META author tag missing

Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No <meta name="author".. found
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No <meta name="author".. found
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No <meta name="author".. found
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No <meta name="author".. found
Source: https://www.huntress.com/blog-categories/response-to-incidents	HTTP Parser: No <meta name="author".. found
Source: https://www.huntress.com/blog-categories/response-to-incidents	HTTP Parser: No <meta name="author".. found
Source: https://www.huntress.com/blog-categories/response-to-incidents	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No <meta name="copyright".. found
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No <meta name="copyright".. found
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No <meta name="copyright".. found
Source: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email	HTTP Parser: No <meta name="copyright".. found
Source: https://www.huntress.com/blog-categories/response-to-incidents	HTTP Parser: No <meta name="copyright".. found
Source: https://www.huntress.com/blog-categories/response-to-incidents	HTTP Parser: No <meta name="copyright".. found
Source: https://www.huntress.com/blog-categories/response-to-incidents	HTTP Parser: No <meta name="copyright".. found

Compliance

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49743 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2832502 - Severity 1 - ETPRO MALWARE PowerShell Decoding Potential Stage 2 : 13.50.141.112:443 -> 192.168.2.4:50811
Source: Network traffic	Suricata IDS: 2037083 - Severity 1 - ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190) : 13.50.141.112:443 -> 192.168.2.4:50883
Source: Network traffic	Suricata IDS: 2832502 - Severity 1 - ETPRO MALWARE PowerShell Decoding Potential Stage 2 : 13.50.141.112:443 -> 192.168.2.4:50914
Source: Network traffic	Suricata IDS: 2037083 - Severity 1 - ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190) : 13.50.141.112:443 -> 192.168.2.4:50971

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.4:50511 -> 162.159.36.2:53

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /e3t/Ctc/ON+113/cpWbt04/VX4GLN83B5sSVcgNxQ2Ps5TgVfQRxk5l9kHPN48YK9C5m_5PW50kH_H6lZ3pVW8y4rsC3Frq3xW6yS46B81vNwBW7nKjzX7rlDGLW8Pgnsm2TMWP7W8BGJ3S7v4twJW4Frjvh65WTfKVTz5h-5gQP1gMVRZvWxc0gFW70YCkf5Yr5gxW4_ym5p4kM2HWW8XQLRs2fQKTSW6H8zL35wntpYW2g-lt23Pgmr-W5tJKtK3hc6rbW6CjtL61FP38FN8Dg60fYghyWW9bC6JC3rZqmzW8VJhP664ltDxW1lwcb13ZpPGyW5K_1JQ3TqNPdW95WCPZ4QLNngW273xc864PDv3W5x93bB7dRNxTW92-5jF1RVBWpW8x57FF7P2xcjW7KK8Xj8n_ZZMW7CgpVb566CBBW8bVlWQ11xhLlVs3yDJ8NdTRzW12g9Fn559wR0W9bq01776CWknW5nG39p82bgTcf5RLlBK04 HTTP/1.1Host: www.cyderes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /events/public/v1/encoded/track/tc/ON+113/cpWbt04/VX4GLN83B5sSVcgNxQ2Ps5TgVfQRxk5l9kHPN48YK9C5m_5PW50kH_H6lZ3pVW8y4rsC3Frq3xW6yS46B81vNwBW7nKjzX7rlDGLW8Pgnsm2TMWP7W8BGJ3S7v4twJW4Frjvh65WTfKVTz5h-5gQP1gMVRZvWxc0gFW70YCkf5Yr5gxW4_ym5p4kM2HWW8XQLRs2fQKTSW6H8zL35wntpYW2g-lt23Pgmr-W5tJKtK3hc6rbW6CjtL61FP38FN8Dg60fYghyWW9bC6JC3rZqmzW8VJhP664ltDxW1lwcb13ZpPGyW5K_1JQ3TqNPdW95WCPZ4QLNngW273xc864PDv3W5x93bB7dRNxTW92-5jF1RVBWpW8x57FF7P2xcjW7KK8Xj8n_ZZMW7CgpVb566CBBW8bVlWQ11xhLlVs3yDJ8NdTRzW12g9Fn559wR0W9bq01776CWknW5nG39p82bgTcf5RLlBK04?_ud=28cdcd9f-4952-4113-9730-b18c8709f120&_jss=1&_fl=8&_pl=5&_hc=4&_lg=en-US,en&_plt=Win32&_scr=1280,1024 HTTP/1.1Host: www.cyderes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KkZwfeAeRB9T3Ybkgxb1ljk89rKhWegExK7sV_biT_0-1726835342-1.0.1.1-ihP7Soyii0PDzt6vpGoSYPfB0PMbdsMPRtae1IWyYeWBRU_sHMhGQIMDu1.2XR6Lhv0v9.S2ib6GUzgGRjIQow; __cfruid=1e21363c4ffbf205a55d4495409a89a07e4b73c5-1726835342
Source: global traffic	HTTP traffic detected: GET /blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email HTTP/1.1Host: www.huntress.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/slick.min.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.css HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65f75020c99f25928927347f_banner-blue-halo.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@snowplow/browser-plugin-button-click-tracking@latest/dist/index.umd.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66267cd1946bdc414612a045_banner-blue-halo-mobile.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /655d92689c415e9fefcf2368/655d92689c415e9fefcf2400_Hero-grapic-right-02.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66267cd1946bdc414612a045_banner-blue-halo-mobile.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65f75020c99f25928927347f_banner-blue-halo.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a7c_search.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/medium-zoom@1.0.3/dist/medium-zoom.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@finsweet/attributes-richtext@1/richtext.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66abcfee331da80089b29d7e_Huntress%20Logo%20Wide%20Teal.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /655d92689c415e9fefcf2368/656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a71_Blog%20banner%20Thumb%20Glitch%20Left.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/js/huntress-new.28c3b280d.js HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rich-text-enhancer/bundle.v1.0.0.js HTTP/1.1Host: tools.refokus.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296927_hknova-semibold-webfont.woff2 HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3911692.js HTTP/1.1Host: js.hs-scripts.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296925_hknova-regular-webfont.woff2 HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29691d_hknova-bold-webfont.woff2 HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /655d92689c415e9fefcf2368/655d92689c415e9fefcf2400_Hero-grapic-right-02.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296961_visuelt-bold-webfont.woff2 HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gleeda/7d3165787015692aec4d2aad740ab8fe.js HTTP/1.1Host: gist.github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.5.1.min.dc5e7f18c8.js?site=6579dd0b5f9a54376d296915 HTTP/1.1Host: d3e54v103j8qbb.cloudfront.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /655d92689c415e9fefcf2368/656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a7c_search.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5b_facebook.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/slick-carousel@1.8.1/slick/slick.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a71_Blog%20banner%20Thumb%20Glitch%20Left.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a6f_twitter.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66abcfee331da80089b29d7e_Huntress%20Logo%20Wide%20Teal.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a70_linkedin.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rich-text-enhancer/bundle.v1.0.0.js HTTP/1.1Host: tools.refokus.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3911692.js HTTP/1.1Host: js.hs-scripts.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /us1/v5/datadog-rum.js HTTP/1.1Host: www.datadoghq-browser-agent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /include/1726835400000/5d3cypit2iz8.js HTTP/1.1Host: js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/gist-embed-38aeddf8d15a.css HTTP/1.1Host: github.githubassets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5a_download.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/js/huntress-new.28c3b280d.js HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gleeda/7d3165787015692aec4d2aad740ab8fe.js HTTP/1.1Host: gist.github.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5b_facebook.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a6f_twitter.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a70_linkedin.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.5.1.min.dc5e7f18c8.js?site=6579dd0b5f9a54376d296915 HTTP/1.1Host: d3e54v103j8qbb.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/66e88ca4db87912b833221bc_AD_4nXfOwDpF0yBEfx9g2KQU_7gC1nQg6KooRMNo04vFs1ifPF6jT0n6r4w0SZAd9fd5olhmUACBtCzTKgcB4_cTsAwdFPOcqi1EKiAeOCNkiYXMbTYFUgVNlXkA_YNsqmR84gUmAr0CZKGM0HE7qSitXg4ZgvI.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5a_download.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29694d_roboto-regular-webfont.woff2 HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a6e_DMSans_24pt-Bold.ttf HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3_24_2_kzhk9kjvjzpzdnk61lg3.js HTTP/1.1Host: static.huntresscdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-interactives-embed.js HTTP/1.1Host: js.hubspot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /leadflows.js HTTP/1.1Host: js.hsleadflows.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics/1726835100000/3911692.js HTTP/1.1Host: js.hs-analytics.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3911692.js HTTP/1.1Host: js.hs-banner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fb.js HTTP/1.1Host: js.hsadspixel.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /collectedforms.js HTTP/1.1Host: js.hscollectedforms.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=normal&cb=yya36n8lxzog HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/pixel.js HTTP/1.1Host: www.redditstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/hotjar-2159185.js?sv=6 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-interactives/public/v1/embed/combinedConfigs?portalId=3911692&currentUrl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email HTTP/1.1Host: cta-service-cms2.hubspot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /collected-forms/v1/config/json?portalId=3911692&utk= HTTP/1.1Host: forms.hscollectedforms.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widget/dist/NeverBounce.js HTTP/1.1Host: cdn.neverbounce.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ping.min.js HTTP/1.1Host: pixel.byspotify.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /attribution_tracking/conversions/1006267.js?p=https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%2520EMDR%2520Intelligence%2520Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email&e= HTTP/1.1Host: tracking.g2crowd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uwt.js HTTP/1.1Host: static.ads-twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /events.js HTTP/1.1Host: tags.srv.stackadapt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE
Source: global traffic	HTTP traffic detected: GET /ads/conversions-config/v1/pixel/config/t2_12z44i_telemetry HTTP/1.1Host: www.redditstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixels/t2_12z44i/config HTTP/1.1Host: pixel-config.reddit.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-GCTMBVFESS&gacid=802109752.1726835353&gtm=45je49j0v9122196611z89171248136za200zb9171248136&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533421&z=1522092947 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rp.gif?ts=1726835352270&id=t2_12z44i&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=817e47f3-3def-4930-9b06-a0005d41eba1&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_e9773deb&dpm=&dpcc=&dprc= HTTP/1.1Host: alb.reddit.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embed/v3/counters.gif?key=config-loaded-success&value=1 HTTP/1.1Host: perf-na1.hsforms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=2 HTTP/1.1Host: forms.hsforms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email HTTP/1.1Host: q.quora.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/66e88ca4db87912b833221bc_AD_4nXfOwDpF0yBEfx9g2KQU_7gC1nQg6KooRMNo04vFs1ifPF6jT0n6r4w0SZAd9fd5olhmUACBtCzTKgcB4_cTsAwdFPOcqi1EKiAeOCNkiYXMbTYFUgVNlXkA_YNsqmR84gUmAr0CZKGM0HE7qSitXg4ZgvI.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fb.js HTTP/1.1Host: js.hsadspixel.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3_24_2_kzhk9kjvjzpzdnk61lg3.js HTTP/1.1Host: static.huntresscdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-interactives-embed.js HTTP/1.1Host: js.hubspot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /leadflows.js HTTP/1.1Host: js.hsleadflows.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics/1726835100000/3911692.js HTTP/1.1Host: js.hs-analytics.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /collectedforms.js HTTP/1.1Host: js.hscollectedforms.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3911692.js HTTP/1.1Host: js.hs-banner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/pixel.js HTTP/1.1Host: www.redditstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /us1/v5/datadog-rum.js HTTP/1.1Host: www.datadoghq-browser-agent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /include/1726835400000/5d3cypit2iz8.js HTTP/1.1Host: js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sa.css HTTP/1.1Host: tags.srv.stackadapt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw
Source: global traffic	HTTP traffic detected: GET /saq_pxl?uid=yZKscIIzalsoNin7qAYxQw&is_js=true&landing_url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&t=Cracks%20in%20the%20Foundation%3A%20Intrusions%20of%20FOUNDATION%20Accounting%20Software%20%7C%20Huntress&tip=EdLJ8wtMAAZjrQjdUHdYQjeX1-gsKyUY41w1YDIrVrc&host=https%3A%2F%2Fwww.huntress.com&l_src=&l_src_d=&u_src=hs_email&u_src_d=2024-09-20T12%3A29%3A14.958Z&shop=false&sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw&sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo&sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI HTTP/1.1Host: tags.srv.stackadapt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw
Source: global traffic	HTTP traffic detected: GET /sa.jpeg HTTP/1.1Host: tags.srv.stackadapt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/action/187135658.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE
Source: global traffic	HTTP traffic detected: GET /signals/config/403957864408442?v=2.9.167&r=stable&domain=www.huntress.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/t3bQSayBNZay3AlGqfTWX-kXKQVLgnR7Ylzfc1IrTxc.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=normal&cb=yya36n8lxzogAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=4f26952d-2a31-4087-afd0-8204d6df9832&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=daf947f7-18a2-44e3-9bf3-3ce82a5c298c&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.30 HTTP/1.1Host: analytics.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=4f26952d-2a31-4087-afd0-8204d6df9832&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=daf947f7-18a2-44e3-9bf3-3ce82a5c298c&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.30 HTTP/1.1Host: t.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v4/poe/notify?key=public_0e95e4405380cdd75d8aa57fca3692dc&event=form.load&callback=__neverbounce_567032 HTTP/1.1Host: api.neverbounce.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules.0721e7cf944cf9d78a0b.js HTTP/1.1Host: script.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/conversions-config/v1/pixel/config/t2_12z44i_telemetry HTTP/1.1Host: www.redditstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /collected-forms/v1/config/json?portalId=3911692&utk= HTTP/1.1Host: forms.hscollectedforms.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-interactives/public/v1/embed/combinedConfigs?portalId=3911692&currentUrl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email HTTP/1.1Host: cta-service-cms2.hubspot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=yDTqM.QV_yon5q0wCQwxmm_SMsU9tC.R.bzgeueScyM-1726835357-1.0.1.1-Jm09yUDqJRDaZUBlOBhE7GuqHlpUbXtHk3D1jryOgT2WG97SIcQQKTRs7P0Kps8yh7MI_4q3Sbntjy6ysFL5aQ; _cfuvid=7Kr9.OpOE3xOMKgFNycrVxwF3RIEUG.pXAjb7_zSC.w-1726835357756-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /action/0?ti=187135658&Ver=2&mid=cb6bc014-c188-4332-9eca-25b6791c6740&sid=f3f1cd40774b11ef8c236b760e7c7256&vid=f3f2c300774b11efada401c2fdee9d80&vids=1&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=Cracks%20in%20the%20Foundation%3A%20Intrusions%20of%20FOUNDATION%20Accounting%20Software%20%7C%20Huntress&p=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&r=&lt=9693&evt=pageLoad&sv=1&cdb=AQAQ&rn=898361 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE
Source: global traffic	HTTP traffic detected: GET /ping.min.js HTTP/1.1Host: pixel.byspotify.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /attribution_tracking/conversions/1006267.js?p=https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%2520EMDR%2520Intelligence%2520Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email&e= HTTP/1.1Host: tracking.g2crowd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=sYnno6Exr4ULsoo4qxaPykw.usUpdQsfQs1Hxr9QuOk-1726835355-1.0.1.1-QZbaa..IfeHX7iIOZ0sRUZUE0fNUFe8IFhv4zZeWB1H8lXY4cpR59P3UdxVsNr9uDUY_GVnh2ovadjMzQWMF4A
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=EGbODne6buzpTnWrrBprcfAY HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=normal&cb=yya36n8lxzogAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a/gif.gif?actTypeId=31&cid=17715818&r=1726835354763&ref=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&version=2.4 HTTP/1.1Host: ibc-flow.techtarget.comConnection: keep-aliveibc_rate_tier: 17715818sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uwt.js HTTP/1.1Host: static.ads-twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widget/dist/NeverBounce.js HTTP/1.1Host: cdn.neverbounce.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /events.js HTTP/1.1Host: tags.srv.stackadapt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw
Source: global traffic	HTTP traffic detected: GET /c/hotjar-2159185.js?sv=6 HTTP/1.1Host: static.hotjar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=2 HTTP/1.1Host: forms.hsforms.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=kw7a54PKmOoyTHlYMczA4UQhqk0VkawKjpHJieRlyOg-1726835357-1.0.1.1-50XuMmnxDipENnxkNr6CF67zOg7ivkQakljNfouZroBz.Rx00N5Be86aGD3LoWjBKAIJeu9xSSUon9FC5pswPQ; _cfuvid=MhPxD.t5a.s6O381J.rDJPFirRLuGmKh6biQ6yC83Ps-1726835357354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /pixels/t2_12z44i/config HTTP/1.1Host: pixel-config.reddit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE
Source: global traffic	HTTP traffic detected: GET /embed/v3/counters.gif?key=config-loaded-success&value=1 HTTP/1.1Host: perf-na1.hsforms.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=kw7a54PKmOoyTHlYMczA4UQhqk0VkawKjpHJieRlyOg-1726835357-1.0.1.1-50XuMmnxDipENnxkNr6CF67zOg7ivkQakljNfouZroBz.Rx00N5Be86aGD3LoWjBKAIJeu9xSSUon9FC5pswPQ; _cfuvid=MhPxD.t5a.s6O381J.rDJPFirRLuGmKh6biQ6yC83Ps-1726835357354-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=403957864408442&ev=PageView&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&rl=&if=false&ts=1726835358399&sw=1280&sh=1024&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726835358379.798225651589239556&cs_est=true&ler=empty&cdl=API_unavailable&it=1726835354947&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=403957864408442&ev=PageView&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&rl=&if=false&ts=1726835358399&sw=1280&sh=1024&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726835358379.798225651589239556&cs_est=true&ler=empty&cdl=API_unavailable&it=1726835354947&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: not-navigation-source, trigger, event-sourceReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rp.gif?ts=1726835352270&id=t2_12z44i&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=817e47f3-3def-4930-9b06-a0005d41eba1&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_e9773deb&dpm=&dpcc=&dprc= HTTP/1.1Host: alb.reddit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email HTTP/1.1Host: q.quora.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=4f26952d-2a31-4087-afd0-8204d6df9832&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=daf947f7-18a2-44e3-9bf3-3ce82a5c298c&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.30 HTTP/1.1Host: t.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: muc_ads=05132678-e7b1-4701-b864-66f5b78b3c42; __cf_bm=4To780TRpV.vS99OlTsuo_.9XkOZuSiVrEK9Z26CY_0-1726835358-1.0.1.1-zRrZR4yVPsEtrblTpk.k40CMY0uznfgbiQyXyDy5bfhTPiQWVWZNTDj5Vv7ok8tItEB9rEnn6ETV_hGN1WSLVA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=EGbODne6buzpTnWrrBprcfAY&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/action/187135658.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MR=0
Source: global traffic	HTTP traffic detected: GET /v1/ingest HTTP/1.1Host: pixels.spotify.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=4f26952d-2a31-4087-afd0-8204d6df9832&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=daf947f7-18a2-44e3-9bf3-3ce82a5c298c&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.30 HTTP/1.1Host: analytics.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: guest_id_marketing=v1%3A172683535853486226; guest_id_ads=v1%3A172683535853486226; personalization_id="v1_fY3Bce5v/Rs00ev+LxzE8w=="; guest_id=v1%3A172683535853486226
Source: global traffic	HTTP traffic detected: GET /js/bg/t3bQSayBNZay3AlGqfTWX-kXKQVLgnR7Ylzfc1IrTxc.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /saq_pxl?uid=yZKscIIzalsoNin7qAYxQw&is_js=true&landing_url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&t=Cracks%20in%20the%20Foundation%3A%20Intrusions%20of%20FOUNDATION%20Accounting%20Software%20%7C%20Huntress&tip=EdLJ8wtMAAZjrQjdUHdYQjeX1-gsKyUY41w1YDIrVrc&host=https%3A%2F%2Fwww.huntress.com&l_src=&l_src_d=&u_src=hs_email&u_src_d=2024-09-20T12%3A29%3A14.958Z&shop=false&sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw&sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo&sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI HTTP/1.1Host: tags.srv.stackadapt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw
Source: global traffic	HTTP traffic detected: GET /sa.jpeg HTTP/1.1Host: tags.srv.stackadapt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw
Source: global traffic	HTTP traffic detected: GET /v4/poe/notify?key=public_0e95e4405380cdd75d8aa57fca3692dc&event=form.load&callback=__neverbounce_567032 HTTP/1.1Host: api.neverbounce.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a/gif.gif?actTypeId=31&cid=17715818&r=1726835354763&ref=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&version=2.4 HTTP/1.1Host: ibc-flow.techtarget.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=z5ATAeghYXQscaur.ko6LBOj8iVb0E4ErVdYaGvtU64-1726835355-1.0.1.1-SXNa208dIRPuxtaoWVpz67RlwXNZ46gjdgZ0IY6Sn6_ZPzhTetfuv3S2By7FIrDktLjTDNDXYdlFIBwTltwGcQ
Source: global traffic	HTTP traffic detected: GET /signals/config/403957864408442?v=2.9.167&r=stable&domain=www.huntress.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110 HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=EGbODne6buzpTnWrrBprcfAY HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules.0721e7cf944cf9d78a0b.js HTTP/1.1Host: script.hotjar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1Host: secure.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=403957864408442&ev=PageView&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&rl=&if=false&ts=1726835358399&sw=1280&sh=1024&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726835358379.798225651589239556&cs_est=true&ler=empty&cdl=API_unavailable&it=1726835354947&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=403957864408442&ev=PageView&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&rl=&if=false&ts=1726835358399&sw=1280&sh=1024&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726835358379.798225651589239556&cs_est=true&ler=empty&cdl=API_unavailable&it=1726835354947&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lead-flows-config/v1/config/json?portalId=3911692&currentUrl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email HTTP/1.1Host: forms.hubspot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lead-flows-config/v1/config/json?portalId=3911692&currentUrl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email HTTP/1.1Host: forms.hubspot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=yDTqM.QV_yon5q0wCQwxmm_SMsU9tC.R.bzgeueScyM-1726835357-1.0.1.1-Jm09yUDqJRDaZUBlOBhE7GuqHlpUbXtHk3D1jryOgT2WG97SIcQQKTRs7P0Kps8yh7MI_4q3Sbntjy6ysFL5aQ; _cfuvid=7Kr9.OpOE3xOMKgFNycrVxwF3RIEUG.pXAjb7_zSC.w-1726835357756-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /js_tracking?url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software&uid=yZKscIIzalsoNin7qAYxQw&v=1&host=https%3A%2F%2Fwww.huntress.com&l_src=&l_src_d=&u_src=hs_email&u_src_d=2024-09-20T12%3A29%3A14.958Z&shop=false HTTP/1.1Host: tags.srv.stackadapt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id=s%3A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%2BnIDtZVp3vzenSYI; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v2=s%3ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw; sa-user-id-v3=s%3AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%2BOtibvooVqq7ObUEv5%2BSNuwF%2BSNTLTHw
Source: global traffic	HTTP traffic detected: GET /zi-tag.js HTTP/1.1Host: js.zi-scripts.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /__ptq.gif?k=1&sd=1280x1024&cd=24-bit&cs=UTF-8&ln=en-us&bfp=471034161&v=1.1&a=3911692&rcu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software&pu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&t=Cracks+in+the+Foundation%3A+Intrusions+of+FOUNDATION+Accounting+Software+%7C+Huntress&cts=1726835369872&vi=e7b8316db2e32b920a737d5d0e9995fd&nc=true&ce=false&pt=1&cc=0 HTTP/1.1Host: track.hubspot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=yDTqM.QV_yon5q0wCQwxmm_SMsU9tC.R.bzgeueScyM-1726835357-1.0.1.1-Jm09yUDqJRDaZUBlOBhE7GuqHlpUbXtHk3D1jryOgT2WG97SIcQQKTRs7P0Kps8yh7MI_4q3Sbntjy6ysFL5aQ; _cfuvid=7Kr9.OpOE3xOMKgFNycrVxwF3RIEUG.pXAjb7_zSC.w-1726835357756-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66030a0ceace49bce51c36de_favicon-32x32.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /zi-tag.js HTTP/1.1Host: js.zi-scripts.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66030a0ceace49bce51c36de_favicon-32x32.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /__ptq.gif?k=1&sd=1280x1024&cd=24-bit&cs=UTF-8&ln=en-us&bfp=471034161&v=1.1&a=3911692&rcu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software&pu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&t=Cracks+in+the+Foundation%3A+Intrusions+of+FOUNDATION+Accounting+Software+%7C+Huntress&cts=1726835369872&vi=e7b8316db2e32b920a737d5d0e9995fd&nc=true&ce=false&pt=1&cc=0 HTTP/1.1Host: track.hubspot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=yDTqM.QV_yon5q0wCQwxmm_SMsU9tC.R.bzgeueScyM-1726835357-1.0.1.1-Jm09yUDqJRDaZUBlOBhE7GuqHlpUbXtHk3D1jryOgT2WG97SIcQQKTRs7P0Kps8yh7MI_4q3Sbntjy6ysFL5aQ; _cfuvid=7Kr9.OpOE3xOMKgFNycrVxwF3RIEUG.pXAjb7_zSC.w-1726835357756-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /com.snowplowanalytics.snowplow/tp2 HTTP/1.1Host: t.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835370..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.2; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c
Source: global traffic	HTTP traffic detected: GET /unified/v1/master/getSubscriptions HTTP/1.1Host: js.zi-scripts.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"Content-Type: application/jsonsec-ch-ua-mobile: ?0Authorization: Bearer 5880e3e5891679926699User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36visited_url: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_emailAccept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /unified/v1/master/getSubscriptions HTTP/1.1Host: js.zi-scripts.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/tp2 HTTP/1.1Host: webhooks.fivetran.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel/62f67a71a4cf97008ef6d460/?iszitag=true HTTP/1.1Host: ws.zoominfo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/javascriptvisited-url: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_email_vtok: OC40Ni4xMjMuMzM=_zitok: c59f3dabf15c2190f28e1726835373sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?utm_campaign=CYDERES%20EMDR%20Intelligence%20Digest&utm_medium=email&_hsenc=p2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I&_hsmi=325473246&utm_content=325473246&utm_source=hs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=403957864408442&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&rl=&if=false&ts=1726835372587&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22hs-en-cookie-confirmation-buttons-area%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22Accept%5CnDecline%22%2C%22numChildButtons%22%3A3%2C%22tag%22%3A%22div%22%2C%22type%22%3Anull%7D&cd[buttonText]=Accept%0ADecline&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22Cracks%20in%20the%20Foundation%3A%20Intrusions%20of%20FOUNDATION%20Accounting%20Software%20%7C%20Huntress%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.167&r=stable&ec=1&o=4126&fbp=fb.1.1726835358379.798225651589239556&cs_est=true&ler=empty&cdl=API_unavailable&it=1726835354947&coo=false&es=automatic&tm=3&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=403957864408442&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&rl=&if=false&ts=1726835372587&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22hs-en-cookie-confirmation-buttons-area%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22Accept%5CnDecline%22%2C%22numChildButtons%22%3A3%2C%22tag%22%3A%22div%22%2C%22type%22%3Anull%7D&cd[buttonText]=Accept%0ADecline&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22Cracks%20in%20the%20Foundation%3A%20Intrusions%20of%20FOUNDATION%20Accounting%20Software%20%7C%20Huntress%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.167&r=stable&ec=1&o=4126&fbp=fb.1.1726835358379.798225651589239556&cs_est=true&ler=empty&cdl=API_unavailable&it=1726835354947&coo=false&es=automatic&tm=3&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger=navigation-source, event-sourceReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel/62f67a71a4cf97008ef6d460/?iszitag=true HTTP/1.1Host: ws.zoominfo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=mdJ4ZkOM50BCbDNEloZIoEn8Ve94aTg4K8wEjRTrAz0-1726835374-1.0.1.1-1A_nkRjWJ3MG9GfKK5q6RtVynjAv25NXoF71F8ctNLctJtjAvcf55nEP0WnZHr4RhEhXYCkvG40RumpIccp.6g; _cfuvid=J.B0J.468L.9BJ8qt5O.wNhQJEjtoQscsY5FlKPHW0c-1726835374842-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /tr/?id=403957864408442&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&rl=&if=false&ts=1726835372587&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22hs-en-cookie-confirmation-buttons-area%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22Accept%5CnDecline%22%2C%22numChildButtons%22%3A3%2C%22tag%22%3A%22div%22%2C%22type%22%3Anull%7D&cd[buttonText]=Accept%0ADecline&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22Cracks%20in%20the%20Foundation%3A%20Intrusions%20of%20FOUNDATION%20Accounting%20Software%20%7C%20Huntress%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.167&r=stable&ec=1&o=4126&fbp=fb.1.1726835358379.798225651589239556&cs_est=true&ler=empty&cdl=API_unavailable&it=1726835354947&coo=false&es=automatic&tm=3&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=403957864408442&ev=SubscribedButtonClick&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&rl=&if=false&ts=1726835372587&cd[buttonFeatures]=%7B%22classList%22%3A%22%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22hs-en-cookie-confirmation-buttons-area%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22Accept%5CnDecline%22%2C%22numChildButtons%22%3A3%2C%22tag%22%3A%22div%22%2C%22type%22%3Anull%7D&cd[buttonText]=Accept%0ADecline&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22Cracks%20in%20the%20Foundation%3A%20Intrusions%20of%20FOUNDATION%20Accounting%20Software%20%7C%20Huntress%22%7D&cd[parameters]=%5B%5D&sw=1280&sh=1024&v=2.9.167&r=stable&ec=1&o=4126&fbp=fb.1.1726835358379.798225651589239556&cs_est=true&ler=empty&cdl=API_unavailable&it=1726835354947&coo=false&es=automatic&tm=3&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835374650&i=gtm&dwt=4775&ive=blur HTTP/1.1Host: q.quora.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/css/dist/block-library/style.min.css?ver=61d6c8f4cfb4a67a5b525ccfe7264dd4 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835374650&i=gtm&dwt=4775&ive=blur HTTP/1.1Host: q.quora.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/branda-white-labeling/inc/modules/front-end/assets/css/cookie-notice.css?ver=3.4.19 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/style.css?ver=61d6c8f4cfb4a67a5b525ccfe7264dd4 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/framework/dist/css/site/stacks/integrity-light.css?ver=6.5.7 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro-child/style.css?ver=6.5.7.1724669600 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/searchwp/assets/css/frontend/search-forms.css?ver=4.3.16 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835375916&i=gtm&dwt=8&ive=blur HTTP/1.1Host: q.quora.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro-child/scripts.js?ver=61d6c8f4cfb4a67a5b525ccfe7264dd4.1680526300 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/presto-player/dist/components/web-components/web-components.esm.js?ver=1726113917 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.foundationsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/cornerstone/assets/fonts/fa-solid-900.woff2?ver=6.5.2 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.foundationsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/cornerstone/assets/fonts/fa-regular-400.woff2?ver=6.5.2 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.foundationsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/iframe-resizer/4.2.11/iframeResizer.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/06/fsl-logo.png HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/09/ConstructionHeader-V2-3-compressed.jpg HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/02/64303163-0-2023-05-ATT-Mobile-p.webp HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/07/WhyFoundationSection-compressed.webp HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835375916&i=gtm&dwt=8&ive=blur HTTP/1.1Host: q.quora.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro-child/scripts.js?ver=61d6c8f4cfb4a67a5b525ccfe7264dd4.1680526300 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/presto-player/dist/components/web-components/web-components.esm.js?ver=1726113917 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/iframe-resizer/4.2.11/iframeResizer.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/cornerstone/assets/fonts/fa-brands-400.woff2?ver=6.5.2 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.foundationsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /l/970183/2022-10-11/2cxrl HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /l/970183/2022-10-06/2c3zl HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/06/fsl-logo.png HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/cornerstone/assets/js/site/cs-classic.7.5.7.js?ver=7.5.7 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/09/ConstructionHeader-V2-3-compressed.jpg HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/07/WhyFoundationSection-compressed.webp HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/02/64303163-0-2023-05-ATT-Mobile-p.webp HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /l/970183/2022-10-11/2cxrl HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/form.css?ver=2021-09-20 HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://hello.foundationsoft.com/l/970183/2022-10-11/2cxrlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /js/piUtils.js?ver=2021-09-20 HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/l/970183/2022-10-11/2cxrlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MR=0
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/branda-white-labeling/inc/modules/front-end/assets/js/cookie-notice-front.js?ver=3.4.19 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/framework/dist/js/site/x.js?ver=6.5.7 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/cornerstone/assets/js/site/cs-accordion.7.5.7.js?ver=7.5.7 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/cornerstone/assets/js/site/cs-sliders.7.5.7.js?ver=7.5.7 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /dcjs/970183/558/dc.js?asset_type=form&asset_id=5297 HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/l/970183/2022-10-06/2c3zlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /javascript/highlight.js HTTP/1.1Host: cdn.schemaapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dcjs/970183/558/dc.js?asset_type=form&asset_id=5360 HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/l/970183/2022-10-11/2cxrlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/presto-player/dist/components/web-components/p-43f79dfb.js HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.foundationsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/presto-player/dist/components/web-components/p-e1255160.js HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.foundationsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/comment-reply.min.js?ver=61d6c8f4cfb4a67a5b525ccfe7264dd4 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/cornerstone/assets/js/site/cs-accordion.7.5.7.js?ver=7.5.7 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /dcjs/970183/558/dc.js?asset_type=form&asset_id=5360 HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/l/970183/2022-10-11/2cxrlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/branda-white-labeling/inc/modules/front-end/assets/js/cookie-notice-front.js?ver=3.4.19 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /dcjs/970183/558/dc.js?asset_type=form&asset_id=5297 HTTP/1.1Host: hello.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /dcjs/970183/558/dc.js?asset_type=form&asset_id=5360 HTTP/1.1Host: hello.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /js/piUtils.js?ver=2021-09-20 HTTP/1.1Host: hello.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/cornerstone/assets/js/site/cs-sliders.7.5.7.js?ver=7.5.7 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/04/2nd-Section.jpg HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/04/p4c-logo.png HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/pro/framework/dist/js/site/x.js?ver=6.5.7 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /uwt.js HTTP/1.1Host: static.ads-twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/iframe-resizer/4.2.11/iframeResizer.contentWindow.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/hotjar-2150031.js?sv=7 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/05/workmax-hover-1536x342.png HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-S26LX9DYQD&gacid=1755879698.1726835380&gtm=45je49j0v869536148z878376671za200zb78376671&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=991962348 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/08/SafetyHQ-Logo.webp HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/presto-player/dist/components/web-components/p-e1255160.js HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /dcjs/970183/558/dc.js?asset_type=form&asset_id=5360 HTTP/1.1Host: hello.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/presto-player/dist/components/web-components/p-43f79dfb.js HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/comment-reply.min.js?ver=61d6c8f4cfb4a67a5b525ccfe7264dd4 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/04/p4c-logo.png HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/04/2nd-Section.jpg HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /ajax/libs/iframe-resizer/4.2.11/iframeResizer.contentWindow.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /javascript/highlight.js HTTP/1.1Host: cdn.schemaapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdnr/94/acton/bn/tracker/17367 HTTP/1.1Host: info.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /p/action/5740310.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MR=0
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=61d6c8f4cfb4a67a5b525ccfe7264dd4 HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/05/workmax-hover-1536x342.png HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /c/hotjar-2150031.js?sv=7 HTTP/1.1Host: static.hotjar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uwt.js HTTP/1.1Host: static.ads-twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "bbbcf811d8437a575d796a4c1e5d4fad"If-Modified-Since: Tue, 26 Mar 2024 20:58:07 GMT
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=b1bcdb4a-20c4-4018-8f69-9ae3e4c1e79e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=66ca7fd3-6b8c-4e97-9b70-221f6b4586bd&tw_document_href=https%3A%2F%2Fwww.foundationsoft.com%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzica&type=javascript&version=2.3.30 HTTP/1.1Host: t.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: muc_ads=05132678-e7b1-4701-b864-66f5b78b3c42; __cf_bm=4To780TRpV.vS99OlTsuo_.9XkOZuSiVrEK9Z26CY_0-1726835358-1.0.1.1-zRrZR4yVPsEtrblTpk.k40CMY0uznfgbiQyXyDy5bfhTPiQWVWZNTDj5Vv7ok8tItEB9rEnn6ETV_hGN1WSLVA
Source: global traffic	HTTP traffic detected: GET /com.snowplowanalytics.snowplow/tp2 HTTP/1.1Host: t.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835380..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4
Source: global traffic	HTTP traffic detected: GET /modules.0721e7cf944cf9d78a0b.js HTTP/1.1Host: script.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=b1bcdb4a-20c4-4018-8f69-9ae3e4c1e79e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=66ca7fd3-6b8c-4e97-9b70-221f6b4586bd&tw_document_href=https%3A%2F%2Fwww.foundationsoft.com%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzica&type=javascript&version=2.3.30 HTTP/1.1Host: analytics.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: guest_id_marketing=v1%3A172683535853486226; guest_id_ads=v1%3A172683535853486226; personalization_id="v1_fY3Bce5v/Rs00ev+LxzE8w=="; guest_id=v1%3A172683535853486226
Source: global traffic	HTTP traffic detected: GET /td/rul/1072600148?random=1726835380865&cv=11&fst=1726835380865&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49j0v868615713z878376671za201zb78376671&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.foundationsoft.com%2F&hn=www.googleadservices.com&frm=0&tiba=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20%7C%20Foundation%20Software&npa=0&pscdl=noapi&auid=1327568034.1726835378&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/08/SafetyHQ-Logo.webp HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga=GA1.1.1755879698.1726835380; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0
Source: global traffic	HTTP traffic detected: GET /action/0?ti=5740310&tm=gtm002&Ver=2&mid=f5b4423b-545f-4fdc-838d-56ad636fd170&sid=024628b0774c11efb170275a5f1ff82f&vid=02463e70774c11ef8a0619cbd0a972f9&vids=1&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20%7C%20Foundation%20Software&p=https%3A%2F%2Fwww.foundationsoft.com%2F&r=&lt=5449&evt=pageLoad&sv=1&cdb=AQAA&rn=980122 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MR=0
Source: global traffic	HTTP traffic detected: GET /p/action/5740310.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MR=0
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1072600148/?random=1726835380865&cv=11&fst=1726835380865&bg=ffffff&guid=ON&async=1&gtm=45be49j0v868615713z878376671za201zb78376671&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.foundationsoft.com%2F&hn=www.googleadservices.com&frm=0&tiba=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20%7C%20Foundation%20Software&npa=0&pscdl=noapi&auid=1327568034.1726835378&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUlpzIjr-7VIIrf-0-WV127xY26qDVbNIuqhuRJe7zi5Jh67nYagqHenXAR-
Source: global traffic	HTTP traffic detected: GET /signals/config/347646367428939?v=2.9.167&r=stable&domain=www.foundationsoft.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /highlighter/prod/FoundationSoftware/FoundationSoftware1/v2/aHR0cHM6Ly93d3cuZm91bmRhdGlvbnNvZnQuY29t HTTP/1.1Host: cdn.schemaapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonx-account-id: FoundationSoftware/FoundationSoftware1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.foundationsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly9oZWxsby5mb3VuZGF0aW9uc29mdC5jb206NDQz&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=normal&cb=5qjg13nelqok HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://hello.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly9oZWxsby5mb3VuZGF0aW9uc29mdC5jb206NDQz&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=normal&cb=dz5us94o35s1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://hello.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=b1bcdb4a-20c4-4018-8f69-9ae3e4c1e79e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=66ca7fd3-6b8c-4e97-9b70-221f6b4586bd&tw_document_href=https%3A%2F%2Fwww.foundationsoft.com%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzica&type=javascript&version=2.3.30 HTTP/1.1Host: t.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: muc_ads=05132678-e7b1-4701-b864-66f5b78b3c42; __cf_bm=4To780TRpV.vS99OlTsuo_.9XkOZuSiVrEK9Z26CY_0-1726835358-1.0.1.1-zRrZR4yVPsEtrblTpk.k40CMY0uznfgbiQyXyDy5bfhTPiQWVWZNTDj5Vv7ok8tItEB9rEnn6ETV_hGN1WSLVA
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly9oZWxsby5mb3VuZGF0aW9uc29mdC5jb206NDQz&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=normal&cb=rml808mevu76 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://hello.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=61d6c8f4cfb4a67a5b525ccfe7264dd4 HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
Source: global traffic	HTTP traffic detected: GET /FoundationSoftware/FoundationSoftware1/aHR0cHM6Ly93d3cuZm91bmRhdGlvbnNvZnQuY29tLw HTTP/1.1Host: data.schemaapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonx-account-id: FoundationSoftware/FoundationSoftware1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.foundationsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/adsct?bci=3&eci=2&event_id=b1bcdb4a-20c4-4018-8f69-9ae3e4c1e79e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=66ca7fd3-6b8c-4e97-9b70-221f6b4586bd&tw_document_href=https%3A%2F%2Fwww.foundationsoft.com%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nzica&type=javascript&version=2.3.30 HTTP/1.1Host: analytics.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: guest_id_marketing=v1%3A172683535853486226; guest_id_ads=v1%3A172683535853486226; personalization_id="v1_fY3Bce5v/Rs00ev+LxzE8w=="; guest_id=v1%3A172683535853486226
Source: global traffic	HTTP traffic detected: GET /api/v2/client/ws?v=7&site_id=2150031 HTTP/1.1Host: ws.hotjar.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://www.foundationsoft.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: Kgp2nFEGuJRhfNzuYUgKbQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1072600148/?random=1726835380865&cv=11&fst=1726833600000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v868615713z878376671za201zb78376671&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.foundationsoft.com%2F&hn=www.googleadservices.com&frm=0&tiba=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20%7C%20Foundation%20Software&npa=0&pscdl=noapi&auid=1327568034.1726835378&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfJsjAqrUzF_1z5e5XMCafD0fPo8HLglmCms9ePNiJnkuDa3IR&random=1223636476&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/tp2 HTTP/1.1Host: webhooks.fivetran.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1072600148/?random=1726835380865&cv=11&fst=1726835380865&bg=ffffff&guid=ON&async=1&gtm=45be49j0v868615713z878376671za201zb78376671&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.foundationsoft.com%2F&hn=www.googleadservices.com&frm=0&tiba=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20%7C%20Foundation%20Software&npa=0&pscdl=noapi&auid=1327568034.1726835378&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkVw5RGLc2q89x7ihwhM-m5faLgJ9_jFnEwcxLR_EBykyPkk6QV64U87AkH
Source: global traffic	HTTP traffic detected: GET /tr/?id=347646367428939&ev=PageView&dl=https%3A%2F%2Fwww.foundationsoft.com%2F&rl=&if=false&ts=1726835382603&sw=1280&sh=1024&v=2.9.167&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1726835382602.901974263764085373&ler=empty&cdl=API_unavailable&it=1726835381310&coo=false&tm=1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=347646367428939&ev=PageView&dl=https%3A%2F%2Fwww.foundationsoft.com%2F&rl=&if=false&ts=1726835382603&sw=1280&sh=1024&v=2.9.167&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1726835382602.901974263764085373&ler=empty&cdl=API_unavailable&it=1726835381310&coo=false&tm=1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger, event-sourceReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/347646367428939?v=2.9.167&r=stable&domain=www.foundationsoft.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110 HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /highlighter/prod/FoundationSoftware/FoundationSoftware1/v2/aHR0cHM6Ly93d3cuZm91bmRhdGlvbnNvZnQuY29t HTTP/1.1Host: cdn.schemaapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=EGbODne6buzpTnWrrBprcfAY HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly9oZWxsby5mb3VuZGF0aW9uc29mdC5jb206NDQz&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=normal&cb=dz5us94o35s1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/t3bQSayBNZay3AlGqfTWX-kXKQVLgnR7Ylzfc1IrTxc.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly9oZWxsby5mb3VuZGF0aW9uc29mdC5jb206NDQz&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=normal&cb=dz5us94o35s1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?site_id=2150031&gzip=1 HTTP/1.1Host: content.hotjar.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1072600148/?random=1726835380865&cv=11&fst=1726833600000&bg=ffffff&guid=ON&async=1&gtm=45be49j0v868615713z878376671za201zb78376671&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.foundationsoft.com%2F&hn=www.googleadservices.com&frm=0&tiba=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20%7C%20Foundation%20Software&npa=0&pscdl=noapi&auid=1327568034.1726835378&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfJsjAqrUzF_1z5e5XMCafD0fPo8HLglmCms9ePNiJnkuDa3IR&random=1223636476&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=347646367428939&ev=PageView&dl=https%3A%2F%2Fwww.foundationsoft.com%2F&rl=&if=false&ts=1726835382603&sw=1280&sh=1024&v=2.9.167&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1726835382602.901974263764085373&ler=empty&cdl=API_unavailable&it=1726835381310&coo=false&tm=1&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=347646367428939&ev=PageView&dl=https%3A%2F%2Fwww.foundationsoft.com%2F&rl=&if=false&ts=1726835382603&sw=1280&sh=1024&v=2.9.167&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1726835382602.901974263764085373&ler=empty&cdl=API_unavailable&it=1726835381310&coo=false&tm=1&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /FoundationSoftware/FoundationSoftware1/aHR0cHM6Ly93d3cuZm91bmRhdGlvbnNvZnQuY29tLw HTTP/1.1Host: data.schemaapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pd.js HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/l/970183/2022-10-11/2cxrlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/05/cropped-chevron-icon-32x32.png HTTP/1.1Host: www.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /analytics?ver=3&pi_form=true&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=146571&account_id=971183&title=&url=https%3A%2F%2Fhello.foundationsoft.com%2Fl%2F970183%2F2022-10-11%2F2cxrl&referrer=https%3A%2F%2Fwww.foundationsoft.com%2F HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/l/970183/2022-10-11/2cxrlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /analytics?ver=3&pi_form=true&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=146556&account_id=971183&title=&url=https%3A%2F%2Fhello.foundationsoft.com%2Fl%2F970183%2F2022-10-06%2F2c3zl&referrer=https%3A%2F%2Fwww.foundationsoft.com%2F HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/l/970183/2022-10-06/2c3zlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=146436&account_id=971183&title=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20%7C%20Foundation%20Software&url=https%3A%2F%2Fwww.foundationsoft.com%2F&referrer= HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /pd.js HTTP/1.1Host: hello.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/05/cropped-chevron-icon-32x32.png HTTP/1.1Host: www.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /core/assets/js/runtime~main.23dacaf3.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://rc-widget-frame.js.driftt.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/9.4a3e9801.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://rc-widget-frame.js.driftt.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics?ver=3&pi_form=true&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=146571&account_id=971183&title=&url=https%3A%2F%2Fhello.foundationsoft.com%2Fl%2F970183%2F2022-10-11%2F2cxrl&referrer=https%3A%2F%2Fwww.foundationsoft.com%2F HTTP/1.1Host: hello.foundationsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hello.foundationsoft.com/l/970183/2022-10-11/2cxrlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /analytics?ver=3&pi_form=true&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=146571&account_id=971183&title=&url=https%3A%2F%2Fhello.foundationsoft.com%2Fl%2F970183%2F2022-10-11%2F2cxrl&referrer=https%3A%2F%2Fwww.foundationsoft.com%2F HTTP/1.1Host: hello.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /analytics?ver=3&pi_form=true&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=146556&account_id=971183&title=&url=https%3A%2F%2Fhello.foundationsoft.com%2Fl%2F970183%2F2022-10-06%2F2c3zl&referrer=https%3A%2F%2Fwww.foundationsoft.com%2F HTTP/1.1Host: hello.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373
Source: global traffic	HTTP traffic detected: GET /analytics?conly=true&visitor_id=313668642&visitor_id_sign=b069f543db16259c3cfd994c855a51d87936a452ddeaf0ba3be58cb6697f32b5c2449dfeb6e49280b577d65e115faae086148a09&pi_opt_in=&campaign_id=146436&account_id=971183&title=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20|%20Foundation%20Software&url=https://www.foundationsoft.com/&referrer= HTTP/1.1Host: pi.pardot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v2/client/ws?v=7&site_id=2150031 HTTP/1.1Host: ws.hotjar.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://www.foundationsoft.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: WC1qEz2EUnKniFD0+IcZ7Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=146436&account_id=971183&title=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20%7C%20Foundation%20Software&url=https%3A%2F%2Fwww.foundationsoft.com%2F&referrer= HTTP/1.1Host: hello.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373; visitor_id970183=313668642; visitor_id970183-hash=b069f543db16259c3cfd994c855a51d87936a452ddeaf0ba3be58cb6697f32b5c2449dfeb6e49280b577d65e115faae086148a09; lpv970183=aHR0cHM6Ly93d3cuZm91bmRhdGlvbnNvZnQuY29tLw%3D%3D
Source: global traffic	HTTP traffic detected: GET /core/assets/js/main~493df0b3.91dc5a14.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://rc-widget-frame.js.driftt.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics?ver=3&pi_form=true&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=146571&account_id=971183&title=&url=https%3A%2F%2Fhello.foundationsoft.com%2Fl%2F970183%2F2022-10-11%2F2cxrl&referrer=https%3A%2F%2Fwww.foundationsoft.com%2F HTTP/1.1Host: hello.foundationsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1327568034.1726835378; _ga_S26LX9DYQD=GS1.1.1726835379.1.0.1726835379.60.0.0; _ga_H9W8D4RX40=GS1.1.1726835380.1.0.1726835380.0.0.0; _uetsid=024628b0774c11efb170275a5f1ff82f; _uetvid=02463e70774c11ef8a0619cbd0a972f9; _ga=GA1.2.1755879698.1726835380; _gid=GA1.2.1612450582.1726835382; _gat_UA-30919619-1=1; _hjSessionUser_2150031=eyJpZCI6ImNhZDc1YWZmLWE1M2YtNTZiNi1iN2I3LTgyM2FkMzc1OTEyMCIsImNyZWF0ZWQiOjE3MjY4MzUzODIwOTYsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2150031=eyJpZCI6IjExMjczNjUyLWZmNjAtNGMyMy1hNTAxLWVkYjY1ZTNlZDdjNiIsImMiOjE3MjY4MzUzODIwOTcsInMiOjEsInIiOjEsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _fbp=fb.1.1726835382602.901974263764085373; visitor_id970183=313668642; visitor_id970183-hash=b069f543db16259c3cfd994c855a51d87936a452ddeaf0ba3be58cb6697f32b5c2449dfeb6e49280b577d65e115faae086148a09; lpv970183=aHR0cHM6Ly93d3cuZm91bmRhdGlvbnNvZnQuY29tLw%3D%3D
Source: global traffic	HTTP traffic detected: GET /analytics?conly=true&visitor_id=313668642&visitor_id_sign=b069f543db16259c3cfd994c855a51d87936a452ddeaf0ba3be58cb6697f32b5c2449dfeb6e49280b577d65e115faae086148a09&pi_opt_in=&campaign_id=146436&account_id=971183&title=Construction%20Accounting%20Software%20by%20FOUNDATION%C2%AE%20|%20Foundation%20Software&url=https://www.foundationsoft.com/&referrer= HTTP/1.1Host: pi.pardot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: visitor_id970183=313668642; visitor_id970183-hash=b069f543db16259c3cfd994c855a51d87936a452ddeaf0ba3be58cb6697f32b5c2449dfeb6e49280b577d65e115faae086148a09
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=EGbODne6buzpTnWrrBprcfAY&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://hello.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/runtime~main.23dacaf3.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/9.4a3e9801.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/main~493df0b3.91dc5a14.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/51.558be3c5.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/33.ae4de0a0.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog-categories/response-to-incidents HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835380..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836275907
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=EGbODne6buzpTnWrrBprcfAY&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://hello.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=EGbODne6buzpTnWrrBprcfAY&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://hello.foundationsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/css/8.98b34517.chunk.css HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/css/16.22abfce0.chunk.css HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/51.558be3c5.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/33.ae4de0a0.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@finsweet/attributes-cmsload@1/cmsload.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/22.6b9a301a.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@finsweet/attributes-cmsnest@1/cmsnest.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@finsweet/attributes-animation@1/animation.esm.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/65dcd9aad5690d38a312f5c4_Blog-SlashAndGrab-the-ConnectWise-ScreenConnect-vulnerabilities-explained-p-500.jpg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/66e88ae0334c01ef01d7b9c6_100m-arr-blog-thumbnail-2%20(1)-p-500.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296969_visuelt-regular-webfont.woff2 HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a7a_Blog%20glitch%20right.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/19.6f85b843.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a93_Blog%20filter%20gradient.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog-categories/response-to-incidents?301e1821_page=2 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835380..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836275907
Source: global traffic	HTTP traffic detected: GET /include/1726835400000/5d3cypit2iz8.js HTTP/1.1Host: js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "576cdc1c0941a520c47b54aef3b463f7"If-Modified-Since: Mon, 21 Aug 2023 14:57:31 GMT
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=en&v=EGbODne6buzpTnWrrBprcfAY&theme=dark&size=compact&cb=fi5vsevzfu7t HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/41.b4fc4de2.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a85_Filter%20Glitch%20Top%20Mobile.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a7e_Blog%20glitch%20listing%20right.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a55_Gated%20glitch%20banner%20mobile.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/65d91c17bbf42843c2ab615d_Blog-Think-your-ScreenConnect-server-is-hacked_v1%20(1).jpg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/65d8f499ba3251bdb3e67c42_Blog-SlashAndGrab-ScreenConnect-Post-Exploitation-in-the-wild-p-500.jpg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/65d56cefb34458516918d259_Rapid%20Response%202-p-500.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v2/client/ws?v=7&site_id=2150031 HTTP/1.1Host: ws.hotjar.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://www.foundationsoft.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: QKruN7guoQ/jtGg3BQwsbA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /leadflows.js HTTP/1.1Host: js.hsleadflows.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"7d65c542c3a53442feef1a0f44071183"If-Modified-Since: Thu, 12 Sep 2024 08:49:54 UTC
Source: global traffic	HTTP traffic detected: GET /npm/@finsweet/attributes-cmscore@1/cmscore.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.huntress.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-interactives/public/v1/embed/combinedConfigs?portalId=3911692&currentUrl=https%3A%2F%2Fwww.huntress.com%2Fblog-categories%2Fresponse-to-incidents HTTP/1.1Host: cta-service-cms2.hubspot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=EGbODne6buzpTnWrrBprcfAY&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/slashandgrab-the-connectwise-screenconnect-vulnerability-explained-2 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/slashandgrab-the-connectwise-screenconnect-vulnerability-explained HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/how-to-know-if-your-screenconnect-server-is-hacked HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835397496&i=gtm&dwt=11&ive=blur HTTP/1.1Host: q.quora.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /core/assets/js/20.8c21ea18.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835398038&i=gtm&dwt=9&ive=webkitHidden HTTP/1.1Host: q.quora.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/27.3951aad8.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/14.e24a6190.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/11.639238ba.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296ac3_Close%20Icon.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d2969e1_Secondary%20Text%20CTA%20Black.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /655ddcc107aef728354e9c2a/655ddcc107aef728354e9cba_Secondary%20Text%20CTA%20Black.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f42186bd038ff65c2901_managed-edr%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/18.9c1bd1fb.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f58dee0405731067e1bb_hsat.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/49.f7274268.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29698f_Secondary%20Text%20CTA%20Black.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/detection-guidance-for-connectwise-cwe-288-2 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/rapid-response-trickboot HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66b0e0ae56c636b679619a00_MDRforM365%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66b0e0941952090c965c0771_Managed%20SIEM%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bc11cbdfd171e4de042009_Platform%20Nav%20Image.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd4618974812a59c9e95d9_Managed%20EDR%201%20(2).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296ab1_Icon-HSAT-White.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f6a6428feb6a848b9886_msp.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/40.31ef8dbf.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/29.31d09948.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/21.b8c41db9.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/8.5fdda827.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/16.890a0911.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/24.24e43c3b.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f6ed63c32a0963f64190_reseller.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f74703df956c64c182bd_business-it-teams%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@finsweet/attributes-cmsload@1/cmsload.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f85803df956c64c29612_success-stories%20(2).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f7e1e53239ee83da1446_soc%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd01d4c0f3634790afea77_Managed%20EDR%201.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296ab2_Icon-EDR-White.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/critical-vulnerability-printnightmare-exposes-windows-servers-to-remote-code-execution HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/cybersecurity-advisory-hackers-are-exploiting-cve-2021-40444 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog-categories/response-to-incidents?301e1821_page=3 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/investigating-unauthorized-access-huntress-qa-environment-incident HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /core/assets/js/22.6b9a301a.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/critical-rce-vulnerability-log4j-cve-2021-44228 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835397496&i=gtm&dwt=11&ive=blur HTTP/1.1Host: q.quora.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd01d451643bcc8140096e_IT%20Business%20Owner%201.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835398038&i=gtm&dwt=9&ive=webkitHidden HTTP/1.1Host: q.quora.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-interactives-embed.js HTTP/1.1Host: js.hubspot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=yDTqM.QV_yon5q0wCQwxmm_SMsU9tC.R.bzgeueScyM-1726835357-1.0.1.1-Jm09yUDqJRDaZUBlOBhE7GuqHlpUbXtHk3D1jryOgT2WG97SIcQQKTRs7P0Kps8yh7MI_4q3Sbntjy6ysFL5aQ; _cfuvid=7Kr9.OpOE3xOMKgFNycrVxwF3RIEUG.pXAjb7_zSC.w-1726835357756-0.0.1.1-604800000If-None-Match: W/"edf91c1320ba2916398ed791b63187bc"If-Modified-Since: Wed, 28 Aug 2024 20:01:26 UTC
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd01d41aac1d9f234e41ca_Managed%20EDR%203.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@finsweet/attributes-cmsnest@1/cmsnest.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a7a_Blog%20glitch%20right.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-interactives/public/v1/embed/combinedConfigs?portalId=3911692&currentUrl=https%3A%2F%2Fwww.huntress.com%2Fblog-categories%2Fresponse-to-incidents HTTP/1.1Host: cta-service-cms2.hubspot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=yDTqM.QV_yon5q0wCQwxmm_SMsU9tC.R.bzgeueScyM-1726835357-1.0.1.1-Jm09yUDqJRDaZUBlOBhE7GuqHlpUbXtHk3D1jryOgT2WG97SIcQQKTRs7P0Kps8yh7MI_4q3Sbntjy6ysFL5aQ; _cfuvid=7Kr9.OpOE3xOMKgFNycrVxwF3RIEUG.pXAjb7_zSC.w-1726835357756-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/65dcd9aad5690d38a312f5c4_Blog-SlashAndGrab-the-ConnectWise-ScreenConnect-vulnerabilities-explained-p-500.jpg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd01d4a30f479eabb0011a_M365%203.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644e7fbb21af831cdb00ec6_chat-bubble%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/66e88ae0334c01ef01d7b9c6_100m-arr-blog-thumbnail-2%20(1)-p-500.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@finsweet/attributes-animation@1/animation.esm.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3911692.js HTTP/1.1Host: js.hs-scripts.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-Modified-Since: Fri, 20 Sep 2024 12:27:35 GMT
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a93_Blog%20filter%20gradient.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f34cd010502d85a6afc0_calendar%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@finsweet/attributes-cmscore@1/cmscore.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/17.413337a8.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a55_Gated%20glitch%20banner%20mobile.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f36bcdd664ac55be1293_checklist%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a85_Filter%20Glitch%20Top%20Mobile.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /leadflows.js HTTP/1.1Host: js.hsleadflows.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"7d65c542c3a53442feef1a0f44071183"If-Modified-Since: Thu, 12 Sep 2024 08:49:54 UTC
Source: global traffic	HTTP traffic detected: GET /core/assets/js/41.b4fc4de2.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/19.6f85b843.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/14.e24a6190.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/20.8c21ea18.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /include/1726835400000/5d3cypit2iz8.js HTTP/1.1Host: js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "576cdc1c0941a520c47b54aef3b463f7"If-Modified-Since: Mon, 21 Aug 2023 14:57:31 GMT
Source: global traffic	HTTP traffic detected: GET /core/assets/js/27.3951aad8.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog-categories/response-to-incidents?301e1821_page=2 HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/slashandgrab-the-connectwise-screenconnect-vulnerability-explained-2 HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/slashandgrab-the-connectwise-screenconnect-vulnerability-explained HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/how-to-know-if-your-screenconnect-server-is-hacked HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835401583&i=gtm&dwt=143&ive=webkitHidden HTTP/1.1Host: q.quora.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a7e_Blog%20glitch%20listing%20right.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/65d8f499ba3251bdb3e67c42_Blog-SlashAndGrab-ScreenConnect-Post-Exploitation-in-the-wild-p-500.jpg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66cf90834916604f4370fac3_integrations-07.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/65d56cefb34458516918d259_Rapid%20Response%202-p-500.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66db4dad5c35dc85c909a6a0_Partner%20Enablement.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296939/65d91c17bbf42843c2ab615d_Blog-Think-your-ScreenConnect-server-is-hacked_v1%20(1).jpg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd3937b555ca8e0b628b51_TT%20Logo.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd3bf02edc81af0185ab74_Fireside%20Logo%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /655ddcc107aef728354e9c2a/655ddcc107aef728354e9cba_Secondary%20Text%20CTA%20Black.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd395ec38c5cf450eaaca9_Group%2041159.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d2969e1_Secondary%20Text%20CTA%20Black.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/658e2de87a397cda82fad047_Huntress_Logo_Wide_Teal%5B1%5D.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/11.639238ba.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/targeted-apt-activity-babyshark-is-out-for-blood HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/microsoft-office-remote-code-execution-follina-msdt-bug HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/threat-advisory-hackers-are-selling-access-to-msps HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/new-0-day-vulnerabilities-found-in-microsoft-exchange HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /core/assets/js/18.9c1bd1fb.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/threat-advisory-qakbot-activity-is-rising HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /core/assets/js/49.f7274268.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/css/4.07aa08a5.chunk.css HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/0.0b2ebd4a.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?j=1&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_email&tag=DwellTime&ts=1726835401583&i=gtm&dwt=143&ive=webkitHidden HTTP/1.1Host: q.quora.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd36c1df784bfdc36451b0_Managed%20EDR%203%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296ac3_Close%20Icon.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd36cef95e73f013d7f944_M365%203%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f42186bd038ff65c2901_managed-edr%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd36d42685c82309c6be63_HSAT%203%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66e8480cc91b5fc3539be36f_Managed%20EDR%202%20(1).png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f8c5a5060320c7f49b85_leadership%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29698f_Secondary%20Text%20CTA%20Black.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/40.31ef8dbf.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/29.31d09948.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f58dee0405731067e1bb_hsat.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/24.24e43c3b.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f8e69bff560c4991106c_bullhorn%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/incident-response-choose-your-own-adventure-exercise HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66b0e0941952090c965c0771_Managed%20SIEM%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/detection-guidance-for-connectwise-cwe-288-2 HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8 HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604 HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/rapid-response-trickboot HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers HTTP/1.1Host: www.huntress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836298000
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66b0e0ae56c636b679619a00_MDRforM365%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/8.5fdda827.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f6a6428feb6a848b9886_msp.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296ab1_Icon-HSAT-White.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd4618974812a59c9e95d9_Managed%20EDR%201%20(2).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/66be4ae62c6f0b71cf910808_awards_icon.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f952c393b09d64bbb728_caereers%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/657b2a3b1f11ca0d1f210bad_Icon-SAT-Content.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/660da63009a196dfeb26efb4_Testimonial_CascadeTechnologies_Small.jpg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd4300f95e73f013e09901_M365%201%20(1).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bc11cbdfd171e4de042009_Platform%20Nav%20Image.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd430a9ffbd1551fa49ccf_HSAT%201.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f6ed63c32a0963f64190_reseller.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/16.890a0911.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f85803df956c64c29612_success-stories%20(2).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/21.b8c41db9.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/js/17.413337a8.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/css/1.12ba17b6.chunk.css HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/assets/css/26.5208cc6b.chunk.css HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rc-widget-frame.js.driftt.com/core?d=1&embedId=5d3cypit2iz8&eId=5d3cypit2iz8&region=US&forceShow=false&skipCampaigns=false&sessionId=0044150e-5d5d-4959-818c-e94ff049406a&sessionStarted=1726835383.868&campaignRefreshToken=183ed74a-ac27-41fc-a1c9-3618e0225fed&pageLoadStartTime=1726835344654&mode=CHAT&driftEnableLog=false&loadStrategy=ON_INTERACTIVE&secureIframe=false&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fcracks-in-the-foundation-intrusions-of-foundation-accounting-software%3Futm_campaign%3DCYDERES%2520EMDR%2520Intelligence%2520Digest%26utm_medium%3Demail%26_hsenc%3Dp2ANqtz--fMDgREU9ml-hUt10atczAQ_smi1REpVwMy30bvENGq5guDPGPq7gfYUqjq9A4eUxZ__7AblzbXkpTvvpaVU7yfpb4iT8dJYCZbLNk_mnnTe6Yw_I%26_hsmi%3D325473246%26utm_content%3D325473246%26utm_source%3Dhs_emailAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/veeam-backup-replication-cve-2023-27532-response HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/everything-we-know-about-cve-2023-23397 HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/critical-vulnerabilities-in-papercut-print-management-software HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /blog/threat-advisory-xmrig-crypto-mining-by-way-of-teamviewer HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /core/assets/js/0.0b2ebd4a.chunk.js HTTP/1.1Host: rc-widget-frame.js.driftt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/moveit-transfer-critical-vulnerability-rapid-response HTTP/1.1Host: www.huntress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/blog-categories/response-to-incidentsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.token=4febcc48-11bd-4be6-a133-ce27cbd26c0c; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session=5321f4ee-4431-456c-9fc4-ca9e87feae6b; mutiny.user.session_number=1; mutiny.user.session_number=1; _sp_ses.1564=*; _rdt_uuid=1726835352266.817e47f3-3def-4930-9b06-a0005d41eba1; _gcl_au=1.1.173469610.1726835350.364559002.1726835352.1726835352; _ga_GCTMBVFESS=GS1.1.1726835353.1.0.1726835353.60.0.0; _ga=GA1.1.802109752.1726835353; __spdt=1917ea7c0c654d13971c7b5f61eb18d5; sa-u-source=hs_email; sa-u-date=2024-09-20T12:29:14.958Z; sa-user-id=s%253A0-44ef61b2-fe37-563b-497a-08aac775d996.HUZAD87nGmfB6ts9monpnGc74iU%252BnIDtZVp3vzenSYI; sa-user-id-v2=s%253ARO9hsv43VjtJegiqx3XZlggueyE.f1DEnV0kSRDqXApJa8DQm75QGQfLI69IqPby0eTbqqo; sa-user-id-v3=s%253AAQAKIPMD_qM83gEw_KpANQ1k_u5OM7M1EA1HSai3RTqI7aomEHwYBCCb1bW3BjABOgT87-jmQgRE1Zzk.eNrSOL7PeCR%252BOtibvooVqq7ObUEv5%252BSNuwF%252BSNTLTHw; _uetsid=f3f1cd40774b11ef8c236b760e7c7256; _uetvid=f3f2c300774b11efada401c2fdee9d80; _fbp=fb.1.1726835358379.798225651589239556; _gd_visitor=5a7b4e78-7250-46bb-810a-5b66e9984afa; _gd_session=1fda1c52-0ec5-4295-84aa-dc9bc5875e94; _hjSessionUser_2159185=eyJpZCI6IjU1ZWU1YTkxLWMyMTEtNWJjNS1iZDVlLTZlMTllYzViZjA5ZSIsImNyZWF0ZWQiOjE3MjY4MzUzNTg2MDMsImV4aXN0aW5nIjp0cnVlfQ==; _hjSession_2159185=eyJpZCI6IjY0MzhkOWQzLWZlMWUtNDE5My1hZjdhLTZkOWMzMGViZGNiOSIsImMiOjE3MjY4MzUzNTg2MDcsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=; _an_uid=0; sp=98c3a97b-daae-4277-8045-7e9e8d86d91c; _zitok=c59f3dabf15c2190f28e1726835373; drift_campaign_refresh=183ed74a-ac27-41fc-a1c9-3618e0225fed; _sp_id.1564=197e4f69-5e53-424b-920b-ed6bec43868e.1726835351.1.1726835396..20298ebe-c783-4268-9b74-e21b2005ebc5..c9b9f32c-669c-4802-bfaf-204ab8da95b9.1726835369856.4; _dd_s=rum=2&id=66aed457-8be4-4d29-91ac-c4ebdb0aa932&created=1726835350843&expire=1726836294849
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd42dcb44336a1f210c24c_Managed%20EDR%203%20(2).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f7e1e53239ee83da1446_soc%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6644f74703df956c64c182bd_business-it-teams%20(1).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd01d4c0f3634790afea77_Managed%20EDR%201.svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65bd42f4c995899f6082c903_M365%203%20(2).svg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/65edee5e9d94c555ff4fb329_Huntress-Default-Thumbnail-365x274.jpg HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a01_Blog%20Filter%20Glitch%20banner%20mobile.webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Found strings which match to known social media urls

Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr	String found in binary or memory: $('[data-share-facebook').attr('href', 'https://www.facebook.com/sharer/sharer.php?u=' + url); equals www.facebook.com (Facebook)
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr	String found in binary or memory: $('[data-share-linkedin').attr('href', 'https://www.linkedin.com/shareArticle?mini=true&url=' + url); equals www.linkedin.com (Linkedin)
Source: chromecache_614.2.dr	String found in binary or memory: "https://www.facebook.com/foundationsoft", equals www.facebook.com (Facebook)
Source: chromecache_614.2.dr	String found in binary or memory: "https://www.linkedin.com/company/foundation-software/", equals www.linkedin.com (Linkedin)
Source: chromecache_605.2.dr	String found in binary or memory: Have You Scanned Your BIOS Recently?</a></li><li><a href="https://www.youtube.com/watch?v=P3yMXspLzoY" target="_blank">2017 equals www.youtube.com (Youtube)
Source: chromecache_605.2.dr	String found in binary or memory: The UEFI Firmware Rootkits: Myths and Reality</a></li><li><a href="https://www.youtube.com/watch?v=dpG97TBR3Ys" target="_blank">2018 equals www.youtube.com (Youtube)
Source: chromecache_605.2.dr	String found in binary or memory: UEFI technology: say hello to the Windows 8 bootkit!</a></li><li><a href="https://www.youtube.com/watch?v=QDSlWa9xQuA" target="_blank">2015 equals www.youtube.com (Youtube)
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr	String found in binary or memory: Webinar</a></li><li><a href="https://www.huntress.com/neighborhood-watch-program/internal-license-request">Neighborhood Watch Program (free coverage for MSPs)</a></li><li><a href="https://www.youtube.com/watch?v=tUhu1c8ulLE" target="_blank">Atomics on Friday || ConnectWise Connections</a> equals www.youtube.com (Youtube)
Source: chromecache_428.2.dr	String found in binary or memory: is trivial and embarrassingly easy.</strong></p><p>Below is a video demonstration of our recreated proof-of-concept exploit, which performs the simple authentication bypass but takes it a step further to showcase remote code execution.</p><div class="w-embed w-iframe"><iframe width="700" height="395" src="https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe></div><div class="w-embed"><a name="our-analysis"></a></div><h2><strong>Our Analysis</strong></h2><p>When the Huntress team was made aware of the ConnectWise advisory, our team began to dig into what changes were made in the patch that could help explain what these vulnerabilities were.</p><p>We could simply look for the differences between code present in the new, patched version, and the previous, unpatched version. Creating a local testing environment for both of these states of the ScreenConnect software, we could easily see the delta that might clue us into the potential exploit.</p><p>We observed that these files differed: equals www.youtube.com (Youtube)
Source: chromecache_386.2.dr	String found in binary or memory: </p><p>Check out the below video to watch our interview with <a href="https://www.linkedin.com/company/mspmediatv/" target="_blank">MSP Media Network</a> equals www.linkedin.com (Linkedin)
Source: chromecache_967.2.dr	String found in binary or memory: </style></div></div></div></div></div><div class="social-share-icon-mobile"><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a73_Path%2073610.svg" loading="lazy" alt="Share icon"/></div></section><section class="blog-detail-content-section"><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp" loading="eager" alt="Glitch effect" class="landing-banner-shape-8 blog-detail-landing-banner-shape-8"/><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp" loading="lazy" alt="Glitch effect" class="landing-banner-shape-8 blog-detail-landing-banner-glitch-2"/><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp" loading="lazy" alt="Glitch effect" class="landing-banner-shape-8 blog-right-glitch"/><div class="w-layout-blockcontainer container-width-1143 w-container"><div class="blog-detail-content-wrapper"><div class="blog-main-section"><div class="post-wrapper"><div class="blog-post-summary-main"><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a71_Blog%20banner%20Thumb%20Glitch%20Left.webp" loading="eager" alt="Glitch banner" class="blog-post-summary-main-glitch-top"/><div fs-richtext-sanitize="true" fs-richtext-element="rich-text" class="blog-post-summary first w-richtext"><p>On Thursday, September 28, 2023, software vendor <a href="https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023" target="_blank">Progress released a security advisory</a> for numerous vulnerabilities affecting the WS_FTP Server Ad Hoc Transfer Module within their WS_FTP software.</p><p>These vulnerabilities were disclosed as:</p><ul role="list"><li><a href="https://www.cve.org/CVERecord?id=CVE-2023-40044" target="_blank">CVE-2023-40044</a> (CVSS: 10)</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2023-42657" target="_blank">CVE-2023-42657</a> (CVSS 9.9)</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2023-40045" target="_blank">CVE-2023-40045</a> (CVSS 8.3)</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2023-40046" target="_blank">CVE-2023-40046</a> (CVSS 8.2)</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2023-40048" target="_blank">CVE-2023-40048</a> (CVSS 6.8)</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2022-27665" target="_blank">CVE-2022-27665</a> (CVSS 6.1)</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2023-40049" target="_blank">CVE-2023-40049</a> (CVSS 5.3)</li></ul><p>Most notable amongst these were CVE-2023-40044 and CVE-2023-42657, both critical severity issues. Throughout this past weekend, the cybersecurity industry has been chasing CVE-2023-40044 specifically.</p><h2>What We Know So Far</h2><p><a href="https://community.progress.com/s/article/
Source: chromecache_834.2.dr, chromecache_886.2.dr	String found in binary or memory: </style></div></div></div></div></div><div class="social-share-icon-mobile"><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a73_Path%2073610.svg" loading="lazy" alt="Share icon"/></div></section><section class="blog-detail-content-section"><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp" loading="eager" alt="Glitch effect" class="landing-banner-shape-8 blog-detail-landing-banner-shape-8"/><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp" loading="lazy" alt="Glitch effect" class="landing-banner-shape-8 blog-detail-landing-banner-glitch-2"/><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp" loading="lazy" alt="Glitch effect" class="landing-banner-shape-8 blog-right-glitch"/><div class="w-layout-blockcontainer container-width-1143 w-container"><div class="blog-detail-content-wrapper"><div class="blog-main-section"><div class="post-wrapper"><div class="blog-post-summary-main"><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a71_Blog%20banner%20Thumb%20Glitch%20Left.webp" loading="eager" alt="Glitch banner" class="blog-post-summary-main-glitch-top"/><div fs-richtext-sanitize="true" fs-richtext-element="rich-text" class="blog-post-summary first w-richtext"><p>Our team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers that could lead to Remote Code Execution (RCE) for an authenticated user.</p><figure style="max-width:1382pxpx" class="w-richtext-align-fullwidth w-richtext-figure-type-image"><div><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296ed3_image1-4.png" alt="ThreatOps team Slack screenshot" loading="lazy"/></div></figure><p>Our ThreatOps team discovered <a href="https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html" target="_blank">this blog</a>, and the team began to research and see if anyone else in the community had flagged it. We found <a href="https://twitter.com/GossiTheDog/status/1575580072961982464" target="_blank">this tweet</a> from Security Researcher Kevin Beaumont, where he notes that equals www.twitter.com (Twitter)
Source: chromecache_834.2.dr, chromecache_886.2.dr	String found in binary or memory: <strong><em>authenticated</em></strong> adversary. Currently, no official patch has been released by Microsoft yet.</p><p><a href="https://twitter.com/GossiTheDog/status/1575813395835547651" target="_blank">Kevin Beaumount has pointed out that there is still a risk to Exchange Online users</a>, as a significant number may be running a hybrid server that migrated to Exchange Online and are still vulnerable to this post-authentication threat. Shodan reports over 1,200 potentially vulnerable endpoints with this attack surface.</p><figure style="max-width:1874pxpx" class="w-richtext-align-fullwidth w-richtext-figure-type-image"><div><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296ed2_image-png-Sep-30-2022-02-24-23-31-PM.png" alt="Shodan reports over 1,200 potentially vulnerable endpoints" loading="lazy"/></div></figure><p>The freely available Microsoft Defender antivirus will detect the current publicly known post-exploitation attempts as <a href="https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:ASP/Webshell.Y" target="_blank"><strong>Backdoor:ASP/Webshell.Y</strong></a> and <a href="https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/RewriteHttp.A" target="_blank"><strong>Backdoor:Win32/RewriteHttp.A</strong></a>.</p><h2><strong>What Huntress Partners Need to Know</strong></h2><p>We equals www.twitter.com (Twitter)
Source: chromecache_749.2.dr, chromecache_810.2.dr, chromecache_443.2.dr, chromecache_570.2.dr, chromecache_398.2.dr	String found in binary or memory: Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Uj:function(){e=zb()},ld:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),vC=["www.youtube.com","www.youtube-nocookie.com"],wC,xC=!1; equals www.youtube.com (Youtube)
Source: chromecache_570.2.dr	String found in binary or memory: N.getElementsByTagName("iframe"),la=R.length,na=0;na<la;na++)if(!u&&c(R[na],H.Ce)){WI("https://www.youtube.com/iframe_api");u=!0;break}})}}else E(v.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,u=!1;Y.__ytl=n;Y.__ytl.o="ytl";Y.__ytl.isVendorTemplate=!0;Y.__ytl.priorityOverride=0;Y.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_443.2.dr, chromecache_398.2.dr, chromecache_763.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=dA(a,c,e);M(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return M(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},gA=function(){var a=[],b=function(c){return pb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_406.2.dr	String found in binary or memory: check out </strong><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190" target="_blank"><strong>Microsoft&#x27;s update</strong></a><strong> for the full list.</strong></p><p>Below, the code fails to execute on Windows 10:</p><figure class="w-richtext-align-center w-richtext-figure-type-image"><div><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f36_image%2520(7)-1.png" alt="image (7)-1" loading="lazy"/></div></figure><p>In the below image, the raw command fails on Windows 10:<br/></p><figure class="w-richtext-align-center w-richtext-figure-type-image"><div><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f20_image%2520(9).png" alt="image (9)" loading="lazy"/></div></figure><p><strong>UPDATE 11:16pm ET May 30, 2022:</strong></p><p>Microsoft has now revealed the CVE identifier for this vulnerability is <strong>CVE-2022-30190</strong>, including a Security Update and article with guidance... but no patch looks to be available as of yet.</p><ul role="list"><li><a href="https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/">https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/</a></li><li><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190">https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190</a></li></ul><h3>Jump Links</h3><p><a href="#">Understanding the Exploit</a></p><p><a href="#">Detection Efforts</a></p><p><a href="#">Mitigation Efforts</a></p><p><a href="#">The Non-Technical Version of What&#x27;s Happening</a></p><p><a href="#">Further Reading</a></p><p>Huntress is keeping a close eye on the developing threat of a zero-click remote code execution technique used through MSDT (Microsoft Diagnostics Tool) and Microsoft Office utilities, namely Microsoft Word. Throughout the next coming days, we expect exploitation attempts in the wild through email-based delivery.</p><p>In this article, we will discuss recreating the attack vector, detection efforts and potential mitigation steps.</p><p><strong>If you are seeking guidance on how to keep your users safe rather than an in-depth explanation of the vulnerability, the short answer is to let them know that there is a newly discovered vulnerability in MS Word (and likely other MS Office apps) that could install malware so they should be especially vigilant about opening any attachments. They should also be made aware that this exploit can be triggered with a hover-preview of a downloaded file that does not require any clicks (post download). There are additional suggestions for mitigation actions at the bottom of this post.</strong></p><h2>Understanding the Exploit</h2><p>The Huntress team obtained the sample <a href="https://twitter.com/nao_sec/status/1530196847679401984" target="_blank">first shared by
Source: chromecache_443.2.dr, chromecache_398.2.dr	String found in binary or memory: if(!(e||f||g||k.length||m.length))return;var p={Vg:e,Tg:f,Ug:g,Dh:k,Eh:m,Ce:n,Ab:b},q=z.YT;if(q)return q.ready&&q.ready(d),b;var r=z.onYouTubeIframeAPIReady;z.onYouTubeIframeAPIReady=function(){r&&r();d()};E(function(){for(var t=D.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(GC(w,"iframe_api")||GC(w,"player_api"))return b}for(var x=D.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!xC&&EC(x[A],p.Ce))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_386.2.dr	String found in binary or memory: or keep reading to learn more.</p><figure style="padding-bottom:56.25%" class="w-richtext-align-fullwidth w-richtext-figure-type-video"><div><iframe src="https://www.youtube.com/embed/1E78M_EUF0Y?feature=oembed" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div></figure><h3><strong>1. The threat primarily comes in via email.</strong> equals www.youtube.com (Youtube)
Source: chromecache_950.2.dr, chromecache_487.2.dr, chromecache_393.2.dr, chromecache_385.2.dr, chromecache_763.2.dr, chromecache_555.2.dr	String found in binary or memory: return b}tC.H="internal.enableAutoEventOnTimer";var gc=ja(["data-gtm-yt-inspected-"]),vC=["www.youtube.com","www.youtube-nocookie.com"],wC,xC=!1; equals www.youtube.com (Youtube)
Source: chromecache_956.2.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_956.2.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_956.2.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_749.2.dr, chromecache_810.2.dr, chromecache_443.2.dr, chromecache_570.2.dr, chromecache_398.2.dr, chromecache_763.2.dr	String found in binary or memory: var IB=function(a,b,c,d,e){var f=Bz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Bz("fsl","nv.ids",[]):Bz("fsl","ids",[]);if(!g.length)return!0;var k=Gz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);M(121);if(m==="https://www.facebook.com/tr/")return M(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!oy(k,qy(b, equals www.facebook.com (Facebook)
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: ve <a href="https://www.youtube.com/watch?v=WRnXzHfpMWs&amp;t=3037s" target="_blank">given in a dozen or so presentations</a> on this topic, the first phone calls we made were to our legal and insurance teams. equals www.youtube.com (Youtube)

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: www.cyderes.com
Source: global traffic	DNS traffic detected: DNS query: www.huntress.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.prod.website-files.com
Source: global traffic	DNS traffic detected: DNS query: client-registry.mutinycdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: gist.github.com
Source: global traffic	DNS traffic detected: DNS query: d3e54v103j8qbb.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: tools.refokus.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: www.datadoghq-browser-agent.com
Source: global traffic	DNS traffic detected: DNS query: js.driftt.com
Source: global traffic	DNS traffic detected: DNS query: github.githubassets.com
Source: global traffic	DNS traffic detected: DNS query: static.huntresscdn.com
Source: global traffic	DNS traffic detected: DNS query: js.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: js.hsleadflows.net
Source: global traffic	DNS traffic detected: DNS query: js.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: api-v2.mutinyhq.io
Source: global traffic	DNS traffic detected: DNS query: js.hsadspixel.net
Source: global traffic	DNS traffic detected: DNS query: js.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: browser-intake-datadoghq.com
Source: global traffic	DNS traffic detected: DNS query: www.redditstatic.com
Source: global traffic	DNS traffic detected: DNS query: a.quora.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: j.6sc.co
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: cdn.neverbounce.com
Source: global traffic	DNS traffic detected: DNS query: cta-service-cms2.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: forms.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: trk.techtarget.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: tags.srv.stackadapt.com
Source: global traffic	DNS traffic detected: DNS query: pixel.byspotify.com
Source: global traffic	DNS traffic detected: DNS query: tracking.g2crowd.com
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: pixel-config.reddit.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: q.quora.com
Source: global traffic	DNS traffic detected: DNS query: alb.reddit.com
Source: global traffic	DNS traffic detected: DNS query: forms.hsforms.com
Source: global traffic	DNS traffic detected: DNS query: perf-na1.hsforms.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: pixels.spotify.com
Source: global traffic	DNS traffic detected: DNS query: ibc-flow.techtarget.com
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: api.neverbounce.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: c.6sc.co
Source: global traffic	DNS traffic detected: DNS query: ipv6.6sc.co
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: b.6sc.co
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: forms.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: webhooks.fivetran.com
Source: global traffic	DNS traffic detected: DNS query: t.huntress.com
Source: global traffic	DNS traffic detected: DNS query: js.zi-scripts.com
Source: global traffic	DNS traffic detected: DNS query: track.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: ws.zoominfo.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.foundationsoft.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: hello.foundationsoft.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: cdn.schemaapp.com
Source: global traffic	DNS traffic detected: DNS query: data.schemaapp.com
Source: global traffic	DNS traffic detected: DNS query: info.foundationsoft.com
Source: global traffic	DNS traffic detected: DNS query: secure.main5poem.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ws.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: content.hotjar.io
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net
Source: global traffic	DNS traffic detected: DNS query: rc-widget-frame.js.driftt.com
Source: global traffic	DNS traffic detected: DNS query: customer.api.drift.com
Source: global traffic	DNS traffic detected: DNS query: conversation.api.drift.com
Source: global traffic	DNS traffic detected: DNS query: metrics.api.drift.com
Source: global traffic	DNS traffic detected: DNS query: targeting.api.drift.com
Source: global traffic	DNS traffic detected: DNS query: pi.pardot.com
Source: global traffic	DNS traffic detected: DNS query: bootstrap.api.drift.com
Source: global traffic	DNS traffic detected: DNS query: 5092804-4.chat.api.drift.com
Source: global traffic	DNS traffic detected: DNS query: api.hubapi.com

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /v2/b HTTP/1.1Host: api-v2.mutinyhq.ioConnection: keep-aliveContent-Length: 261sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://www.huntress.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.huntress.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Fri, 20 Sep 2024 12:29:22 GMTserver: envoyContent-Length: 0strict-transport-security: max-age=31536000x-content-type-options: nosniffVia: HTTP/2 edgeproxy, 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Fri, 20 Sep 2024 12:30:15 GMTserver: envoyContent-Length: 0strict-transport-security: max-age=31536000x-content-type-options: nosniffVia: HTTP/2 edgeproxy, 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

URLs found in memory or binary data

Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: http://103.163.187.12:8080/cz3eKnhcaD0Fik7Eexo66A
Source: chromecache_608.2.dr	String found in binary or memory: http://172.245.16
Source: chromecache_608.2.dr	String found in binary or memory: http://4.216.93
Source: chromecache_608.2.dr	String found in binary or memory: http://45.32.120
Source: chromecache_606.2.dr, chromecache_526.2.dr	String found in binary or memory: http://bit.ly/sp-js)
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: http://cyberdrain.com/
Source: chromecache_600.2.dr, chromecache_940.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_912.2.dr, chromecache_960.2.dr	String found in binary or memory: http://opensource.org/licenses/BSD-2-Clause
Source: chromecache_912.2.dr, chromecache_960.2.dr	String found in binary or memory: http://opensource.org/licenses/GPL-2.0
Source: chromecache_605.2.dr	String found in binary or memory: http://phrack.org/issues/66/7.html
Source: chromecache_605.2.dr	String found in binary or memory: http://rweverything.com/
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: http://schema.org
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000077359549
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735954e
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000077359558
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735955e
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000077359562
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000077359564
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000077359577
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735957a
Source: chromecache_442.2.dr, chromecache_683.2.dr	String found in binary or memory: http://underscorejs.org
Source: chromecache_629.2.dr, chromecache_429.2.dr, chromecache_780.2.dr	String found in binary or memory: http://www.hubspot.com
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: http://www.reddit.com/submit?url=
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://1.1.1.1/
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://1.1.1.1/pt-BR/dns/
Source: chromecache_570.2.dr	String found in binary or memory: https://a.quora.com/qevents.js
Source: chromecache_608.2.dr	String found in binary or memory: https://activemq.apache.org/activemq-command-line-tools-reference.html
Source: chromecache_608.2.dr	String found in binary or memory: https://activemq.apache.org/components/classic/download/
Source: chromecache_570.2.dr, chromecache_398.2.dr, chromecache_763.2.dr, chromecache_555.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_654.2.dr, chromecache_639.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_614.2.dr	String found in binary or memory: https://api.w.org/
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://assets-global.website-files.com/655d92689c415e9fefcf2368/655efb41f4bb20e00c9cfe91_Group%2039
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://assets-global.website-files.com/655d92689c415e9fefcf2368/656441d92b1162f7be36d189_FAQ%20arro
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://assets-global.website-files.com/655d92689c415e9fefcf2368/656586dc3bab343494e5e662_Group%2011
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://assets-global.website-files.com/655d92689c415e9fefcf2368/656586dcbfdb733f67438298_Group%2049
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://aws.amazon.com/blogs/security/forensic-investigation-environment-strategies-in-the-aws-cloud
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://benjamin-altpeter.de/shell-openexternal-dangers/
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/
Source: chromecache_605.2.dr	String found in binary or memory: https://blog.huntresslabs.com/assisted-remediation-in-action-a1e564e759a6
Source: chromecache_605.2.dr	String found in binary or memory: https://blog.huntresslabs.com/huntress-service-ransomware-canaries-2f7f586b8f1e
Source: chromecache_605.2.dr	String found in binary or memory: https://blog.huntresslabs.com/tried-and-true-hacker-technique-dos-obfuscation-400b57cd7dd
Source: chromecache_749.2.dr, chromecache_950.2.dr, chromecache_487.2.dr, chromecache_393.2.dr, chromecache_810.2.dr, chromecache_443.2.dr, chromecache_385.2.dr, chromecache_570.2.dr, chromecache_398.2.dr, chromecache_763.2.dr, chromecache_555.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_397.2.dr, chromecache_386.2.dr, chromecache_624.2.dr, chromecache_407.2.dr, chromecache_617.2.dr, chromecache_834.2.dr, chromecache_819.2.dr, chromecache_754.2.dr, chromecache_935.2.dr, chromecache_967.2.dr, chromecache_406.2.dr, chromecache_886.2.dr, chromecache_894.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/medium-zoom
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://cdn.neverbounce.com/widget/dist/NeverBounce.js
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/655d92689c415e9fefcf2368/655d92689c415e9fefcf2400_Hero-grapic-rig
Source: chromecache_1004.2.dr, chromecache_397.2.dr, chromecache_386.2.dr, chromecache_624.2.dr, chromecache_617.2.dr, chromecache_834.2.dr, chromecache_754.2.dr, chromecache_935.2.dr, chromecache_967.2.dr, chromecache_406.2.dr, chromecache_886.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/655d92689c415e9fefcf2368/656079b2a6c055ce7d368e61_Secondary%20Tex
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296993_Image%20180.svg
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a1c_CTA-Home.webp
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a71_Blog%20banner%2
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a73_Path%2073610.sv
Source: chromecache_1004.2.dr, chromecache_397.2.dr, chromecache_386.2.dr, chromecache_624.2.dr, chromecache_617.2.dr, chromecache_834.2.dr, chromecache_754.2.dr, chromecache_935.2.dr, chromecache_967.2.dr, chromecache_406.2.dr, chromecache_886.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%2
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a89_Landing%20WWW%2
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a91_Gated%20glitch%
Source: chromecache_1004.2.dr, chromecache_397.2.dr, chromecache_386.2.dr, chromecache_624.2.dr, chromecache_407.2.dr, chromecache_617.2.dr, chromecache_834.2.dr, chromecache_819.2.dr, chromecache_754.2.dr, chromecache_935.2.dr, chromecache_967.2.dr, chromecache_406.2.dr, chromecache_886.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296ad7_Secondary%20Tex
Source: chromecache_1004.2.dr, chromecache_397.2.dr, chromecache_386.2.dr, chromecache_624.2.dr, chromecache_617.2.dr, chromecache_834.2.dr, chromecache_754.2.dr, chromecache_935.2.dr, chromecache_967.2.dr, chromecache_406.2.dr, chromecache_886.2.dr, chromecache_894.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/65f75020c99f25928927347f_banner-blue-hal
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/66030a0ceace49bce51c36de_favicon-32x32.p
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6603101ade570b07f0fb6625_android-chrome-
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/66267cd1946bdc414612a045_banner-blue-hal
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.css
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/js/huntress-new.28c3b280d.js
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296c39_rzZJNq3S5iKvDjR
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296c4b_HiOGTRQ7ADbC3jH
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296c6a_3HUtyDCAietS-TR
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296c82_GYP8fynEdzoA7Db
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296c83_y2RriP0M-ZywnR3
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296c84_kYl9Coq_171Ftie
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296c86_ejrLkwloT4wUwGN
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296cac_Rapid%2520Respo
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296cb0_MBJgjmYbZpacDYc
Source: chromecache_415.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296d01_rctGf5wf78mKYDO
Source: chromecache_507.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296d14_MOVEit%2520reca
Source: chromecache_480.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296eed_BlogHeader-Resp
Source: chromecache_828.2.dr, chromecache_480.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296eff_image2-2.png
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f1d_BlogHeader-Rapi
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f28_AGk0z-N6EKRpqyo
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f2c_AGk0z-MJoFmNdQJ
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f2d_AGk0z-MOs9U3ALZ
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f2f_AGk0z-NzyeIhzJV
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f3b_AGk0z-Mc4d4pkjO
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f3c_AGk0z-MZ0yjTaz7
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296f3e_AGk0z-P6kTLiPey
Source: chromecache_1000.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296fef_BlogHeader-Resp
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296ff0_QA2.png
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296ff1_QA1.png
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296ff2_QA%2520Blog%252
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d296ff3_Copy%2520of%252
Source: chromecache_892.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2970ed_BlogHeader-Resp
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2970f5_image%2520(1)-3
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2970f6_image%2520(5)-1
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2970f8_image%2520(4)-1
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2970f9_image-Mar-06-20
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2970fa_vgzKkKUHsFBZT0r
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2970fb_image%2520(2)-2
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2970fc_image%2520(3).p
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2970fe_kBCcmTrHJmqRbDl
Source: chromecache_397.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d297120_Qakbot-Malware-
Source: chromecache_415.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d29712a_Response-to-Inc
Source: chromecache_605.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d29715c_Annie%20Ballew.
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2971ea_Screenshot%2520
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6579dd0b5f9a54376d2971eb_MFtcWTzYWPh19QK
Source: chromecache_387.2.dr, chromecache_541.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/657cbded6bf7002bcf82db6d_Huntress%20Free
Source: chromecache_608.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/658104e3dfbc6796e2532cc0_Critical%20Vuln
Source: chromecache_605.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65810894c628f8f736f54859_Rapid%20Respons
Source: chromecache_387.2.dr, chromecache_541.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/658cbd1d4205f28754cb22bf_secure-endpoint
Source: chromecache_880.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65d4f7eaefe0eedab65efac0_rI0fxWGKQYEOCPv
Source: chromecache_428.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65d5587816961aa1bccf46e7_bCQT10Rn49nJ0hf
Source: chromecache_428.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65d558784370931755195cac_VOF-6GVi8aXEkUn
Source: chromecache_428.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65d55878e0bce79d5469d328_3UiSOzyngYMkZ2T
Source: chromecache_428.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65d55879cb2af12170f04f97_Es0JkQJKuG-5Dji
Source: chromecache_428.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65d56cefb34458516918d259_Rapid%20Respons
Source: chromecache_880.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65d64d16df7c4f9ca83fc13a_ConnectWise%20C
Source: chromecache_485.2.dr, chromecache_754.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65d91c17bbf42843c2ab615d_Blog-Think-your
Source: chromecache_485.2.dr, chromecache_754.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65d91f61d8c9fc9c27d1c706_code%20image.pn
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65db9ab37d65c02ae75c55cb_ep73oXQNB2PXELJ
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65db9ab37eb940ee3761eab3_b-Do8ggd_gx_2aN
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65db9ab38742134620e8713f_XLXWdQujVraidkH
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65db9ab3a8fcf334ff2fb03a_KsupFXO_dTKN-Vm
Source: chromecache_440.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65dcd9aad5690d38a312f5c4_Blog-SlashAndGr
Source: chromecache_387.2.dr, chromecache_541.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65dd200bc8571c720dc43767_Huntress-SlashA
Source: chromecache_736.2.dr, chromecache_632.2.dr, chromecache_892.2.dr, chromecache_397.2.dr, chromecache_834.2.dr, chromecache_406.2.dr, chromecache_886.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/66144ca5e4117fba97085be3_john-hammond-he
Source: chromecache_507.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/66144fe5e4117fba970b7790_Joe%20Slowik.we
Source: chromecache_828.2.dr, chromecache_480.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6616df84b71288f323ee418a_Harlan%20Carvey
Source: chromecache_440.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/66ae91e65a631306c4b10215_65dd200bc8571c7
Source: chromecache_452.2.dr, chromecache_894.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/66e88ae0334c01ef01d7b9c6_100m-arr-blog-t
Source: chromecache_837.2.dr, chromecache_452.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/66e88ca4db87912b833221bc_AD_4nXfOwDpF0yB
Source: chromecache_837.2.dr, chromecache_452.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/66e88d0290d2adece032129c_AD_4nXdt94nQfK9
Source: chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_387.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_624.2.dr, chromecache_617.2.dr, chromecache_754.2.dr, chromecache_935.2.dr, chromecache_967.2.dr	String found in binary or memory: https://cdn.prod.website-files.com/plugins/Basic/assets/placeholder.60f9b1840c.svg
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://censys.com/cve-2023-40044/
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://circleci.com/docs/2.0/aws-prereq/#private-subnet-requirements
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://client-registry.mutinycdn.com/personalize/client/c9c27905c1e445d6.js
Source: chromecache_614.2.dr	String found in binary or memory: https://clients.foundationsoft.com/pdfs/requirements/mobile_requirements.pdf
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_507.2.dr	String found in binary or memory: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
Source: chromecache_964.2.dr, chromecache_630.2.dr, chromecache_956.2.dr	String found in binary or memory: https://connect.facebook.net/
Source: chromecache_749.2.dr, chromecache_810.2.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: chromecache_964.2.dr, chromecache_630.2.dr, chromecache_956.2.dr	String found in binary or memory: https://connect.facebook.net/log/fbevents_telemetry/
Source: chromecache_633.2.dr	String found in binary or memory: https://conversation.api.drift.com
Source: chromecache_570.2.dr	String found in binary or memory: https://ct.capterra.com/capterra_tracker.gif
Source: chromecache_633.2.dr	String found in binary or memory: https://customer.api.drift.com
Source: chromecache_614.2.dr	String found in binary or memory: https://cvent.me/8P7qoV
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://cyberdrain.com/automating-with-powershell-enable-m365-activity-based-time-out-office-code-ex
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=6579dd0b5f9a54376d29691
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instances-and-amis.html
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://docs.datadoghq.com/getting_started/site/
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://explore.zoom.us
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVI
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVI
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVI
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVI
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVI
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVI
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVI
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5OaVI
Source: chromecache_513.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVI
Source: chromecache_614.2.dr	String found in binary or memory: https://foundationlive.wpenginepowered.com/wp-content/uploads/2021/06/fsl-logo.png
Source: chromecache_428.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/16b19436045484ccf2aad539f31271ea.js
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/349de807b96db1d0292d3d20e4ff6453
Source: chromecache_428.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/4bffa96fe54aa6c1cb35509e9d7ad0b1.js
Source: chromecache_428.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/65cee24bc949be53e6744a84e78b7239.js
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/6930c8e5d7c233ddb86f5631ff5ba7a6
Source: chromecache_428.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/a1bf6c78769ea253e43326ca23d3c2b8.js
Source: chromecache_428.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/ca3824104f47498768a5ccee49af95b3.js
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/d4dba6b272bcae62d8946a0eb9af9220
Source: chromecache_428.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/e07caff1b2d4526b7fabbecd63784258.js
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/e3053768a06f1ba115c1efbd3a71103d
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/f95bfab2b28d92b8491609541a84bc40.js
Source: chromecache_428.2.dr	String found in binary or memory: https://gist.github.com/JohnHammond/fac42eefb1bb137d1d8b5707d67d6964.js
Source: chromecache_837.2.dr, chromecache_452.2.dr	String found in binary or memory: https://gist.github.com/gleeda/7d3165787015692aec4d2aad740ab8fe.js
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://gist.github.com/matthewB-huntress/14ab9d309f25a05fc9305a8e7f351089
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr	String found in binary or memory: https://github.com/SigmaHQ/sigma/pull/4732
Source: chromecache_442.2.dr, chromecache_683.2.dr	String found in binary or memory: https://github.com/bkwld/tram
Source: chromecache_600.2.dr, chromecache_940.2.dr	String found in binary or memory: https://github.com/cssinjs/jss
Source: chromecache_607.2.dr, chromecache_742.2.dr	String found in binary or memory: https://github.com/francoischalifour/medium-zoom
Source: chromecache_392.2.dr	String found in binary or memory: https://github.com/googlefonts/dm-fonts)
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://github.com/huntresslabs/everyone-oops
Source: chromecache_608.2.dr	String found in binary or memory: https://github.com/huntresslabs/threat-intel/blob/main/2023/2023-11/suspicious_child_process_from_ac
Source: chromecache_892.2.dr	String found in binary or memory: https://github.com/microsoft/CSS-Exchange/blob/main/Security/Test-ProxyLogon.ps1
Source: chromecache_892.2.dr	String found in binary or memory: https://github.com/microsoft/CSS-Exchange/blob/main/Security/http-vuln-cve2021-26855.nse
Source: chromecache_608.2.dr	String found in binary or memory: https://github.com/rapid7/metasploit-framework/pull/18501
Source: chromecache_556.2.dr	String found in binary or memory: https://github.githubassets.com/assets/gist-embed-38aeddf8d15a.css
Source: chromecache_614.2.dr	String found in binary or memory: https://go.foundationsoft.com/estimating?&utm_source=software&utm_medium=ad&utm_campaign
Source: chromecache_570.2.dr, chromecache_763.2.dr	String found in binary or memory: https://google.com
Source: chromecache_570.2.dr, chromecache_763.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_614.2.dr	String found in binary or memory: https://hello.foundationsoft.com/l/970183/2022-10-06/2c3zl
Source: chromecache_614.2.dr	String found in binary or memory: https://hello.foundationsoft.com/l/970183/2022-10-11/2cxrl
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://hubspotonwebflow.com/api/forms/c32ae9e7-4a4b-4436-a6e4-0de41bd8df62
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://huntress.io/
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://ibc-flow.techtarget.com/a/gif.gif
Source: chromecache_588.2.dr, chromecache_871.2.dr	String found in binary or memory: https://j.6sc.co/6si.min.js
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://j.6sc.co/j/8769192b-20ba-4df2-8d62-2740a805c3e8.js
Source: chromecache_629.2.dr	String found in binary or memory: https://js-na1.hs-scripts.com/3911692.js
Source: chromecache_633.2.dr	String found in binary or memory: https://js.driftt.com
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://js.driftt.com/include/
Source: chromecache_917.2.dr, chromecache_825.2.dr	String found in binary or memory: https://js.hs-analytics.net/analytics/1726835100000/3911692.js
Source: chromecache_917.2.dr, chromecache_825.2.dr	String found in binary or memory: https://js.hs-banner.com/3911692.js
Source: chromecache_429.2.dr, chromecache_780.2.dr	String found in binary or memory: https://js.hs-banner.com/cookie-banner-public/v1
Source: chromecache_917.2.dr, chromecache_825.2.dr	String found in binary or memory: https://js.hsadspixel.net/fb.js
Source: chromecache_917.2.dr, chromecache_825.2.dr	String found in binary or memory: https://js.hscollectedforms.net/collectedforms.js
Source: chromecache_917.2.dr, chromecache_825.2.dr	String found in binary or memory: https://js.hsleadflows.net/leadflows.js
Source: chromecache_917.2.dr, chromecache_825.2.dr	String found in binary or memory: https://js.hubspot.com/web-interactives-embed.js
Source: chromecache_614.2.dr	String found in binary or memory: https://mccormicksys.com/
Source: chromecache_633.2.dr	String found in binary or memory: https://metrics.api.drift.com
Source: chromecache_605.2.dr	String found in binary or memory: https://news.saferbytes.it/analisi/2012/09/uefi-technology-say-hello-to-the-windows-8-bootkit/
Source: chromecache_507.2.dr	String found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2023-34362
Source: chromecache_415.2.dr	String found in binary or memory: https://nvd.nist.gov/vuln/detail/CVE-2023-39143
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: chromecache_570.2.dr, chromecache_398.2.dr, chromecache_763.2.dr, chromecache_555.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_749.2.dr, chromecache_950.2.dr, chromecache_487.2.dr, chromecache_393.2.dr, chromecache_810.2.dr, chromecache_443.2.dr, chromecache_385.2.dr, chromecache_570.2.dr, chromecache_398.2.dr, chromecache_763.2.dr, chromecache_555.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_828.2.dr, chromecache_480.2.dr, chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://platform.twitter.com/widgets.js
Source: chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_614.2.dr	String found in binary or memory: https://px.ads.linkedin.com/collect/?pid=4456305&fmt=gif
Source: chromecache_810.2.dr	String found in binary or memory: https://px.ads.linkedin.com/collect?
Source: chromecache_570.2.dr	String found in binary or memory: https://q.quora.com/_/ad/
Source: chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_614.2.dr, chromecache_407.2.dr, chromecache_819.2.dr	String found in binary or memory: https://schema.org
Source: chromecache_485.2.dr, chromecache_754.2.dr	String found in binary or memory: https://screenconnect.connectwise.com/download
Source: chromecache_485.2.dr, chromecache_754.2.dr	String found in binary or memory: https://screenconnect.connectwise.com/download"
Source: chromecache_392.2.dr	String found in binary or memory: https://scripts.sil.org/OFLThis
Source: chromecache_392.2.dr	String found in binary or memory: https://scripts.sil.org/OFLhttps://www.indiantypefoundry.comhttps://www.colophon-foundry.orgColophon
Source: chromecache_990.2.dr, chromecache_753.2.dr	String found in binary or memory: https://secure.main5poem.com/Track/Capture.aspx?retType=js&trk_jshv=1&trk_uid=&trk_user=217250&trk_s
Source: chromecache_749.2.dr, chromecache_810.2.dr, chromecache_570.2.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: chromecache_614.2.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js;
Source: chromecache_749.2.dr, chromecache_810.2.dr	String found in binary or memory: https://static.ads-twitter.com/uwt.js
Source: chromecache_749.2.dr, chromecache_810.2.dr	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://static.huntresscdn.com/3_24_2_kzhk9kjvjzpzdnk61lg3.js
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://static.huntresscdn.com/schemas/com.huntress/mutiny/jsonschema/1-0-5.json
Source: chromecache_950.2.dr, chromecache_487.2.dr, chromecache_443.2.dr, chromecache_385.2.dr, chromecache_398.2.dr, chromecache_555.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_654.2.dr, chromecache_639.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://support.cloudflare.com/hc/en-us
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://support.cloudflare.com/hc/en-us/articles/200171906-Error-522
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://support.cloudflare.com/hc/en-us/articles/200171916-Error-521
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://support.cloudflare.com/hc/en-us/articles/200171936-Error-520
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://support.cloudflare.com/hc/en-us/articles/217720788-Why-doesn-t-my-site-display-correctly-whe
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://support.cloudflare.com/hc/en-us/requests/new
Source: chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://support.huntress.io/hc/en-us
Source: chromecache_485.2.dr, chromecache_754.2.dr	String found in binary or memory: https://support.huntress.io/hc/en-us/articles/26563195577363-2024-Feb-ConnectWise-ScreenConnect-Vuln
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://t.co/CoGFp4Uf8A
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://t.co/W7MdGNXvLH
Source: chromecache_828.2.dr, chromecache_480.2.dr	String found in binary or memory: https://t.co/ahu3SQqbvG
Source: chromecache_654.2.dr, chromecache_639.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_633.2.dr	String found in binary or memory: https://targeting.api.drift.com
Source: chromecache_749.2.dr, chromecache_950.2.dr, chromecache_487.2.dr, chromecache_393.2.dr, chromecache_810.2.dr, chromecache_443.2.dr, chromecache_385.2.dr, chromecache_570.2.dr, chromecache_398.2.dr, chromecache_763.2.dr, chromecache_555.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_440.2.dr	String found in binary or memory: https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarr
Source: chromecache_785.2.dr	String found in binary or memory: https://theme.co
Source: chromecache_785.2.dr	String found in binary or memory: https://theme.co/pro
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://tools.refokus.com/rich-text-enhancer/bundle.v1.0.0.js
Source: chromecache_575.2.dr, chromecache_734.2.dr, chromecache_611.2.dr, chromecache_598.2.dr	String found in binary or memory: https://tracking.g2crowd.com
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://twitter.com/DidierStevens/status/1531033449561264128
Source: chromecache_828.2.dr, chromecache_480.2.dr	String found in binary or memory: https://twitter.com/Intel_by_KELA/status/1551892789499142145?ref_src=twsrc%5Etfw
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://twitter.com/KyleHanslovan/status/1531114931973767168
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://twitter.com/KyleHanslovan/status/1531138449536958465
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://twitter.com/MCKSysAr/status/1707855204647899194
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://twitter.com/_JohnHammond/status/1531125503725289472
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://twitter.com/_JohnHammond/status/1531170265039781888
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://twitter.com/assetnote?ref_src=twsrc%5Etfw
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://twitter.com/buffaloverflow/status/1531168929925713923
Source: chromecache_614.2.dr	String found in binary or memory: https://twitter.com/foundationsoft
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://twitter.com/infosec_au/status/1708271663182381240?ref_src=twsrc%5Etfw
Source: chromecache_828.2.dr, chromecache_480.2.dr	String found in binary or memory: https://twitter.com/intel_by_kela?lang=en
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://twitter.com/share?url=
Source: chromecache_605.2.dr	String found in binary or memory: https://unit42.paloaltonetworks.com/goodbye-mworm-hello-nworm-trickbot-updates-propagation-module/#a
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://us02web.zoom.us
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://us05web.zoom.us
Source: chromecache_614.2.dr	String found in binary or memory: https://use.typekit.net/
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: https://use.typekit.net/af/00841f/000000000000000077359564/30/
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: https://use.typekit.net/af/199a3f/00000000000000007735955e/30/
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: https://use.typekit.net/af/624cab/000000000000000077359558/30/
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: https://use.typekit.net/af/671919/00000000000000007735954e/30/
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: https://use.typekit.net/af/6cc429/00000000000000007735957a/30/
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: https://use.typekit.net/af/98e3f6/000000000000000077359562/30/
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: https://use.typekit.net/af/ad9c1c/000000000000000077359549/30/
Source: chromecache_818.2.dr, chromecache_872.2.dr	String found in binary or memory: https://use.typekit.net/af/d45b9a/000000000000000077359577/30/
Source: chromecache_892.2.dr	String found in binary or memory: https://vulners.com/carbonblack/CARBONBLACK:6730D6EB8DF875C002A93DBC78C80B9D
Source: chromecache_614.2.dr	String found in binary or memory: https://workmax.com/
Source: chromecache_605.2.dr	String found in binary or memory: https://www.advanced-intel.com/post/persist-brick-profit-trickbot-offers-new-trickboot-uefi-focused-
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2
Source: chromecache_605.2.dr	String found in binary or memory: https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Heasman.pdf
Source: chromecache_828.2.dr, chromecache_480.2.dr	String found in binary or memory: https://www.cisa.gov/uscert/ncas/alerts/aa22-131a
Source: chromecache_605.2.dr	String found in binary or memory: https://www.cisecurity.org/white-papers/security-primer-trickbot/
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://www.cloudflare.com/learning/cdn/what-is-a-cdn
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://www.cloudflare.com/learning/dns/what-is-dns
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://www.cloudflare.com/media-and-entertainment
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://www.cloudflarestatus.com/
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://www.cloudflarestatus.com/?_ga=2.206399059.190221946.1556053151-1076456093.1556053151
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://www.cloudflarestatus.com/?_ga=2.35996259.2108316469.1554333761-13370612.1552956708
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://www.comptia.org/blog/security-awareness-training-network-segmentation
Source: chromecache_485.2.dr, chromecache_428.2.dr, chromecache_880.2.dr, chromecache_754.2.dr	String found in binary or memory: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://www.cve.org/CVERecord?id=CVE-2022-27665
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://www.cve.org/CVERecord?id=CVE-2023-40044
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://www.cve.org/CVERecord?id=CVE-2023-40045
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://www.cve.org/CVERecord?id=CVE-2023-40046
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://www.cve.org/CVERecord?id=CVE-2023-40048
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://www.cve.org/CVERecord?id=CVE-2023-40049
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://www.cve.org/CVERecord?id=CVE-2023-42657
Source: chromecache_605.2.dr	String found in binary or memory: https://www.cyberscoop.com/trickbot-microsoft-cyber-command-disruption-down/
Source: chromecache_511.2.dr	String found in binary or memory: https://www.cyderes.com/events/public/v1/encoded/track/tc/ON
Source: chromecache_605.2.dr	String found in binary or memory: https://www.darkreading.com/threat-intelligence/like-the-energizer-bunny-trickbot-goes-on-and-on-/d/
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://www.datadoghq-browser-agent.com/us1/v5/datadog-rum.js
Source: chromecache_614.2.dr	String found in binary or memory: https://www.estimatingedge.com/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/#breadcrumb
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/#primaryimage
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/#website
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/?s=
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/about/philosophy/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/careers/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/clients/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/comments/feed/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/contact/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/events/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/events/#industry-events
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/events/#on-demand-webinars
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/events/#upcoming-webinars
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/faqs/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/feed/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/get-more/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/learn/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/learn/category/case-study/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/meet-our-sales-team/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/partners/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/partners/#integrations
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/press-releases/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/aca/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/accounts-payable/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/accounts-receivable/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/consolidated-general-ledger/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/construction-document-imaging/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/construction-reports/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/cpa-audit-review/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/eaccess/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/equipment/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/executive-dashboard/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/fixed-assets/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/general-ledger/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/inventory-management/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/job-costing/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/microsoft-sql/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/mobile/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/payroll/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/project-management/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/purchase-orders-subcontract/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/quickbooks/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/scheduling/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/service-dispatch/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/time-material-billing/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/software/unit-price-billing/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/support/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/terms/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/plugins/branda-white-labeling/inc/modules/front-end/assets
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/plugins/presto-player/dist/components/web-components/web-c
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/plugins/searchwp/assets/css/frontend/search-forms.css?ver=
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/themes/pro-child/scripts.js?ver=61d6c8f4cfb4a67a5b525ccfe7
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/themes/pro-child/style.css?ver=6.5.7.1724669600
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/themes/pro/cornerstone/assets/js/site/cs-accordion.7.5.7.j
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/themes/pro/cornerstone/assets/js/site/cs-classic.7.5.7.js?
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/themes/pro/cornerstone/assets/js/site/cs-sliders.7.5.7.js?
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/themes/pro/framework/dist/css/site/stacks/integrity-light.
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/themes/pro/framework/dist/js/site/x.js?ver=6.5.7
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/themes/pro/style.css?ver=61d6c8f4cfb4a67a5b525ccfe7264dd4
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/04/2nd-Section-100x79.jpg
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/04/2nd-Section-150x119.jpg
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/04/2nd-Section-379x300.jpg
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/04/2nd-Section.jpg
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/04/p4c-logo-100x16.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/04/p4c-logo-150x23.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/04/p4c-logo-300x47.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/04/p4c-logo.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/05/cropped-chevron-icon-180x180.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/05/cropped-chevron-icon-192x192.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/05/cropped-chevron-icon-270x270.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/05/cropped-chevron-icon-32x32.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/07/2021-07_FOUNDATION-MK_HomePage-Tab2-Payrol
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/07/2021-07_FOUNDATION-MK_HomePage-Tab3-CPAToo
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2021/07/2021-07_FOUNDATION-MK_POSubcontractorPage-
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2022/08/SafetyHQ-Logo-100x28.webp
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2022/08/SafetyHQ-Logo-150x41.webp
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2022/08/SafetyHQ-Logo.webp
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2023/05/workmax-hover-100x22.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2023/05/workmax-hover-1024x228.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2023/05/workmax-hover-1200x267.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2023/05/workmax-hover-150x33.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2023/05/workmax-hover-1536x342.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2023/05/workmax-hover-660x147.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2023/05/workmax-hover-768x171.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-content/uploads/2023/05/workmax-hover.png
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-includes/css/dist/block-library/style.min.css?ver=61d6c8f4cfb4a67a
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-includes/js/comment-reply.min.js?ver=61d6c8f4cfb4a67a5b525ccfe7264
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-json/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.foundationsoft.com%2F
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.foundationsoft.com%2F&
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/wp-json/wp/v2/pages/6
Source: chromecache_614.2.dr	String found in binary or memory: https://www.foundationsoft.com/xmlrpc.php
Source: chromecache_785.2.dr	String found in binary or memory: https://www.gnu.org/licenses/gpl-2.0.html
Source: chromecache_749.2.dr, chromecache_810.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_654.2.dr, chromecache_639.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_654.2.dr, chromecache_639.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_654.2.dr, chromecache_639.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_570.2.dr, chromecache_398.2.dr, chromecache_763.2.dr, chromecache_555.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_654.2.dr, chromecache_639.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_983.2.dr, chromecache_638.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/1072600148/?random
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_709.2.dr, chromecache_718.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_570.2.dr, chromecache_398.2.dr, chromecache_763.2.dr, chromecache_555.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_570.2.dr, chromecache_398.2.dr, chromecache_763.2.dr, chromecache_555.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_749.2.dr, chromecache_393.2.dr, chromecache_810.2.dr, chromecache_570.2.dr, chromecache_763.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_654.2.dr, chromecache_639.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_614.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_614.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-5L35WSM
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_439.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-TXRTDGW4
Source: chromecache_749.2.dr, chromecache_393.2.dr, chromecache_810.2.dr, chromecache_570.2.dr, chromecache_763.2.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_878.2.dr, chromecache_713.2.dr, chromecache_435.2.dr, chromecache_451.2.dr, chromecache_938.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__.
Source: chromecache_686.2.dr, chromecache_709.2.dr, chromecache_718.2.dr, chromecache_857.2.dr, chromecache_652.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__en.js
Source: chromecache_415.2.dr	String found in binary or memory: https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/
Source: chromecache_439.2.dr, chromecache_407.2.dr, chromecache_819.2.dr	String found in binary or memory: https://www.huntress.com
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://www.huntress.com/
Source: chromecache_439.2.dr, chromecache_407.2.dr, chromecache_819.2.dr	String found in binary or memory: https://www.huntress.com/blog-categories
Source: chromecache_439.2.dr, chromecache_407.2.dr, chromecache_611.2.dr, chromecache_819.2.dr, chromecache_598.2.dr	String found in binary or memory: https://www.huntress.com/blog-categories/response-to-incidents
Source: chromecache_1004.2.dr, chromecache_397.2.dr, chromecache_386.2.dr, chromecache_624.2.dr, chromecache_407.2.dr, chromecache_617.2.dr, chromecache_834.2.dr, chromecache_819.2.dr, chromecache_754.2.dr, chromecache_935.2.dr, chromecache_967.2.dr, chromecache_406.2.dr, chromecache_886.2.dr, chromecache_894.2.dr	String found in binary or memory: https://www.huntress.com/blog/
Source: chromecache_440.2.dr, chromecache_754.2.dr	String found in binary or memory: https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authenticati
Source: chromecache_415.2.dr	String found in binary or memory: https://www.huntress.com/blog/another-papercut-cve-2023-39143-remote-code-execution
Source: chromecache_452.2.dr, chromecache_894.2.dr	String found in binary or memory: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software
Source: chromecache_575.2.dr, chromecache_734.2.dr	String found in binary or memory: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software?
Source: chromecache_1004.2.dr, chromecache_967.2.dr	String found in binary or memory: https://www.huntress.com/blog/critical-vulnerabilities-ws-ftp-exploitation
Source: chromecache_608.2.dr	String found in binary or memory: https://www.huntress.com/blog/critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604
Source: chromecache_880.2.dr, chromecache_440.2.dr, chromecache_754.2.dr	String found in binary or memory: https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
Source: chromecache_485.2.dr, chromecache_754.2.dr	String found in binary or memory: https://www.huntress.com/blog/how-to-know-if-your-screenconnect-server-is-hacked
Source: chromecache_1000.2.dr	String found in binary or memory: https://www.huntress.com/blog/investigating-unauthorized-access-huntress-qa-environment-incident
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
Source: chromecache_507.2.dr	String found in binary or memory: https://www.huntress.com/blog/move-it-on-over-reflecting-on-the-moveit-exploitation
Source: chromecache_397.2.dr	String found in binary or memory: https://www.huntress.com/blog/qakbot-malware-takedown-and-defending-forward
Source: chromecache_892.2.dr	String found in binary or memory: https://www.huntress.com/blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers
Source: chromecache_605.2.dr	String found in binary or memory: https://www.huntress.com/blog/rapid-response-trickboot
Source: chromecache_440.2.dr, chromecache_754.2.dr	String found in binary or memory: https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-170
Source: chromecache_440.2.dr	String found in binary or memory: https://www.huntress.com/blog/slashandgrab-the-connectwise-screenconnect-vulnerability-explained
Source: chromecache_541.2.dr	String found in binary or memory: https://www.huntress.com/blog/slashandgrab-the-connectwise-screenconnect-vulnerability-explained-2
Source: chromecache_480.2.dr	String found in binary or memory: https://www.huntress.com/blog/threat-advisory-hackers-are-selling-access-to-msps
Source: chromecache_485.2.dr, chromecache_387.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_440.2.dr, chromecache_754.2.dr	String found in binary or memory: https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
Source: chromecache_429.2.dr, chromecache_780.2.dr	String found in binary or memory: https://www.huntress.com/cookie-policy
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr	String found in binary or memory: https://www.huntress.com/huntress-saved-my-ass?metadata_cid=1507288&utm_campaign=ToFu%20-%20Save
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr, chromecache_889.2.dr	String found in binary or memory: https://www.huntress.com/neighborhood-watch-program/internal-license-request
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://www.huntress.com/privacy-policy
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr	String found in binary or memory: https://www.huntress.com/resources/ama-breaking-down-the-connectwise-screenconnect-vulnerability-cve
Source: chromecache_485.2.dr, chromecache_754.2.dr	String found in binary or memory: https://www.huntress.com/resources/incident-response-tabletop-in-a-box
Source: chromecache_541.2.dr, chromecache_440.2.dr, chromecache_624.2.dr, chromecache_617.2.dr, chromecache_754.2.dr, chromecache_889.2.dr	String found in binary or memory: https://www.huntress.com/start-trial
Source: chromecache_614.2.dr	String found in binary or memory: https://www.instagram.com/foundationsoft/
Source: chromecache_507.2.dr	String found in binary or memory: https://www.investopedia.com/terms/l/long-tail.asp
Source: chromecache_614.2.dr	String found in binary or memory: https://www.linkedin.com/company/foundation-software/
Source: chromecache_605.2.dr, chromecache_828.2.dr, chromecache_837.2.dr, chromecache_665.2.dr, chromecache_485.2.dr, chromecache_415.2.dr, chromecache_608.2.dr, chromecache_736.2.dr, chromecache_428.2.dr, chromecache_1000.2.dr, chromecache_507.2.dr, chromecache_480.2.dr, chromecache_387.2.dr, chromecache_632.2.dr, chromecache_541.2.dr, chromecache_880.2.dr, chromecache_892.2.dr, chromecache_440.2.dr, chromecache_452.2.dr, chromecache_1004.2.dr, chromecache_397.2.dr	String found in binary or memory: https://www.linkedin.com/shareArticle?mini=true&url=
Source: chromecache_507.2.dr	String found in binary or memory: https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft
Source: chromecache_950.2.dr, chromecache_487.2.dr, chromecache_443.2.dr, chromecache_385.2.dr, chromecache_398.2.dr, chromecache_555.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_614.2.dr	String found in binary or memory: https://www.myhqsuite.com/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.myhqsuite.com/software/crewhq/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.myhqsuite.com/software/executivehq/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.myhqsuite.com/software/hrhq/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.myhqsuite.com/software/projecthq/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.myhqsuite.com/software/safetyhq/
Source: chromecache_415.2.dr	String found in binary or memory: https://www.papercut.com/kb/Main/securitybulletinjuly2023/
Source: chromecache_614.2.dr	String found in binary or memory: https://www.payroll4construction.com
Source: chromecache_614.2.dr	String found in binary or memory: https://www.payroll4construction.com/
Source: chromecache_507.2.dr	String found in binary or memory: https://www.proofpoint.com/us/blog/threat-insight/how-threat-actors-are-adapting-post-macro-world
Source: chromecache_608.2.dr	String found in binary or memory: https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-4
Source: chromecache_415.2.dr	String found in binary or memory: https://www.reddit.com/r/msp/comments/15iwjez/papercut_patch_party_cve202339143/
Source: chromecache_632.2.dr, chromecache_892.2.dr	String found in binary or memory: https://www.reddit.com/r/msp/comments/lwmo5c/mass_exploitation_of_onprem_exchange_servers/
Source: chromecache_736.2.dr, chromecache_406.2.dr	String found in binary or memory: https://www.reddit.com/r/msp/comments/v0tuvs/ms_office_vuln_polite_warning_about_nearterm/
Source: chromecache_574.2.dr, chromecache_490.2.dr	String found in binary or memory: https://www.redditstatic.com/ads/8d515a58/pixel.js
Source: chromecache_570.2.dr	String found in binary or memory: https://www.redditstatic.com/ads/pixel.js
Source: chromecache_507.2.dr	String found in binary or memory: https://www.reuters.com/technology/who-is-behind-sweeping-moveit-hack-2023-06-27/
Source: chromecache_507.2.dr	String found in binary or memory: https://www.secureworks.com/blog/clop-ransomware-leak-site-shows-increased-activity
Source: chromecache_485.2.dr, chromecache_754.2.dr	String found in binary or memory: https://www.securityweek.com/slashandgrab-screenconnect-vulnerability-widely-exploited-for-malware-d
Source: chromecache_507.2.dr	String found in binary or memory: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/20-years-of-macro-m
Source: chromecache_507.2.dr	String found in binary or memory: https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysi
Source: chromecache_605.2.dr	String found in binary or memory: https://www.virusbulletin.com/uploads/pdf/conference_slides/2017/Kapoor-VB2017-have-you-scanned-your
Source: chromecache_428.2.dr	String found in binary or memory: https://www.youtube.com/embed/AWGoGO5jnvY?si=QVZ66js3CVQEZlVY
Source: chromecache_749.2.dr, chromecache_810.2.dr, chromecache_443.2.dr, chromecache_570.2.dr, chromecache_398.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_605.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=P3yMXspLzoY
Source: chromecache_605.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=QDSlWa9xQuA
Source: chromecache_665.2.dr, chromecache_1000.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=WRnXzHfpMWs&t=3037s
Source: chromecache_605.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=dpG97TBR3Ys
Source: chromecache_387.2.dr, chromecache_541.2.dr, chromecache_440.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=tUhu1c8ulLE
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://www.zoom.us
Source: chromecache_837.2.dr, chromecache_452.2.dr	String found in binary or memory: https://x.com/MaxRogers5/status/1834999656201289782
Source: chromecache_614.2.dr	String found in binary or memory: https://yoast.com/wordpress/plugins/seo/
Source: chromecache_436.2.dr, chromecache_839.2.dr	String found in binary or memory: https://zoom.us

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50731
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50746
Source: unknown	Network traffic detected: HTTP traffic on port 50853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50749
Source: unknown	Network traffic detected: HTTP traffic on port 51135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50741
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50754
Source: unknown	Network traffic detected: HTTP traffic on port 51008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 50980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50768
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50762
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 50931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 51065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 51033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50712
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50716
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50719
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 51225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50727
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 51021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 51201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 50685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 50923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50779
Source: unknown	Network traffic detected: HTTP traffic on port 50911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50778
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50772
Source: unknown	Network traffic detected: HTTP traffic on port 51025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 50943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50787
Source: unknown	Network traffic detected: HTTP traffic on port 51057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50785
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50798
Source: unknown	Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 51245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 51069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51147
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 51210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 51061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 50755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51171
Source: unknown	Network traffic detected: HTTP traffic on port 50903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51181
Source: unknown	Network traffic detected: HTTP traffic on port 51073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 50940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51107
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 51119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51103
Source: unknown	Network traffic detected: HTTP traffic on port 50731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51112
Source: unknown	Network traffic detected: HTTP traffic on port 50639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown	Network traffic detected: HTTP traffic on port 51132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51127
Source: unknown	Network traffic detected: HTTP traffic on port 51004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51125
Source: unknown	Network traffic detected: HTTP traffic on port 50836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51130
Source: unknown	Network traffic detected: HTTP traffic on port 50964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51133
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51136
Source: unknown	Network traffic detected: HTTP traffic on port 50893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51141
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51187
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51190
Source: unknown	Network traffic detected: HTTP traffic on port 51097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51195
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51194
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51197
Source: unknown	Network traffic detected: HTTP traffic on port 51100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50859
Source: unknown	Network traffic detected: HTTP traffic on port 50749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50851
Source: unknown	Network traffic detected: HTTP traffic on port 51044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 51032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50865
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50868
Source: unknown	Network traffic detected: HTTP traffic on port 50956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50862
Source: unknown	Network traffic detected: HTTP traffic on port 50864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 50852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50878
Source: unknown	Network traffic detected: HTTP traffic on port 51056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50877
Source: unknown	Network traffic detected: HTTP traffic on port 50657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50871
Source: unknown	Network traffic detected: HTTP traffic on port 51020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50873
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 50601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 50888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50888
Source: unknown	Network traffic detected: HTTP traffic on port 50555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50884
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 50807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49743 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Detects code from APT wateringhole Author: @dragonthreatlab
Source: sslproxydump.pcap, type: PCAP	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: dropped/chromecache_892, type: DROPPED	Matched rule: Detects code from APT wateringhole Author: @dragonthreatlab
Source: dropped/chromecache_632, type: DROPPED	Matched rule: Detects code from APT wateringhole Author: @dragonthreatlab

Yara signature match

Source: sslproxydump.pcap, type: PCAP	Matched rule: apt_c16_win_wateringhole date = 2015/01/11, author = @dragonthreatlab, description = Detects code from APT wateringhole, reference = http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html
Source: sslproxydump.pcap, type: PCAP	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: dropped/chromecache_892, type: DROPPED	Matched rule: apt_c16_win_wateringhole date = 2015/01/11, author = @dragonthreatlab, description = Detects code from APT wateringhole, reference = http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html
Source: dropped/chromecache_632, type: DROPPED	Matched rule: apt_c16_win_wateringhole date = 2015/01/11, author = @dragonthreatlab, description = Detects code from APT wateringhole, reference = http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html

Classification label

Source: classification engine

Classification label: mal80.expl.evad.win@23/986@320/100

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1996,i,5053550496788528240,1529284334004214173,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.cyderes.com/e3t/Ctc/ON+113/cpWbt04/VX4GLN83B5sSVcgNxQ2Ps5TgVfQRxk5l9kHPN48YK9C5m_5PW50kH_H6lZ3pVW8y4rsC3Frq3xW6yS46B81vNwBW7nKjzX7rlDGLW8Pgnsm2TMWP7W8BGJ3S7v4twJW4Frjvh65WTfKVTz5h-5gQP1gMVRZvWxc0gFW70YCkf5Yr5gxW4_ym5p4kM2HWW8XQLRs2fQKTSW6H8zL35wntpYW2g-lt23Pgmr-W5tJKtK3hc6rbW6CjtL61FP38FN8Dg60fYghyWW9bC6JC3rZqmzW8VJhP664ltDxW1lwcb13ZpPGyW5K_1JQ3TqNPdW95WCPZ4QLNngW273xc864PDv3W5x93bB7dRNxTW92-5jF1RVBWpW8x57FF7P2xcjW7KK8Xj8n_ZZMW7CgpVb566CBBW8bVlWQ11xhLlVs3yDJ8NdTRzW12g9Fn559wR0W9bq01776CWknW5nG39p82bgTcf5RLlBK04"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1996,i,5053550496788528240,1529284334004214173,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Malware Analysis System Evasion

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: chromecache_935.2.dr	Binary or memory string: </script></div><div class="menu-button-mobile w-nav-button" data-ix="mobile-menu-open"><div class="top-line"></div><div class="middle-line"></div><div class="bottom-line"></div></div></div></div></header><section class="content-with-form gated-content-with-form w-condition-invisible"><div class="temp w-condition-invisible">This is some text inside of a div block.</div><img src="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a91_Gated%20glitch%20dektop.webp" loading="lazy" alt="Glitch effect" class="cwf-glitch-01 gated-glitch-desktop"/><div class="w-layout-blockcontainer container-1303 w-condition-invisible w-container"><div class="two-column-layout-wrapper blog-detail-two-column-layout-wrapper"><div><div fs-richtext-sanitize="true" fs-richtext-element="rich-text" class="gated-content w-dyn-bind-empty w-richtext"></div></div></div></div></section><div class="gated-blog-content"><section class="blog-banner-section"><img src="https://cdn.prod.website-files.com/655d92689c415e9fefcf2368/655d92689c415e9fefcf2400_Hero-grapic-right-02.png" loading="eager" alt="" class="landing-banner-shape-1 blog-listing-landing-banner-shape-1"/><div class="w-layout-blockcontainer container-width-1143 w-container"><div class="blog-listing-banner-wrapper"><div class="breadcrumb contained"><a href="/" class="breadcrumb-link level-1">Home</a><img src="https://cdn.prod.website-files.com/655d92689c415e9fefcf2368/656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg" loading="lazy" alt="" class="breadcrumb-icon"/><a href="/blog" class="breadcrumb-link level-2">Blog</a><img src="https://cdn.prod.website-files.com/655d92689c415e9fefcf2368/656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg" loading="lazy" alt="" class="breadcrumb-icon"/><div class="breadcrumb-text">Threat Advisory: VMware Horizon Servers Actively Being Hit With Cobalt Strike</div></div><div class="breadcrumb blog-asset-breadcrumb"><a href="/" class="breadcrumb-link breadcrumb-link-back">January 15, 2022</a></div><div class="landing-banner-heading blog-landing-banner-heading"><h1 class="landing-banner-heading-h1">Threat Advisory: VMware Horizon Servers Actively Being Hit With Cobalt Strike</h1><div class="attribution-container"><div class="author-container"><div class="author-wrap-text">By: </div><div class="authors-wrapper w-dyn-list"><div fs-cmsnest-collection="authors" fs-cmsnest-element="template-reference" role="list" class="authors-list w-dyn-items"><div role="listitem" class="author-item w-dyn-item"><a href="/authors/team-huntress" class="author-link w-inline-block"><img src="https://cdn.prod.website-files.com/plugins/Basic/assets/placeholder.60f9b1840c.svg" loading="lazy" width="40" height="40" alt="" class="author-profile w-dyn-bind-empty"/><div class="author-name">Team Huntress</div></a></div></div></div></div><div class="author-divider w-condition-invisible">|</div><div class="contributor-container"><div class="contributor-wrap-text w-conditio
Source: chromecache_935.2.dr	Binary or memory string: "name": "Threat Advisory: VMware Horizon Servers Actively Being Hit With Cobalt Strike"
Source: chromecache_935.2.dr	Binary or memory string: "@id": "https://www.huntress.com/blog/cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike",
Source: chromecache_935.2.dr	Binary or memory string: s important to note that ~34% of the 180 Horizon servers (62) we analyzed were unpatched and internet-facing at the time of this publication. the web shells on these 18 compromised systems established a timeline that started on December 25, 2021 and continued until December 29, 2021.</p><h4>New Behavior</h4><p>On January 14 at 1458 ET, an unrelated Managed Antivirus detection (Microsoft Defender) tipped our ThreatOps team to new exploitation of the Log4Shell vulnerability in VMware Horizon. This time it was used to deliver the Cobalt Strike implant. </p><p>Additional security researchers including <a href="https://twitter.com/TheDFIRReport/status/1482078434327244805?s=20">TheDFIRReport</a> and <a href="https://twitter.com/redcanary/status/1482100290698375169?s=20">Red Canary</a> reported similar behavior around the same time
Source: chromecache_935.2.dr	Binary or memory string: link.href='https://www.huntress.com/blog/cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike';
Source: chromecache_935.2.dr	Binary or memory string: <!DOCTYPE html><!-- Last Published: Thu Sep 19 2024 22:43:52 GMT+0000 (Coordinated Universal Time) --><html data-wf-domain="www.huntress.com" data-wf-page="65f3299e49a461b4b9c729ba" data-wf-site="6579dd0b5f9a54376d296915" lang="en" data-wf-collection="65f3299e49a461b4b9c728ba" data-wf-item-slug="cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike"><head><meta charset="utf-8"/><title>VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress</title><meta content="Huntress is monitoring an incident in which VMware Horizon Servers are being hit with Cobalt Strike. Read our up-to-date blog to learn more." name="description"/><meta content="VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress" property="og:title"/><meta content="Huntress is monitoring an incident in which VMware Horizon Servers are being hit with Cobalt Strike. Read our up-to-date blog to learn more." property="og:description"/><meta content="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65810506f631f9d85cb799a9_Threat%20Advisory-%20VMware%20Horizon%20Servers%20Actively%20Being%20Hit%20With%20Cobalt%20Strike.jpeg" property="og:image"/><meta content="VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress" property="twitter:title"/><meta content="Huntress is monitoring an incident in which VMware Horizon Servers are being hit with Cobalt Strike. Read our up-to-date blog to learn more." property="twitter:description"/><meta content="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/65810506f631f9d85cb799a9_Threat%20Advisory-%20VMware%20Horizon%20Servers%20Actively%20Being%20Hit%20With%20Cobalt%20Strike.jpeg" property="twitter:image"/><meta property="og:type" content="website"/><meta content="summary_large_image" name="twitter:card"/><meta content="width=device-width, initial-scale=1" name="viewport"/><meta content="QZk47k59WXGOBjZRZodH6wC5rKaX9MnmeBFsV5jchE4" name="google-site-verification"/><link href="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.5d94925d4.min.css" rel="stylesheet" type="text/css"/><script type="text/javascript">!function(o,c){var n=c.documentElement,t=" w-mod-";n.className+=t+"js",("ontouchstart"in o||o.DocumentTouch&&c instanceof DocumentTouch)&&(n.className+=t+"touch")}(window,document);</script><link href="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/66030a0ceace49bce51c36de_favicon-32x32.png" rel="shortcut icon" type="image/x-icon"/><link href="https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6603101ade570b07f0fb6625_android-chrome-256x256.png" rel="apple-touch-icon"/><link href="rss.xml" rel="alternate" title="RSS Feed" type="application/rss+xml"/><script src="https://www.google.com/recaptcha/api.js" type="text/javascript"></script><!-- Google Tag Manager -->
Source: chromecache_935.2.dr	Binary or memory string: s <a href="https://kb.vmware.com/sfc/servlet.shepherd/version/download/0685G00000e9d3cQAA">Horizon Mitigation tool</a> to report whether there is a vulnerable Log4J library or child_process based web shell present under the installation location with the following command: Horizon_Windows_Log4j_Mitigation.bat /verbose</li><li>Manually inspect/assess the files within %ProgramFiles%\VMware\VMware View\Server\appblastgateway\ for the presence of the child_process string <a href="https://i.imgur.com/t5ojfac.png">as pictured here</a>.</li><li>Review historical records for evidence of node.exe or ws_TomcatService.exe spawning abnormal processes to include PowerShell.</li></ul><h4>Mitigation Steps</h4><p>This new wave of coordinated hacking emphasizes the criticality of patching these servers immediately. VMware has <a href="https://kb.vmware.com/s/article/87073">produced detailed guidance</a> to help you address these security vulnerabilities.</p><p>Should you discover a web shell, VMware recommends you
Source: chromecache_935.2.dr	Binary or memory string: soon-to-be-released Process Insights agent to all of the VMware Horizon servers we protect. This new EDR capability is based on an <a href="https://searchitchannel.techtarget.com/news/252495064/Huntress-security-platform-gets-boost-from-Level-Effect-EDR">acquisition we made in early 2021</a> and allows us to proactively detect and respond to non-persistent malicious behavior by giving us the ability to collect detailed information about processes.</p><h4>Initial Access Source</h4><p>Despite mass exploitation of VMware Horizon to deliver web shells, our data suggests today&#x27;s Cobalt Strike deployments were exploitation of Horizon itself and not the abuse of web shells. This conclusion is largely based on analysis of the PowerShell payload&#x27;s parent process where web shell abuse spawns from node.exe while exploitation of Log4Shell in Horizon spawns from ws_tomcatservice.exe as pictured.</p><h4>Detection Tips</h4><p>For those of you just learning about the mass exploitation of VMware Horizon servers and the installation of backdoor web shells, you should seriously consider the possibility that your server is compromised if it was unpatched and internet-facing. To help you determine your status, </p><p>we strongly suggest you perform the following actions:</p><ul role="list"><li>Run VMware
Source: chromecache_935.2.dr	Binary or memory string: s National Health Service (NHS) <a href="https://digital.nhs.uk/cyber-alerts/2022/cc-4002">alerted that hackers</a> were actively targeting Log4Shell vulnerabilities in VMware Horizon servers in an effort to establish persistent access via web shells. These web shells allow unauthenticated attackers to remotely execute commands on your server as NT AUTHORITY\SYSTEM (root privileges). According to Shodan, ~25,000 Horizon servers are currently internet accessible worldwide.</p><p>Our team is continuing to track this activity and this post will be updated with new information as it becomes available.</p><p>Image Source: NHS - <a href="https://digital.nhs.uk/cyber-alerts/2022/cc-4002" target="_blank">https://digital.nhs.uk/cyber-alerts/2022/cc-4002</a></p><p>Based on Huntress
Source: chromecache_935.2.dr	Binary or memory string: const curl = "https://www.huntress.com/blog/cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike"
Source: chromecache_935.2.dr	Binary or memory string: link.href= 'https://www.huntress.com/blog/' + 'cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike';

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match	File source: dropped/chromecache_892, type: DROPPED
Source: Yara match	File source: dropped/chromecache_632, type: DROPPED

Yara detected Powershell download and execute

Source: Yara match	File source: dropped/chromecache_892, type: DROPPED
Source: Yara match	File source: dropped/chromecache_632, type: DROPPED
Source: Yara match	File source: dropped/chromecache_624, type: DROPPED
Source: Yara match	File source: dropped/chromecache_617, type: DROPPED