Edit tour

Windows Analysis Report
https://getwellslogsnowonline.vercel.app/

Overview

General Information

Sample URL:	https://getwellslogsnowonline.vercel.app/
Analysis ID:	1604811
Infos:

Errors URL not reachable

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1980,i,686530358897787946,159423849547294936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 1812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://getwellslogsnowonline.vercel.app/" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: POST /target/offers/conversations HTTP/1.1Host: getwellslogsnowonline.vercel.appConnection: keep-aliveContent-Length: 105sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json; charset=UTF-8Accept: */*Origin: https://getwellslogsnowonline.vercel.appSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://getwellslogsnowonline.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:39 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::7dq7s-1738453839253-3c402f3f714fConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:40 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::2mjtf-1738453840525-90695ea1f32fConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:40 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::dg5j8-1738453840585-8f6a0f87586cConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:40 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::2jcj2-1738453840597-168302b1a6c7Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::zc98w-1738453841258-4b0d4a11bc46Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::x468v-1738453841258-6b2ab235667bConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::jhnbc-1738453841271-89b230dc3926Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::ln9b9-1738453841282-4de6fa2d1a21Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::jnhdn-1738453841306-1a9deec9c9acConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::5qtmb-1738453841293-5a0c961935e5Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::hnwxd-1738453841883-3e214305ee86Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::86xhr-1738453841897-686ce8cfa466Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::kn6fz-1738453841899-745409f60d16Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::2z6x9-1738453841956-b0c1116282f2Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:41 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::kfrs7-1738453841954-e13b4faf2b46Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:42 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::28stb-1738453842071-bbe89b15f0ceConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:42 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::m8pcq-1738453842493-020f3759faf0Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:42 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::kv9gv-1738453842618-c6bdafb9a1d9Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:53 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::gfdnp-1738453853680-8e742a48124bConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:55 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::djshc-1738453855008-31b609eb09dfConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:55 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::6l9zp-1738453855703-a68764871924Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:56 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::mrfhc-1738453856680-ef3839762b50Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:56 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::bnnm8-1738453856681-b19f4fe16071Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:56 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::knfbp-1738453856681-493c86b4c164Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:56 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::hp4f9-1738453856685-3c97d7fa7e1eConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:56 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::n6x9k-1738453856681-2a7ef25adf63Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:56 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::2xd46-1738453856712-0e4b4b4e0443Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:57 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::kv9gv-1738453857306-299c05b3d1c1Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:57 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::jhnbc-1738453857310-c01955284eb9Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:57 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::kv9gv-1738453857311-59ae5f82306eConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:57 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::2xd46-1738453857316-4a9120420483Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:57 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::h8fq7-1738453857317-b08c23beafffConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:57 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::mn829-1738453857340-6a896736f8f9Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:50:57 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::qt5sd-1738453857970-a41c8dea2844Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:51:05 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::xqnvl-1738453865837-3876b50d3de4Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 79Content-Type: text/plain; charset=utf-8Date: Sat, 01 Feb 2025 23:51:05 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::gn6j8-1738453865857-56126d5cdb36Connection: close

Source: chromecache_192.4.dr, chromecache_183.4.dr	String found in binary or memory: https://a.dtsan.net
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://a.dtssrv.com/a?i=
Source: chromecache_121.4.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_152.4.dr	String found in binary or memory: https://api.rlcdn.com/api/identity/idl?pid=1317
Source: chromecache_152.4.dr	String found in binary or memory: https://b.videoamp.com/d2/
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://c1.wfinterface.com/rtto/
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://c1.wfinterface.com/rtto/toppages/utag.sync.js
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://c1.wfinterface.com/tracking/hp/utag.js
Source: chromecache_141.4.dr, chromecache_121.4.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://cdn.tynt.com/afwu.js
Source: chromecache_152.4.dr	String found in binary or memory: https://cm.g.doubleclick.net/pixel?google_nid=wellsfargo_adh&google_hm=
Source: chromecache_152.4.dr	String found in binary or memory: https://docs.tealium.com/platforms/javascript/debugging/
Source: chromecache_152.4.dr	String found in binary or memory: https://gbxreport-prod.wf.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report
Source: chromecache_221.4.dr, chromecache_189.4.dr, chromecache_155.4.dr, chromecache_124.4.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_221.4.dr, chromecache_189.4.dr, chromecache_155.4.dr, chromecache_124.4.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.21.1/LICENSE
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://p.dtsan.net/dtsa.js
Source: chromecache_121.4.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_141.4.dr, chromecache_121.4.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://pd.sharethis.com/pd/dtscout
Source: chromecache_188.4.dr, chromecache_169.4.dr	String found in binary or memory: https://pd.sharethis.com/pd/dtscout?_t_=px&url=
Source: chromecache_188.4.dr, chromecache_169.4.dr	String found in binary or memory: https://pd.sharethis.com/pd/error?e=
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://pixel.onaudience.com/?partner=137085098&mapped=
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://schema.org/
Source: chromecache_152.4.dr	String found in binary or memory: https://static.wellsfargo.com/tracking/alloy/alloy.js
Source: chromecache_152.4.dr	String found in binary or memory: https://static.wellsfargo.com/tracking/gb/detector-dom.min.js
Source: chromecache_152.4.dr	String found in binary or memory: https://static.wellsfargo.com/tracking/hp/utag.js
Source: chromecache_152.4.dr	String found in binary or memory: https://static.wellsfargo.com/tracking/ytc/ytc.js
Source: chromecache_141.4.dr, chromecache_121.4.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_141.4.dr, chromecache_121.4.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://t.dtscdn.com/widget/?d=
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://t.dtscout.com/idg/?su=
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://t.dtscout.com/pv/
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://t.dtscout.com/udg/?su=
Source: chromecache_188.4.dr, chromecache_169.4.dr	String found in binary or memory: https://t.sharethis.com/1/k/t.dhj?cid=c010&cls=C&rnd=
Source: chromecache_149.4.dr, chromecache_170.4.dr	String found in binary or memory: https://tags.crwdcntrl.net/lt/c/3825/lt.min.js
Source: chromecache_141.4.dr, chromecache_121.4.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_121.4.dr	String found in binary or memory: https://www.google.com
Source: chromecache_141.4.dr, chromecache_121.4.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_121.4.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-5Z8C8NSVHK
Source: chromecache_141.4.dr, chromecache_121.4.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www.wellsfargo.com/
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www17.wellsfargomedia.com/assets/images/contextual/responsive/lpromo/wfi_ph_g_1199830824_160
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_134511123
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_557715963
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_900217040
Source: chromecache_218.4.dr	String found in binary or memory: https://www17.wellsfargomedia.com/assets/images/logos/wellsfargo/logo_974x1050.png
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www17.wellsfargomedia.com/assets/images/rwd/Native_App_Phone_Personal_v8.png
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www17.wellsfargomedia.com/assets/images/rwd/first_time_experience-account_summary.png
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www17.wellsfargomedia.com/assets/images/rwd/volunteers_cars_616x353.jpg
Source: chromecache_165.4.dr, chromecache_218.4.dr	String found in binary or memory: https://www17.wellsfargomedia.com/assets/images/rwd/women-in-greenhouse_616x353.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443

Source: classification engine

Classification label: mal64.phis.win@20/224@122/44

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1980,i,686530358897787946,159423849547294936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://getwellslogsnowonline.vercel.app/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1980,i,686530358897787946,159423849547294936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://getwellslogsnowonline.vercel.app/	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854945&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A242-223859-16%7Etcm%3A91-223657-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/favicon_48x48.png	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839538&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/tick.png	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/position-3-bg-gradient.png	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854942&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/bg.jpg	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839527&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453839534&pageID=per_home&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=2	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854954&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/target/offers/conversations	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854943&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/js/wfui-container-bottom.js/assets/js/wfui/ndep/websdk/nuance-websdk-loader.js	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-sbd.woff2	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453854946&pageID=undefined&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarqueeOffer	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/css/ps-homepage.ae488a2de98b84f77de2.css	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/wf_logo_220x23.png	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/HYeWm0	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-lt.woff2	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453839532&pageID=per_home&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=1	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/bg2.jpg	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839523&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453854948&pageID=undefined&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=1	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854940&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-bd.woff2	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453864077&event=LinkActivated&eventType=click&eventDescription=SubmitSignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8&linkText=	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/auth/login/static/js/general_alt.js?1js	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839526&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/responsive-sprite-v10.png	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839529&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A242-223859-16%7Etcm%3A91-223657-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854947&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A242-228778-16%7Etcm%3A91-228643-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453839536&pageID=per_home&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=3	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839535&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A242-228805-16%7Etcm%3A91-228643-32	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/box.png	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/position-2-bg-gradient.png	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/favicon.ico	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854951&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A242-228805-16%7Etcm%3A91-228643-32	100%	Avira URL Cloud	phishing
https://docs.tealium.com/platforms/javascript/debugging/	0%	Avira URL Cloud	safe
https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-rg.woff2	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/images/home.png	100%	Avira URL Cloud	phishing
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453854950&pageID=undefined&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=2	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
e114945.b.akamaiedge.net	2.21.65.149	true	false	high
a.dtsan.net	172.67.167.79	true	false	high
de.tynt.com	67.202.105.33	true	false	high
e213908.b.akamaiedge.net	2.21.65.136	true	false	high
cdn.tynt.com.cdn.cloudflare.net	104.18.13.146	true	false	high
ps.eyeota.net	3.124.210.90	true	false	high
idsync.rlcdn.com	35.244.174.68	true	false	high
httplogserver-lb.global.unified-prod.sharethis.net	52.59.135.49	true	false	high
userstatics.com	104.21.48.1	true	false	high
s4.histats.com	149.56.240.132	true	false	high
e167121.b.akamaiedge.net	2.21.65.153	true	false	high
i.simpli.fi	35.234.162.151	true	false	high
www.google.com	142.250.184.228	true	false	high
p.dtsan.net	104.21.91.54	true	false	high
dcs-ups.g03.yahoodns.net	87.248.119.251	true	false	high
s10.histats.com.cdn.cloudflare.net	104.20.11.182	true	false	high
match.adsrvr.org	52.223.40.198	true	false	high
pippio.com	107.178.254.65	true	false	high
pixel.nordicdataresources.net	57.128.187.108	true	false	high
getwellslogsnowonline.vercel.app	64.29.17.1	true	true	unknown
e15118.a.akamaiedge.net	104.102.62.193	true	false	high
t.dtscout.com	172.67.70.180	true	false	high
pixel.onaudience.com	54.38.113.2	true	false	high
tags.crwdcntrl.net	65.9.66.104	true	false	high
thirdparty-logserver-lb.global.unified-prod.sharethis.net	18.196.170.244	true	false	high
t.dtscdn.com	104.26.12.60	true	false	high
e.dtscout.com	104.26.10.2	true	false	high
ic.tynt.com	67.202.105.33	true	false	high
rc-ext-geo.rlcdn.com	35.244.174.68	true	false	high
ml314.com	34.117.77.79	true	false	high
rc.rlcdn.com	unknown	unknown	false	high
sync.sharethis.com	unknown	unknown	false	high
www17.wellsfargomedia.com	unknown	unknown	false	high
t.sharethis.com	unknown	unknown	false	high
ups.analytics.yahoo.com	unknown	unknown	false	high
p.adsymptotic.com	unknown	unknown	false	high
cdn.tynt.com	unknown	unknown	false	high
e.dlx.addthis.com	unknown	unknown	false	high
s10.histats.com	unknown	unknown	false	high
c1.wfinterface.com	unknown	unknown	false	high
pxdrop.lijit.com	unknown	unknown	false	high
cms.analytics.yahoo.com	unknown	unknown	false	high
pd.sharethis.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854945&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A242-223859-16%7Etcm%3A91-223657-32	true	Avira URL Cloud: phishing	unknown
https://s4.histats.com/stats/0.php?4854432&@f16&@g1&@h1&@i1&@j1738453853904&@k0&@l1&@mError&@n0&@ohttps%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&@q0&@r0&@s0&@ten-US&@u1280&@b1:-9690431&@b3:1738453854&@b4:js15_as.js&@b5:-300&@a-_0.2.1&@vhttps%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&@w	false		high
https://www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_900217040_616x353.jpg	false		high
https://pxdrop.lijit.com/1/d/t.dhj?cls=sync&dmn=getwellslogsnowonline.vercel.app&GDPR_v2=&us_privacy=&pubid=dt_scout&gpp=&gpp_sid=	false		high
https://getwellslogsnowonline.vercel.app/images/bg.jpg	true	Avira URL Cloud: phishing	unknown
https://a.dtsan.net/a	false		high
https://getwellslogsnowonline.vercel.app/images/position-3-bg-gradient.png	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/images/tick.png	true	Avira URL Cloud: phishing	unknown
https://sync.sharethis.com/ttd?uid=3119e009-c218-4243-8eca-efb4668d80e9&gdpr=0&gdpr_consent=	false		high
https://getwellslogsnowonline.vercel.app/images/favicon_48x48.png	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839538&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32	true	Avira URL Cloud: phishing	unknown
https://t.dtscout.com/pv/	false		high
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854954&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32	true	Avira URL Cloud: phishing	unknown
https://www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_557715963_616x353.jpg	false		high
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854942&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32	true	Avira URL Cloud: phishing	unknown
https://t.sharethis.com/1.1683.23406/a/US/t_.js?cid=c010&cls=C	false		high
https://ml314.com/utsync.ashx?eid=50131&et=13&cid=lr&fp=ZGQAA2ees2EAAAAIPhmVAw%3D%3D&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fidsync.rlcdn.com%2F395886.gif%3Fpartner_uid%3D%5BPersonID%5D	false		high
https://cdn.tynt.com/afwu.js	false		high
https://ml314.com/csync.ashx?fp=2316405e883022bdb4c1760feab127c2207b763908f291f2fad61d2e1f227a15f4cb09cee1a4f8eb&person_id=3650262495646449678&eid=50082	false		high
https://t.sharethis.com/d/a.gif?cid=c010&cls=C&stid=ZGQAA2ees2EAAAAIPhmVAw%253D%253D&tt=t.dhj&dhjLcy=1738453857515&lbl=pxcel&flbl=pxcel&ll=d&ver=1.1683.23406&ell=d&cck=__stid&dmn=getwellslogsnowonline.vercel.app&pn=%2Ferror.html&qs=na&rdn=getwellslogsnowonline.vercel.app&rpn=%2F&rqs=na&cc=US&cont=NA&evid=dyL7DTZAALmgg9NNxvgX&urls=!1!1906!b-13j,!0!681!b-13l,!1!2966!b-14s,!1!1950!b-150&rnd=1738453862491&cid=c010&version=1.1683.23406&cc=US&cont=NA&cls=C&repeat=0&htmLcy=924	false		high
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453839534&pageID=per_home&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=2	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839527&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32	true	Avira URL Cloud: phishing	unknown
https://www17.wellsfargomedia.com/assets/images/contextual/responsive/lpromo/wfi_ph_g_1199830824_1600x700.jpg	false		high
https://idsync.rlcdn.com/386076.gif?partner_uid=ZGQAA2ees2EAAAAIPhmVAw%3D%3D&gdpr=0&gdpr_consent=	false		high
https://getwellslogsnowonline.vercel.app/target/offers/conversations	true	Avira URL Cloud: phishing	unknown
https://www17.wellsfargomedia.com/assets/images/rwd/Native_App_Phone_Personal_v8.png	false		high
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854943&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8	true	Avira URL Cloud: phishing	unknown
https://p.dtsan.net/dtsa.js	false		high
https://pd.sharethis.com/pd/dtscout	false		high
https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-sbd.woff2	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/css/ps-homepage.ae488a2de98b84f77de2.css	true	Avira URL Cloud: phishing	unknown
https://tags.crwdcntrl.net/lt/c/3825/lt.min.js	false		high
https://getwellslogsnowonline.vercel.app/js/wfui-container-bottom.js/assets/js/wfui/ndep/websdk/nuance-websdk-loader.js	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/	true		unknown
https://getwellslogsnowonline.vercel.app/images/wf_logo_220x23.png	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453854946&pageID=undefined&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarqueeOffer	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/HYeWm0	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453839532&pageID=per_home&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=1	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-lt.woff2	true	Avira URL Cloud: phishing	unknown
https://ic.tynt.com/b/p?id=wu!&lm=0&ts=1738453856261&dn=AFWU&iso=0&pu=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&r=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&t=Error&chpv=10.0.0&chuav=Google%20Chrome%3Bv%3D117.0.5938.149%2C%20Not%3BA%3DBrand%3Bv%3D8.0.0.0%2C%20Chromium%3Bv%3D117.0.5938.149&chp=Windows&chmob=0&chua=Google%20Chrome%3Bv%3D117%2C%20Not%3BA%3DBrand%3Bv%3D8%2C%20Chromium%3Bv%3D117	false		high
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0&verify=true	false		high
https://t.dtscout.com/pv/?_a=v&_h=getwellslogsnowonline.vercel.app&_ss=2fr49utj3d&_pv=1&_ls=0&_u1=1&_u3=1&_cc=us&_pl=d&_cbid=123c&_cb=_dtspv.c	false		high
https://i.simpli.fi/dpx?cid=11411&us_privacy=&33random=1738453858275.6&ref=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F	false		high
https://getwellslogsnowonline.vercel.app/images/bg2.jpg	true	Avira URL Cloud: phishing	unknown
https://pxdrop.lijit.com/d/a.gif?cls=sync&dmn=getwellslogsnowonline.vercel.app&GDPR_v2=&us_privacy=&pubid=dt_scout&gpp=&gpp_sid=&tt=t.dhj&cid=c026&lbl=lijit&flbl=pxcel&ll=d&ver=1.1683.885&ell=d&cck=ljt_reader&pn=%2Ferror.html&qs=na&rdn=getwellslogsnowonline.vercel.app&rpn=%2F&rqs=na&cc=US&cont=NA&evid=nhL7DTZAKs1hg_pM6Nrq&urls=&rnd=1738453864860&cid=c026&version=1.1683.885&cc=US&cont=NA&cls=sync&repeat=0&htmLcy=935&sndBcn=1	false		high
https://rc.rlcdn.com/361726.gif?n=1&33random=1738453858275.5	false		high
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453864077&event=LinkActivated&eventType=click&eventDescription=SubmitSignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8&linkText=	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839526&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/auth/login/static/js/general_alt.js?1js	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854940&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-bd.woff2	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453854948&pageID=undefined&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=1	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839523&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP	true	Avira URL Cloud: phishing	unknown
https://ps.eyeota.net/pixel/bounce/?pid=1mpb5m0&t=gif&gdpr=0&gdpr_consent=	false		high
https://getwellslogsnowonline.vercel.app/images/responsive-sprite-v10.png	true	Avira URL Cloud: phishing	unknown
https://idsync.rlcdn.com/395886.gif?partner_uid=3650262495646449678	false		high
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839529&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A242-223859-16%7Etcm%3A91-223657-32	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854947&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A242-228778-16%7Etcm%3A91-228643-32	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/images/position-2-bg-gradient.png	true	Avira URL Cloud: phishing	unknown
https://rc.rlcdn.com/361726.gif?n=1&33random=1738453858275.2	false		high
https://getwellslogsnowonline.vercel.app/images/box.png	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453839536&pageID=per_home&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=3	true	Avira URL Cloud: phishing	unknown
https://match.adsrvr.org/track/cmb/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0	false		high
https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-rg.woff2	true	Avira URL Cloud: phishing	unknown
https://de.tynt.com/deb/v2?id=wu!&dn=AFWU&cc=1&chpv=10.0.0&chuav=Google%20Chrome%3Bv%3D117.0.5938.149%2C%20Not%3BA%3DBrand%3Bv%3D8.0.0.0%2C%20Chromium%3Bv%3D117.0.5938.149&chp=Windows&chmob=0&chua=Google%20Chrome%3Bv%3D117%2C%20Not%3BA%3DBrand%3Bv%3D8%2C%20Chromium%3Bv%3D117&r=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&pu=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html	false		high
https://pxdrop.lijit.com/a/t_.htm?ver=1.1683.885&cid=c026&cls=sync	false		high
https://i.simpli.fi/dpx?cid=11411&us_privacy=&33random=1738453858275.3&ref=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F	false		high
https://getwellslogsnowonline.vercel.app/favicon.ico	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839535&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A242-228805-16%7Etcm%3A91-228643-32	true	Avira URL Cloud: phishing	unknown
https://t.sharethis.com/1/k/t.dhj?cid=c010&cls=C&rnd=0.48747477896910496&stid=ZGQAA2ees2EAAAAIPhmVAw%3D%3D	false		high
https://match.adsrvr.org/track/cmf/generic?ttd_pid=1h1y1a7&ttd_tpi=1&gdpr=0&gdpr_consent=	false		high
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854951&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A242-228805-16%7Etcm%3A91-228643-32	true	Avira URL Cloud: phishing	unknown
https://getwellslogsnowonline.vercel.app/images/home.png	true	Avira URL Cloud: phishing	unknown
https://c1.wfinterface.com/tracking/hp/utag.js	false		high
https://e.dtscout.com/e/?v=1a&pid=5200&site=1&l=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&j=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F	false		high
https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453854950&pageID=undefined&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=2	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_141.4.dr, chromecache_121.4.dr	false		high
https://github.com/zloirock/core-js	chromecache_221.4.dr, chromecache_189.4.dr, chromecache_155.4.dr, chromecache_124.4.dr	false		high
https://www17.wellsfargomedia.com/assets/images/logos/wellsfargo/logo_974x1050.png	chromecache_218.4.dr	false		high
https://www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_134511123	chromecache_165.4.dr, chromecache_218.4.dr	false		high
https://www.google.com	chromecache_121.4.dr	false		high
https://www17.wellsfargomedia.com/assets/images/contextual/responsive/lpromo/wfi_ph_g_1199830824_160	chromecache_165.4.dr, chromecache_218.4.dr	false		high
https://c1.wfinterface.com/rtto/	chromecache_165.4.dr, chromecache_218.4.dr	false		high
https://t.dtscout.com/idg/?su=	chromecache_149.4.dr, chromecache_170.4.dr	false		high
https://t.dtscdn.com/widget/?d=	chromecache_149.4.dr, chromecache_170.4.dr	false		high
https://github.com/zloirock/core-js/blob/v3.21.1/LICENSE	chromecache_221.4.dr, chromecache_189.4.dr, chromecache_155.4.dr, chromecache_124.4.dr	false		high
https://static.wellsfargo.com/tracking/gb/detector-dom.min.js	chromecache_152.4.dr	false		high
https://t.dtscout.com/udg/?su=	chromecache_149.4.dr, chromecache_170.4.dr	false		high
https://www17.wellsfargomedia.com/assets/images/contextual/responsive/smlpromo/wfi000_ph_g_900217040	chromecache_165.4.dr, chromecache_218.4.dr	false		high
https://cct.google/taggy/agent.js	chromecache_141.4.dr, chromecache_121.4.dr	false		high
https://pd.sharethis.com/pd/dtscout?_t_=px&url=	chromecache_188.4.dr, chromecache_169.4.dr	false		high
https://api.rlcdn.com/api/identity/idl?pid=1317	chromecache_152.4.dr	false		high
https://gbxreport-prod.wf.com/glassbox/reporting/0C458F45-AC71-02CE-34D8-401C8A313B38/cls_report	chromecache_152.4.dr	false		high
https://schema.org/	chromecache_165.4.dr, chromecache_218.4.dr	false		high
https://static.wellsfargo.com/tracking/ytc/ytc.js	chromecache_152.4.dr	false		high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_141.4.dr, chromecache_121.4.dr	false		high
https://static.wellsfargo.com/tracking/hp/utag.js	chromecache_152.4.dr	false		high
https://pd.sharethis.com/pd/error?e=	chromecache_188.4.dr, chromecache_169.4.dr	false		high
https://docs.tealium.com/platforms/javascript/debugging/	chromecache_152.4.dr	false	Avira URL Cloud: safe	unknown
https://www.wellsfargo.com/	chromecache_165.4.dr, chromecache_218.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	userstatics.com	United States	13335	CLOUDFLARENETUS	false
149.56.240.131	unknown	Canada	16276	OVHFR	false
149.56.240.132	s4.histats.com	Canada	16276	OVHFR	false
104.21.80.1	unknown	United States	13335	CLOUDFLARENETUS	false
35.234.162.151	i.simpli.fi	United States	15169	GOOGLEUS	false
3.124.210.90	ps.eyeota.net	United States	16509	AMAZON-02US	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
172.67.74.186	unknown	United States	13335	CLOUDFLARENETUS	false
65.9.66.104	tags.crwdcntrl.net	United States	16509	AMAZON-02US	false
34.117.77.79	ml314.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
172.67.70.180	t.dtscout.com	United States	13335	CLOUDFLARENETUS	false
2.21.65.136	e213908.b.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false
3.33.220.150	unknown	United States	8987	AMAZONEXPANSIONGB	false
64.29.17.193	unknown	Canada	13768	COGECO-PEER1CA	false
104.18.12.146	unknown	United States	13335	CLOUDFLARENETUS	false
3.64.16.188	unknown	United States	16509	AMAZON-02US	false
104.102.62.193	e15118.a.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
54.38.113.2	pixel.onaudience.com	France	16276	OVHFR	false
52.59.135.49	httplogserver-lb.global.unified-prod.sharethis.net	United States	16509	AMAZON-02US	false
104.26.10.2	e.dtscout.com	United States	13335	CLOUDFLARENETUS	false
107.178.254.65	pippio.com	United States	15169	GOOGLEUS	false
172.67.167.79	a.dtsan.net	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
64.29.17.1	getwellslogsnowonline.vercel.app	Canada	13768	COGECO-PEER1CA	true
35.244.174.68	idsync.rlcdn.com	United States	15169	GOOGLEUS	false
104.26.12.60	t.dtscdn.com	United States	13335	CLOUDFLARENETUS	false
52.223.40.198	match.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
57.128.187.108	pixel.nordicdataresources.net	Belgium	2686	ATGS-MMD-ASUS	false
104.21.91.54	p.dtsan.net	United States	13335	CLOUDFLARENETUS	false
2.21.65.149	e114945.b.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false
104.18.13.146	cdn.tynt.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
87.248.119.251	dcs-ups.g03.yahoodns.net	United Kingdom	203220	YAHOO-DEBDE	false
18.196.170.244	thirdparty-logserver-lb.global.unified-prod.sharethis.net	United States	16509	AMAZON-02US	false
67.202.105.33	de.tynt.com	United States	32748	STEADFASTUS	false
67.202.105.32	unknown	United States	32748	STEADFASTUS	false
2.21.65.158	unknown	European Union	20940	AKAMAI-ASN1EU	false
104.20.12.182	unknown	United States	13335	CLOUDFLARENETUS	false
67.202.105.34	unknown	United States	32748	STEADFASTUS	false
2.21.65.153	e167121.b.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false
2.21.65.154	unknown	European Union	20940	AKAMAI-ASN1EU	false
104.20.11.182	s10.histats.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
104.26.11.2	unknown	United States	13335	CLOUDFLARENETUS	false
13.32.110.126	unknown	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.10

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1604811
Start date and time:	2025-02-02 00:49:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://getwellslogsnowonline.vercel.app/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@20/224@122/44
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, Sgrmuserer.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.212.142, 142.251.168.84, 142.250.184.227, 142.250.186.46, 142.250.185.142, 142.250.185.206, 172.217.23.104, 142.250.181.232, 142.250.181.238, 142.250.186.42, 142.250.74.202, 142.250.181.234, 142.250.186.170, 172.217.18.106, 142.250.185.234, 142.250.185.202, 142.250.185.74, 142.250.186.74, 142.250.185.138, 142.250.185.106, 172.217.16.202, 142.250.186.138, 142.250.185.170, 216.58.212.138, 142.250.186.106, 84.201.210.23, 142.250.186.174, 216.58.206.78, 13.107.246.61, 184.28.90.27, 20.12.23.50
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, www.googletagmanager.com, clients.l.google.com, www.google-analytics.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://getwellslogsnowonline.vercel.app/

Input	Output
URL: https://getwellslogsnowonline.vercel.app Model: Joe Sandbox AI	```json{ "brand": "Wells Fargo", "brand_classification": "wellknown", "legit_url": "https://www.wellsfargo.com", "similarity": 6, "spoofed": 7, "reasoning": "The URL 'getwellslogsnowonline.vercel.app' appears to target the brand 'Wells Fargo' by including 'wells' in its structure, which is a key component of the brand's name. The use of 'logs' could be interpreted as a reference to 'login', a common target for phishing attempts. The domain 'vercel.app' is a legitimate hosting platform, which could be used for various purposes, but in this context, it does not provide a clear indication of a legitimate association with Wells Fargo. The similarity score is based on the inclusion of 'wells' and the potential for confusion with login-related activities. The spoofed score is high due to the potential for user confusion, especially if the site mimics a login page. However, without further context or content analysis, it's not possible to definitively conclude malicious intent."}
URL: https://getwellslogsnowonline.vercel.app
URL: https://getwellslogsnowonline.vercel.app/#/auth/st... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be primarily focused on analytics and tracking functionality, which is a common practice for legitimate websites. While it uses some legacy APIs like `XDomainRequest`, the overall behavior does not indicate any high-risk activities. The script sets up variables for various configuration parameters and includes a Google Analytics tag, which is a common practice for web analytics. Therefore, this script is likely low-risk and primarily used for legitimate purposes." }
<!DOCTYPE html><html class="" lang="en"><head> <script src="js/general_alt.js" nonce=""></script> <script type="text/javascript" nonce=""> var iaCallSwitch = "on"; var logInfoSwitch = true; var iaCallTimeout = "1000"; var pageID = "per_home"; varplacementName="WF_CON_HP_PRIMARY_BNR" var accounts_url = "#"; var hp_prefetch_value = "true"; var rwd = "true"; var user = "sign_on"; </script> Google tag (gtag.js) --> <script async src="https://www.googletagmanager.com/gtag/js?id=G-5Z8C8NSVHK"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-5Z8C8NSVHK'); </script> <script type="text/javascript" src="js/homepage_iaoffer.e2e5b96e43979f8bc7a0.js" nonce=""></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Wells Fargo Bank \| Financial Services & Online Banking</title> <script type="application/ld+json" nonce=""> { "@context": "https://schema.org/", "@type": "Organization", "name": "Wells Fargo Bank Branch & Online Banking Services", "url": "https://www.wellsfargo.com/", "logo":"https://www17.wellsfargomedia.com/assets/images/logos/wellsfargo/logo_974x1050.png", "subOrganization": [ { "@type": "BankOrCreditUnion", "name": "Wells Fargo", "description": "Open checking accounts, savings accounts, CDs, interest bearing bank accounts, loans, lines of credit, mortgages, credit cards, investment accounts, retirement and wealth management services. View the latest interest rates and additional banking services and support available for Wells Fargo customers and community services. Browse the full site for personal banking, consumer banking, business banking, corporate banking, commercial and investment banking and financial education articles. Get insights from financial experts and resources to improve your financial health. Visit a Wells Fargo branch near you, or login to manage your accounts with mobile banking and online banking with Wells Fargo Online", "logo": "https://www17.wellsfargomedia.com/assets/images/logos/wellsfargo/logo_974x1050.png", "url": "https://www.wellsfargo.com/", "image":"https://www17.wellsfargomedia.com/assets/images/logos/wellsfargo/logo_974x1050.png" }, { "@type": "Corporation", "name": "Wells Fargo Bank Branch & Online Banking Services", "description": "Open checking accounts, savings accounts, CDs, interest bearing bank accounts, loans, lines of credit, mortgages, credit cards, investment accounts, retirement and wealth management services. View the latest interest rates and additional banking services and support available for Wells Fargo customers and community services. Browse the full site for personal banking, consumer banking, business banking, corporate banking, commercial and investment banking and financial education articles. Get insights from financial experts and resources to improve your financial health. Visit a Wells Fargo branch near you, or login to manage your accounts with mobile banking and online banking with Wells Fargo Online", "logo": "https://www17.wellsfargomedia.com/assets/images/logos/wellsfargo/logo_974x1050.png", "url": "https://www.wellsfargo.com/", "image":"https://www17.wellsfargomedia.com/assets/images/logos/wellsfargo/logo_974x1050.png" } ] } </script> <link rel="shortcut icon" href="favicon.ico"> <link rel="apple-touch-icon" sizes="120x120" href="images/apple-touch-icon_120x120.png"> <link rel="apple-touch-icon" sizes="180x180" href="images/apple-touch-icon_180x180.png"> <link rel="icon" sizes="128x128" href="images/icon-normal_128x128.png"> <link rel="icon" sizes="192x192" href="images/icon-hires_192x192.png"> <link rel="icon" type="image/png" href="images/favicon_48x48.png"> <script nonce=""> // if this line executes, then javascript is turned
URL: https://getwellslogsnowonline.vercel.app/js/genera... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This JavaScript snippet demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. The use of the `Function` constructor, `eval`, and the custom `toString` method to override the default `Function.prototype.toString` behavior are all indicators of potential malicious intent. Additionally, the script appears to be collecting and transmitting user data to external domains, which poses a significant risk of data exfiltration. While the script may have some legitimate functionality, the overall risk level is high due to the presence of these concerning behaviors." }
(function(){(function(a){"use strict";var b=Function.prototype.call.bind(Function.prototype.toString);var c=[];var d=[];var e={toString:function(){var f=c.lastIndexOf(this);if(f>=0){return d[f]}return b(this)}};e.toString.prototype=void 0;c=[e.toString];d=[b(Function.prototype.toString)];function g(h,i){if(typeof i!=="function"){return}try{var j=e.toString.call(i);d.push(j);c.push(h);if(Function.prototype.toString!==e.toString){Function.prototype.toString=e.toString}}catch(k){}}var l="ZT4tcOwEFkVEzfiT1T6u";var m=Object.call.bind(Object.bind,Object.call);var n=m(Object.call);var o=Array.prototype.push;var p=Array.prototype.indexOf;var q=Array.prototype.concat;var r=Array.prototype.slice;function s(){return{__callbacks:[],notify:function(t){var u;var v=n(r,this.__callbacks);var w=v.length;for(var x=w-1;x>=0;--x){try{var y=v[x];if(y!=null){var z=y(t,u);if(z!=null){u=z}}}catch(A){}}return u},register:function(B){n(o,this.__callbacks,B)},unregister:function(C){var D=n(p,this.__callbacks,C);if(D!==-1){this.__callbacks[D]=null}},__merge:function(E){if(E!=null){this.__callbacks=n(q,this.__callbacks,E.__callbacks)}}}}var F=Object.hasOwnProperty;var G=Object.getPrototypeOf;var H=Object.getOwnPropertyDescriptor;var I=Object.getOwnPropertyNames;var J=Object.defineProperty;var K=Object.call.bind(Object.bind,Object.call);var L=K(Object.apply);var M=K(Object.call);var N=Object.create;var O=Function.prototype.bind;var P=Array.prototype.push;var Q=Array.prototype.indexOf;var R=["arguments","caller"];var S;if(typeof Reflect!=="undefined"&&Reflect!=null&&typeof Reflect.construct==="function"){S=Reflect.construct}else{S=function(T,U){var V=[null];L(P,V,U);var W=L(O,T,V);return new W}}function X(Y,Z){var ba=Y;while(ba!=null){var bb=H(ba,Z);if(bb!=null){return{containingObj:ba,desc:bb}}ba=G(ba)}return null}var bc=N(null);function bd(be){if(be==null){return}bc=be}function bf(bg,bh){var bi=bc[bh];if(bi==null){return null}for(var bj=0;bj<bi.length;++bj){var bk=bi[bj];if(bg===bk.object){return bk}}return null}function bl(bm,bn){var bo=bc[bm];if(bo==null){bo=[];bc[bm]=bo}M(P,bo,bn)}function bp(bq,br){var bs=X(bq,br);if(bs==null){return void 0}var bt=bs.containingObj,bu=bs.desc;var bv=bf(bt,br);if(bv!=null){return bv.original}var bw=bu.value;bl(br,{object:bt,original:bw});return bw}function bx(by,bz){var bA=X(by,bz);if(bA==null){return void 0}var bB=bA.containingObj,bC=bA.desc;var bD=bf(bB,bz);if(bD!=null){return bD.original}if(M(F,bC,"value")){return void 0}var bE=N(null);if(bC.get!=null){bE.get=bC.get}if(bC.set!=null){bE.set=bC.set}bl(bz,{object:bB,original:bE});return bE}function bF(bG,bH,bI){if(bI===void 0){bI=false}var bJ=X(bG,bH);if(bJ==null){return null}var bK=bJ.containingObj,bL=bJ.desc;var bM=bL.configurable,bN=bL.writable;var bO=bL.value;if(!M(F,bL,"value")){return null}var bP=N(null);bP.value=bO;if(bM===false&&bN===false\|\|typeof bO!=="function"){return{originals:bP}}var bQ=bf(bK,bH);if(bQ!=null){if(bQ.result!=null){return bQ.result}bO=bQ.original;bP.value=bO}var bR=s();var bS=s();bL.value=function bT(){var bU=arguments;var bV=bR.notify({args:bU,thisObj:this});if(bV){if(bV.bypassResult!=null){if(bV.bypassResult.throw){throw bV.bypassResult.value}return bV.bypassResult.value}else if(bV.args!=null){bU=bV.args}}var bW;var bX={args:arguments,thisObj:this,threw:true,result:null};try{if(bI&&this instanceof bT){bW=S(bO,bU)}else{bW=L(bO,this,bU)}bX={args:arguments,thisObj:this,threw:false,result:bW}}finally{var bY=bS.notify(bX);if(bY&&bY.bypassResult!=null){if(bY.bypassResult.throw){throw bY.bypassResult.value}return bY.bypassResult.value}}return bW};var bZ=bL.value;g(bZ,bO);var ca=I(bO);for(var cb=0;cb<ca.length;++cb){var cc=ca[cb];if(M(Q,R,cc)===-1){var cd=H(bZ,cc);if(cd==null\|\|cd.configurable===true\|\|cd.writable===true){var ce=H(bO,cc);if(ce!=null){if(cd!=null&&cd.configurable===false&&ce.configurable===true){}else{J(bZ,cc,ce)}}}}}try{if(!M(F,bO,"prototype")){bZ.prototype=void 0}}catch(cf){}J(bK,bH,bL);var cg={onBeforeInvoke:bR,onAfterInvoke:bS,original
URL: https://getwellslogsnowonline.vercel.app/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be related to analytics or tracking functionality, with variables for controlling the behavior of the script. While it includes some legacy practices like using string values for timeouts, there are no clear indicators of high-risk behaviors like dynamic code execution or data exfiltration. The script seems to be focused on page-level interactions and user state, which is common for analytics and tracking purposes. Overall, the risk level is low, and the script is likely benign with some outdated implementation details." }
var iaCallSwitch = "on"; var logInfoSwitch = true; var iaCallTimeout = "1000"; var pageID = "per_home"; varplacementName="WF_CON_HP_PRIMARY_BNR" var accounts_url = "#"; var hp_prefetch_value = "true"; var rwd = "true"; var user = "sign_on";
URL: https://getwellslogsnowonline.vercel.app/js/homepa... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a larger web application and does not demonstrate any high-risk behaviors. It primarily handles deferred image loading, conversion of HTML sup tags to Unicode characters, and an asynchronous call to retrieve content. While the code uses some legacy APIs like `XDomainRequest`, it does not exhibit any clear signs of malicious intent or data exfiltration. The script seems to be focused on improving the user experience and performance of the web application, which is a legitimate use case. Therefore, the overall risk score is assessed as low (3)." }
(()=>{var t={659:(t,e,r)=>{r(1249),r(9554),r(1539),r(4747),r(7327),r(1038),r(8783),r(3210);t.exports={deferredImages:function(){var t,e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[];(t=e.length?e.map((function(t){return document.querySelector(t)})):document.getElementsByTagName("img")).length&&Array.from(t).filter(Boolean).forEach((function(t){if(t.classList.contains("deferred")){var e=t.getAttribute("data-deferred-src");e&&t.setAttribute("src",e),t.removeAttribute("data-deferred-src"),t.classList.toggle("deferred")}}))},convertSupTagToUnicode:function(){document.querySelectorAll("sup").forEach((function(t){"SM"===t.innerHTML.trim()&&(t.innerHTML="℠"),"TM"===t.innerHTML.trim()&&(t.innerHTML="™"),""===t.innerHTML.trim()&&(t.innerHTML="©"),""===t.innerHTML.trim()&&(t.innerHTML="®"),""===t.innerHTML.trim()&&(t.innerHTML="℗")}))}}},6548:(t,e,r)=>{r(2772);var n,o,a=r(7109),i=a.postLogger,c=a.timestamp,s=a.loadResponseData,u=a.isVisible,l={},d="",p=new Date,f=null,m=window.iaCallTimeout\|\|1e3,v=!1,g=window.iaCallSwitch,h=window.pageID\|\|"",x=window.pageURL\|\|null,y=window.placementName\|\|"WF_CON_HP_PRIMARY_BNR",b={};document.documentElement.clientWidth>=1080&&(window.navigator.userAgent.indexOf("Edge")>-1\|\|window.navigator.userAgent.indexOf("Mozilla")>-1)&&(m=1450),l.init=function(t,e){var r=document.documentElement.lang\|\|"en",o="per_home"===e?"/target/offers/conversations":"/as/target/offers/conversations";try{return"on"===t?(u(!1),n=new XMLHttpRequest,b={placementName:y,pageURL:x,language:r,pageID:h,rwd:"true"},n.open("POST",o,!0),!0):(u(!0,d='IA Async call error catched in init method and the error is iaCallSwitchlog not "on".'),!1)}catch(t){return u(!0,d="IA Async call error catched in init method and the error is "+t+"."),!1}},l.executexhrResponse=function(t,e,r){e&&window.clearTimeout(e),r&&window.logInfoSwitch&&p?(f=new Date,d="xhr status code 200. Start Time="+c(p)+" and End Time="+c(f)+", IA timeout response time="+(f.getTime()-p.getTime())+" ms",i(d)):"complete"===document.readyState\|\|"interactive"===document.readyState?s(t):document.onreadystatechange=function(){"interactive"===document.readyState&&s(t)}},l.executexhrCall=function(t,e,r){4===t.readyState?200===t.status?l.executexhrResponse(t,e,r):(d="IA Async call status is not 200.",l.executeClearTimeout(e)):(d="IA Async call ready state is not 4.",l.executeClearTimeout(e))},l.ontimeout=function(){v=!0,window.logInfoSwitch&&p&&(f=new Date,d="IA Async call is timedout. Request Start Time="+c(p)+" and End Time="+c(f)+", Total Time Taken="+(f.getTime()-p.getTime())+" ms",u(!0,d))},l.xhrOnload=function(){try{l.executexhrCall(n,o,v)}catch(t){d="IA Async call error catched in onload and the error is "+t+".",l.executeClearTimeout(o)}return!1},l.executeClearTimeout=function(t){return t&&window.clearTimeout(t),u(!0,d),!1},l.xhrOnError=function(){d="IA Async call error catched in onerror."+n.status,l.executeClearTimeout(o)},l.onInitialLoad=function(t){(t\|\|l.init(g,h))&&(p=new Date,n.onload=l.xhrOnload,n.onerror=l.xhrOnError,n.setRequestHeader("Content-Type","application/json; charset=UTF-8"),n.send(JSON.stringify(b)),o=window.setTimeout(l.ontimeout,m))},l.onInitialLoad(),t.exports={IAOffer:l}},7109:(t,e,r)=>{r(6699),r(2023),r(4916),r(5306),r(2222),r(3123),r(1539),r(9714),r(9600),r(7941),r(9720),r(4553),r(561),r(6992),r(8559),r(9554),r(4747);var n=r(6964).renderInnerItems,o=r(5957).renderCardComponent,a=r(7920).createRskMarqueeHtml,i=r(659).deferredImages,c=function(t){var e,r,n;try{e="uid="+(new Date).getTime()+", ",r={message:e+t,url:window.location.href,logType:"SUCCESS"===t?t:"ERROR",detailedMessage:"IA Async call Logging"},(n=new XMLHttpRequest).open("POST","/as/jsLog",!0),document.onreadystatechange=function(){"complete"===document.readyState&&setTimeout((function(){n.setRequestHeader("Content-Type","application/json; charset=UTF-8"),n.send(JSON.stringify(r))}),200)}}catch(t){}return!1},s=function(t,e){var r=document.createElement("style"),n
URL: https://getwellslogsnowonline.vercel.app/error.htm... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a tracking script from the Histats service, which is a legitimate analytics platform. While it uses some legacy practices like `Histats.fasi` and `Histats.track_hits`, these are common in older analytics solutions and do not pose a significant security risk. The script is not attempting to execute dynamic code, exfiltrate sensitive data, or interact with suspicious domains. Overall, this script is likely used for legitimate analytics and tracking purposes, and the risk score is low." }
var _Hasync= _Hasync\|\| []; _Hasync.push(['Histats.start', '1,4854432,4,0,0,0,00010000']); _Hasync.push(['Histats.fasi', '1']); _Hasync.push(['Histats.track_hits', '']); (function() { var hs = document.createElement('script'); hs.type = 'text/javascript'; hs.async = true; hs.src = ('//s10.histats.com/js15_as.js'); (document.getElementsByTagName('head')[0] \|\| document.getElementsByTagName('body')[0]).appendChild(hs); })();
URL: https://getwellslogsnowonline.vercel.app/js/ps-hom... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns: 1. It uses the `eval()` function to execute dynamic code, which is a high-risk indicator (3 points). 2. It sends user data to external domains via `XHR` or `fetch` calls, which is another high-risk indicator (3 points). 3. The code appears to be heavily obfuscated, which is also a high-risk indicator (3 points). However, the script also includes some legitimate functionality, such as intersection observation and DOM manipulation, which are not inherently malicious. Additionally, the script does not appear to be targeting any specific domains, and the data transmission may be for legitimate analytics or telemetry purposes. Given the mix of high-risk and moderate-risk behaviors, along with the potential for legitimate use cases, the overall risk score is assessed as 6 (Medium Risk). Further investigation may be needed to determine the true intent and purpose of this script." }
(()=>{var e={3905:(e,t,n)=>{var r=n(8698);n(9653),n(6977),n(9600),n(1249),n(9554),n(1539),n(5212),n(7327),n(7042),n(2707),n(4916),n(3123),n(4678),n(2772),n(561),n(4747),function(){"use strict";if("object"===("undefined"==typeof window?"undefined":r(window)))if("IntersectionObserver"in window&&"IntersectionObserverEntry"in window&&"intersectionRatio"in window.IntersectionObserverEntry.prototype)"isIntersecting"in window.IntersectionObserverEntry.prototype\|\|Object.defineProperty(window.IntersectionObserverEntry.prototype,"isIntersecting",{get:function(){return this.intersectionRatio>0}});else{var e=function(e){for(var t=window.document,n=i(t);n;)n=i(t=n.ownerDocument);return t}(),t=[],n=null,o=null;s.prototype.THROTTLE_TIMEOUT=100,s.prototype.POLL_INTERVAL=null,s.prototype.USE_MUTATION_OBSERVER=!0,s._setupCrossOriginUpdater=function(){return n\|\|(n=function(e,n){o=e&&n?d(e,n):{top:0,bottom:0,left:0,right:0,width:0,height:0},t.forEach((function(e){e._checkForIntersections()}))}),n},s._resetCrossOriginUpdater=function(){n=null,o=null},s.prototype.observe=function(e){if(!this._observationTargets.some((function(t){return t.element==e}))){if(!e\|\|1!=e.nodeType)throw new Error("target must be an Element");this._registerInstance(),this._observationTargets.push({element:e,entry:null}),this._monitorIntersections(e.ownerDocument),this._checkForIntersections()}},s.prototype.unobserve=function(e){this._observationTargets=this._observationTargets.filter((function(t){return t.element!=e})),this._unmonitorIntersections(e.ownerDocument),0==this._observationTargets.length&&this._unregisterInstance()},s.prototype.disconnect=function(){this._observationTargets=[],this._unmonitorAllIntersections(),this._unregisterInstance()},s.prototype.takeRecords=function(){var e=this._queuedEntries.slice();return this._queuedEntries=[],e},s.prototype._initThresholds=function(e){var t=e\|\|[0];return Array.isArray(t)\|\|(t=[t]),t.sort().filter((function(e,t,n){if("number"!=typeof e\|\|isNaN(e)\|\|e<0\|\|e>1)throw new Error("threshold must be a number between 0 and 1 inclusively");return e!==n[t-1]}))},s.prototype._parseRootMargin=function(e){var t=(e\|\|"0px").split(/\s+/).map((function(e){var t=/^(-?\d*\.?\d+)(px\|%)$/.exec(e);if(!t)throw new Error("rootMargin must be specified in pixels or percent");return{value:parseFloat(t[1]),unit:t[2]}}));return t[1]=t[1]\|\|t[0],t[2]=t[2]\|\|t[0],t[3]=t[3]\|\|t[1],t},s.prototype._monitorIntersections=function(t){var n=t.defaultView;if(n&&-1==this._monitoringDocuments.indexOf(t)){var r=this._checkForIntersections,o=null,a=null;this.POLL_INTERVAL?o=n.setInterval(r,this.POLL_INTERVAL):(c(n,"resize",r,!0),c(t,"scroll",r,!0),this.USE_MUTATION_OBSERVER&&"MutationObserver"in n&&(a=new n.MutationObserver(r)).observe(t,{attributes:!0,childList:!0,characterData:!0,subtree:!0})),this._monitoringDocuments.push(t),this._monitoringUnsubscribes.push((function(){var e=t.defaultView;e&&(o&&e.clearInterval(o),u(e,"resize",r,!0)),u(t,"scroll",r,!0),a&&a.disconnect()}));var s=this.root&&(this.root.ownerDocument\|\|this.root)\|\|e;if(t!=s){var l=i(t);l&&this._monitorIntersections(l.ownerDocument)}}},s.prototype._unmonitorIntersections=function(t){var n=this._monitoringDocuments.indexOf(t);if(-1!=n){var r=this.root&&(this.root.ownerDocument\|\|this.root)\|\|e,o=this._observationTargets.some((function(e){var n=e.element.ownerDocument;if(n==t)return!0;for(;n&&n!=r;){var o=i(n);if((n=o&&o.ownerDocument)==t)return!0}return!1}));if(!o){var a=this._monitoringUnsubscribes[n];if(this._monitoringDocuments.splice(n,1),this._monitoringUnsubscribes.splice(n,1),a(),t!=r){var s=i(t);s&&this._unmonitorIntersections(s.ownerDocument)}}}},s.prototype._unmonitorAllIntersections=function(){var e=this._monitoringUnsubscribes.slice(0);this._monitoringDocuments.length=0,this._monitoringUnsubscribes.length=0;for(var t=0;t<e.length;t++)e[t]()},s.prototype._checkForIntersections=function(){if(this.root\|\|!n\|\|o){var e=this._rootIsInDom(),t=e?this._getRootRect():{top:0,bottom:0,left:0,right:0,width:0,heig
URL: https://getwellslogsnowonline.vercel.app/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Open an eligible checking account with qualifying electronic deposits", "prominent_button_name": "Get started >>", "text_input_field_labels": [ "Username", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "finance" } Google indexed: False

URL: https://getwellslogsnowonline.vercel.app/ Model: Joe Sandbox AI	{ "brands": [ "Wells Fargo" ] } Google indexed: False
	{ "brands": [ "Wells Fargo" ] } Google indexed: False
URL: https://getwellslogsnowonline.vercel.app/ Model: Joe Sandbox AI	```json{ "legit_domain": "wellsfargo.com", "classification": "wellknown", "reasons": [ "The brand 'Wells Fargo' is a well-known financial institution.", "The legitimate domain for Wells Fargo is 'wellsfargo.com'.", "The URL 'getwellslogsnowonline.vercel.app' does not match the legitimate domain.", "The URL contains suspicious elements such as 'getwellslogsnowonline', which is not associated with Wells Fargo.", "The use of 'vercel.app' as a domain extension is unusual for a financial institution like Wells Fargo.", "The presence of input fields for 'Username' and 'Password' on a non-legitimate domain is a common phishing tactic." ], "riskscore": 9} Google indexed: False
URL: getwellslogsnowonline.vercel.app Brands: Wells Fargo Input Fields: Username, Password
URL: https://getwellslogsnowonline.vercel.app/error.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Log in issues detected in your Wells Fargo Account", "prominent_button_name": "Sign On", "text_input_field_labels": [ "Username", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": true, "page_classification": "finance" } Google indexed: False

URL: https://getwellslogsnowonline.vercel.app/error.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Log in issues detected in your Wells Fargo Account", "prominent_button_name": "Sign On", "text_input_field_labels": [ "Username", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": true, "page_classification": "finance" } Google indexed: False

Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854945&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A242-223859-16%7Etcm%3A91-223657-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/favicon_48x48.png	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839538&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/tick.png	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/position-3-bg-gradient.png	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854942&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/bg.jpg	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839527&event=DisplayFatNav&eventType=Presented&eventDescription=DisplayFatNav&clist=tcm%3A84-226512-16%7Etcm%3A91-226306-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453839534&pageID=per_home&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=2	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854954&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A182-228910-16%7Etcm%3A91-223671-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/target/offers/conversations	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854943&event=DisplaySignOn&eventType=Presented&eventDescription=DisplaySignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/js/wfui-container-bottom.js/assets/js/wfui/ndep/websdk/nuance-websdk-loader.js	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-sbd.woff2	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453854946&pageID=undefined&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarqueeOffer	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/css/ps-homepage.ae488a2de98b84f77de2.css	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/wf_logo_220x23.png	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/HYeWm0	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-lt.woff2	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453839532&pageID=per_home&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=1	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/bg2.jpg	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839523&event=PageLoad&eventType=PageLoad&eventDescription=PageOnLoad&device_type=DESKTOP	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453854948&pageID=undefined&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=1	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854940&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-bd.woff2	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453864077&event=LinkActivated&eventType=click&eventDescription=SubmitSignOn&clist=tcm%3A84-224415%7Etcm%3A83-2046-8&linkText=	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/auth/login/static/js/general_alt.js?1js	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839526&event=DisplayMasthead&eventType=Presented&eventDescription=DisplayMasthead&clist=tcm%3A84-224274-16%7Etcm%3A91-223647-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/responsive-sprite-v10.png	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839529&event=DisplayMarquee&eventType=Presented&eventDescription=DisplayMarquee&clist=tcm%3A242-223859-16%7Etcm%3A91-223657-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854947&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A242-228778-16%7Etcm%3A91-228643-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453839536&pageID=per_home&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=3	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=702-224111-64&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2F&cb=1738453839535&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A242-228805-16%7Etcm%3A91-228643-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/box.png	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/position-2-bg-gradient.png	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&pid=%23&pageUrl=https%3A%2F%2Fgetwellslogsnowonline.vercel.app%2Ferror.html&cb=1738453854951&event=DisplayMarketingSmallPromo&eventType=Presented&eventDescription=DisplayMarketingSmallPromo&clist=tcm%3A242-228805-16%7Etcm%3A91-228643-32	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/fonts/wellsfargosans-rg.woff2	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/images/home.png	Avira URL Cloud: Label: phishing
Source: https://getwellslogsnowonline.vercel.app/assets/images/global/s.gif?log=1&event=IADefaultOffer&cb=1738453854950&pageID=undefined&program=EventReporting&offterType=cmsDefault&eventDescription=DisplayCMSDefaultMarketingSmallPromoOffer&promoSlot=2	Avira URL Cloud: Label: phishing

Source: https://getwellslogsnowonline.vercel.app/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Wells Fargo' is a well-known financial institution., The legitimate domain for Wells Fargo is 'wellsfargo.com'., The URL 'getwellslogsnowonline.vercel.app' does not match the legitimate domain., The URL contains suspicious elements such as 'getwellslogsnowonline', which is not associated with Wells Fargo., The use of 'vercel.app' as a domain extension is unusual for a financial institution like Wells Fargo., The presence of input fields for 'Username' and 'Password' on a non-legitimate domain is a common phishing tactic. DOM: 1.0.pages.csv
Source: https://getwellslogsnowonline.vercel.app/error.html	Joe Sandbox AI: Score: 9 Reasons: The brand 'Wells Fargo' is a well-known financial institution., The legitimate domain for Wells Fargo is 'wellsfargo.com'., The URL 'getwellslogsnowonline.vercel.app' does not match the legitimate domain., The URL contains suspicious elements such as 'getwellslogsnowonline', which is not associated with Wells Fargo., The use of 'vercel.app' as a domain extension is unusual for a financial institution like Wells Fargo., The presence of input fields for 'Username' and 'Password' on a non-legitimate domain is a common phishing tactic. DOM: 2.1.pages.csv
Source: https://getwellslogsnowonline.vercel.app/error.html	Joe Sandbox AI: Score: 9 Reasons: The brand 'Wells Fargo' is a well-known financial institution with a legitimate domain of 'wellsfargo.com'., The URL 'getwellslogsnowonline.vercel.app' does not match the legitimate domain of Wells Fargo., The URL contains suspicious elements such as 'getwellslogsnowonline', which is not associated with Wells Fargo., The use of 'vercel.app' as a domain extension is unusual for a financial institution like Wells Fargo., The presence of input fields for 'Username' and 'Password' on a non-legitimate domain is a common phishing tactic. DOM: 2.4.pages.csv

Source: https://getwellslogsnowonline.vercel.app/	HTTP Parser: Number of links: 0
Source: https://getwellslogsnowonline.vercel.app/error.html	HTTP Parser: Number of links: 0

Source: https://getwellslogsnowonline.vercel.app/	HTTP Parser: <input type="password" .../> found
Source: https://getwellslogsnowonline.vercel.app/error.html	HTTP Parser: <input type="password" .../> found

Source: https://getwellslogsnowonline.vercel.app/error.html	HTTP Parser: No favicon
Source: https://getwellslogsnowonline.vercel.app/error.html	HTTP Parser: No favicon
Source: https://getwellslogsnowonline.vercel.app/error.html	HTTP Parser: No favicon
Source: https://getwellslogsnowonline.vercel.app/error.html	HTTP Parser: No favicon

Source: https://getwellslogsnowonline.vercel.app/	HTTP Parser: No <meta name="author".. found
Source: https://getwellslogsnowonline.vercel.app/error.html	HTTP Parser: No <meta name="author".. found

Source: https://getwellslogsnowonline.vercel.app/	HTTP Parser: No <meta name="copyright".. found
Source: https://getwellslogsnowonline.vercel.app/error.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_152.4.dr	String found in binary or memory: return a;};u.map={};u.extend=[function(a,b){try{if((b['app_id'].toString().toLowerCase()=='WWW'.toLowerCase()&&b['canonical_page_url'].toString().toLowerCase()=='/'.toLowerCase()&&b['device_type'].toString().toLowerCase()=='DESKTOP'.toLowerCase()&&b['page_type'].toString().toLowerCase()=='BROWSER'.toLowerCase())\|\|(b['app_id'].toString().toLowerCase()=='WWW'.toLowerCase()&&b['canonical_page_url'].toString().toLowerCase()=='/'.toLowerCase()&&b['device_type'].toString().toLowerCase()=='TABLET'.toLowerCase()&&b['page_type'].toString().toLowerCase()=='BROWSER'.toLowerCase())){b['fb_ev_value']='ALL_ALL_PAGE_WFHomepage';b['fb_id']='1578146899100389'}}catch(e){utag.DB(e);}},function(a,b){try{if((b['app_id'].toString().toLowerCase()=='WWW'.toLowerCase()&&b['canonical_page_url'].toString().toLowerCase()=='/'.toLowerCase()&&b['device_type'].toString().toLowerCase()=='MOBILE'.toLowerCase()&&b['page_type'].toString().toLowerCase()=='BROWSER'.toLowerCase())){b['fb_ev_value']='FrontPorchHomePage';b['fb_id']='1578146899100389'}}catch(e){utag.DB(e);}},function(a,b){try{if((b['app_id'].toString().toLowerCase()=='WWW'.toLowerCase()&&b['canonical_page_url'].toString().toLowerCase()=='/com/'.toLowerCase()&&b['page_type'].toString().toLowerCase()=='BROWSER'.toLowerCase())){b['fb_ev_value']='ALL_ALL_PAGE_WFCommercialHomepage';b['fb_id']='1578146899100389'}}catch(e){utag.DB(e);}}];u.send=function(a,b){if(u.ev[a]\|\|u.ev.all!==undefined){utag.DB("send:95");utag.DB(b);var c;u.t="@@";u.i=[];u.p=["//www.facebook.com/tr?id=@@fb_id@@&ev=@@fb_ev_value@@&cd[currency]=USD&cd[value]=0.00&cd[Product]=@@product_code@@&cd[Subproduct]=@@subproduct_code@@&cd[PageID]=@@page_id@@&cd[customer_status]=@@customer_status@@&cd[customer_type]=@@customer_type@@&dpo=LDU&dpoco=0&dpost=0","","","","","","",""];u.delim="";u.cachebust="disabled";u.cachevar=""\|\|"_rnd";for(c=0;c<u.extend.length;c++){try{d=u.extend[c](a,b);if(d==false)return}catch(e){}};if(!b.fb_ev_value)return false;for(c=0;c<u.p.length;c++){if(u.p[c]!=""){var x=u.rp(u.p[c],b);if(x!=""){if(u.cachebust=="enabled"&&x.indexOf(u.cachevar)<0){if(x.indexOf("?")<0){u.delim="?";}else{u.delim="&";} equals www.facebook.com (Facebook)
Source: chromecache_141.4.dr, chromecache_121.4.dr	String found in binary or memory: return f}oF.F="internal.enableAutoEventOnTimer";var Yb=wa(["data-gtm-yt-inspected-"]),qF=["www.youtube.com","www.youtube-nocookie.com"],rF,sF=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: getwellslogsnowonline.vercel.app
Source: global traffic	DNS traffic detected: DNS query: c1.wfinterface.com
Source: global traffic	DNS traffic detected: DNS query: userstatics.com
Source: global traffic	DNS traffic detected: DNS query: www17.wellsfargomedia.com
Source: global traffic	DNS traffic detected: DNS query: s10.histats.com
Source: global traffic	DNS traffic detected: DNS query: s4.histats.com
Source: global traffic	DNS traffic detected: DNS query: e.dtscout.com
Source: global traffic	DNS traffic detected: DNS query: t.dtscout.com
Source: global traffic	DNS traffic detected: DNS query: pxdrop.lijit.com
Source: global traffic	DNS traffic detected: DNS query: pd.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: cdn.tynt.com
Source: global traffic	DNS traffic detected: DNS query: p.dtsan.net
Source: global traffic	DNS traffic detected: DNS query: ic.tynt.com
Source: global traffic	DNS traffic detected: DNS query: tags.crwdcntrl.net
Source: global traffic	DNS traffic detected: DNS query: t.dtscdn.com
Source: global traffic	DNS traffic detected: DNS query: pixel.onaudience.com
Source: global traffic	DNS traffic detected: DNS query: de.tynt.com
Source: global traffic	DNS traffic detected: DNS query: t.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: e.dlx.addthis.com
Source: global traffic	DNS traffic detected: DNS query: rc.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: i.simpli.fi
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: pippio.com
Source: global traffic	DNS traffic detected: DNS query: p.adsymptotic.com
Source: global traffic	DNS traffic detected: DNS query: idsync.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: ps.eyeota.net
Source: global traffic	DNS traffic detected: DNS query: ml314.com
Source: global traffic	DNS traffic detected: DNS query: cms.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: sync.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: ups.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: pixel.nordicdataresources.net
Source: global traffic	DNS traffic detected: DNS query: a.dtsan.net

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://getwellslogsnowonline.vercel.app/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Windows Analysis Report
https://getwellslogsnowonline.vercel.app/