IOC Report
https://kellyt.clickfunnels.com/optin1653662776127

loading gif

Files

File Path
Type
Category
Malicious
C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\54a6c337-87ea-4dd1-a519-8132f8b948ce.tmp
ASCII text, with very long lines, with no line terminators
modified
C:\Users\user\AppData\Local\Google\Chrome\User Data\6b0a3d6b-54e6-4d92-82e3-58a1304c8d5f.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\7fa01e9d-5d90-488b-a146-f8441d08551b.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\052145f7-0eb7-46f0-ab20-92e39648597f.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0cd6b519-ad49-42fc-a109-abf7e1cf167e.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\39d385f5-bdca-433f-b2c0-00f43902a849.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3c121264-f10d-4c5d-ba47-4ace74f90a46.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3cf7c2e3-ef73-4678-a67a-1e1a47b42c42.tmp
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9e38ace7-9b5e-4e5a-a980-b27b549734e3.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\af0c5d23-6e05-4e42-bb2b-37ccbeb2922f.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network Persistent State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\ea7c1bbc-93fe-4ba3-beba-422d86f30fbc.tmp
ASCII text, with very long lines, with no line terminators
modified
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity (copy)
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a6db0da6-c7f6-49c5-95ce-15104b968ac3.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\aa5c6ffe-c042-45a9-a072-16b926403924.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\b5ff3631-4742-441c-987e-c2a7c18ec341.tmp
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)
ASCII text
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e5abe16b-0fa1-4152-b49d-a8bc3eb59f1d.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\faee9ff9-b4aa-4c1b-8a72-fbef71243a0a.tmp
UTF-8 Unicode text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\a615144b-3dab-46e3-9c23-58590d04ed86.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\ac260b8d-0428-415e-b4e0-52ec5eaa5742.tmp
data
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\adf008b0-75b0-4943-8555-a6faf1fe2ff0.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\ae1091f7-b3c1-4cf2-b610-ebb510ec21ab.tmp
SysEx File -
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\bb5bb44a-0a0c-44cb-afcf-3c7ba0a18fcf.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\db403f24-2e19-48e1-ba79-ea2cbb8d982e.tmp
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Google\Chrome\User Data\f982aa56-26fe-4a6f-821e-b5320b64d8f3.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\3348_1692724561\LICENSE
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\3348_1692724561\_metadata\verified_contents.json
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\3348_1692724561\crl-set
data
dropped
C:\Users\user\AppData\Local\Temp\3348_1692724561\manifest.fingerprint
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\3348_1692724561\manifest.json
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\758b882f-704f-4af6-8be8-0f8fbc7b961f.tmp
Google Chrome extension, version 3
dropped
C:\Users\user\AppData\Local\Temp\c7d3161c-a870-4c47-b03b-95941e338cfa.tmp
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\758b882f-704f-4af6-8be8-0f8fbc7b961f.tmp
Google Chrome extension, version 3
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\bg\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\ca\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\cs\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\da\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\de\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\el\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\en\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\en_GB\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\es\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\es_419\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\et\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\fi\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\fil\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\fr\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\hi\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\hr\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\hu\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\id\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\it\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\ja\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\ko\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\lt\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\lv\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\nb\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\nl\messages.json
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\pl\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\pt_BR\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\pt_PT\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\ro\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\ru\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\sk\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\sl\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\sr\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\sv\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\th\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\tr\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\uk\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\vi\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\zh_CN\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_locales\zh_TW\messages.json
UTF-8 Unicode text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\_metadata\verified_contents.json
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\craw_background.js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\craw_window.js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\css\craw_window.css
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\html\craw_window.html
HTML document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\images\flapper.gif
GIF image data, version 89a, 30 x 30
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\images\icon_128.png
PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\images\icon_16.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\images\topbar_floating_button.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\images\topbar_floating_button_close.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\images\topbar_floating_button_hover.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\images\topbar_floating_button_maximize.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\images\topbar_floating_button_pressed.png
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir3348_1304085142\CRX_INSTALL\manifest.json
ASCII text, with CRLF line terminators
dropped
There are 97 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://kellyt.clickfunnels.com/optin1653662776127
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,10485927905257442261,7096848172002024249,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8

URLs

Name
IP
Malicious
https://kellyt.clickfunnels.com/optin1653662776127
malicious
https://virtualtherapysessions.com/geerede/Odrivex/
162.241.24.101
 malicious
https://virtualtherapysessions.com/geerede/Odrivex/1.png
162.241.24.101
 malicious
https://virtualtherapysessions.com/geerede/Odrivex/
malicious
https://app.clickfunnels.com/assets/pushcrew.js
104.16.16.194
https://kellyt.clickfunnels.com/cdn-cgi/rum?
104.16.15.194
https://kellyt.clickfunnels.com/optin16536627761272:
unknown
https://www.google.com/images/cleardot.gif
unknown
https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
104.18.47.230
https://www.virtualtherapysessions.com/wp-includes/images/w-logo-blue-white-bg.png
162.241.24.101
https://www.clickfunnels.com/favicon.ico
104.16.13.194
https://app.clickfunnels.com/mailcheck.min.js
104.16.16.194
https://sandbox.google.com/payments/v4/js/integrator.js
unknown
https://kellyt.clickfunnels.com/optin16536627761272
unknown
https://accounts.google.com/MergeSession
unknown
https://images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ClickfunnelsTag.png
104.16.15.194
https://www.google.com
unknown
https://app.clickfunnels.com/v1/track?_unique=0.7273385905989427&_uniqueVisitorID=null&_type=WINDOW&_location=ttps%3A//kellyt.clickfunnels.com/optin1653662776127&_title=&_key=ye7a8r&_page_key=rekstpnwh25yxv64&_fid=12131842&_fspos=1&_fvrs=1&_funnel_stat=1&_location=https://kellyt.clickfunnels.com/optin1653662776127&_referrer=
104.16.16.194
https://app.clickfunnels.com/cf.js
104.16.16.194
https://accounts.google.com
unknown
https://apis.google.com
unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
104.18.11.207
https://app.clickfunnels.com/images/email.png
104.16.15.194
https://www.google.com/accounts/OAuthLogin?issueuberauth=1
unknown
https://www-googleapis-staging.sandbox.google.com
unknown
https://clients2.google.com
unknown
https://images.clickfunnels.com/cdn-cgi/image/fit=scale-down,width=1060,quality=75/https://images.clickfunnels.com/6a/ed640baabc4a73ba57a1eae99e0caa/vvv.png
104.16.15.194
https://dns.google
unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
unknown
https://www.google.com/intl/en-US/chrome/blank.html
unknown
https://ogs.google.com
unknown
https://www.clickfunnels.com/images/closemodal.png
104.16.13.194
https://app.clickfunnels.com/images/name.png
104.16.15.194
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1
216.58.215.238
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
142.250.203.109
https://app.clickfunnels.com/assets/lander.css
104.16.16.194
https://payments.google.com/payments/v4/js/integrator.js
unknown
https://app.clickfunnels.com/assets/userevents/application.js
104.16.16.194
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
104.18.11.207
https://kellyt.clickfunnels.com/optin1653662776127
104.16.15.194
https://www.google.com/images/x2.gif
unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
104.18.11.207
https://app.clickfunnels.com/assets/lander.js
104.16.16.194
https://virtualtherapysessions.com/favicon.ico
162.241.24.101
https://www.google.com/images/dot2.gif
unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
104.17.24.14
https://www.clickfunnels.com/cf.js
104.16.13.194
https://clients2.googleusercontent.com
unknown
https://www.google.com/
unknown
https://kellyt.clickfunnels.com/optin1653662776127
https://clients2.google.com/service/update2/crx
unknown
There are 40 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
gstaticadssl.l.google.com
216.58.215.227
virtualtherapysessions.com
162.241.24.101
stackpath.bootstrapcdn.com
104.18.11.207
app.clickfunnels.com
104.16.16.194
static.cloudflareinsights.com
104.18.47.230
kellyt.clickfunnels.com
104.16.15.194
accounts.google.com
142.250.203.109
cdnjs.cloudflare.com
104.17.24.14
maxcdn.bootstrapcdn.com
104.18.11.207
www.clickfunnels.com
104.16.13.194
clients.l.google.com
216.58.215.238
images.clickfunnels.com
104.16.15.194
www.virtualtherapysessions.com
unknown
js-agent.newrelic.com
unknown
track.addevent.com
unknown
use.fontawesome.com
unknown
clients2.google.com
unknown
code.jquery.com
unknown
bam-cell.nr-data.net
unknown
There are 9 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
192.168.2.1
unknown
unknown
216.58.215.238
clients.l.google.com
United States
104.18.47.230
static.cloudflareinsights.com
United States
162.241.24.101
virtualtherapysessions.com
United States
104.16.16.194
app.clickfunnels.com
United States
142.250.203.109
accounts.google.com
United States
104.17.24.14
cdnjs.cloudflare.com
United States
216.58.215.227
gstaticadssl.l.google.com
United States
104.16.15.194
kellyt.clickfunnels.com
United States
104.18.11.207
stackpath.bootstrapcdn.com
United States
104.16.13.194
www.clickfunnels.com
United States
239.255.255.250
unknown
Reserved
127.0.0.1
unknown
unknown
There are 3 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ahfgeienlihckogmohjhadlkjgocpleb
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gdaefkejpgkiemlaofpalmlakkmbjdnl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gfdkimpbcpahaombhbimeihdjnejgicl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mfehgcgbbipciphmccgaenjidiccnmng
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-3853321935-2125563209-4053062332-1002
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gfdkimpbcpahaombhbimeihdjnejgicl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
pkedcjkdefgpdelpbcmbmeomcjbeemfm
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.reporting
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
module_blacklist_cache_md5_digest
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
media.storage_id_salt
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_seed
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
default_search_provider_data.template_url_data
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
safebrowsing.incidents_sent
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
pinned_tabs
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
search_provider_overrides
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_default_search
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_username
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.restore_on_startup
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_version
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.prompt_wave
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage_is_newtabpage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
browser.show_home_button
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
There are 33 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
14262A3D000
heap
page read and write
1005FB000
stack
page read and write
1A3E3267000
heap
page read and write
224E0380000
heap
page read and write
1B7F5B0E000
heap
page read and write
1DA46C3C000
heap
page read and write
1B7F0F18000
heap
page read and write
9388F7F000
stack
page read and write
1B7F5B0A000
heap
page read and write
1A3E30F0000
heap
page read and write
224E0313000
heap
page read and write
485CF7F000
stack
page read and write
1FE7B3E0000
trusted library allocation
page read and write
1A3E3261000
heap
page read and write
14262B00000
heap
page read and write
12985865000
heap
page read and write
264DC1C0000
heap
page read and write
1B7F5ADC000
heap
page read and write
1B7F5A3D000
heap
page read and write
1B7F0F18000
heap
page read and write
1DA46C2A000
heap
page read and write
12985750000
trusted library allocation
page read and write
9388BBF000
stack
page read and write
12986002000
trusted library allocation
page read and write
224E036F000
heap
page read and write
12985802000
heap
page read and write
1A3E326B000
heap
page read and write
1B7F5AFF000
heap
page read and write
224DF813000
heap
page read and write
14262910000
heap
page read and write
1B7F5E60000
remote allocation
page read and write
1A3E3254000
heap
page read and write
1B7F0390000
trusted library allocation
page read and write
A48DFE000
stack
page read and write
1A3E3269000
heap
page read and write
1B7F0502000
heap
page read and write
224DF881000
heap
page read and write
86ED577000
stack
page read and write
A4877E000
stack
page read and write
1A3E327D000
heap
page read and write
224DF8E2000
heap
page read and write
1B7F5D40000
trusted library allocation
page read and write
1B7F5E60000
trusted library allocation
page read and write
1138FFE000
stack
page read and write
3A2817E000
stack
page read and write
1A3E3263000
heap
page read and write
1B7F5D06000
trusted library allocation
page read and write
11396FC000
stack
page read and write
129855F0000
heap
page read and write
1298588A000
heap
page read and write
224DF8AC000
heap
page read and write
1B7F5D40000
trusted library allocation
page read and write
1A3E323C000
heap
page read and write
1B7F15C0000
trusted library section
page readonly
14262A57000
heap
page read and write
1B7F0457000
heap
page read and write
485CE7A000
stack
page read and write
1DA469E0000
heap
page read and write
3A27C7E000
stack
page read and write
1FE7B650000
trusted library allocation
page read and write
264DBF10000
heap
page read and write
1B7F5D24000
trusted library allocation
page read and write
1A3E3200000
heap
page read and write
1B7F5B08000
heap
page read and write
1B7F5E50000
trusted library allocation
page read and write
1B7F0F13000
heap
page read and write
224DF710000
heap
page read and write
1B7F5AB3000
heap
page read and write
1DA47402000
trusted library allocation
page read and write
224E0311000
heap
page read and write
1A3E322A000
heap
page read and write
12985650000
heap
page read and write
1B7F0413000
heap
page read and write
1B7F5B0A000
heap
page read and write
1DA46C5D000
heap
page read and write
1B7F5960000
trusted library allocation
page read and write
A48AF7000
stack
page read and write
1138DFA000
stack
page read and write
14262A6C000
heap
page read and write
113927F000
stack
page read and write
1DA46C00000
heap
page read and write
10017E000
stack
page read and write
1B7F5A13000
heap
page read and write
1B7F049E000
heap
page read and write
1B7F5D30000
trusted library allocation
page read and write
1B7F5B0A000
heap
page read and write
1B7F046F000
heap
page read and write
1B7F0F59000
heap
page read and write
86ED3FC000
stack
page read and write
BDC867C000
stack
page read and write
1B7F5970000
trusted library allocation
page read and write
1A3E325E000
heap
page read and write
1B7F5ADC000
heap
page read and write
1A3E3287000
heap
page read and write
12985902000
heap
page read and write
1B7F5B0D000
heap
page read and write
1B7F04B1000
heap
page read and write
1B7F5D0E000
trusted library allocation
page read and write
BDC88F7000
stack
page read and write
1B7F5D01000
trusted library allocation
page read and write
224DF86F000
heap
page read and write
1FE7B6B0000
trusted library allocation
page read and write
1DA469D0000
heap
page read and write
1B7F0474000
heap
page read and write
1B7F03A0000
trusted library section
page read and write
1B7F59E0000
trusted library allocation
page read and write
A48BFE000
stack
page read and write
113947F000
stack
page read and write
1A3E3278000
heap
page read and write
86ED47E000
stack
page read and write
11392FE000
stack
page read and write
1B7F5B04000
heap
page read and write
1B7F0F18000
heap
page read and write
1B7F0455000
heap
page read and write
12985908000
heap
page read and write
1A3E3150000
heap
page read and write
485CABB000
stack
page read and write
10007B000
stack
page read and write
1B7F5E30000
trusted library allocation
page read and write
1FE7A5B0000
heap
page read and write
1B7F0F59000
heap
page read and write
224DF8C2000
heap
page read and write
1B7F5AA9000
heap
page read and write
BDC847B000
stack
page read and write
1A3E325C000
heap
page read and write
485CEF9000
stack
page read and write
1B7F5D0A000
trusted library allocation
page read and write
1B7F6000000
trusted library allocation
page read and write
1B7F5E10000
trusted library allocation
page read and write
1B7F5B02000
heap
page read and write
1FE7A722000
heap
page read and write
1B7F5AA1000
heap
page read and write
1B7F5A61000
heap
page read and write
12985913000
heap
page read and write
1A3E3308000
heap
page read and write
1B7F0493000
heap
page read and write
113890E000
stack
page read and write
1B7F5A4A000
heap
page read and write
1298585F000
heap
page read and write
224E00D0000
remote allocation
page read and write
1A3E30E0000
heap
page read and write
12985829000
heap
page read and write
1B7F0F59000
heap
page read and write
14262B02000
heap
page read and write
1FE7A734000
heap
page read and write
1B7F14E0000
trusted library allocation
page read and write
1B7F0479000
heap
page read and write
224E0351000
heap
page read and write
264DC170000
heap
page read and write
14262A13000
heap
page read and write
1B7F5B0E000
heap
page read and write
1FE7A610000
heap
page read and write
9388E7E000
stack
page read and write
1B7F1960000
trusted library allocation
page read and write
1FE7B3F0000
trusted library allocation
page read and write
1B7F5AFC000
heap
page read and write
1A3E3275000
heap
page read and write
86ED677000
stack
page read and write
1B7F04FE000
heap
page read and write
1DA46C5D000
heap
page read and write
224DF8B2000
heap
page read and write
BDC87FE000
stack
page read and write
9388FFE000
stack
page read and write
3A27E7B000
stack
page read and write
1A3E3180000
trusted library allocation
page read and write
1A3E3302000
heap
page read and write
113937F000
stack
page read and write
1B7F5B04000
heap
page read and write
129855E0000
heap
page read and write
A4867B000
stack
page read and write
1A3E3278000
heap
page read and write
A48CFD000
stack
page read and write
485CFF9000
stack
page read and write
1B7F0F18000
heap
page read and write
1138CF7000
stack
page read and write
1B7F5D20000
trusted library allocation
page read and write
1FE7A8A0000
trusted library allocation
page read and write
142629A0000
trusted library allocation
page read and write
1B7F0DF0000
trusted library allocation
page read and write
86ED2FD000
stack
page read and write
9388B3A000
stack
page read and write
1FE7A630000
heap
page read and write
A4897B000
stack
page read and write
1A3E3C02000
trusted library allocation
page read and write
224E00D0000
remote allocation
page read and write
1B7F0F59000
heap
page read and write
1FE7A71A000
heap
page read and write
9388EF9000
stack
page read and write
12985852000
heap
page read and write
11391FB000
stack
page read and write
224E0368000
heap
page read and write
264DC150000
heap
page read and write
224DF800000
heap
page read and write
1138EFA000
stack
page read and write
1B7F5E50000
trusted library allocation
page read and write
1FE7A741000
heap
page read and write
224DF7A0000
trusted library allocation
page read and write
1DA46D08000
heap
page read and write
1FE7A650000
trusted library allocation
page read and write
1B7F1610000
trusted library section
page readonly
1B7F5A43000
heap
page read and write
1B7F5E20000
trusted library allocation
page read and write
9389079000
stack
page read and write
14262A28000
heap
page read and write
1B7F5B02000
heap
page read and write
14262900000
heap
page read and write
1DA46C83000
heap
page read and write
1B7F0E00000
heap
page read and write
1B7F0DF3000
trusted library allocation
page read and write
1008FE000
stack
page read and write
1B7F0F02000
heap
page read and write
264DBF8B000
heap
page read and write
1B7F0429000
heap
page read and write
3A2790C000
stack
page read and write
1004FB000
stack
page read and write
1DA46A40000
heap
page read and write
BDC89FE000
stack
page read and write
1B7F5B04000
heap
page read and write
1007FF000
stack
page read and write
224E0341000
heap
page read and write
1B7F1300000
trusted library allocation
page read and write
A486FE000
stack
page read and write
1B7F5B1F000
heap
page read and write
1B7F0F18000
heap
page read and write
1B7F5D30000
trusted library allocation
page read and write
1298583C000
heap
page read and write
1B7F5B02000
heap
page read and write
1FE7A5B9000
heap
page read and write
86ED77F000
stack
page read and write
86ED9FE000
stack
page read and write
86ED879000
stack
page read and write
1B7F0DD1000
trusted library allocation
page read and write
1B7F043D000
heap
page read and write
1FE7B660000
trusted library allocation
page read and write
1001FF000
stack
page read and write
1B7F5E70000
trusted library allocation
page read and write
1FE7A6B0000
trusted library allocation
page read and write
1A3E3275000
heap
page read and write
1B7F15D0000
trusted library section
page readonly
1B7F5D00000
trusted library allocation
page read and write
3A2807F000
stack
page read and write
1B7F5B11000
heap
page read and write
1B7F5B0C000
heap
page read and write
1DA46D00000
heap
page read and write
1B7F5AF4000
heap
page read and write
1B7F5E60000
remote allocation
page read and write
1FE7A6D8000
heap
page read and write
1B7F0F5A000
heap
page read and write
224DF913000
heap
page read and write
1B7F0F59000
heap
page read and write
224DF8C8000
heap
page read and write
1FE7B640000
heap
page readonly
264DC1C5000
heap
page read and write
1B7F5E40000
trusted library allocation
page read and write
1DA46C6F000
heap
page read and write
1B7F02F0000
heap
page read and write
BDC84FE000
stack
page read and write
1DA46C53000
heap
page read and write
86ECFDB000
stack
page read and write
12985800000
heap
page read and write
11395F9000
stack
page read and write
1B7F5980000
trusted library allocation
page read and write
1B7F5B0E000
heap
page read and write
1FE7A722000
heap
page read and write
1B7F0E15000
heap
page read and write
1B7F59A0000
trusted library allocation
page read and write
1B7F0F00000
heap
page read and write
224DF902000
heap
page read and write
1B7F5B08000
heap
page read and write
14262A00000
heap
page read and write
1B7F0360000
heap
page read and write
1B7F5D05000
trusted library allocation
page read and write
1B7F5B04000
heap
page read and write
1A3E3300000
heap
page read and write
1DA46C4D000
heap
page read and write
1B7F0400000
heap
page read and write
14262A02000
heap
page read and write
1FE7A5A0000
heap
page read and write
1B7F0F5A000
heap
page read and write
1000FE000
stack
page read and write
1A3E3213000
heap
page read and write
224DF8DA000
heap
page read and write
14262A6D000
heap
page read and write
11390FA000
stack
page read and write
1B7F5D21000
trusted library allocation
page read and write
224DF829000
heap
page read and write
224DF8EC000
heap
page read and write
113888B000
stack
page read and write
A489FF000
stack
page read and write
12985813000
heap
page read and write
12985900000
heap
page read and write
1B7F0300000
heap
page read and write
224DF770000
heap
page read and write
1FE7A6C0000
trusted library allocation
page read and write
1FE7A5B5000
heap
page read and write
3A27F7B000
stack
page read and write
1B7F5B0B000
heap
page read and write
264DBFB1000
heap
page read and write
1B7F5D07000
trusted library allocation
page read and write
1006F7000
stack
page read and write
224E038A000
heap
page read and write
1B7F5A2C000
heap
page read and write
264DBF80000
heap
page read and write
1B7F5B0A000
heap
page read and write
1B7F04BC000
heap
page read and write
1FE7B630000
trusted library allocation
page read and write
1B7F1080000
trusted library allocation
page read and write
1FE7A722000
heap
page read and write
BDC877B000
stack
page read and write
1B7F5E60000
remote allocation
page read and write
1298587E000
heap
page read and write
1B7F5D08000
trusted library allocation
page read and write
1B7F15F0000
trusted library section
page readonly
14262B13000
heap
page read and write
14262A79000
heap
page read and write
1B7F5D44000
trusted library allocation
page read and write
1B7F5AEF000
heap
page read and write
1B7F0F59000
heap
page read and write
11394FF000
stack
page read and write
1DA46D02000
heap
page read and write
1B7F5A1E000
heap
page read and write
1B7F59F0000
trusted library allocation
page read and write
224DF8AE000
heap
page read and write
224E0300000
heap
page read and write
1A3E326A000
heap
page read and write
224DF8A5000
heap
page read and write
224E00D0000
remote allocation
page read and write
1A3E3265000
heap
page read and write
1B7F5D00000
trusted library allocation
page read and write
1FE7A6D0000
heap
page read and write
11393FF000
stack
page read and write
1B7F1600000
trusted library section
page readonly
1B7F0F59000
heap
page read and write
1B7F5B04000
heap
page read and write
BDC8AFF000
stack
page read and write
1DA46B40000
trusted library allocation
page read and write
1B7F0F18000
heap
page read and write
BDC857E000
stack
page read and write
1B7F15E0000
trusted library section
page readonly
1B7F048D000
heap
page read and write
224DF8B6000
heap
page read and write
14263402000
trusted library allocation
page read and write
86ED27E000
stack
page read and write
224DF8F5000
heap
page read and write
224DF83C000
heap
page read and write
1A3E3313000
heap
page read and write
1B7F0513000
heap
page read and write
224DF700000
heap
page read and write
1B7F5FA0000
trusted library allocation
page read and write
1DA46C13000
heap
page read and write
1B7F5DD0000
trusted library allocation
page read and write
1DA46D13000
heap
page read and write
1B7F5A00000
heap
page read and write
11397FE000
stack
page read and write
14262970000
heap
page read and write
224E0202000
heap
page read and write
1B7F5F90000
trusted library allocation
page read and write
86ED97C000
stack
page read and write
1B7F0E02000
heap
page read and write
There are 349 hidden memdumps, click here to show them.

DOM / HTML

URL
Malicious
https://virtualtherapysessions.com/geerede/Odrivex/
 malicious
https://kellyt.clickfunnels.com/optin1653662776127