Windows Analysis Report
https://link.mail.beehiiv.com/ls/click?upn=u001.FC1hxQg0vjMaKvj1drxxGhIhXUkPFfRxKlXXnsrz2PM25dqPmi4BtCTWgv3CiFmkz-2B7Hc09iqRIhx3uSmkdd7QE0-2BnHx0mpXdDH0R4j2ecXYT4gMlABijGBQgiruXhEAIyR4Mpg-2BI9rgqzsUm9Ym4ntMFzX8ZZqOUxeSkDzXxVoJ8WeSXobIPUv2N8-2F9AvCiXURXVJQullKL1fGIZARuroIP0Rwd-2BwTicddUz9m9843Wwh45Wj

ID:	1458474
Product:	CloudBasic
Start time:	17:47:52
Start date:	17.06.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 17 14:48:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F243249EAAEA49A640B015CC566CAD41	21AE0FC15ADBC12223F9F605C6B0157A1DB5B653	E0DA8A4B8618A7F1CC888A8A2223D54A5290241CF867AB718E9299711E429236
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 17 14:48:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	323FBEC3FA9C81F84D0951672E469E3D	6C5472D240A28FC7A1548830B0A398A09C6B0917	059904F85B4D02F5CFEC32AD371D9F4A0BC630822DE234543BBAE065AB91DB28
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B0791DA9F057DCE4CEC2085889C0B2ED	2FC0E607BC7E9DF6F143A06B0187960064211CBD	52BAE7F2CF2D428378BCAB9E54CC54025AADCC55CB61B62143C0D6F92D0EC9CB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 17 14:48:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	68F984F1C31B43E4AEA3178364C1057F	BA45FD2360196330F7C8693080F1E2DD48AA6C16	6B86D3A4932A07B6CF0B4F08FD3567E2F190B68E40D8EE7996CEA6AF74DAAF20
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 17 14:48:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	A5D59C97C7295C14C703C21469A07710	F7F6AF0A7864DE0D0C7257519F66F172D30F108B	5C719130FBDF665AA1AB6FD235292B704DEF62468BE979C5DFCD8EB2A478B845
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 17 14:48:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	74F62C37E5389AAEC7DB934F17E6C5D5	883A97D1E1DCB8734235DD0A38D2B3F64DC2938B	0C8E6780F8313EB4901090A15EF477C43C3E8B4EF1B523BE7FB12992975EF0AF
Chrome Cache Entry: 65	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	13FEC0C2FBF5C47C4608CE0C9405E5A7	DAFB6CA27CFD22E88A2D53150C4350FCA3D32A21	7F25FD0260C4EF8C26A87A5A126634E846BA539C75E5D508103F4D98831654A5
Chrome Cache Entry: 66	ASCII text, with very long lines (12331)	88A769D2FE35899FD45A332A0A032CC0	514C6C1D8475D17E412849A4C90159517D0FA10A	CCF00D1923B0131A10E0C6D26F95E5DEE6EBF8621A27E83C5A2F68A2E0093142
Chrome Cache Entry: 67	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	2259DA5C99F5AFDEF304B9698E262F3F	A2B28ECCF5D75DAEAF9B7BB8D6A88DE14E2ED40E	1DA37119E89FCE4C63424B027A85B241885BCCFF9E993413F4F6B649636308DB
Chrome Cache Entry: 68	PNG image data, 171 x 213, 8-bit colormap, non-interlaced	4C9ACF280B47CEF7DEF3FC91A34C7FFE	C32BB847DAF52117AB93B723D7C57D8B1E75D36B	5F9FC5B3FBDDF0E72C5C56CDCFC81C6E10C617D70B1B93FBE1E4679A8797BFF7
Chrome Cache Entry: 70	HTML document, Unicode text, UTF-8 text, with very long lines (523), with CRLF line terminators	FC14C2572BCB1342A2D9E91F206282ED	2103256331F6D9DF01DEF4FA7DA72D6E45843DB3	05990D6A99F1C346844432FC25EA70235CA90A9B66511E015748D05EC1BF6FEA
Chrome Cache Entry: 71	ASCII text, with very long lines (791)	595DD293A2418387BA8517BC60669AD2	AE2A226E31CEECF7A4A03E79A9CDE43B508E2F53	500EB2BE57BD512F918F13B32B4D7D194B35C22A85BF045E2BB815D530F7BD41
Chrome Cache Entry: 72	PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced	9D73B3AA30BCE9D8F166DE5178AE4338	D0CBC46850D8ED54625A3B2B01A2C31F37977E75	DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
Chrome Cache Entry: 73	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	F1070F0060F285698B9A2E7E2CD85548	537276A17DF52A0EA694C14D4808BE3D8992DD82	77510868A0463A155725A0F2C71114FF6E7F55615CD59947FFE12B46A1682A99

Phishing

Source: https://firebasestorage.googleapis.com/2615514-.html

HTTP Parser: No favicon

Compliance

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.123.104.59:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49724 version: TLS 1.2

Software Vulnerabilities

Source: chrome.exe

Memory has grown: Private usage: 10MB later: 29MB

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90

Source: global traffic	DNS traffic detected: DNS query: link.mail.beehiiv.com
Source: global traffic	DNS traffic detected: DNS query: rallysportmag.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cloud.antibot.cloud
Source: global traffic	DNS traffic detected: DNS query: alt.antibot.cloud
Source: global traffic	DNS traffic detected: DNS query: ajax.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.123.104.59:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49724 version: TLS 1.2

System Summary

Source: classification engine

Classification label: clean0.win@15/14@18/141

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://link.mail.beehiiv.com/ls/click?upn=u001.FC1hxQg0vjMaKvj1drxxGhIhXUkPFfRxKlXXnsrz2PM25dqPmi4BtCTWgv3CiFmkz-2B7Hc09iqRIhx3uSmkdd7QE0-2BnHx0mpXdDH0R4j2ecXYT4gMlABijGBQgiruXhEAIyR4Mpg-2BI9rgqzsUm9Ym4ntMFzX8ZZqOUxeSkDzXxVoJ8WeSXobIPUv2N8-2F9AvCiXURXVJQullKL1fGIZARuroIP0Rwd-2BwTicddUz9m9843Wwh45WjoCgNjpFjIMwnkQSSVnjkmpl9RHa2uTbNVpomKKm17ID1RjWPCdBy0EpXuO2sCcEB2uqeViXVCzmBM-2FrQqLcPkSotW3jK1eSOlg-2FKIa8JRz653oEdMMsYT56-2FOhNIw5a9-2BNuZJkmfvFPOKaZLIZ65y5OLZQaLuQ7xTGAIgUdVXuzbgeFerxHGMDP8hEqzjUCIJN8hJ2DF1OZKFTvoEsLR51S78RvmTEJyLDECLNyB9Gf62lbie3o0yudclnajoEgplga1YLKYLTZ3MO6wqbJytm3RfP3wEE4vfXBg-3D-3Dnq7D_k5zaofJQ6PaDm4eQpA56e4xWG4OoVdk-2BXhZTssh6QwsCP88A0kMHGtSsxje-2F1AU3Us-2FAqI42-2Fyfjf1CXFECDeifYr626jCVDN-2Fp8UNMYaDS37CB4A9KTpDn9LWR6FZfUTkc5tU7dwMuI2jumTC7wXokNzeEDxuAqc35MGbfHe-2BRg-2B-2FsKUMtoWO6wwrECQ1IPwqZN-2F4JlCY9oDuBXPeL327ZURNFNTQcs2VIMFbLb-2FasgcPnr0Sj7W-2FozFbFnH0XAhOFjidPEbz-2F0-2B-2BZYu9PL9evq1fkkkU1uvY8VHkodsFQnKgXRtUzL00SmyXU158XJLD-2BweZymsamW640Y7FP9Lc8A-2By96oH3yG6P-2FhxEyLEUzjKuM5cKNwPaNcvbMuMQ-2Bt3Qgx771eCtv7AooKfSloIy67HE-2FxEYTbkr7jciWTgvvmIt0-2FKE-2FuKv8E6iUNBIlTu6ELpDdXGMI-2FHtH0KQBDQ-3D-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2032,i,3875392723416854500,2325133546994465528,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2032,i,3875392723416854500,2325133546994465528,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk