Windows Analysis Report
http://passback.free.fr/pub/pp_120x600.html

ID:	1523763
Product:	CloudBasic
Start time:	01:14:44
Start date:	02.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 22:15:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	DC8C5D8960F5B1B1860F8490059B45DB	7E7C10163B0F9BE3AC0C0159B4EED0275332D25C	058F5C63495E7AF32CF3D55F0B2797C9A152F25AAC550EC237D78EAE94664DBF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 22:15:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C19F8512042DB71816C4EFE3F451DB7C	8FE45059C6B8E25A82C3B12485093608A5DE3399	D6E8587D5B7E7A031D5EE9A747EB6836F1EF0F59A539FF20C5BA43890DCE27E5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0A1CE27C34972682A66E15051EF1CF1C	F9D116E6DA5EF9E933593C4B47D5C11C4ABC560E	5F06421200D2944FF343FD2E9E6D6CB3FEADA12EBDD35E8CC1EFF6F208599B21
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 22:15:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	41DFCE7877F4ED3C357DA0F9FABC4C93	B2D34DE19CC2611EB95F40DB76903386031C61AB	E0C10E55FA9B11647BADED24A2A9884D9206228B448750A4A3947BCD5181B784
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 22:15:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	4C77A1148099B70D64420CD928FF19F3	C51B8D81EA87071E30428E95FE7E8CA8796EFF50	66AEC0D8A9358BCB804B99FB212AD16E409C0800A2A8409F922FEAB429A2E17B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 22:15:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9B8F6D6BDE5671F390AB21E71D6FC3E9	3A04EF232C8E5A2CFB2986162BE201575A10BA70	28CC19FDFEF138E6000EB8F6F4E0CEAEEFCC87B99E5C47BFCD07A17A46D8D896
Chrome Cache Entry: 72	HTML document, ASCII text, with very long lines (829), with no line terminators	C074BC0596ABF8F829156250DBC81B35	C8D4494A3A541D7591795DFA3CA4E0F6A21FD2F2	4D4328E0FDA134C5A18E68CDB2FDB2931F7B4C6960909266BC7EE4DFDCFE3C87
Chrome Cache Entry: 73	gzip compressed data, from Unix, original size modulo 2^32 571	5E78C911BE8B87FAAD0475ADDBDABB0D	0FFB1EC3C09730C6B9B9BF9912C3325DEC3E466A	1037C7BFA41F306D2E733866B9FDDF3A9EDCCBF92896E9A3350F155F763A0AC4
Chrome Cache Entry: 74	ASCII text, with very long lines (1382)	3B071D5606CC1CF92AE307F5BDB4E540	E191068CC90E5489130489A1CF173FE50BBA28B8	FF3DE130872FE0FB5B770DFA2BC9F0DAF8AB320403A34A60D089436F08D24F99
Chrome Cache Entry: 75	ASCII text, with very long lines (32027)	5EE9E0776F546C58891989E14C61B600	A87A5C3711C44C1318D680C0D45B55BAF87C62B3	09E84AA0B2955D370F2AA763610894FA62E7D9B2F11E678F84393F9AC7CA58B5
Chrome Cache Entry: 76	gzip compressed data, from Unix, original size modulo 2^32 3304	8B137EEB7A93A5AC0915764A95BDD6FB	455A4956EE76C1F563D4C6DF8E115EFD65DDC502	EA84B3B39A0AE82486BF6EFDEAAE6FFFBBD26D0F7B3FEE91BC471D4F2269FCE0
Chrome Cache Entry: 77	ASCII text, with very long lines (32027)	BC3BBD6FA509423641A60FD366216338	AFB751BB5F358F5A9D1128122CA813D0CC1D9D4F	04D5F5023C49E04A5F9C28FF3A7EB0718B300254248777B263898C9D1D59F82A
Chrome Cache Entry: 78	HTML document, ASCII text, with very long lines (5657)	6AAAF8E11A32FD37FB419E3A4CE9696C	1FD88F2EE4DE5422E0C344DEBEFE3F2B5ABB2592	468959E93F9B4E6F07C6A8F8D0E93D8FCB37D76A8615A93EC153F5842247BA99
Chrome Cache Entry: 80	JSON data	9E0653CDF3694AA39D89F863F5C42410	6D6159AA96E6BE94B59384971DB006BC4A012431	EB29807FA8E624B312D067D61651220967876F0C3B9425B2D56E9D5D1A9D0D0C
Chrome Cache Entry: 81	ASCII text, with very long lines (64561)	5486E95F576CF8FA4252E907DDD4335F	0600338B0626BDE9CA988A26ABA680662B40768F	9A373AE6214168509DC4FE047F320B9D27BD87ED907D66806CE9B865CA55042A
Chrome Cache Entry: 82	JSON data	7786384B31000EB1173B3CB5FF698A4E	583CB5AABDE49477204AA6BDD1302CDDE9EA8574	F7463BFAE62ABD5A29EC3B8482D0AFF827CB57D70BBF27DFA80A860A661AE65D
Chrome Cache Entry: 84	ASCII text, with very long lines (52915)	ACBCBB660EBC92A6766BA72457065851	7BC2CA2EA734A0490E24D745C0F1AF580B3521F5	0DEBF1DE10E6D0C2AB58FEBB6ACB542F7847594FA4D8070F86756D710785BE76
Chrome Cache Entry: 85	JSON data	69E31A61FC960BC076671A401AB5DED3	DE0B4B72DA7AC9F6B50B33C8151C9087EC42E34D	46807D9E79A08CF5CE8980EA9D1D0AE6FB9A66DF3F2EB0B49B6D65683CABC8BA
Chrome Cache Entry: 87	JSON data	FFFC6ED7100858178BD7F7951867344F	5B7A9765CDA75A69D128A6222D3D951383D26BC4	D51F684E4CB0B1447AA259B860C8F32841E9E4FE679A27C215A2EFC8C42686F8
Chrome Cache Entry: 88	HTML document, ASCII text, with very long lines (2008)	D1F231B50B152372A6C3100F4AED1973	1BF10951BE06DA03D1371A904E19C0419F2A3637	9DEC95894AF322B087AB6E87F9C8CE66D849646CF33B375D33C957F4569ED081

Phishing

Source: http://passback.free.fr/pub/pp_120x600.html	HTTP Parser: No favicon
Source: http://passback.free.fr/pub/pp_120x600.html	HTTP Parser: No favicon
Source: http://passback.free.fr/pub/pp_120x600.html	HTTP Parser: No favicon
Source: http://passback.free.fr/pub/pp_120x600.html	HTTP Parser: No favicon
Source: http://passback.free.fr/pub/pp_120x600.html	HTTP Parser: No favicon
Source: http://passback.free.fr/pub/pp_120x600.html	HTTP Parser: No favicon

Compliance

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49734 version: TLS 1.2

Software Vulnerabilities

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 31MB

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic

HTTP traffic detected: GET /pub/pp_120x600.html HTTP/1.1Host: passback.free.frConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: passback.free.frConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://passback.free.fr/pub/pp_120x600.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gads=ID=fac9742ac38abd4b:T=1727824518:RT=1727824518:S=ALNI_MZiSqTSUf10e2gN-_P259ddO3PATg; __gpi=UID=00000f00ca34939c:T=1727824518:RT=1727824518:S=ALNI_MZ0AjOucsSCcIPRdnboCHwerZv__Q; __eoi=ID=d80c6368ea5d1935:T=1727824518:RT=1727824518:S=AA-AfjbnLg2keJ8qjLMuJqLszD66

Source: global traffic	DNS traffic detected: DNS query: passback.free.fr
Source: global traffic	DNS traffic detected: DNS query: www.googletagservices.com
Source: global traffic	DNS traffic detected: DNS query: securepubads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Tue, 01 Oct 2024 23:15:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 b1 0e 02 21 0c 86 77 13 df a1 de 8e 78 e6 46 64 31 9a 38 e8 e2 13 70 47 05 12 8e 1a c4 e8 bd bd a0 67 62 9c 1d 1d fb f7 eb d7 a6 c2 a6 de cb e9 44 58 54 5a 8a e4 92 47 d9 2c 1a 38 50 82 2d 5d 83 16 fc 15 0a fe 44 32 da 92 1e a0 35 1d 79 8a ab ea 66 5d c2 aa 28 3a 0c 09 a3 14 b6 fe 36 e4 44 f0 b1 5d 76 65 68 ac 82 71 e1 ce eb 79 dd cc 97 9f 08 2f 4b 8a 94 bf 0f 9c 31 06 0a ce 4a 6b 17 0c 24 02 ed 2e aa f5 08 fb e3 6e 03 2a 68 58 db 48 3d c2 29 3a 0c da 0f 80 31 52 cc 13 06 81 b1 e2 fa 2b 7e f9 8b 07 32 c5 84 02 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc!wxFd18pGgbDXTZG,8P-]D25yf](:6D]vehqy/K1Jk$.n*hXH=):1R+~2;0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49734 version: TLS 1.2

System Summary

Source: classification engine

Classification label: clean0.win@19/20@14/207

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,5060305073691491895,3946397409507975366,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://passback.free.fr/pub/pp_120x600.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,5060305073691491895,3946397409507975366,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk