Windows Analysis Report
https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com

ID:	1533090
Product:	CloudBasic
Start time:	13:08:00
Start date:	14.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 10:08:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	88EF33CFFB650CDE67CD1FCCF2792DEE	AB90FAD341602476AF15296D84A7D3D57930691F	9CD220380C80DDB8779686682E3785AB774CFD5BD85A5F6834A6270D71992517
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 10:08:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B6443F163D998F5218485987BF9984BA	358017E815DF97678B9F7746CCA9817A9A820695	B6D31ADE0E211FB901F221CB85783B32DE487FEFBCAFDFE220B3726A4AA6495A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 10:08:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7BD7B4BD3A3CDA7E9B25202F4E8DB7ED	10B08E3D8134956B05F725A8E8525319C9328FE6	E17B453AADE22C740A6808A9FD74F5EF01FFB03077D973C84AE49ED0AF8141ED
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 10:08:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A4F0EDE2D0CF0F4F38CF64D3212CAD32	253CA7AE93DA7A5E49D9946C17210F1CA3423C36	C5128F8C35909CE899E76814E2046D01865A30EEA181F304658A41EFC707ED28
Chrome Cache Entry: 59	PNG image data, 3396 x 1920, 8-bit/color RGB, non-interlaced	A4D9107960AE4E4F79E6A36DF931EF5D	35704C698FCCD795B8F19DA76672A72C00422857	FBBBC78E85DFA4F2B390E6DC2F3850D0F5247D16B5FD525093331572AA79AE84
Chrome Cache Entry: 60	HTML document, ASCII text, with CRLF, LF line terminators	F58515DFE987F7E027C8A71BBC884621	BEC6AEBF5940EA88FBBFF5748D539453D49FA284	679E7E62B81267C93D0778083AE0FD0EFE24172FF0AC581835B54165B3D9ED43
Chrome Cache Entry: 61	HTML document, ASCII text, with very long lines (10455), with CRLF line terminators	44A718D10DC9BEABC26AFB035DC9DA95	2E5C2A949EA5029494D775EA3AC8D7250EB76F6B	6DE83C295D405851F37D2D5A72692068375EDE9400D04B175C41DDE8D9A027F7
Chrome Cache Entry: 63	ASCII text, with no line terminators	F1C9C44E663E7E62582E3F5B236C1C72	E142F3A0C2D1CDF175A5C3AF43AD66FEFE208B1F	D843E67FBFA1F5CB0024062861EE26860C5A866F80755CF39B3465459A8538B9

AV Detection

Source: atenasur.cl

Virustotal: Detection: 6%

Perma Link

Phishing

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_61, type: DROPPED

Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com
Source: https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com	Sample URL: PII: james@domain.com

Source: https://tiny-startupop.pl/OXHpn/#Djames@domain.com

HTTP Parser: No favicon

Compliance

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49730 version: TLS 1.2

Software Vulnerabilities

Source: chrome.exe

Memory has grown: Private usage: 18MB later: 28MB

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /wp/ld//QjLtBRuVpCWi/james@domain.com HTTP/1.1Host: atenasur.clConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com.pe
Source: global traffic	DNS traffic detected: DNS query: atenasur.cl
Source: global traffic	DNS traffic detected: DNS query: tiny-startupop.pl
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: blogger.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49730 version: TLS 1.2

System Summary

Source: classification engine

Classification label: mal56.phis.win@19/8@18/172

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1884,i,11242851642936306301,11392960889638104959,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.com.pe/url?q=QjLtBRuVpCWi&rct=QjLtBRuVpCWi&sa=t&esrc=QjLtBRuVpCWi&source=&cd=QjLtBRuVpCWi&uact=&url=amp%2Fatenasur.cl/wp/ld//QjLtBRuVpCWi/james@domain.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1884,i,11242851642936306301,11392960889638104959,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk