Post #3835003

Hoping someone can chime in, i'm at a wall at the moment. So, i've come across a scenario where i have a couple of users devices that are downloading crypto token icons in SVG format to a directory that is then deleted. From all of the evidence gathered, it look slike this is all happening within 30 seconds on the devices. We manage Chrome with policies. We have a whitelist for plugins and extensions. I located this, while searching for something else in our XDR logs. C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\arc-native-token-logo.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\avax-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura.svg We've manually checked the users device, installed extensions/plugins, we've used KQL queries to try to locate the root of this, however, the way Chrome works, it hides the information we're looking for. I've even gone through all the chrome://chrome-urls/ to see if i could locate anything. We've compared job roles, of the users and they have nothing in common. One of the new ones located had this information Process event: chrome.exe --utility-sub-type=unzip.mojom.Unzipper Time: 7:21:46 PM File events (10 SVGs): Time: 7:22:11 PM Folder:Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ Delta = ~25 seconds What is excluded in all of the logs on the device and in our Defender system, is if this is an extension, what the ID or name is if it is. I know or at least I know that the CRX also handles Chrome updates. But in either case, I need to find out what is download icons for crypto currency then deleting it. The users event viewer shows nothing, as these events are not logged, so I am hoping someone might know a way to dig deeper into Chrome to figure this out. This is the Initiating Process Command Line for just about everyone of these entries "chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --metrics-shmem-handle=5840,i,2169236920772237475,2071396139152657378,524288 --field-trial-handle=1940,i,9109780936433903204,1179441795768105101,262144 --variations-seed-version=20260630-171645.651000-production --pseudonymization-salt-handle=1956,i,16028727218760239160,14674054428472284321,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=5868 /prefetch:14 #Chrome #KQL #Defender