Chrome Extension report 2

[dscoland]

Hi Lansweeper team,

I am sure this question has been asked many times before, and I saw that there was one post about it.
Do you have any ETA on Chrome extension scanning?

Reference:
https://www.lansweeper.com/forum/yaf_postst12256_Chrome-Extension-report.aspx#post44363

Thanks in advance!
Daniel

[dscoland · Accepted solution]

I created a report that may or may not help anyone out.
It is powered by the below registry keys.

SOFTWARE\Google\Chrome\PreferenceMACs\Profile 2\extensions.settings
SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings

We have noticed that the below placeholder (<value>) in the key name may vary in based upon how many profiles were created in Chrome.

SOFTWARE\Google\Chrome\PreferenceMACs\<value>\extensions.settings

Below is the report I created that encompasses every manually added extension (via registry value), as well as identifying them with a Case statement.
Lansweeper will only scan what you enter into the report, so other methods of detection might be necessary if you need to know what you're scanning for (malware scanning/detection and/or other scripts).
Also if you want to use this as a tool for cleaning up, it is imperative to delete the registry value from the computer you intend to remove the Extension from. Otherwise Windows doesn't do a great job of cleaning that up after removing it from the web browser. If you don't, it will still show up on the report because it still exists.

Select Distinct Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
Case
When tblRegistry.Valuename = 'hdokiejnpimakedhajhdlcegeplioahd' Then
'LastPass: Free Password Manager'
When tblRegistry.Valuename = 'hcnhehfhmoehmgleanahialfapndding' Then
'LanSweeper Shell Execute'
When tblRegistry.Valuename = 'aohghmighlieiainnegkcijnfilokake' Then 'Docs'
When tblRegistry.Valuename = 'efaidnbmnnnibpcajpcglclefindmkaj' Then
'Adobe Acrobat'
When tblRegistry.Valuename = 'ghbmnnjooekpmoecnnnilnnbdlolhkhi' Then
'Google Docs Offline'
When tblRegistry.Valuename = 'apdfllckaahabafndbhieahigkjlhalf' Then
'Google Drive'
When tblRegistry.Valuename = 'ennkphjdgehloodpbhlhldgbnhmacadg' Then
'Settings'
When tblRegistry.Valuename = 'bepbmhgboaologfdajaanbcjmnhjmhfn' Then
'Google Voice Search'
When tblRegistry.Valuename = 'jlhmfgmfgeifomenelglieieghnjghma' Then
'Cisco WebEx Extension'
When tblRegistry.Valuename = 'blpcfgokakmgnkcojhhkbfbldkacnbeo' Then
'YouTube'
When tblRegistry.Valuename = 'pkedcjkdefgpdelpbcmbmeomcjbeemfm' Then
'Chrome Media Router'
When tblRegistry.Valuename = 'pjkljhegncpnkpknbcohdijeoejaedia' Then 'Gmail'
When tblRegistry.Valuename = 'nmmhkkegccagdldgiimedpiccmgmieda' Then
'Chrome Web Store Payments'
When tblRegistry.Valuename = 'coobgpohoikkiipiblmjeljniedjpjpf' Then
'Google Search'
When tblRegistry.Valuename = 'eemcgdkfndhakfknompkggombfjjjeno' Then
'Bookmark Manager'
When tblRegistry.Valuename = 'ahfgeienlihckogmohjhadlkjgocpleb' Then
'Web Store'
When tblRegistry.Valuename = 'gfdkimpbcpahaombhbimeihdjnejgicl' Then
'Feedback'
When tblRegistry.Valuename = 'kmendfapggjehodndflmmgagdbamhnfd' Then
'CryptoTokenExtension'
When tblRegistry.Valuename = 'mfehgcgbbipciphmccgaenjidiccnmng' Then
'Cloud Print'
When tblRegistry.Valuename = 'mfffpogegjflfpflabcdkioaeobkgjik' Then
'gaia_auth'
When tblRegistry.Valuename = 'mhjfbmdgcfjbbpaeojofohoefgiehjai' Then
'Chrome PDF Viewer'
When tblRegistry.Valuename = 'nbpagnldghgfoolbancepceaanlmhfmd' Then
'Hotword triggering'
When tblRegistry.Valuename = 'neajdppkdcdipfabeoofebfddakdcjhd' Then
'Google Network Speech'
When tblRegistry.Valuename = 'nkeimhogjdpnpccoofpliimaahmaaome' Then
'Google+ Hangouts'
When tblRegistry.Valuename = 'nmmhkkegccagdldgiimedpiccmgmieda' Then
'Google Wallet'
When tblRegistry.Valuename = 'kbfnbcaeplbcioakkpcpgfkobkghlhen' Then
'Grammarly for Chrome'
When tblRegistry.Valuename = 'cdjplknefldnfcncohonjbeeocljjmbm' Then
'Simple Autofill' Else 'Extension Not Named' End As ChromeExtension,
tblRegistry.Valuename As ExtensionID,
tsysIPLocations.IPLocation,
tsysAssetTypes.AssetTypename,
tsysAssetTypes.AssetTypeIcon10 As icon,
tblAssets.IPAddress,
tblAssets.Lastseen,
tblAssets.Lasttried
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tblRegistry On tblAssets.AssetID = tblRegistry.AssetID
Inner Join tsysIPLocations On tsysIPLocations.LocationID =
tblAssets.LocationID
Where tblRegistry.Valuename In ('hdokiejnpimakedhajhdlcegeplioahd',
'hcnhehfhmoehmgleanahialfapndding', 'aohghmighlieiainnegkcijnfilokake',
'efaidnbmnnnibpcajpcglclefindmkaj', 'ghbmnnjooekpmoecnnnilnnbdlolhkhi',
'apdfllckaahabafndbhieahigkjlhalf', 'ennkphjdgehloodpbhlhldgbnhmacadg',
'blpcfgokakmgnkcojhhkbfbldkacnbeo', 'jlhmfgmfgeifomenelglieieghnjghma',
'pkedcjkdefgpdelpbcmbmeomcjbeemfm', 'pjkljhegncpnkpknbcohdijeoejaedia',
'nmmhkkegccagdldgiimedpiccmgmieda', 'coobgpohoikkiipiblmjeljniedjpjpf',
'eemcgdkfndhakfknompkggombfjjjeno', 'ahfgeienlihckogmohjhadlkjgocpleb',
'gfdkimpbcpahaombhbimeihdjnejgicl', 'kmendfapggjehodndflmmgagdbamhnfd',
'mfehgcgbbipciphmccgaenjidiccnmng', 'mfffpogegjflfpflabcdkioaeobkgjik',
'mhjfbmdgcfjbbpaeojofohoefgiehjai', 'nbpagnldghgfoolbancepceaanlmhfmd',
'neajdppkdcdipfabeoofebfddakdcjhd', 'nkeimhogjdpnpccoofpliimaahmaaome',
'bepbmhgboaologfdajaanbcjmnhjmhfn', 'mgndgikekgjfcpckkfioiadnlibdjbkf',
'kbfnbcaeplbcioakkpcpgfkobkghlhen', 'cdjplknefldnfcncohonjbeeocljjmbm') And
tblAssetCustom.State = 1
Order By ChromeExtension,
tsysIPLocations.IPLocation,
tblAssets.AssetName

[Esben_D]

Unfortunately, there is no estimated release date for this feature. This feature has been requested before by our customers and is already on our customer wish list. We have added this topic to the existing feature request to add weight to it.