I was wondering why my Canarytoken (a file folder) was triggering & discovered the culprit was chrome.exe. Turns out @googlechrome quietly began performing AV scans on Windows devices last fall. Wtf m8? This isn’t a system dir, either, it’s in \Documents\ 
Here’s the source on the Windows device scanning: support.google.com/chrome/answer/… “Chrome helps you find suspicious or unwanted programs on your Windows computer.”
I’m also now wondering if this is why my box is crashing so often 🤔 when I googled the errors before, advice was to uninstall third party AV & until now I didn’t think I had any.... ffs
FYI for people joining the thread late, here is someone from google chrome’s response:
Follow up from the google chrome security lead for those navigating the thread:
