Y’all joke, but when that ‘task’ is run through process monitor, we see it’s trying to overwrite a DLL in system32, create a directory at root of %systemdrive% or cache some data in the Program Files application itself, instead of utilizing ProgramData or Appdata properly.
When applications fail these simple practices and demand local admin, they shouldn’t touch your network.
Y’all joke, but when that ‘task’ is run through process monitor, we see it’s trying to overwrite a DLL in system32, create a directory at root of %systemdrive% or cache some data in the Program Files application itself, instead of utilizing ProgramData or Appdata properly.
When applications fail these simple practices and demand local admin, they shouldn’t touch your network.
<3