I was looking at some security events in my Meraki dashboard and it seems to be showing this malicious filename: W32.4E846BBEDE-95.SBX.TG when I visit the virus total link attached to this finding it gives me different information. I have googled this malicious filename and found that it was linked to a malicious Microsoft Powerpoint exe file. What I am trying to gather here is what exactly does this virus do to the system? Any information would help.
Microsoft classifies it as a PUA:Win32/InstallCore,
Summary
This application was stopped from running on your network because it has a poor reputation. This application can also affect the quality of your computing experience. We have seen this leading to the following potentially unwanted behaviors on PCs:
Adds files that run at startup
Modifies file associations
Injects into other processes on your system
Injects into browsers
Changes browser settings
Changes browser shortcuts
Installs browser extensions
Disables User Access Control (UAC)
These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.
If you were trying to install an application, you might have downloaded it from a source other than the official product's website.
We usually see this application installed on PCs in the following countries. This list is sorted according to prevalence:
Were there any other details? I googled that filename and didn't find anything.
Adam R MS | CISSP, CISM, VCP, MCITP, CCNP, ITILv3, CMNO If this was helpful click the Kudo button below If my reply solved your issue, please mark it as a solution.
Same here I looked everywhere and could not find anything on it. The virus total link I posted at the bottom said Roblox as the file name. I looked up this hash associated with the file 4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36 and got this.
Microsoft classifies it as a PUA:Win32/InstallCore,
Summary
This application was stopped from running on your network because it has a poor reputation. This application can also affect the quality of your computing experience. We have seen this leading to the following potentially unwanted behaviors on PCs:
Adds files that run at startup
Modifies file associations
Injects into other processes on your system
Injects into browsers
Changes browser settings
Changes browser shortcuts
Installs browser extensions
Disables User Access Control (UAC)
These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.
If you were trying to install an application, you might have downloaded it from a source other than the official product's website.
We usually see this application installed on PCs in the following countries. This list is sorted according to prevalence:
