Suspicious process

Why would Manager try to modify the attributes of a file in an entirely different directory from Manager or from my Manager data files?

Norton 360 gave me the following warning. It’s alarmingly specific about ManagerDesktop.exe trying to change the attributes of an .ICO file in an unrelated directory.

For a reason I don’t understand, the Manager installer uses the following file for icon display

%APPDATA%\Microsoft\Installer\{D28BC637-D8A4-480B-852B-E10130F1D4F2}\ManagerDesktop_1.exe

Rather than a file in the program directory such as

C:\Program Files (x86)\Manager\ManagerDesktop.exe
or
C:\Program Files (x86)\Manager\Manager.ico

Not sure why the installer would access the path you have shown part of .

Manager contains no code that changes file attributes of any file. It could be Microsoft component such as WebView2 that could be doing it within ManagerDesktop.exe process.

Does this have a trigger such as doing something before this alert or completely random?

We distribute MSI package which is launched using Windows Installer. What entries Windows Installer creates in its %APPDATA%\Microsoft\Installer\ folder is beyond my control.

Random. It happened exactly once, when I was doing the same thing I do every week when I enter my billable hours, issue invoices, and record receipts. However, this was the first time I did that with the current version. I tried to trigger it again just now, but it didn’t recur.

The icon file that was accessed is an older file that I can’t recall using recently, and it’s in a little-used directory. It’s odd that WebView (or any process, for that matter) would need to access it, let alone change its attributes.

I suppose this is a mystery. I expect occasional false-positives from Norton, but the specificity of this one threw me.