Jump to content

AndresQ

Members
 View Profile  See their activity

  • Posts

    2

  • Joined

  • Last visited

Kudos

  1. Upvote
    AndresQ
    AndresQ gave kudos to Marcos in Process execution from suspicious location (execution flow hijacking) [E0422]   
    What is the path to mousocoreworker.exe? It's normally located in c:\windows\system32 and %WINDIR%\uus\amd64 on Windows 11 according to the rule. Since the rule was triggered, the file was likely run from another non-standard location.
×
×
  • Create New...