The updater that is not OneDrive
Read the user’s Run key from a memory image with windows.registry.printkey, find the entry that imitates OneDrive, and confirm the file and process with filescan and pslist.
Briefing
tomas’s laptop starts something at every logon that the EDR cannot attribute to a vendor. The image is cases/tomas-lt/tomas-lt.raw.
Volatility can read registry hives that are loaded in memory. The Run key under the user’s NTUSER hive starts programs at logon. windows.filescan lists file objects the kernel had open.
forensics-ws · Memory forensics
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.