indicatorfilename
C:\ProgramData\MicrosoftOneDrive\keys.dat
- First seen
- 2026-05-14
- Last seen
- 2026-05-14
- Sightings
- 1
Posts referencing this indicator
- 5 Malicious NuGet Packages Impersonate Chinese UI Libraries to Distribute Crypto Wallet and Credential Stealer
Staging file path used by the malware to archive harvested data before exfiltration.