CountLoader impersonation: c/p/m-prefixed binary in user path with spoofed PE OriginalFileName
Detects execution of pOneDrive.exe, cOneDrive.exe, or mOneDrive.exe running from a user profile or AppData path (outside standard Program Files/System32/SysWOW64 locations) whose PE OriginalFileName does not match the on-disk image name, indicative of CountLoader binary impersonation delivered via the DOUBLECUP loader.
Cortex XDR
