DLL Side-Loading via pgocvt.exe Loading tbbmalloc.dll from C:\ProgramData\TIEmounter\
Detects DLL side-loading of the unsigned tbbmalloc.dll by the signed binary pgocvt.exe from the C:\ProgramData\TIEmounter\ staging directory — a second-stage follow-on payload technique in the ACRStealer campaign.
Cortex XDR
