Run Key Persistence via ProgramData Rapid/TIEmounter Payloads (cmd /c start Wrapper)

Duo Tech@duotech

•updated Aug 17, 2026•5•0•7

Detects Run key persistence for follow-on ACRStealer payloads (creator-ws.exe under ProgramData\Rapid, pgocvt.exe under ProgramData\TIEmounter) launched via a cmd /c start wrapper.