Raspberry Robin: USB Worm to LOLBin Execution

A staff member at Vantekra Solutions inserted an unknown USB drive. The LNK on it silently handed execution to cmd.exe, which called msiexec to fetch a DLL from a compromised host on the internet. rundll32 loaded it, fodhelper provided silent elevation, and a Tor-backed C2 channel opened within minutes. Every step used a signed Windows binary. Trace the full chain through the XDR process tree and Sysmon logs.