Multi-stage intrusion used Registry-stored PowerShell, DNS TXT records, PNG and WAV payloads, and in-memory .NET loading to deploy XMRig mining while weakening Defender and PowerShell logging. #XMRig #RegistryHiding #InMemoryLoad