TinyRCT AppDomainManager Injection via chrome_setup.exe.config and MyAppDomainManager.dll
Detects execution of potentially masqueraded processes or the creation of suspicious files, including specific DLLs, configuration files, and activity within VMware folders, often indicative of staging malicious payloads or side-loading attempts.
CQL
