VERY IMPORTANT

SentinelOne found an initial loader that was implemented in AutoIt and uses Process Hollowing to load a .NET-based payload, they reconstructed the string decryption method enabling them to partially deobfuscate the loader.