CastleLoader Staging - AutoIt Launching

Daniel Jeremiah@daniyyell

•updated Feb 28, 2026•0•24

Detects AutoIt launching `jsc.exe`, matching the CastleLoader stage that hollows into `jsc.exe` per ANY.RUN analysis.