Inside .NET Loader Analysis: From Malspam to In-Memory Loader

A malspam campaign abusing Google's DoubleClick delivers the loader through a five-stage chain that evades detection and blinds Windows telemetry before persisting