and a fixed 16-byte key that is hardcoded in the second stage. Then, it is decompressed using the NRV2e algorithm from the open-source UCL library. The second stage module loads the resulting binary in memory, validates that it is a valid PE file, and calls its entry point in a system thread.