This loader can stealthily run its payload in various ways, such as using the CreateThread function, bypassing Microsoft’s Control Flow Guard (CFG), module stomping, and phantom dynamic link library (DLL) hollowing.