PipeMon’s first stage consists of a password-protected RARSFX executable embedded in the .rsrc section of its launcher. Once written to disk, the RARSFX is executed with CreateProcess by providing the decryption password in an argument, as follows