The last query is to the subdomain ihc[.]stage[.]12019683[.]ns2[.]true-deals[.]com):   The delivered second stage shellcode is encrypted:  METERPRETER: After decryption of the second stage shellcode, the shellcode deletes the ‘MZ’ prefix from within a very important part of the shellcode