We can compare it to the sample e338d49c270baf64363879e5eecb8fa6bdde8ad9 used in May 2017 by Group 74. In this campaign, adversaries did not use any exploit. Instead,the payload is executed in standalone mode by rundll32.exe. Adversaries also changed some constants, such as the XOR key used in the previous version