The developer rewrote a large part of the code however the workflow is the same as previously and some features are copy/paste. This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. Here is an example of code similarities on the execution via named pipe function. The code is not exactly the same but the workflow and some constants are similar