The primary difference between Sample 2 and this sample is the file name used by the payload. The prior version used the name SafeApp.exe and installed the binary into %AppData% and added a Windows auto run registry entry against that file. Sample 3 does the same thing but makes the file name NeutralApp.exe. This is notable, because the malware checks for a copy of itself, and the name is static making it simple to identify infection. Due to the name change, the newer version runs even if SafeApp.exe is currently running on the victim machine