These samples use an odd technique to load the next stages, which until recently was unique to Regin. Interestingly, in mid-2012, the ZeroAccess gang implemented a very similar loading mechanism, which possibly