During our research we discovered that long-term sandboxing detonations of PowerRatankba not running cryptocurrencyrelated applications were never infected with a Stage2 implant. This may indicate that the PowerRatankba operator(s)