UNITED STATES DISTRICT COURT EASTERN DISTRICT OF WISCONSIN UNITED STATES OF AMERICA, Plaintiff, V. Case No. 17-CR-124 MARCUS HUTCHINS, Defendant. PLEA AGREEMENT 1. The United States of America, by its attorneys, Matthew D. Krueger, United States Attorney for the Eastern District of Wisconsin, and Benjamin Proctor and Benjamin Taibleson, Assistant United States Attorneys, and the defendant, Marcus Hutchins, individually and by attorneys Brian Klein, Marcia Hofmann, and Daniel Stiller, pursuant to Rule 11 of the Federal Rules of Criminal Procedure, enter into the following plea agreement: CHARGES 2. The defendant has been charged in 10 counts of a superseding indictment, which allege violations of Title 18, United States Code, Sections 2; 371; 1001(0(2); 1030(a)(5)(A), (a)(2)(0), (b), 0(2)(B), (c)(4)(A)VIV), and (c)(4)(B)(i)-(ii); 2511(1)(a), (4)(a); 2512(1)(0, (1)(b), (1)(c)(i), and (1)(c)(ii); and 1349. 3. The defendant has read and fully understands the charges contained in the indictment. He fully understands the nature and elements of the crimes with Case 2:17-cr-00124-JPS Filed 04/19/19 Page 1 of 19 Document 124 which he has been charged, and the charges and the terms and conditions of the plea agreement have been fully explained to him by his attorneys. 4. The defendant voluntarily agrees to plead. guilty to Counts One and Two of the superseding indictment. 5. The defendant acknowledges, understands, and agrees that he is, in fact, guilty of the offenses described in paragraph 4. The parties acknowledge and understand that if this case were to proceed to trial, the government would be able to prove the facts in Attachment A, as well as the facts set forth in Counts One and Two of the superseding indictment, beyond a reasonable doubt. The defendant admits that these facts are true and correct and establish his guilt beyond a reasonable doubt. The information in Attachment A is provided for the purpose of setting forth a factual basis for the plea of guilty. It is not a full recitation of the defendant's knowledge of, or participation in, the offenses. PENALTIES 6. The parties understand and agree that the offenses to which the defendant will enter a plea of guilty carry the following maximum terms of imprisonment and fines: Count One: up to 6 years in prison, up to $250,000 in fines, up to 1 year of supervised release, and a $100 special assessment. • Count Two: up to 5 years in prison, up to $250,000 in fines, up to 1 year of supervised release, and a $100 special assessment. The parties further recognize that a restitution order may be entered by the court. 2 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 2 of 19 Document 124 7. The defendant acknowledges, understands, and agrees that he has discussed the relevant statutes as well as the applicable sentencing guidelines with his attorneys. DISMISSAL OF REMAINING COUNTS 8. The government agrees to move to dismiss the remaining counts at the time of sentencing. ELEMENTS 9. The parties understand and agree that in order to prove a violation of 18 U.S.C. § 371 as set forth in Count One, the government must prove each of the following propositions beyond a reasonable doubt: 1. The conspiracy as charged existed; 2. The defendant knowingly became a member of the conspiracy with the intent to advance the conspiracy; and 3. One of the conspirators committed an overt act in an effort to advance the goal of conspiracy. The parties understand and agree that in order to prove a violation of 18 U.S.C. § 2512(1)0(0 as set forth in Count Two, the government must prove each of the following propositions beyond a reasonable doubt: 1. The defendant intentionally disseminated by electronic means any advertisement of a device; 2. The defendant knew or had reason to know that the design of the device renders it primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communication; 3. The defendant knew or had reason to know that the advertisement would be transported in interstate or foreign commerce. 3 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 3 of 19 Document 124 SENTENCING PROVISIONS 10. The parties agree to waive the time limits in Fed. R. Crim. P. 32 relating to the presentence report, including that the presentence report be disclosed not less than 35 days before the sentencing hearing, in favor of a schedule for disclosure, and the filing of any objections, to be established by the court at the change of plea hearing. 11. The parties acknowledge, understand, and agree that any sentence imposed by the court will be pursuant to the Sentencing Reform Act, and that the court will give due regard to the Sentencing Guidelines when sentencing the defendant. 12. The parties acknowledge and understand that prior to sentencing the United States Probation Office will conduct its own investigation of the defendant's criminal history. The parties further acknowledge and understand that, at the time the defendant enters a guilty plea, the parties may not have full and complete information regarding the defendant's criminal history. The parties acknowledge, understand, and agree that the defendant may not move to withdraw the guilty plea solely as a result of the sentencing court's determination of the defendant's criminal history. Sentencing Guidelines Calculations 13. The defendant acknowledges and understands that the sentencing guidelines recommendations contained in this agreement do not create any right to be sentenced within any particular sentence range, and that the court may impose a reasonable sentence above or below the guideline range. The parties further 4 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 4 of 19 Document 124 understand and agree that if the defendant has provided false, incomplete, or inaccurate information that affects the calculations, the government is not bound to make the recommendations contained in this agreement. Relevant Conduct 14. The parties acknowledge, understand, and agree that pursuant to Sentencing Guidelines Manual (U.S.S.G.) § 1B1.3, the sentencing judge may consider relevant conduct in calculating the sentencing guidelines range, even if the relevant conduct is not the subject of the offenses to which the defendant is pleading guilty, Base Offense Level and Specific Offense Characteristics 15. The parties agree to recommend the following base offense levels and adjustments for specific offense characteristics: • For Count One, a multi-object conspiracy, U.S.S.G. § 1B1.2(d) provides that the guidelines are to be calculated for each offense that is subject of the conspiracy, and under § 3D1.2(d), all counts are grouped together: o Count One, Part A, conspiracy to violate 18 U.S.C. § 1030(0(5): a base offense level of 6 under a §§ 2B1.1(a)(2) and 2X1.1(a); 2-level increase for an offense involving more than 10 victims under § 2B1.1(b)(2)(A); a 2-level increase because a substantial part of the offense was committed outside of the United States under § 2B1.1(b)(10); a 2-level increase for a violation of 18 U.S.C. § 1030 with an intent to obtain personal information under § 2B1.1(b)(18)(A); a 4-level increase for an offense under 18 U.S.C. § 1030(0(5); a 3-level reduction for conspiracy under § 2X1.1(b)(2). o Count One, Part B, conspiracy to violate 18 U.S.C. § 1030(0(2); a base offense level of 6 under §§ 2B1.1(a)(2) and 2X1.1(a); a 2-level increase for an offense involving more than 10 victims under § 2B1.1(b)(2)(A); a 2-level increase because a substantial part of the offense was committed outside of the United States under § 2B1.1(b)(10); a 2-level 5 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 5 of 19 Document 124 increase for a violation of 18 U.S.C. § 1030 with an intent to obtain personal information under § 2B1.1(b)(18)(A); a 3-level reduction for conspiracy under § 2X1.1(b)(2). o Count One, Part C, conspiracy to violate 18 U.S.C. § 2511(1)(a): a base offense level of 9 under §§ 2113.1(a)(1) and 2X1.1(a); a 3-level reduction for conspiracy under § 2X1.1(b)(2). o The government may also recommend up to an 8-level adjustment under § 2B1.1(b)(1)(E). For Count Two: a base offense level of 6 under § 2113.2(a) and a 3-level increase for commission of the offense for pecuniary gain under § 2113.2(b). Acceptance of Responsibility 16. The government agrees to recommend a two-level decrease for acceptance of responsibility as authorized by U.S.S.G. § 3E1.1(a), but only if the defendant exhibits conduct consistent with the acceptance of responsibility. In addition, if the court determines at the time of sentencing that the defendant is entitled to the two-level reduction under § 3E1.1(a), the government agrees to make a motion recommending an additional one-level decrease as authorized by Sentencing Guidelines Manual § 3E1.1(b) because the defendant timely notified authorities of his intention to enter a plea of guilty. Sentencing Recommendations 17. Both parties reserve the right to provide the district court and the probation office with any and all information which might be pertinent to the sentencing process, including but not limited to any and all conduct related to the offense as well as any and all matters which might constitute aggravating or mitigating sentencing factors. 6 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 6 of 19 Document 124 18. Both parties reserve the right to make any recommendation regarding any and all factors pertinent to the determination of the sentencing guideline range; the fine to be imposed; the amount of restitution and the terms and condition of its payment; the length of supervised release and the terms and conditions of the release; the defendant's custodial status pending the sentencing; and any other matters not specifically addressed by this agreement. 19. The government agrees to make no recommendation regarding the ultimate sentence to be imposed; however, the government remains free to take a position with respect to any fact or factor pertinent to the sentencing decision consistent with this agreement and to advise the court that the government's failure to make a sentencing recommendation should not be construed as a recommendation for leniency or severity. Court's Determinations at Sentencing 20. The parties acknowledge, understand, and agree that neither the sentencing court nor the United States Probation Office is a party to or bound by this agreement. The United States Probation Office will make its own recommendations to the sentencing court. The sentencing court will make its own determinations regarding any and all issues relating to the imposition of sentence and may impose any sentence authorized by law up to the maximum penalties set forth in paragraph 6 above. The parties further understand that the sentencing court will be guided by the sentencing guidelines but will not be bound by the sentencing guidelines and may impose a reasonable sentence above or below the calculated guideline range. 7 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 7 of 19 Document 124 21. The parties acknowledge, understand, and agree that the defendant may not move to withdraw the guilty plea solely as a result of the sentence imposed by the court. FINANCIAL MATTERS 22. The defendant acknowledges and understands that any and all financial obligations imposed by the sentencing court are due and payable in full upon entry of the judgment of conviction. The defendant further understands that any payment schedule imposed by the sentencing court shall be the minimum, the defendant is expected to pay and that the government's collection of any and all court imposed financial obligations is not limited to the payment schedule. The defendant agrees not to request any delay or stay in payment of any and all financial obligations. If the defendant is incarcerated, the defendant agrees to participate in the Bureau of Prisons' Inmate Financial Responsibility Program, regardless of whether the court specifically directs participation or imposes a schedule of payments. 23, The defendant agrees to provide to the Financial Litigation Unit (FLU) of the United States Attorney's Office upon request of the FLU during any period of probation or supervised release imposed by the court, a complete and sworn financial statement on a form provided by FLU and any documentation required by the form. Special Assessment 24. The defendant agrees to pay the special assessment in the amount of $200 prior to or at the time of sentencing. 8 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 8 of 19 Document 124 DEFENDANTS WAIVER OF RIGHTS 25. In entering this agreement, the defendant acknowledges and understands that he surrenders any claims he may have raised in any pretrial motion, as well as certain rights which include the following: a. If the defendant persisted in a plea of not guilty to the charges against him, he would be entitled to a speedy and public trial by a court or jury. The defendant has a right to a jury trial. However, in order that the trial be conducted by the judge sitting without a jury, the defendant, the government and the judge all must agree that the trial be conducted by the judge without a jury. b. If the trial is a jury trial, the jury would be composed of twelve citizens selected at random. The defendant and his attorney would have a say in who the jurors would be by removing prospective jurors for cause where actual bias or other disqualification is shown, or without cause by exercising peremptory challenges. The jury would have to agree unanimously before it could return a verdict of guilty. The court would instruct the jury that the defendant is presumed innocent until such time, if ever, as the government establishes guilt by competent evidence to the satisfaction of the jury beyond a reasonable doubt. c. If the trial is held by the judge without a jury, the judge would find the facts and determine, after hearing all of the evidence, whether or not he was persuaded of defendant's guilt beyond a reasonable doubt. d. At such trial, whether by a judge or a jury, the government would be required to present witnesses and other evidence against the defendant. The defendant would be able to confront witnesses upon whose testimony the government is relying to obtain a conviction and he would have the right to cross-examine those witnesses. In turn the defendant could, but is not obligated to, present witnesses and other evidence on his own behalf. The defendant would be entitled to compulsory process to call witnesses. e. At such trial, defendant would have a privilege against selfincrimination so that he could decline to testify and no inference of guilt could be drawn from his refusal to testify. If defendant desired to do so, he could testify on his own behalf. 9 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 9 of 19 Document 124 26. The defendant acknowledges and understands that by pleading guilty he is waiving all the rights set forth above. The defendant further acknowledges the fact that his attorney has explained these rights to him and the consequences of his waiver of these rights. The defendant further acknowledges that as a part of the guilty plea hearing, the court may question the defendant under oath, on the record, and in the presence of counsel about the offense to which the defendant intends to plead guilty. The defendant further understands that the defendant's answers may later be used against the defendant in a prosecution for perjury or false statement. 27. The defendant acknowledges and understands that he will be adjudicated guilty of the offenses to which he will plead guilty and thereby may be deprived of certain rights, including but not limited to the right to vote, to hold public office, to serve on a jury, to possess firearms, and to be employed by a federally insured financial institution. 28. The defendant knowingly and voluntarily waives all claims he may have based upon the statute of limitations, the Speedy Trial Act, and the speedy trial provisions of the Sixth Amendment. The defendant agrees that any delay between the filing of this agreement and the entry of the defendant's guilty plea pursuant to this agreement constitutes excludable time under the Speedy Trial Act. 29. Based on the government's concessions in this agreement, the defendant knowingly and voluntarily waives his right to appeal his conviction or sentence in this case and further waives his right to challenge his conviction or sentence in any post-conviction proceeding, including but not limited to a motion pursuant to 28 U.S.C. § 2255. As used in this paragraph, the term "sentence" means 10 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 10 of 19 Document 124 any term of imprisonment, term of supervised release, term of probation, supervised release condition, fine, forfeiture order, and restitution order. The defendant's waiver of appeal and post-conviction challenges includes the waiver of any claim that (1) the statutes or Sentencing Guidelines under which the defendant is convicted or sentenced are unconstitutional, and (2) the conduct to which the defendant has admitted does not fall within the scope of the statutes or Sentencing Guidelines. This waiver does not extend to an appeal or post-conviction motion based on (1) any punishment in excess of the statutory maximum, (2) the sentencing court's reliance on any constitutionally impermissible factor, such as race, religion, or sex, (3) ineffective assistance of counsel in connection with the negotiation of the plea agreement or sentencing, or (4) a claim that the plea agreement was entered involuntarily. Further Civil or Administrative Action 30. The defendant acknowledges, understands, and agrees that the defendant has discussed with his attorney and understands that nothing contained in this agreement, including any attachment, is meant to limit the rights and authority of the United States of America or any other state or local government to take further civil, administrative, or regulatory action against the defendant, including but not limited to any listing and debarment proceedings to restrict rights and opportunities of the defendant to contract with or receive assistance, loans, and benefits from United States government agencies. 11 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 11 of 19 Document 124 MISCELLANEOUS MATTERS 31. The defendant recognizes that pleading guilty may have consequences with respect to the defendant's immigration status if the defendant is not a citizen of the United States. Under federal law, a broad range of crimes are removable offenses, including the offense(s) to which defendant is pleading guilty. Removal and other immigration consequences are the subject of a separate proceeding, and the defendant understands that no one, including the defendant's attorney or the sentencing court, can predict to a certainty the effect of the defendant's conviction on the defendant's immigration status. The defendant nevertheless affirms that the defendant wants to plead guilty regardless of any immigration consequences, including the potential for automatic removal from the United States. GENERAL MATTERS 32. The parties acknowledge, understand, and agree that this agreement does not require the government to take, or not to take, any particular position in any post-conviction motion or appeal. 33. The parties acknowledge, understand, and agree that the United States Attorney's office is free to notify any local, state, or federal agency of the defendant's conviction. 34. The defendant understands that pursuant to the Victim and Witness Protection Act, the Justice for All Act, and regulations promulgated thereto by the Attorney General of the United States, the victim of a crime may make a statement describing the impact of the offense on the victim and further may make a recommendation regarding the sentence to be imposed. The defendant 12 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 12 of 19 Document 124 acknowledges and understands that comments and recommendations by a victim may be different from those of the parties to this agreement. EFFECT OF DEFENDANT'S BREACH OF PLEA AGREEMENT 35. The defendant acknowledges and understands if he violates any term of this agreement at any time, engages in any further criminal activity prior to sentencing, or fails to appear for sentencing, this agreement shall become null and void at the discretion of the government. The defendant further acknowledges and understands that the government's agreement to dismiss any charge is conditional upon final resolution of this matter. If this plea agreement is revoked or if the defendant's conviction ultimately is overturned, then the government retains the right to reinstate any and all dismissed charges and to file any and all charges which were not filed because of this agreement. The defendant hereby knowingly and voluntarily waives any defense based on the applicable statute of limitations for any charges filed against the defendant as a result of his breach of this agreement. The defendant understands, however, that the government may elect to proceed with the guilty plea and sentencing. If the defendant and his attorney have signed a proffer letter in connection with this case, then the defendant further acknowledges and understands that he continues to be subject to the terms of the proffer letter. VOLUNTARINESS OF DEFENDANTS PLEA 36. The defendant acknowledges, understands, and agrees that he will plead guilty freely and voluntarily because he is in fact guilty. The defendant further acknowledges and agrees that no threats, promises, representations, or 13 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 13 of 19 Document 124 other inducements have been made, nor agreements reached, other than those set forth in this agreement, to induce the defendant to plead guilty. 14 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 14 of 19 Document 124 ACKNOWLEDGMENTS I am the defendant. I am entering into this plea agreement freely and voluntarily. I am not now on or under the influence of any drug, medication, alcohol, or other intoxicant or depressant, whether or not prescribed by a physician, which would impair my ability to understand the terms and conditions of this agreement. My attorney has reviewed every part of this agreement with me and has advised me of the implications of the sentencing guidelines. I have discussed all aspects of this case with my attorney and I am satisfied that my attorney has provided effective assistance of counsel. Date: 04/17/2019 7114.Eczid-yi/Letc/te;z4MARCUS HUTCHINS Defendant I am the defendant's attorney. I carefully have reviewed every part of this agreement with the defendant. To my knowledge, my client's decision to enter into this agreement is an informed and voluntary one. Date: BRIAN KLEIN Attorney for Defendant Date: 4/15/2019 Date: 4--eIn ill MARCIA H FMANN Attorney for Defendant fe-rDANIEL STILLER Attorney for Defendant For the United States of America: Date: gi/ 4 it `‘ MATTHEW D. KRU United States Attorn ER cii Date: BENJAMIN PROCTOR Assistant United States Attorney Date: BENJAMIN TAIBLESON Assistant United States Attorney 15 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 15 of 19 Document 124 Attachment A Between July 2012 and September 2016, Marcus Hutchins helped create and, in partnership with another, sell malicious computer code, a/k/a malware, known as UPAS-Kit and Kronos,' During this time, Hutchins used aliases such as "Malwaretech" and "irp@jabber.se." One of Hutchins' partners, who went by aliases including "Vinny," "VinnyK," and "Aurora123," advertised and sold the malware. Hutchins and "Vinny" agreed to share the profits from the sales of the malware, and they sought to maximize their profits by selling the malware to as many people as possible. Hutchins also personally provided Kronos to an individual in California who, as Hutchins knew, was active in using malware to gain unlawful access to computers and victims' personal information. Hutchins worked hard to conceal his role in the development and distribution of the malware. At the relevant time, Hutchins resided in the United Kingdom. UPAS and Kronos are similar types of malware that utilize, among other things, form grabbers, key loggers, and web injects to intercept communications and collect personal information, including usernaraes, passwords, email addresses, and financial data, from any number of victim computers. The information from the infected victim computers would then be relayed to the person running the control panel for the malware program. The malware concealed itself in legitimate programs already running on a victim computer, and the malware was configured to avoid anti-virus programs. The malware was designed to target banking information and to work on many types of web browsers, including Internet Explorer, Firefox, and Chrome. Installation of UPAS or Kronos on a computer removes, replaces, and modifies space and information on that computer thereby impairing the integrity and availability of data, a program, a system, and information on the computer. Since 2014, Kronos has been used to infect numerous computers around the world and steal banking information. This includes causing damage to 10 or more protected computers within a 1-year period. In furtherance of the conspiracy as set forth in Count One of the superseding indictment, and to accomplish the objects and purposes of the conspiracy, Hutchins and his coconspirators caused the following acts, among others, to be committed in the Eastern District of Wisconsin and elsewhere: Hutchins developed UPAS Kit and provided it to "Vinny," who was a. using alias "Aurora123" at the time. b. In July 2012, Aurora123 advertised UPAS Kit in online forums that were viewed by the FBI in the Eastern District of Wisconsin. The advertisement stated, among other things, that UPAS Kit "is meant to install on the system silently and not alert antivirus engines" and that its i Terms such as "Kronos," "UPAS Kit," "malware," "crypting," "protected computer," and "form grabber" are all defined in the Superseding Indictment, which is incorporated into this factual summary. Case 2:17-cr-00124-JPS Filed 04/19/19 Page 16 of 19 Document 124 functionality included a USB spreader, FTP grabber, form grabber for Internet Explore, Firefox, and Chrome, and other items. c. On July 3, 2012, an FBI confidential source in the Eastern District of Wisconsin (CS1) purchased UPAS Kit from Aurora123 for $1,500 in digital currency. Later in July 2012, CS1 received an updated version UPAS from Aurora123. CS1 continued to have contact via online chats with Aurora123 over several months regarding UPAS. d. Prior to July 2014, Hutchins developed Kronos and provided it to Vinny so that Vinny could advertise and sell Kronos to others. e. On July 13, 2014, a video showing the functionality of the "Kronos Banking trojan" was posted to YouTube. Vinny and Hutchins used the video to demonstrate how Kronos worked and to promote the sale of Kronos. f. In August 2014, Vinny advertised the sale of "Kronos Banking Trojan $3000 PM/W-MZ/BTC" on the forum exploit.in. An FBI confidential source in the Eastern District of Wisconsin (CS2) engaged Vinny via online chats about Kronos and asked Vinny for a demonstration of Kronos. Vinny directed CS2 to the YouTube video showing how Kronos works. On. September 7, 2014, Vinny marketed Kronos to members of the gDarkode forum. h. In February 2015, Hutchins and Vinny updated Kronos. On February 9, 2015, in a chat with 0S3, Hutchins described the update. CS3 asked, "[D]id you guys just happen to make a (sic) update?" Hutchins responded, "[W]e made a few fixes to both the panel and bot." i. In February 2015, Hutchins sent Kronos to CS3, who was living in California. At that time, Hutchins knew 053 was involved in the various cyber-based criminal enterprises including the unauthorized access of pointof-sale systems and the unauthorized access of ATMs, which is documented in numerous written chats between Hutchins and 0S3. j. In April 2015, Vinny advertised Kronos on the AlphaBay market forum. The advertisement stated: "Kronos has an advanced Formigrabber that doesn't use methods publicly available. It logs ALL POST request and returns the data to the control panel." Vinny was offering a "Lifetime License of Kronos" for $3,000 in bitcoin. The YouTube video was included with the AlphaBay advertisement. k, On June 11, 2015, Vinny sold Kronos for $2,000 in WebMon.ey to CS2, who was in the Eastern District of Wisconsin. After the transfer of funds was 2 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 17 of 19 Document 124 complete, Vinny configured the control panel using domains that CS2 had provided to Vinny, and transferred the Kronos code to 0S2. On or about July 17, 2016, Vinny contacted CS2 asking if Kronos was 1. working fine and whether CS2 needed any crypting services for Kronos. Throughout this time, Hutchins referred people interested in buying m. Kronos to Vinny, In addition to these specific acts, Hutchins discussed with CS3 his work on Kronos and his partnership with Vinny. These conversations were recorded in online chats between Hutchins and CS3, which were recovered by the FBI. For instance, in November 2014, Hutchins told CS3 that he thought he would be making around $100,000 per year selling Kronos with Vinny. Hutchins complained that, so far, he had only made $8,000 from 5 sales. Hutchins then told 0S3 that he wondered if Vinny was misrepresenting sales and profits to Hutchins in order to keep more money for himself. Hutchins told CS3 that he (Hutchins) had the whole source code for Kronos, and that he had developed a "vnc" (virtual network control) for Kronos, but he refused to share it with Vinny until he confirmed that Vinny was not misrepresenting Kronos sales. Hutchins said that the "vnc will likely make lots of money." CS then asked Hutchins if he would be willing to sell Kronos with the vnc on his own without Vinny, to which Hutchins responded "nah, I dont want to sell anything myselff.] too risky." In December 2014, Hutchins told CS3 that he (Hutchins) needs to keep a low profile and that he hoped no one else knew he coded Kronos. Hutchins told 0S3 that CS has "gotta be careful who you share with though, unless you're confident that if these people turn fed and decide to rattle you for info on me, you won't say shit[.]" Hutchins mentioned that Kronos sales were still slow, noting that the reason "could just be that the bot hasn't got the attention yet." Hutchins said that "people want the vile before considering" purchasing Kronos. Hutchins went on to say that Vinny told him sales of Kronos will improve with the vnc. In January 2015, Hutchins again complained to 0S3 about the lack of sales of Kronos. Later, Hutchins said that "Vinny brought some good news today . . apparently someone posted a review and loads of people added him," referring to a good review of Kronos that led many people to contact Vinny regarding Kronos. Also in January 2015, C83 and Hutchins discussed seeing another person selling "cracked bins" of Kronos (a cracked version of Kronos) on an internet forum. Hutchins said that "if he actually cracked it [Kronosl, there's a little surprise for everyone who uses the cracked bins. . . . [T]here's a 'bug' in the rootkit, where it may after some time accidently delete the bot file from the computer." In February 2015, Hutchins told CS3 that he "made a few fixes" to Kronos, and that he was motivated to update Kronos because sales of Kronos had picked up 3 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 18 of 19 Document 124 a little. Per CS3's request, Hutchins sent Kronos to CS2, and. Hutchins helped CS3 get it to work properly on 053's computer. In March 2015, Hutchins complained to 053 that he wanted to be done selling Kronos with Vinny, but he cannot find anyone to take over for him. In May 2015, Hutchins told CS3 that due to a manufacturer's update to the Chrome web browser, the Kronos formgrabber stopped working. Hutchins noted that if sales of Kronos were good, Vinny would be pressing Hutchins to fix the problem. In June 2015, Hutchins told 0S3 that Vinny was trying to hire another coder to update Kronos. Hutchins said that this could get Hutchins in trouble because Hutchins knew the person Vinny wanted to hire, and that person would likely recognize that Hutchins developed the code for Kronos. Hutchins then concluded that sales of Kronos "aint going anywhere without me" because Vinny needs Hutchins' skills to update Kronos and add the vnc, which no one else can do. In a conversation in September 2015, 0S3 tried again to recruit Hutchins to work with him on malware. 053 told Hutchins "i know you didn't go all out in kronos." Hutchins responded: "yeah[.] it was really just Upas with some tweaks[.1" Hutchins was arrested August 2, 2017. Following his arrest, Hutchins was advised of his Miranda rights orally and in writing, and he was advised that it was a crime to lie to FBI agents. In a post-arrest statement, Hutchins admitted to dealing with "Vinny," including being paid by Vinny for developing code for UPAS and Kronos, which Vinny then sold. 4 Case 2:17-cr-00124-JPS Filed 04/19/19 Page 19 of 19 Document 124