SPARS IOC's

Creates:
C:\Users\<user>\AppData\Roaming\Microsoft\svchost.exe
C:\Users\<user>\AppData\Roaming\Microsoft\sparsTmp
C:\Users\<user>\AppData\Roaming\Microsoft\ssleay32.dll
C:\Users\<user>\AppData\Roaming\Microsoft\libeay32.dll
HKCU\Software\SPARS\hwid

Method of persistance:
HKCU\software\microsoft\windows\currentversion\run\java platform sd updater

POSTs to gate.php