Mnubot IOC's

c2:
187.84.237.138
mssql914.umbler.com
tcp port 5003

interesting reg keys accessed:
HKEY_CURRENT_USER\Software\Embarcadero\BDS\18.0\dbExpress

keys created:
HKLM\Software\Description\Microsoft\Rpc\UuidTemporaryData
	dword:  NetworkAddress <- mac address of the box
	dword:	NetworkAddressLocal <- zero

other bits:
Provider=SQLOLEDB.1;Password=102030Abc;Persist Security Info=False;User ID=sqlusername;Initial Catalog=jackjhonson;Data Source=mssql914.umbler.com,5003
UBMSSQL02