tlp:white,estimative-language:likelihood-probability="very-likely",osint:source-type="blog-post",misp-galaxy:mitre-entreprise-attack-attack-pattern="Modify Existing Service",misp-galaxy:mitre-entreprise-attack-attack-pattern="Code Signing",misp-galaxy:mitre-entreprise-attack-attack-pattern="File Deletion",misp-galaxy:mitre-entreprise-attack-attack-pattern="Deobfuscate/Decode Files or Information",misp-galaxy:mitre-mobile-attack-attack-pattern="System Information Discovery",misp-galaxy:mitre-mobile-attack-attack-pattern="Process Discovery",misp-galaxy:mitre-entreprise-attack-attack-pattern="Service Execution",misp-galaxy:mitre-entreprise-attack-attack-pattern="Rundll32",misp-galaxy:mitre-entreprise-attack-attack-pattern="Scripting",misp-galaxy:mitre-entreprise-attack-attack-pattern="Command-Line Interface",misp-galaxy:mitre-entreprise-attack-attack-pattern="Data from Local System",misp-galaxy:mitre-entreprise-attack-attack-pattern="Automated Exfiltration",misp-galaxy:mitre-entreprise-attack-attack-pattern="Data Encrypted",misp-galaxy:mitre-mobile-attack-attack-pattern="Commonly Used Port",misp-galaxy:mitre-entreprise-attack-attack-pattern="Bypass User Account Control"