diff --git a/APT-hunting/hunting-cobaltstrike-beacons-in-the-dark.pdf b/APT-hunting/hunting-cobaltstrike-beacons-in-the-dark.pdf
new file mode 100644
index 0000000..a3e40fb
--- /dev/null
+++ b/APT-hunting/hunting-cobaltstrike-beacons-in-the-dark.pdf
@@ -0,0 +1,44619 @@
+%PDF-1.3
%
+1 0 obj
<>]/Pages 3 0 R/Type/Catalog/ViewerPreferences<>>>
endobj
2 0 obj
<>stream
+
+
+
+
+ 2021-11-15T16:14:28-05:00
+ 2021-11-15T16:14:37-05:00
+ 2021-11-15T16:14:37-05:00
+ Adobe InDesign 16.4 (Macintosh)
+ uuid:82d13550-9c0f-a94f-9b27-8998781bd163
+ xmp.did:8a95fa0d-284c-4264-8b28-8c73d70a153c
+ xmp.id:679c40d3-cc62-4ea3-9ee3-1447578cdd14
+ proof:pdf
+ 1
+
+ xmp.iid:0f28d92c-973d-4dc3-8d50-4b3ced92e35d
+ xmp.did:9c8b1b94-7b25-4c3b-93a7-0835be6543da
+ xmp.did:8a95fa0d-284c-4264-8b28-8c73d70a153c
+ default
+
+
+
+
+ converted
+ from application/x-indesign to application/pdf
+ Adobe InDesign 16.4 (Macintosh)
+ /
+ 2021-11-15T16:14:28-05:00
+
+
+
+ application/pdf
+
+
+ 12271_Blackberry_ContellatingBooklet_FULL_ModifiedLinks.indd
+
+
+ Adobe PDF Library 16.0
+ False
+ PDF/X-1:2001
+ PDF/X-1:2001
+ PDF/X-1a:2001
+
+
+
+
endstream
endobj
3 0 obj
<>
endobj
15 0 obj
<>
endobj
16 0 obj
<>
endobj
17 0 obj
<>
endobj
18 0 obj
<>
endobj
19 0 obj
<>
endobj
40 0 obj
<>
endobj
41 0 obj
<>
endobj
42 0 obj
<>
endobj
43 0 obj
<>
endobj
44 0 obj
<>
endobj
45 0 obj
<>
endobj
71 0 obj
</LastModified/NumberOfPageItemsInPage 2/NumberofPages 1/OriginalDocumentID/PageItemUIDToLocationDataMap<0[1190.0 3.0 3.0 -396.0 277.92 -244.8 288.399 1.0 0.0 0.0 1.0 -332.64 282.96]/1[1213.0 2.0 3.0 244.8 277.92 396.0 288.399 1.0 0.0 0.0 1.0 308.16 282.96]>>/PageTransformationMatrixList<0[1.0 0.0 0.0 1.0 0.0 0.0]>>/PageUIDList<0 22732>>/PageWidthList<0 432.0>>>>>>/Resources<>/ExtGState<>/Font<>/ProcSet[/PDF/Text/ImageC]/XObject<>>>/TrimBox[0.0 0.0 432.0 648.0]/Type/Page>>
endobj
72 0 obj
</LastModified/NumberOfPageItemsInPage 2/NumberofPages 1/OriginalDocumentID/PageItemUIDToLocationDataMap<0[1190.0 3.0 3.0 -396.0 277.92 -244.8 288.399 1.0 0.0 0.0 1.0 -332.64 282.96]/1[1213.0 2.0 3.0 244.8 277.92 396.0 288.399 1.0 0.0 0.0 1.0 308.16 282.96]>>/PageTransformationMatrixList<0[1.0 0.0 0.0 1.0 0.0 0.0]>>/PageUIDList<0 22750>>/PageWidthList<0 432.0>>>>>>/Resources<>/ExtGState<>/Font<>/ProcSet[/PDF/Text]>>/TrimBox[0.0 0.0 432.0 648.0]/Type/Page>>
endobj
73 0 obj
</LastModified/NumberOfPageItemsInPage 2/NumberofPages 1/OriginalDocumentID/PageItemUIDToLocationDataMap<0[1190.0 3.0 3.0 -396.0 277.92 -244.8 288.399 1.0 0.0 0.0 1.0 -332.64 282.96]/1[1213.0 2.0 3.0 244.8 277.92 396.0 288.399 1.0 0.0 0.0 1.0 308.16 282.96]>>/PageTransformationMatrixList<0[1.0 0.0 0.0 1.0 0.0 0.0]>>/PageUIDList<0 22768>>/PageWidthList<0 432.0>>>>>>/Resources<>/ExtGState<>/Font<>/ProcSet[/PDF/Text/ImageC]/XObject<>>>/TrimBox[0.0 0.0 432.0 648.0]/Type/Page>>
endobj
74 0 obj
</LastModified/NumberOfPageItemsInPage 2/NumberofPages 1/OriginalDocumentID/PageItemUIDToLocationDataMap<0[1190.0 3.0 3.0 -396.0 277.92 -244.8 288.399 1.0 0.0 0.0 1.0 -332.64 282.96]/1[1213.0 2.0 3.0 244.8 277.92 396.0 288.399 1.0 0.0 0.0 1.0 308.16 282.96]>>/PageTransformationMatrixList<0[1.0 0.0 0.0 1.0 0.0 0.0]>>/PageUIDList<0 22786>>/PageWidthList<0 432.0>>>>>>/Resources<>/ExtGState<>/Font<>/ProcSet[/PDF/Text]>>/TrimBox[0.0 0.0 432.0 648.0]/Type/Page>>
endobj
75 0 obj
</LastModified/NumberOfPageItemsInPage 2/NumberofPages 1/OriginalDocumentID/PageItemUIDToLocationDataMap<0[1190.0 3.0 3.0 -396.0 277.92 -244.8 288.399 1.0 0.0 0.0 1.0 -332.64 282.96]/1[1213.0 2.0 3.0 244.8 277.92 396.0 288.399 1.0 0.0 0.0 1.0 308.16 282.96]>>/PageTransformationMatrixList<0[1.0 0.0 0.0 1.0 0.0 0.0]>>/PageUIDList<0 22804>>/PageWidthList<0 432.0>>>>>>/Resources<>/ExtGState<>/Font<>/ProcSet[/PDF/Text]>>/TrimBox[0.0 0.0 432.0 648.0]/Type/Page>>
endobj
76 0 obj
</LastModified/NumberOfPageItemsInPage 2/NumberofPages 1/OriginalDocumentID/PageItemUIDToLocationDataMap<0[1190.0 3.0 3.0 -396.0 277.92 -244.8 288.399 1.0 0.0 0.0 1.0 -332.64 282.96]/1[1213.0 2.0 3.0 244.8 277.92 396.0 288.399 1.0 0.0 0.0 1.0 308.16 282.96]>>/PageTransformationMatrixList<0[1.0 0.0 0.0 1.0 0.0 0.0]>>/PageUIDList<0 22822>>/PageWidthList<0 432.0>>>>>>/Resources<>/ExtGState<>/Font<>/ProcSet[/PDF/Text]>>/TrimBox[0.0 0.0 432.0 648.0]/Type/Page>>
endobj
77 0 obj
</LastModified/NumberOfPageItemsInPage 2/NumberofPages 1/OriginalDocumentID/PageItemUIDToLocationDataMap<0[1190.0 0.0 3.0 -396.0 277.92 -244.8 288.399 1.0 0.0 0.0 1.0 -332.64 282.96]/1[1213.0 1.0 3.0 244.8 277.92 396.0 288.399 1.0 0.0 0.0 1.0 308.16 282.96]>>/PageTransformationMatrixList<0[1.0 0.0 0.0 1.0 0.0 0.0]>>/PageUIDList<0 22840>>/PageWidthList<0 432.0>>>>>>/Resources<>/ExtGState<>/Font<>/ProcSet[/PDF/Text]>>/TrimBox[0.0 0.0 432.0 648.0]/Type/Page>>
endobj
78 0 obj
</LastModified/NumberOfPageItemsInPage 2/NumberofPages 1/OriginalDocumentID/PageItemUIDToLocationDataMap<0[1190.0 0.0 3.0 -396.0 277.92 -244.8 288.399 1.0 0.0 0.0 1.0 -332.64 282.96]/1[1213.0 1.0 3.0 244.8 277.92 396.0 288.399 1.0 0.0 0.0 1.0 308.16 282.96]>>/PageTransformationMatrixList<0[1.0 0.0 0.0 1.0 0.0 0.0]>>/PageUIDList<0 383>>/PageWidthList<0 432.0>>>>>>/Resources<>/Font<>/ProcSet[/PDF/Text/ImageC]/XObject<>>>/TrimBox[0.0 0.0 432.0 648.0]/Type/Page>>
endobj
99 0 obj
<>stream
+HTMO1ﯘ>BiJUXl!RUΛ
Hg7o0d(xG)4*Cg7EIۦnl"K&dCjm9p8ٲؙ.
]w(~T;mkR`UFQNT֑ʩSyī$zD`瀙(}U1U9Azt"8J:t1?
+^+/OjG*GiuűSId=>|;wad{0iլ
MC&!Zx0uL*&XS*Le,5mrQYV-)<5խE?W>,O*H](W#)GF_(Nu, 2pfV5ܫa}5\2q1,j >CBţsqKcStppJ7rΏ2)ryPIdD1Sd"\;hj:3+Zn1(ۋ?m3n^tzO| [R0gLPho{^d~s( >?<6ٸ@cx"4$gpS<$_~m9Ncbu9{T9t\=/C|A
бľЇ8D2 UDb97jD$FգKË=H7 EF8DZ5 횔
endstream
endobj
103 0 obj
<>stream
+ Adobe d
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ q E
+
+ S !"1A2Qa#Bq3Rb $r%Cs45SUV&'7EGT
+()*689:DFHIJWXYZcdefghijtuvwxyz Y !1"AQaq2#BR$3SbrCT%4DUcst &de
+'()*56789:EFGHIJVWXYZfghijuvwxyz ? scO5cqiGoZ$5W
+psM3RCld͐TsNMwmS?YU?5ν85kNaq!8+XCX"'z{A$㎔IR1YPFmT}gJcYJJIu^yRR @3 5.3Vdb/̑EmdOf_/~J]D29νANq%M©!1cMh)st#&8-|mV,
+] |US{a:qӻ6A5vG=8?4+<ۺ[--jcqEh bhMQbI9Χs@8 ߈jvcd][η5gvw7y8_
+cDf(岀Wx1W46ڀ}߲0+ec"m]iăƘykӊJSE,qHYBk½u7t|59Z44 J k}1-K`ԚaH 5s=\y>_:yLkLJUoz0CD^sJt>_.)cDܾG@z%j&}/k=YVƼ8Zöu|2|zԖ{] n*o`$^ͬk\aYy>Cx8+^h+CEn.nsE %:W)i3y+pPruGVe4CzS-;0徖ӥiRkD1L:uf(eqQ{պױZԳN{i;k9
8As)1eZMk&Bn1?TKCm{'4qKMOSfx66:}k _VM:=dBm"\s4ynbI
+id}tY;sZgR&F㨭Ri8^|V,WҾcz5lpr+#k#Jׯ^ZsݿGk*qC4Xb(Ġ{jV5(kmoR
jc(u^R⏓p(lh>cw6~˯.;i+!:EU]kWCU?g{h=Ӵ'{%C䧘
+ZMG tk`mjj6B=0?*_4+|Xw[ԤsЏccֽ^vh%9 S:ׯs\g>~j :R$E`4NZN`}Ub#Z5pkec|C~?d}U+^+7@1J݆uGO ^-.d~!6pmX>ue*2ۊ_j0`xit#GR'P|:4{h4|o>c5ڏQvdAVwdLHyX?sƥ։]$yy*9]5TN50>^~xk*|W?X;eGoZQ7
ܪ`c?qKjK1מܑ}vxv3#g
+JN2Ƥ'w^ǥ3JXwxˁ>u!?cB;NR[017txN['#>so"6rTpO+3I'RǻC䞧CLXh5S+Ư[p#Zڵw{J f4%&jIm onKK+_r0u)ռ
B=#E&vG&1-c=*&l%R%,ү EK \s^O v,<ޙF oYe~\Ӡը:luSAփȬȩH`ǟƤٌ4ܦ1e~{Jͬ}KS6s>D}~+X8b2m,<2~'o֛q$ ^3> +W1cƣǴ><̥mӯ#lOZZ}O'?})";\כֿ=(07CZ{k.9K7ZzP)3IPS+"iwg @+"FHI HgK;|eҝr2Wr鑟ľY=VƏ4;n8 oҘNGyW>>DQMJd.W;X..<;'-q$ahWӑMnaT#>c#k.^FN7/;J`~c=zRI!o-l*%(Q''ڋXSfDKۜ1Xn82s
+v8xEl qNQIRJE'Ual?}kʎ+tXrrá"SE B-^Ol$a#N8*eZNV_#zNI,+moʍ5l\bz)*x5Y)=(64^98o/DEpI}
+GRaFK9^GrMk#1M0VR^Սi.c4̻Y
z
:Bcoi[ =tϮ~^ulX&a