From eac0798176f90ea234b4f152fb23373623d76bf3 Mon Sep 17 00:00:00 2001 From: Swelc Date: Sat, 30 Jun 2018 23:37:51 -0500 Subject: [PATCH] Added URL link to Google instead of Red Canary. --- atomics/T1193/PhishingInvoice.xlsm | Bin 18423 -> 18496 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/atomics/T1193/PhishingInvoice.xlsm b/atomics/T1193/PhishingInvoice.xlsm index ac70a50bbb42123b8930d52156de2a7f8d9610e8..46810f753757672aa7ca9d0d1555f93664656c41 100644 GIT binary patch delta 6152 zcmV+j829J*j{(4t0kDJ#30jkz-<$&g00xtd2^fECZ{j!<{l3!vhip`7K83`20a0ND zdF&v~R)}GyUn(ItF~r-%W*w(cRrBBXIw6HVM#DT1Byo(7&pr3tn_Rx%mxXpuL`69p z>8NMv8eu8VDBFzm&&$LZ=vpN)%W%ON8R-wC(%+B&{Nr-R#oaCEcNze&YNY2(gvhcmZOih_5>uwP2!S{UgRj>#B@s{Sk}%nV z2vT4P^sAh1s}8M9&w(qkxU08D%F8W4+|q)|hXz#F$~2g57#H}qfUx(-)AjpBI^h|$({c8=*Lvl?)?y1V*6D#5WBrE?3%Rho4 z>zC0GSgY|$0OI{5n)k%b*2kA?T97ZTbv3-*Ug1(@s?fCpS2E71B-u#s!;tUD@diXC z>g}|q1FpLZ@nnp$#4P7Hi;&3o=qXc>WSKS;x6~KR7 zoGf4Fw7Nc2hWZn@Xi`Wb7?vdDOoC|-BK)dB8|*OWP!8IH{8v*!pbEi^APgLF8sOV% zj%BXZq8RC6a5ESDUy{n|21^dMG6cyCNpN`>S2s%pa@?Hw8ow^0A8#P6(9&$L zU&;Y&MbNo-E`T^jPQe$<67nit0?G^?l^Bu{e$=246=fnW=9&2*5PBQ^NT|_ z*Z4v;#V?fXs-s2JP}^TqmhoK^(Zk90uDN|pGntQc8~GMQ+}`^@=q3lQL$80S9bqd< zBmEhbsHKv?2P~Q-�IuT$;WMoSL)7np#O_SCgwS*1`{y#osYBdexg7m7zugwU?M> zsL5itJR@t$NT!Mfz)nU7$dDIx$(B?W1nJ{<&v$tD*TwV#IhW?iy6=E2$OgI^>h&UI z^}d1V{Wzel0PSx9B6J2KJTiaS!%7M9cAWNiF;@G6mA$#3Os*Qm;OSNH6c?YmJXmi* zBPTdV#0B3qphpGWx8n^jUQ#{H4`dk_rK-!psWC@?XraDx1=-7wm2A$?Whht^xz?m_ zLA$hK$1~i)&^89HV;i9x*|FD;qj>76qEzn;!S8r-Hq9>RUPctl919z{6ga(uSC|D^ zPjLlZq%|?{g(lRoHoH~h{{fS52^6zV4V)SZdq@_#JrV!_05p^ICn>ZIM~Spe8>HfoBv$ILanp91Q97NBYmbvS^|+HZ zNoh6HX*+2x&uE%B_0(1C%;cZc%}m|KZLRC??cR|9Nm(S-shx}$^TY1#=exIW-@bi& z7vEg}PhWer?lM~tZexEocEzY*WkvZC(gYq{jLAq4t{8@4Wh41n_!Z*7N1)Y#$=e9n zfi(clc{xx4R0B?6El>$m0qcMp02iAR%35lEj?lICRL`X{|WI^bICpL7K209yZ~M@R=)>wgQ;a2U89xC4j*M}RwlZlDLa3+M&nz)|3C z;26*c90%?JeiOJCNC5W%p9A`V6F?Fe00w~}fcSF~@hN{`7)Sy410<1YVAQOWL7W91 z0CGSc(1CH_G;ju(0BAKo2s{Kl3`_x!0FMF%K-wf>-XR6AK?2@GMgY?A0n#=|!xOX{ zP$g>kVY5ae-iU`M@%%c{61N5{u{VqZ$Ybp1`L{Ob`i_r6 zDmtKXMV>|cyXJFE$twCJ^mPwtlUY0_*eS8NYcBP?#bSShm8x@CDfvLH`3~}d`ni-S zwcb*K%&L$9mH)i>4`AiAV>O8!wImfbbLUH~S`>f#u)e0|CPk9|jp#0r+!}@po$V?Dof<5Tn|0Z<$`LfG|pKut^+mC z^8t(Jc|N@jwhN6rb6(-&Qmc#99_=jawUka#pYjyQA;n*T6jS^y#1dZ;T>AN_L`!jd zD}8^pd@6qtZAgf%(8={LR=IuHZnZCs9iTUh>cf9feP0=qZen|(QhM1*^S2k1Np{UC8e=(@ty&J(Pbg>c@`$W$1$w3-aj=Bxx48FW6NoV?T#p zs$zZd!CWeNkgbb#aMyC-;t#g4u{5m+C&79G4c^XPdjh)VnXiaCdft>chxR%$Irtw@#8PUu6UFs?IAITq@_GdYSxhthC#7*C8Yf zEnRfQv&li}*{)>Tp4Tde!Z|IeJCc6`>5Vt`RLq0rB2)A>Ssgac|9|ldi+6q#O95U4=9hFWBuJ(ZEW|RD(0+mDoS3@ zb%ryeqsg)9_J%nIF^faYViB`=#4IK;i%W`N(+i5i;+n4X<%i=HGut{8`7wX3d*FVi z4eGlaFwf`tM9-{iC>%(BX>)W!8^o@4qkG$Q`R?-A%w|^JJ+9Yg$8|@|8x`)jE)TIX zcdwQl3fj}@Y2T6jsZi!$CxZTPrL;df+cw)dZA!5@@7IiScNfe$6kBPsaKtjOVjH(s zs4D3WvZ&rLkJgt>OYnEBn6G~jv@_#9W_*{GZ+1Ls#wqH|?3a4~j=5=HHscC&91_`Q z%sdCQ04;rwSw>a}wY{gPuBCe>=E zc7FoSkdIi}V6|H%wpC{KnBlZxTS06;U|hMAZLz0~kDjaS#FG(1CfI*z-$wVVy zfrC=85(kC<`Hy;|HD<6KyWY97tJ2sNGd`d}?Dd8dOPBe}Sj?z2-njy!+Qa9?&d!4l zpHQ8wjLb}KOACt~JBA^%eZT>r9;oH5$b5p$iswq;ohvf!*)Y?6WS5fp$3yY?gKX%P z2An@65-M6YH0#T0PilXk>{|+PSh*U0I=AFkKK?q4OyWt4VY%b)McvDSJ+Q;Y3A7)Z zPA{zb+i?O2b4z}CwBY<#VmU6S)qYfZ++4Lou<*%#Uv0p~$j_hFid#-Uu;W>!sppo~ zUoMlQ!a@>#Q_r1%9UH1J{HY7u37k>vWOvTjqMD=u5ypx{P2_(p_^0y+Hz6;fw@XxL z?u!3_xY?W}asJ2#uXX-dt^h2i#6_QmxA z2VtMTdo5x4xN?88s|A^*Ctfif(u?1^nwVoGWZy*FXZek)|E3o_IM4w2I!gj5LSQIrT>9z?0| z_V~AZPL?VcYyVjY&*h>HAnl z^rwLjEw4rDUiscH?sz5h_57{x|K(SOoy33Gg&!9>{_O2%556}2^5l=g`5#;PmQ7dS zBDF)>&TP`Z!>C(R8J!r^(uG@G%vO0U6#UPBcCj_~zSNk<|HdO`vc+5esG0QpCXlq* zk0b~G_}eaKx1)*wl}0nw_6?*Q_MTkket42R&dn}XR+-m_GHLC(6E5bY0nEbh|2cn^ zb)P($8q_w9yI5r*P?C(T^}XjHX!{#u8hSpS|`()T4>kpvJL4S zSOaBdO$RiuVL17!*om~2U)+zAf1@Dr8%3d-=KmM#*QGS>!d6#%mK@(Mkez=@My$G5 zmY=R**_yILHZ~)(q4(@|Ol>{0gz3paeGU2DI^~-C%VcMV>@1gaQjKFxS#^b6&9{%| zvD@5!Kz43oQm!Bb@-}(PoH0-!YoH1?Pc+`qmS8265Cc6*pP<#kdu zoWIOJ)#!Drjj%hy`x96vFgAbA1b%_nmME|g`{&x$~bd-4`U4e+|gDKG(>Iyb_)Pg6}6pBP! z3(-r#U?J=)tnoe>EqsNY$|XmYt`w-wE4wEG{yl{RiFszsR>2ZSQiFfFOdgi9uEd9v zIhe?a?yj!GVeIk##F2QnJ5n2qH9p}w+oO2=id$8>2d00Z#AZ_ixnyns6ZVRGJx z!|}B{`2woYojQe5uiqJdzrGSOYF6R@`w|AAYq7=Subctoe@r$tI{ zBc8=&f@J!b8T-&A#s2PFFWk{~AoS7|mVUG0uHzCvrHhlgs3PoKnVoe;&0b{owW50j ziA~NuG4>s^Um1S{7i(iQjp*oCMe6dlqlVgp^ zM5x%dF%XeBr@9Aqw6VQ!7b|gAbl3%Vx=j8jC|Fnvma?;SovG?b|7m$k+gZwPD1lvp z(B}3ainh5Uu^3((`yC$@gFCmFY#>IFD}*K~Xy#ou;}d@+??yy!Sn$1t3!T#EE>|Ja z)WV=k*f@#aOh!+LH1u%vcsLq!M~_E|Kg3RMg%Nd!O|2vhHz7a|n0Yv_@Q__Zow|U9 zxYd&BV<2;nvbHF`Ly7&*>&7N!&5p>z)1yQ}%9IBp!P1e>n0arTabXb&v5UWK`mcMp zy1w^Q_7Z=K{9|u5NQka>7R8QbZCJ6GMW|pP5t%fFQxGX`@xEZ@?Jx!O=|x2TWWg-b z%r5-Ah4L1DT|;>bKZ~Kf>PV^Rl7NGjX$(9AoCQ7)JO(@tJOMlj(AN=PG-FDiL;B0W zZvjN~Gr+TE`C?1%vz$*m2bgs-A(coU_gc^VYyy8Fsj9?jqZ0)p)ZtU$6G&#c=SqVQ zEzfW8(%j!hKCROz8G)7B1kaYny=)r3QXA)79?@vFJ*W&h7goR~sl+BuDF#gt(UGsmz zmtjz=qo+Ll(#`k@@9`k09^<~`N$^2%3Ab!(v;Xg-Hq)1$<_)sAKP-R-3uJBLD??sR zJE-*?#KPTP#BKB8NJqm% z?cUb*t_Y4Wkw9x#ldq*c+!SaHM4Eg!;LR4fO!?#4K%ot8dS)9fO(prnRqoIGL zy~XSGVhmIWA35035WxA%-`*8&Yg2tV{soFbg!Y6w8az=?xGR8jTA;n9-QVsLKDd8&f{(P}Se3r8k4*V|wlW++X1x^(x z2T8LIIwt{tOT#b}h2I7LL&kJVwgZ(tIS@9P_!g48uGpj@iFW(K-6Ch8iR&XK@_G_}lBiNc-nNuS}e>awqLOo#Rf~f)C>8KH6$Dwrv}= zX&=MqkMZmJY13B?E7k3a11d7XDL24eV~WjzDF}8@dy~oVMCrCzGwarV;rj~2{pq*) z+Th7TeUSkVBJk1ZP~@WQ(uc?G3Ka>7??RG>NwOs~n#MGlzjg2bnD3$v7xJ9qf8rt} z9vb(=IZbC1;ssD-`09HUUjUPE2^6!8JVFQwT9cdKoC5#=29wuBP60oYCPhI4Z4Z-* z4<(b1MJfS@letAe0TPq?MLGh69h0FQ8k0~)5F2|)7P>tW0000q000pH0000000000 z00000+mm}nBpgl^C>_M4Nap~nCF-YPDbV!0A`tHv(fns_t~owmQ%1hF)-`ZdUEoq@ikSw(wMuiUNIo(LFcn*JxByYf zO*P$62CFFaJm3X}C++s900rLA2?8q!j6#2Y@_oV2b;`UI&t!yFPgCCyLvK2?rjyjQ`m-5y zt6-2?zCWCVshhf?Gx!F<$RNrD-l$@477aZzJ@1{RfAFqbK~A)x`GLlhv;SCne0Av7 z8fWOX_?41veK3ih8oL|HbFpnAdOSMcHkWT`u8NWAqQHTO+iRZ)y(@rg=r@1WBVA2t zWWJ!1v{WGa8JKi7dqKrM;?i_p;M9x;Z>nWBznEOasS$sgEdEZR)$8uus0>vS>3hj} zj+!iX+jFv}oaDM(0PJYChl~Z=l>C}1MvyuF@bV5H{yLkUA@AHi+V=yH1-XO1hI+jO zIlb>7`acioYC!jUfC!y{2oHY^{^0Tn{6Ln0QKtJG42?Mkp@Rn66=bJA*Qyzz&rq-?>N}Hx z0}azjJ>TjNL)RMiJ=co+iJSU^G)bqvE=v8@5d9y|&ZgZ(-Rp>ESzsKgt|iXy;U#84 z)>B+V7imole4z<-tnF^s_&)%Xfe;k4O%0qH3Un>VYw!^O001(R^Cu~P(ejCutPhLe z0R%x(5*^};lx#?(30ahDI21^pOqd`614oInO&g>VMM><8zoto(X~yYzGHzTab((RL zNz>ArOsDOnjWX3VQR=C!)}F~fuA6?wZLI6>?cR|9Kg_GEjwli&@@k<{t~gZ#M^eSsFi`DJ;Uq zkZ0L>tlY}e7D$Zsgd`&$mfrgJzi)ikbyc#V(@eeSd6ETLU{y1J7I$_)BU$s4{4SPe zUKI0M^B49x!G>9qR5Vh#^N2IusNS{-Y)@1(vC%r&AV7dKII)Zcn?SIlEqyuRGR|DIC8els> zI^tI3JAm5&1=tCH)Bz+8yMW!m?PlM-X1*W!9l!yg0dND2fC_j3;#(8o1DXLp&;qoY z_a8)l2sjM119t+S06GAYy&w<*!axM*1iFADz)|2X;BFua90QI6-9Qg;56}z5fD^#I zz)7GFI0f7X{0?wG5C`!v z2C_g7(1CH_EN~8(0BAQq0z3*l2228v15W^XK-wZ<-5~`pLIU1KMJuG?9hCnANRu_7 zPITk@jiAji>Tz)i*RP>0ac{s9d&4-4I>z43{bXyl--vwusjFAs`ReZ<+~yFnHX{Zj z?iM8)Wav+Sm7kpb!sU)X^xpCCW5LMtF4U1o5&>k2ED@I^5=y$FhjYxoZT{3^KOV!P ziUDX|QD+hVrg>dew2OWdI=ct7$t)HX?37r{HCuY#VzIx@D%Ciwl6<(@dv_5%70$`w_@kCVK<2ywWt&_Yv)?6UX=TPu)ii}7e$iZBD(V=yN2Py{IqLH zCt7Q4@sh4-_tOq9-?BxvRUHJMu<>-vowM`qV#7^=z1_0aQNE~vLk^IQ<~I?(e4 zK4IZH&y{b5??UrVzo77W>8>kuKkl=<*J3(Ff2va;hZ5fcT-y08Gn}Ec8o7$|DT?JS5HqMN#8~7@7h&rWA8!_Rj|I;U^bc2 z-LYXUm4X>@%My&l0XdF#h3%IWly@^PuT^C-7YbA5oy-rk%6pg(J$!PY;~;v7l*aPX z>@*{(@z=n{O!}Ob&CwJ}a_nq+L~A&w4P>>4$F-cUG>m7H%CN3yat9k5v)a&LVl0t= zJ?|b&kFq_WfX4ZfIUdC6!mBKx>)GVMxXv`?WU&8uVibjTrS8Nqypg_ic4Q!(c8%0k zIGs-h6FEtKQhiiaRj=C9>S=3WF4g7;m9i?iQre}eKL6xY#baHm^gtpdU2(-Si9zYv z&P2+d)5?cJSuLSE5(BBtxAlOor?tUNMfPd~-_yEEF@-hCC!S>aTaoSy9nrAJ2-V^eK) zvkYPuhnU48X7PwwOtLpN<`bMrir~^06@|q#UFpjW$I7O6v@7yOt$W}hrVZ+Ud+V^k zFYpzf-cXlsPkerBWI`Kcm)70pzICc}Z|Sk=t*o?rT(8cI>yE0|%iJ+t9%3c#UM(>c zu%}W|^Re86!SugQyzUQ`PaTYOv~~ohg!pFf&6`V3xm6|)MToVP+qkzuT}c;^P`_?^ zaM#H`A^o0}bBV`&X1>qN@3HEC&4DeQ@;%eYUN`eHb6gUcXUsYW#E-VF$8007fhf7J zps%GnBzA#QVmn>NrMcKYTwK$9bZaHHN!n^Y=U;&*uIQGAP{_k3&Icl(- zd)~OQr`*^RHU5hxvDX?-Y(eHPVNs*pc;kj}f~keQ06Kg^^|9mR7Bcd=g@+A|Z^-Nb za2Tiss(Bl^JMb}aT@Ji)Lna%$iM(1UAad6hO^eH~3w?!{&8b=R3Qz)!zcfJtqF#bpFgb~ypnN-(5c+C z-nP>?W7x@W6v?`uG$0a=8cT{E??C4V>EBSiiUF@u6>=KtACWhInoJhwhfH9(^TSFP zaN$F`P_=^d!onMiYgT?)=qx1n6mi9Djq<3 z>5rH4|KP%QXu5}g9KT-#?TMVMbH{JStG0U82Bz2@8$$5=YK7k?Pg;K8PU(l1-{(kK zexFOX{61yK^7}Tjmo2}~k+%FkmNNamlC$zI)9))!a=&jGF8nC*EpkMRGMvx|Z`Lw750iFwv$90hDON&XLwYU>{9}D8Z>p>v=vs~0vbGK zZ3G^g8xf=^e)Z@_F~xD*nZg`F0*eqQ53lw@IyM|xYBt$$spaY@X2?`0WT*igq98yJr6AfPXc4+RfL0N$@tO5rL~X>Aw61COZ)V?ggW68S zQfd8#G#mrRx(jy9a+ZZd2-|M!40Fl$epHPy+!dMFRl$^ zw_M!MFvv5bR82!Q!;cbADM=IzUKL_44_jhH^iDv+5})pDxcuYNxb=*`)u3Q@5@>GBK#7 z@^`qHt^8y#@IU|TV(aXE$uW=r^~cR(lehE>djKi zH&Jrfd$Q?=5Fqk6x4KwKc}^cnr?lrzyO@(EFdP5;FQ~2i%$ek%wt3ve%F7XBvqEft zBai)yi44@n3@6_eyHU34 z3&(NtZww^-w7D+&gZy+e6GLZ;&bx)Mft3daqlphu;x87{@+= zvvDpLkDbr;Dcya3U)-j7;Z>x62I{+`5jd3Nh}9EPb|-p zSJ~in? zaCJ0V{~6bX9>wEV+^W(&F!e(vI+Gm8A~ud!Qc~S5(?6BjrfC}tA2?-X80y*8(&5QJ|^jNU1k;y!6N0$=3bt_KY*|*V|n| zdO5Y~^xWP1zXi{N?*qD7;_)C+vIe6%ktDp(T>OW(xc5R3xz^01GXYZhIPCi4s4fDC zew=_f4iC<3Mqd%_6On0}>wR;^=>4bKyIwgI{(ffNckc^cyC(5}Q<^xbQJ2E_pK1}j zihM2KAB_4?>XeG3e&^tguP#-sA^!InOhMlu zES!J!450Wc=|2i5uJrjYq3>(6N>li`GP~f6%*KqrR`6ayV&`YC82g?{BHr5-X@07{ zZnoLkFPBis8_j@!;QZ$#d0Z^DnNl*p4c+0y;){y{OO8Dz6QROvVXc>oWN&P_Xb8EM;fuI#bn={?l@nwzHJoP#ji)(Bk$Wi?q1I(I_4p_Kwer z$(`FwHqgRQD1a7F`k+rU( zuvnJCibgGeLInef$b>1Jf=KZe@3UszPE$aiUO?o}=dB{G?EKGDsBZq(F;qAIvlgnW z3>S+o2{_SWd8V`_=;KW5n){~cR8bCZvtyRL8hpxm8dn(}xzN}Y%G1CF;8Os74RO)T zsr*@#KL>mscoKLD_=4HK(DVDa=A*`eESxKP1DE1|@ivNSorPqKpr!$lEsaOnG<;Bi|ChvcKW#ybET-?gFM>mMud)HS`f|kkTpcZVmzjrgv9CSE8h3fY!GMu z!6@|L6OdDG#VPhjF+K>hMEX6(V`$x&QRj8^<#8{1BoJ8(aGI@cU}<1%fztD0k8=C; zBY8c4-o}bFzb%Hg8ME!4WLF(~)7| zDatI{XuabX4nP&{*Mr zy#GiVpYlW|bZu-%%PL35&ZHlxaLzuTr~T2U)+X@6r#6H-+tdb+C)C-{8Uf=}HK2yt zJRVhT4on_`Fdi!83PvWioWqAX8U`%nUc1NZJ)np`pQi=Irk3UdN`+G}u-)%Dpb*+r z{CS!@z5`0A!hCnUgh;Nc`u_m{0RR7!g%A)01{-=kOtV@#Cjoy?!ypue-%b1v4eu?q z)wz+jOVsSiB_^wx@r}UU)>tS3blbm|wp*>v_z36Rk8^Iw<_B2^pI~g&s2s%+K>;Y< zh)Qj9^inRuDGID(O0c?7kfS45G%v2NGOj6a3_P1ggK-tuz>}1vT<2)#oTeCCz5~f@ zY3o5o1y{Lz1Gv1a_8Z2>2QOt1vU1al0xz)%lFbV3R~AoYi-JAmLAYLK9u#c>ql zZ?6L*?VkgkGIGkw9kuUtiaTZt-iw3#V5`Bn-|wS++QsnsWBj^&T6I;!O0~P-2z)f!7db2I^x?5w zpdumhT}aX}NlJ1<)0ifcxAy%X^KI1rLY`9mPn?FtL*tU9G@a4g*@$=s6dAtw9>o{4 zz&uw73Hl)XjGY4j00@&HMNR=glW#>q0dAAAMNk2VlLAIS3=k8+0wmYw!^O001%o01*HH00000000000002olf*_O90nVD zJxl=r0BZsO01*HH00000000000002{Ig