From 5d6df77a522b64ff23d4f7edc83a711a4ef6ebe6 Mon Sep 17 00:00:00 2001
From: Carrie Roberts <clr2of8@gmail.com>
Date: Tue, 10 Jan 2023 05:42:04 -0700
Subject: [PATCH] add dll and prereqs (#2273)

Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>
---
 atomics/T1137.002/T1137.002.yaml              |  43 ++++-
 atomics/T1137.002/bin/officetest_x64.dll      | Bin 0 -> 10752 bytes
 atomics/T1137.002/bin/officetest_x86.dll      | Bin 0 -> 8704 bytes
 .../T1137.002/src/officetest/officetest.sln   |  31 ++++
 .../src/officetest/officetest/dllmain.cpp     |  27 +++
 .../src/officetest/officetest/framework.h     |   5 +
 .../officetest/officetest/officetest.vcxproj  | 157 ++++++++++++++++++
 .../officetest/officetest.vcxproj.filters     |  33 ++++
 .../officetest/officetest.vcxproj.user        |   4 +
 .../src/officetest/officetest/pch.cpp         |   5 +
 .../T1137.002/src/officetest/officetest/pch.h |  13 ++
 atomics/T1137.006/T1137.006.yaml              |   7 +
 12 files changed, 316 insertions(+), 9 deletions(-)
 create mode 100644 atomics/T1137.002/bin/officetest_x64.dll
 create mode 100644 atomics/T1137.002/bin/officetest_x86.dll
 create mode 100644 atomics/T1137.002/src/officetest/officetest.sln
 create mode 100644 atomics/T1137.002/src/officetest/officetest/dllmain.cpp
 create mode 100644 atomics/T1137.002/src/officetest/officetest/framework.h
 create mode 100644 atomics/T1137.002/src/officetest/officetest/officetest.vcxproj
 create mode 100644 atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.filters
 create mode 100644 atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.user
 create mode 100644 atomics/T1137.002/src/officetest/officetest/pch.cpp
 create mode 100644 atomics/T1137.002/src/officetest/officetest/pch.h

diff --git a/atomics/T1137.002/T1137.002.yaml b/atomics/T1137.002/T1137.002.yaml
index b6f1f5d6..2296cfd0 100644
--- a/atomics/T1137.002/T1137.002.yaml
+++ b/atomics/T1137.002/T1137.002.yaml
@@ -1,21 +1,46 @@
 attack_technique: T1137.002
 display_name: 'Office Application Startup: Office Test'
 atomic_tests:
-- name: Office Application Startup Test Persistence
+- name: Office Application Startup Test Persistence (HKCU)
   auto_generated_guid: c3e35b58-fe1c-480b-b540-7600fb612563
   description: |
     Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office
     application is started. Key is used for debugging purposes. Not created by default & exist in HKCU & HKLM hives.
   supported_platforms:
   - windows
-  input_arguments:
-    thing_to_execute:
-      description: Thing to Run
-      type: Path
-      default: C:\Path\AtomicRedTeam.dll
+  dependencies:
+  - description: |
+      Microsoft Word must be installed
+    prereq_command: |
+      try {
+        New-Object -COMObject "Word.Application" | Out-Null
+        Stop-Process -Name "winword"
+        exit 0
+      } catch { exit 1 }
+    get_prereq_command: |
+      Write-Host "You will need to install Microsoft Word manually to meet this requirement"
+  - description: DLL files must exist on disk at specified location
+    prereq_command: |
+     if ((Test-Path "PathToAtomicsFolder\T1137.002\bin\officetest_x64.dll") -and (Test-Path "PathToAtomicsFolder\T1137.002\bin\officetest_x86.dll")) {exit 0} else {exit 1}
+    get_prereq_command: |-
+      New-Item -Type Directory "PathToAtomicsFolder\T1137.002\bin\" -Force | Out-Null
+      Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.002/bin/officetest_x64.dll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.002\bin\officetest_x64.dll"
+      Invoke-Webrequest -Uri "htps://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.002/bin/officetest_x86.dll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.002\bin\officetest_x86.dll"
   executor:
+    name: powershell
     command: |
-      reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "#{thing_to_execute}"
+      $wdApp = New-Object -COMObject "Word.Application"
+      if(-not $wdApp.path.contains("Program Files (x86)"))  
+      {
+        Write-Host "64-bit Office"
+        reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "PathToAtomicsFolder\T1137.002\bin\officetest_x64.dll" /f       
+      }
+      else{
+        Write-Host "32-bit Office"
+        reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "PathToAtomicsFolder\T1137.002\bin\officetest_x86.dll" /f
+      }
+      Stop-Process -Name "WinWord" 
+      Start-Process "WinWord"
     cleanup_command: |
-      reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /f >nul 2>&1
-    name: command_prompt
+      Stop-Process -Name "notepad","WinWord" -ErrorAction Ignore
+      Remove-Item "HKCU:\Software\Microsoft\Office test\Special\Perf" -ErrorAction Ignore
\ No newline at end of file
diff --git a/atomics/T1137.002/bin/officetest_x64.dll b/atomics/T1137.002/bin/officetest_x64.dll
new file mode 100644
index 0000000000000000000000000000000000000000..725fedd96f4896c945e75b939566a2cf79ff8f1f
GIT binary patch
literal 10752
zcmeHNeRLbum4C7|{z?=%U}Z&sWs=C)0c;d23(kidIkCgImBA!-ND~uTk;b+_mUN_1
z;^cU@4zg*SS+${u0NbTK#OZF?e$Y@TIDz)aIAA9vC1hFF-fT;{v}KHQIEL;*66ntU
z?###^fp-5XXU`ViIdAUAyYIgH?z`{4HzU<=+0U{WV`fxUWo!VDid%dBFAo!A^R7EO
zk3F4#YSDnnb81mzdoa#NW0AI)uY>pd!r_R-Zx{JkBFqQFe9avj`Ho0HEVoz+9ER$}
zXD;n)ed@unOpUypI~D-F^pyjnI(%R>q|y6F!y0^eR0RCV;DJ#;VCz!{#?}IU_myvH
z^51>s-mx}~erS~7hM>QlbpN55G}JN{xIc&Gf8%+7MrM*N=I3P1Tg(c<xkl&izY>sW
z#=0?W9nWGchj5e(WKj_0Oq49v0#UtF27H{J;%I%IE`>dWH86I8pqsJ7+JHo$v@muP
z0KbH3LlNtf%DF}8I<p@SshRX;oysM#Qv$DY9v);eRbw8&w8CTb@>swp`4~Go7c4Ls
z$rqu{C~gd0u8T1@ImU?!U$MogGm4wBba_-4)aD3=CYK2gLl$gzc`P2I1=4&1-)M5z
z8v+J!YjR>J0zvW-`AU<6PiGc4V{2#9pJiM~o-a*aG9?xXDcfW78FL+1Z7o=Pp*Nkd
z2r0{Vz*B8M180DuM@Swk9Xk23(%Ndhu19mDu*&k}b&Mqng~7qX)(-|%HDMYO29Fnx
zKa|bb$&)l*?-^-D@@<n;N{<B?T`HJXu53ZXOmNDL0M=*H+JJTPX@cWc3{l^kwjLPN
zNINVN`kEbiLZ9R)6#BXxeDx*_zzgzw9{F9@apeS*^rWplBj~8y$uYKXbZ?Er?S9sj
ztojv2nYH&tJcqegLD2k^M<LXcmhMo#pAYJFGakRk1KwFoUP)Q51W?|Y!x$X2R9T^m
z^Jsq$)}j4P0A&R2!(11XQrNpI)O{~2PvipYQ4?#F{{$w;qe8NhNe)3CQ9jhnl<Xe)
zrK8lLPX4(dXM1Ez7|N>ES5@x7Um6QAk>yGYa<juJ$daQ{kh>fLe8E?58#)55OnDs7
z{a7E(FL%KiPWQfxGS`Iuz3H!5^v-T{ae9Z;kv?uU8kAcxL(MaMvg*VV7@fFP`4VQP
z{1$7b{34IBWbu!|XPCxYu+??Oz3&ypgrVLaz4~nOO_Nd&X?bX(UpHb28L|JQARiO@
zHuIi7x4o|c>m%fCx=ULicbz;bU&0dgo=I3&*aog;>?^sh^!Pg%BDGdcUNG&f6=d!l
zatp;_!ElYkNvktaq}sNEDUbGngFxu{F}U!W{I77C^4RZHb-L-{nN7B-rle|0+ybQ)
z=;k^@-7bElszUGkh$`i!{{|{^ZTi5{yo`)$`?UoQR3$E{W+&WJBbHC8?M+Kd(X-4j
zIX|`8gvfMG6lG*p+d-(%&6~(^ouyWJh?cSwtKqKR=G{gcYdW53@%TFVg8XlS{4Q-#
zPWgK{!6OgL|13~|Oa%ef-#h+wn2!GLjrs-{qm8@<Nm`I!R&C`#R9mG+jvUQ5Gul`D
zRzWSkiFkb;?4jiO$|HXPpQ$z;Jj^He2*u*5r3mVma0)8_1WJ%=5Osar53yuIituC_
z+mEXvTIL=i(8uLMoFv`A=YTcL{pxDQXxL%yEHGNjVeU5uHh}nI!o6wQJ-+}?7&e<|
z<Y~TaxtsWX9y6a|ngrS6&M?vOdDyI|w0y~9m2jkc<0f*TTad?8TM4$KAU{QChfA%+
z9!NDhTHr&~#!(CAx<W_>9F?%Z<7gLTw0h(ba*GqoN6aV@rLN<&JiKaKfNtt=QqAgm
zk`~XqZEI%j_$EO<uP*`j_(CXuuA={qvcJ0#*s7s~BqT*UMya=}w)+ams9L+wS6iss
zPJ)ut!ZN}~bUanh>vWpvS{~hyRnPH)3%IMcP;d<jM^vpq(-IJ_>7fK`%^<vAOeP>w
z1mT0zAm<T@mA`ukE*nIiMg**dcEnvu%iH5w*t$ZB`w7}0V?g9=<t+>(B=a1~Z*?RK
zdT<nAs-?=0kQ3m<MWP^^i=DKZvXD2y39Ck=B3F7+us&(&qC?@G3O%16Hcfm$u}*#C
zdf!~-86=^JtCX#vkrE%#+2)G$M6U7xh{GmrK<b0UUWE`sVn3kk%jil%t|y(KPFE;9
zbRt*j05WlYMt^M#Wz)3M>3tWXb3}63jm>wF5*7B}xN;H+4q0PC@<UT%zLpjQ`II0J
ztF{w3C@5q$%N|FAu`5HAnkB@)wl!ZuUu~{m)s#quaCR5+E=_2B5Ip7Qx^_-EqKU$>
z#yp=i=<&ya=zH7x40kJK^W)FaHnP?X?d3`+iSM9Xy$5232Z|I)C-UL1Akc}o_dzYT
zJ;kc7tGntvwkMOv5^c$grk(dFzriA4B};qHCLFNxb+js1p)aORR{xUde2tdM;bm8=
zHNt(F9FQDQe`oy)_YV+2oIL?RBtekR0=&fS!PBHI15BWaGUXB;S{&f$8yu+L!dUAH
zE{IS|bP9gUqd;)5ewje_i9IXmuAcA?%t3N!T~TdMG<t4)!TRi-MMClgyO8~=_1Wqi
zAvL$#lbU-%=qqy6t$J0m%U_)9Sv43dkk{sA4|-OmV@Px_luo?iIwRolp-3r8?sl-h
zCaeH)nFE-mg{gf=_tCyF<rTQrbq0Q!({nbFD}2@V1SL4ll^H)CqW6S-W0JY&Ok%Eb
z2_0}&{th5BVT!R7_aelGlEptH=^-uGHwmd9INTp%ihItd;S_ny$im-5d}2tm{PL-#
zN1%u)$FTEYcdCA}df+q`O4$lFk*cj0!h-xQ1!6+#z$hA#_mSyT+Y)Mlp4FKQmpZ4l
zYC_Xl4x2rtPy^*T(n$zUhsX_@>fRA*L?&zy`g&;?GDKrm4?IGnYUe=jUd>J{kRa<l
za8S44_-?Qvd;uFNW>p*Q2%PeCf<PY~6sg)t>x1w}jYFV8dm%uhxm8;XD8g?pT%VT`
zvX!4{XY`|v(<HLz82RjO<RQ8TYP(iQU8|jYsVX|}Ca%Cuisqk#bB$(_9Lf_`y%8JN
zcPi~qeH}7=ucQMpRW<jrzQ3l?KB4am2w)m}I&BoX(yrsy{u+6()^)Z<K2yDCGAxOq
z>OJoT!(v^H{IWdhI$oVxXR4iZ+S*^e=iS@HaH7xbsGajF^qA#~aC}~0qhoGjtB|xL
z@ouFSPp(m|!Z3F)y=ZkaR+Y{%F{!kwB`1qXi>jgo7IKGikx5?QcRGY4CLFQkX~BAE
zFkVz6bJa-v)yWZ4O&@m)(1~2|%76?Y-LsmM@ZqY-uItHc7*ZqC<;0vZ!+P}1{CGj_
zoI&)xbQK-k|BiQI(q7YN83SrP`c{!O`GC$i2F7#nGwZwdr+VAf@m-L(CLV`+(`jMw
zKX_rzX#o@D>59NF9$Gn+xJ%}~4(a4b-Z1w!Kq%b%xGrGT?+@`(Wpacc=0uQK1vL19
z4M6I2&63fYRig>Jrpa+`^|^#4X{kZ0yYJeS0JO-Zbmx_DVNM<^^bTn+8c2Yy^a{=i
z2^=Am4yTG*d>;l^izV&Zsyzp^=l8VdquTRp+VimX+^s!B+H)J8Cr=(W4MG2qTD(Rh
zr*uyv)9*{_xoPe+Hlw}x9w>1);XHu9-riU5ro40acndPd$r)^3xgDJSTI0}kgD(7|
ziy2|OHoPs!CK=(1eNKzuNm<(8Q&o>#8<m@I_o;7DCNJokoY+?wLhIo=zNZq-Pg@@x
zln24bI(%OK3_P&yCVdhi+)$}(HsCi6_>2KxGoWI?j|})VqkpFX?>G2@L01^iZa{q$
z#_Ts_Fdg1w&|frQg#iy=*6$`me~|$%7;?`W@OuV))PVa9c)tN(H(+LTyhC(TF3Z5~
zYjygu%V0)+tHICEe=6AE)W@APU`DTYy`S-D3QIvLBnJ30{`QC@MtuQYGA{XI5|8h#
z#3~m%MMHs`Cif|nyvyvI8e)+?k3s`Z@iWM$WKTx@$Dl*E=W>3YVV~WAya7uM=rkbp
z%X}NAm(tCs%??yMwM@6o1x}~)(`bA8vNpW;GXb4P&^B^e8@?C(pB6GFt2?XP4%=v}
z)c_LjW=!V$sA<&t1&sMoT{!)($E9I2>Q3BXyHM%NKop<E9)klKalxni#6JRl18~E}
znvLJt^2@?~f7|Z4@7sr-yJ6SL6}0^8RyH@q#aO%<A=?~}Bw~KCIVMIU@#aWtYtS!B
zVq9wOyk&Xw1~DZ1;^GW8J{NC?2Hn@>Z(5TpP;Xn;=%H`cQ8-)smhI>WgUzC_<rcsU
z&*5}V*{Ab58RH=U!^(s7E!y!{pcq?(Z{YytPN%=M4LE4}PEo#Y177vkRg;K&Hg5~@
zgju{gO|D@!Pm|j`i`SsZwan&ea_zHtjhb8(JWSQFrBRdX2Co~=$b6q?SjT3P(Z1I^
zc0@u_M*uX%?$c9pj@`R=2exB+tgytGUrh2l>Z-MI?6Y`Vv~l>EyhdHFbQVvSbAs1n
z!uXx~_kH?Zqk-(veOv*QnV0J8Xz*Obvx7HdEtYFM<m`U3S?^2Bsr{zl2AKMt!3hHQ
z&hqW?I4~@Z{<}%$_XQff1#Ini1c!4OP}Tz8Bhx(1CgT6GVltbUd98l`oo~xyHYuOk
z0=dk#JcrpT=ASD>yunm<p^&jQd^@MTK;;DRf0;p>aA(h{$ZD8hU}go&^H{-#oGA4*
zL)MCbE=T>T(bo)oJu1D8Q@I29mKp6tZ=KPezc7a_TyA9xV++m|MXzijy;utN0AzOJ
z&igiKf|?B*vKma*9A?EFteAtfVoubQZ({k|(Vk~!c`<V|yCutM*y}V|%*?VppIIt$
z8uG~(ixE49ei@0wh8)4;a|A(CmWgG-$EKn@Run*O%w<Iwqo|@VYO-<g*->UQ4X_-N
z(fp9Z3Mz7<x;?OEIR{_NiPD_Oekug_Q;Znpdc;O2kNh)(CxN#Yypb8aTX0`E44xKW
zM&Eu)c;J0f`K;fI=9|_B!-2a{BRi{E)5h8ju8Q(NC`4Jp>s{xKM@4@S$=ciQ3kO1C
zjIm<y<5IvY?TU)tV7N8n4Iq!lBD=hyU|eGC3#>!zh>O5Bt=rIadt+UF?Xu-gU1uwc
z?}|%e2jyz?4N8(2>tMG|<6e=iVcxjd?rjZ*(C8&o?9A(rgj<7ciJ0gO`(m-kPOmT4
zwgV@X-ZSV61$R$1iQyf=SR~vbhGE0<SrU=3*cp_(l5cwm7pKL{iwl%LA&K5u4GS<H
z$uZ`O2Fp6)Wjll6GJi}e!|&TtutO{hEh}4ArcY_yyg>@B^F<}twl0DX0QhzFUE+Bn
zk$V%-^@*@w3P!@UVJWr?*@9X&1!Gde7itPaEmHL;*A&*B8>sE{i%}9^uT7q@hq;ZS
z^aq=7$hu9G)+J&w%(NjE@ry`_&v1=!X)x@Q#0-mlJG(A!5Ruq=(MPs6#Kbr`C}6%b
zA;xw!h_Tj4tiu=fV-}bt7W&4IYp)Bin`dwv+hd|H046hK!;+2K(l)|D)p1NfB#iCJ
zuER3x3$)RL01?oIJq(L##O;Z;HZhj5<V&?1Zm;!ZqHi@tkv|HbeO~?)9yoP3f2Q>{
zRn7cLL9ZI5m+~x~WBRQ?Lo_mzhc(XUkN^K3C`2wqrTba~U>LO$INj;f2A|;TxVx+d
ze-yA8_lR!b1XH+2yat^9A9D)TjC<Z`f<=s#0w?%7Y7y{Jz&d;gz6Q7l@B*q6xC8GN
zYf#AsH{dP<?*cq*-~?YZ@DadC11HGgXG`jv2iT4pfKGys7<__1FmQtZg-W(v08HY}
zLU<40HMp~^22Rk8N_>Jr1MdPHUWoe!_#=R3{QkHXI6?X?lJFY9NxTz12pr!M*nOyv
z1IPCS?Jjs2INb^9Zr2H$3DUieaDsF<Bb*@Jqdo#ouoATyeLvk|(%${xitgFt;2sBt
z^Aq^^QI`p5qr3D2vpZ?j>NTAmA$|wm_HcYvl`JcFmhfWO9|;7*ZB->rjqA%QOL%;|
z2nT#29JW;@yTo|OnlD%iR{P>{v15B^7Y_yDcvVRv7G4?mw~HOVcv(l#AB)5ztx}mk
z(y`JP?<n7~tc1rg6>P<wW7EvhNY%|5T_8Te#?Lg1H~uSiFz;aDLHj}ep!49~gZmFw
d_BZrz?myRmp`RVfJ5+ece&{ppr9a!r{}0WySi}GT

literal 0
HcmV?d00001

diff --git a/atomics/T1137.002/bin/officetest_x86.dll b/atomics/T1137.002/bin/officetest_x86.dll
new file mode 100644
index 0000000000000000000000000000000000000000..9f862ce2d7b97c69d437f7cd4d491dda3f74511d
GIT binary patch
literal 8704
zcmeHM4|J1NmVarJHk7mt+OAbmf}|E#+et`5|0I?2Cjw53g_c5<QbO~Uq_#;n`93TT
z9m=Lv;ztK&M(41zxGRI}>i!v>m2r#iXdp<btAew0)E(G4WkmVdvOArT130Jp?eD%X
zffmR0oH={;oZay|=iU46efQmW-+lMp_wrJA|8ADa7}KMuDq};y^wn_qB|yhm-mI7N
z*nw$p%^uR#zBRis5R6*7BjHUEUzerL7Yc<%%SOQxkwTVW$g<?V21{4iFO=ox=2%mz
z|M@-n#a%CbIGQexyuEpJ5Om^=Gp98?dU}A<r&IW&)87KU?#P+bkMVwIMxO^>@y2;B
zzv7LXMyY+p8)v!Ps$g4ybbrxI>b;EB>I|&?JO9*{mKkLkv#0CwZew}iT&HojT@P$V
zv2fbV>lut?aq=o=8^9oE;>%z)@DMstzbiOJ5)0qXV#fSbsbTCg;cLHo#+E?K?%9lW
zU)wf`K4H0L%|QQm@@1mXBclJ!xd3Dz%{65=YW%Y>wxKNI_lZ8lg%K<;SPn|cC#dnS
z21A!=Vr(}BlMMyFVKY%CeKm|F$|BJSIhxNE3@&#o@T9MX^hJcuFa&AttR98*Sx_c@
zHH<BqM1EEMJv^{lJ|F8c>7-eKr!CCf!PG(<@IXS!3k;#67On-19nlZbI<y=%F?TMO
z*DUFh=VUB3y31ZuOktuUrszZqff)o0jzrCvO)+ABj2V<)8W_ueDKR!nmCUMSREnUi
zdCVN^HM9ID5@@McOc<b<2Iw#cjK$2XY@Ehe2UE(Sp}9Yi-~SH!C}mKz!~4ODx*aWN
zW5NWBRj+j*eDeohN9(YG2r^V@gIs??tW#b_+$vE7w(=c-KtE;^=mStTPlw)SO!N+A
zx+ZK1Y^By7YF))!HH8#;^G;&GVeiCes;Vm0VDz7q7Awwd#^mwX-AtU-q^!^k6$@0!
z)RBQ%%Jb#7)xvJ5Q{Pn$MerK=B>%CNv#Rug@*;^R9SON^+#jb+$eLT%KQNN)$W}f;
z)0=R^Tynz$n7}^jJdoI?cO=Gw%l30s>e6`c8FGPg6DGF9I~wnu(7cf$J*d1xGv0v(
zQa*%@v10BeE?tR{u*_HlZg6w{OXHV*ar4DFm*Ucy^aO8%jC}N3%jDiOsx+$n7T#)3
z%F-ES7X~4F9o$}1pq}jgTk=V-X+V|oE33)UZP|{*xqpR5zFw+M%!#QPqCsvkkJ$kl
z){reDG~zf+7`T|<zaNCge)3aQy~5skg}pS*j;T7SWZ<GSr=gy-d=318lj(?h8H?52
z&_oR#=sKW^hM1ZuEz?vlO6wT7D7rM(5^ltpRjxZP>sG3^zydSYjw04XN|wW&u_HxE
zSx_7ouX^kAj>4vBl3jbS@Gy;UgzKRN!NB#TLt;GzJ8i#SY(In2kGQ=$)(>HO?1(8P
zLfdjK#gSxG3ky&QOw+T3T4+VJUM;i$wIrcx`*|yD?6^TKoC(%ILNs(_G{1Gnev6%%
z<GC{l78Vh_rGTKzOt9Jn*uJx{f}`BKIJ(8ikwMQ<G2^Io0?WB~m%#=~_Oks}j`jQJ
z0uOqP`<+A&oSIP8VM8}Wbxg<hQRDu*Kn)u#fMocv!OB}{$J$c04*l8(6KuH837R&X
zM$0_e#A^+gK_41ra;_fjL<ja_hRP`1G(t0voiB(97ucZpLQJ^K;1d&?W$$H&_d?t|
zp%$7!+Nr{{%Aof=go?P(_+Z_H!+YN0op2l)Noqqjt$A(5M>Vg!N|z${aZx|;wsgDl
zI5xk0%za$SK6oD*$MV3<$(^y3u|uQg>Bq2(Vcey6TI1Zx^~pdD(vezd#3))_Imb8s
z&@%9oL-hoeUy;&f`k2ugU#3^irl|~2G%?w0Y?7CGGLPl|<HCZ$l|`8+P|135d~W7%
z-0zAv%5^69y{1TxyvUfj$mBj2F~ttgb-ye9yCbo_B`F^s`=m(;U{J(@#lMfz?yKuC
ztX!`j)4NZI$Vl=V<M}_zLmnKTmsp>CLAO51Q!YAWD^1woV@1jwD5zIflI>t;&Pybf
zdqKRQOCmp?fX@CzGd5jPsRg$`A#sTst)9)bjr|9Nl~S;jxmr(5O*xKCf`M=3JAiMI
zx&qqAsU5N!nRKQq6)Epf#%XRzDu2N{h^Bxab5MRt?4<H@&dl#00VacniGA)6AjL(m
zkxAJ{4I9uwr#wOl@vqSWBlYtV(D;3g$U(nd)NkzE3p&1)`l@~C!bCmMO|oP}nlQvZ
z(@7hZA_&3{w_|hPrdhIxx?(2zfo?L)p^@U9^AcmW*oYd>C41w!0S-GkB*A#D$YBrQ
zQ3H*qga2ES9R_6-UVXE}80e;yx)vLPlIKv}{fxC&LOTxNmVF+e?L$P+C043EI2|dZ
zy>bUu*(}|Sz&S{5cOI%=sl13}M~9tQ66>+Dt+P{!{srCGEZKWrW{#2V6;PYVfBcYq
zh!R{%VBY7BCt9}~5Ejst-$%}!=13f*ka{%jH*z%-v-)~XOuCNp=6r|~E(30ECVvj?
zgv`~1)i60@$#urJ?&!!=K7sMWdh45*`ykIL9f-l_c?veg2X<mY@xdJgpXev}WFNsF
zZzcGX9>DgUPdv@h;2w^i6ge8`=IF0FIr{qm(B54Gdx2!HK0fd`DuYyc3YB3#E@d&f
zW}>4$KCqj&K1-Gq!xHpBjvn?tTZjwmu=nraeirv0Pz&`Ix=IbMRWF?!^gbK+Ue;!C
z(@Er_&yrd$AM{>E2BKt+z%k)EVZ@~2A=ZpbK&*Hxc`@10^y-9_nO`B`{y2K$8u@M<
zV>$Bi)E0R!c2w{FIC2g*2a?qzT3#XWWwLKx`2yaXnAxwoFffysSk3WHt9cOR&e4XZ
zHTx)`A#FNdua66gDqWVn6RF6cNqNWp`>7wTByACOzEY3nQl)};mUfgi1?*;=R-{Jx
z1n!9)nThy5tZmKWKAL0fyfv0<hJdakCw*?^_meMU!Z>pzV1{F4u=i9${tx7jAJ`qw
zjz6T2-)D4;#MhW)?<u)=H155y{nAn)B*|XI6$}Z>;bqx-#uXBUPMC>HSE}z|%c*!K
zrZC-mdHQfXs*iu&7;i91i=n1?e1V!@oygKLaZdGytPCd3tnMaMSY4l$$;3P`fwIBO
zWYP?|x*xX3j_cyQGM1$=<hnB**=yr<6P4ZzTWyY!$>VC{$#oMLQf?W&l%!uYVqWZc
zMoLGf+%mq891%N~F>D~;P(1A?&ZR@x$SlAAyI{nQ>9tmLzuL--;uex(X7NuPBl)@$
zaqs!~>T%lKb>kgb>*pMGAC=am)EhMgh+s{@#iT`a$BtPvHl-InDpE`4i8=4P-<NKM
zo|i|#hq5_`-G`-IZOLllF0vER=SYm;E?a|AX()ijbR4L~HHdDtxPn6uhm9Q8a~R-o
z8HejQ+`yrq!&*Qb8jb`-*UDHmcgWWE?Y+hW87v`AL*>V)NR9bFY{7C*#KspqyIoxH
zoF0CWvWLEfY&Md7E<*<=|M7E1Y%DOptuf8GQiFmwNyLI*zf#`NE=~>Y<_O7iB#HU{
z|NpAyGWI=`K9qKpdXyiO;HNgQ9%UT$Qz);Z(6`}s4Syf_X_SXkbQan-qkIJV=O`yo
zET9*mtVg+!k`s|`G!0)4>Au*FvN|LN#ZJL*DYdK!i$b^0&sbFSMMMkUmxwGAdW4j^
z#Fwl6VhN1JZqxQ1{cM{eh(P+E`1H{KyYz^Y#!J6N(GG7!*>D?5fz~VCW&%m9186&N
zO<OMbHgrCQwqw_{(KFBF59y!LwJ@VEqi-hU??QbUF!7#7U()?NWX4e1Zf5L#l#?jG
zKsk+aJKlK8Q0$o1@o9{azCXg)PlESN=vdXTq+!~&*MGg`mtFVD$Fu%)X0qvL<jTcW
z>sCjFNOT>Raa}YlMcRaQ5urOAT^DX|54H)S5Ea+05;_H6RG7pn>-KL%Z;X*D7>fI0
z>Egy(@+`e)@wY8&SBT`8MSBM;3(^CXm7jB1TV_O4na$SLzKO9O&~);aEnd}VUAuT8
zs%-02-u=Yuo5EYp<@%@cxZI8@ym~ITb1IL^?ViGG<Z_Qs<#D+^;01KBFZC9O7}f0M
zv^Cn3dV51`v2`phXWbm`6uYohc>L^vqqP3khaY~}zY)`Bm#t|%Vw-jOLOwoj8Y$hx
zyPuEGiYM_JH96ceuF5rPa(K33{WLx|$l8M{f8VSpp635~#5)B!3d<DFLA-JBy07w_
z#G_n8ci)uUeB$9M!DBQ1-iQ|l)`OF*Y-2Ra+iTDd75>g>#V=KS8)_KabCt(!ApYc!
z9(IU6k-}*@GDF+1Y5LmsitDcK=Q~kP%l&MUo`UP~^n*hB)9vq1YS$Gpa{-Dal_N<m
zgu2bb*xX6HS5e1d$|@%D`jA_3gmV9(8~^?Wd7D|Z`nB+XJKxXH-4hJ?*Pw(STF6#6
zcvm^*mH9h68G@>{H7fdB#Vy@JYcSLvZuMi&N5WfLJA+XXvtnIBS5!dF#ae})HlbT=
z4fsO-P9frKZ3}mGg+r`q@v7A;8kg63?M|DfHOQh{qN30RFEMBhilPwdVwG3xtpZ!f
zTBAaswLRF0##S=sMh1<c_TVNdBD98lkx2NVR$pY(W<EA)3HmyN4_|2#LYsq;aHvZN
z!MgdH?vzA0B=iKuR?)YyQ((+WmJ4l?D6~##xB=sl9Am!jU};yh^r2v=v@If*;-3;R
z*d>&9+Dq-F+LVS3t3%qn{a)^cU^sLSH=VIZ4Gn_$h0WHCrGmIvibP;%eI(o_V2eCs
zXoN$8A)hFuS?td<mq$}XIC78R6XAvWh!Cae`SdF#A+n`jh_r_zUA|D8us94Gg$OJD
zy!PdOcE==cV;~~<{9v-*61RabOe3bZFp3EXRKwm~e#N~FwOIIN=)xX{MN5Q@(xy#9
zByGvpy{lGuYtzwlZCrmv|9&2zSFRu3_}UVrBcA_o%rGineSe4^(DAbscfY==v)A#z
z-*D7^j*s_TWNPh<{r1#OoboK_>FTs>#!U}ttGdKqW-GA>p|-F;7}``_vbyn}(uxub
zF7qM3uM;V<x@3zGEm?4PZjQ$njS5{GJGWS%AQY`Gks_h0Xj?$&@<mI#f^Cs-G~6zh
z;vlH<MZ3y2+e<7+Pr-JaAx)D<BUN8Z>jLpRZ2W^};Z`ye8$QQ&o$Y4ZY@5UOgzb>+
zZQHMG7i_uq>+G}aK6}u<*Zz$Cfc?1rti5*L`gylF?stfe=N$jw_=)3)<2}cRjxoot
z9hV%RIx?L(&Kb@k=Pc*#&Qhn->2WS`);iZZea?1gr*pHj&$-+Al=B7WLFfC<v(9nn
zr_SqLb*?5?i>u8QbV;snxPIgM-u##5pPheGc}@9!<?ZF2<&pB9@^6;+mp@kim*oe_
zUnxIS{x9YKR_?7>Rk67uUa`7Ts@zt&r*dEAGnEG`->Up+<%gBJs#~izR0&mEs~)M^
zRaN0$=w9v~aPM;Oaqn}#<bKWlpYBU;=E?Ki;HmV~cp5w{o;FX=6ZS}+Z+NzQ9`y`*
yzU%oj&vPESL(x^L+qT#Cl+9!}+l%bo_8oSMtHxF9^1A}Ae%B8Ei{k%o1pODpApE!h

literal 0
HcmV?d00001

diff --git a/atomics/T1137.002/src/officetest/officetest.sln b/atomics/T1137.002/src/officetest/officetest.sln
new file mode 100644
index 00000000..639c629d
--- /dev/null
+++ b/atomics/T1137.002/src/officetest/officetest.sln
@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.4.33205.214
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "officetest", "officetest\officetest.vcxproj", "{38D47045-36F2-48CD-9523-0104408A650E}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{38D47045-36F2-48CD-9523-0104408A650E}.Debug|x64.ActiveCfg = Debug|x64
+		{38D47045-36F2-48CD-9523-0104408A650E}.Debug|x64.Build.0 = Debug|x64
+		{38D47045-36F2-48CD-9523-0104408A650E}.Debug|x86.ActiveCfg = Debug|Win32
+		{38D47045-36F2-48CD-9523-0104408A650E}.Debug|x86.Build.0 = Debug|Win32
+		{38D47045-36F2-48CD-9523-0104408A650E}.Release|x64.ActiveCfg = Release|x64
+		{38D47045-36F2-48CD-9523-0104408A650E}.Release|x64.Build.0 = Release|x64
+		{38D47045-36F2-48CD-9523-0104408A650E}.Release|x86.ActiveCfg = Release|Win32
+		{38D47045-36F2-48CD-9523-0104408A650E}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {B554E807-7489-4A46-9DF8-41BE9F6CF3FD}
+	EndGlobalSection
+EndGlobal
diff --git a/atomics/T1137.002/src/officetest/officetest/dllmain.cpp b/atomics/T1137.002/src/officetest/officetest/dllmain.cpp
new file mode 100644
index 00000000..e4b4fc2e
--- /dev/null
+++ b/atomics/T1137.002/src/officetest/officetest/dllmain.cpp
@@ -0,0 +1,27 @@
+#include "pch.h"
+#include <windows.h>
+#include <string>
+
+BOOL APIENTRY DllMain(HMODULE hModule,
+	DWORD  ul_reason_for_call,
+	LPVOID lpReserved
+)
+{
+	switch (ul_reason_for_call)
+	{
+	case DLL_PROCESS_ATTACH: {
+		LPCSTR app_name = "Untitled - Notepad";
+		if (FindWindowA(0, app_name)) {
+			// Notepad is already running
+		}
+		else {
+			system("start notepad.exe");
+		}		
+	}
+	case DLL_THREAD_ATTACH:
+	case DLL_THREAD_DETACH:
+	case DLL_PROCESS_DETACH: {
+		break; }
+	}
+	return TRUE;
+}
\ No newline at end of file
diff --git a/atomics/T1137.002/src/officetest/officetest/framework.h b/atomics/T1137.002/src/officetest/officetest/framework.h
new file mode 100644
index 00000000..54b83e94
--- /dev/null
+++ b/atomics/T1137.002/src/officetest/officetest/framework.h
@@ -0,0 +1,5 @@
+#pragma once
+
+#define WIN32_LEAN_AND_MEAN             // Exclude rarely-used stuff from Windows headers
+// Windows Header Files
+#include <windows.h>
diff --git a/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj
new file mode 100644
index 00000000..8bc03109
--- /dev/null
+++ b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj
@@ -0,0 +1,157 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{38d47045-36f2-48cd-9523-0104408a650e}</ProjectGuid>
+    <RootNamespace>officetest</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;OFFICETEST_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;OFFICETEST_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;OFFICETEST_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;OFFICETEST_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClInclude Include="framework.h" />
+    <ClInclude Include="pch.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.cpp" />
+    <ClCompile Include="pch.cpp">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
+    </ClCompile>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file
diff --git a/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.filters b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.filters
new file mode 100644
index 00000000..1e57c7b1
--- /dev/null
+++ b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.filters
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="framework.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="pch.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="pch.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
\ No newline at end of file
diff --git a/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.user b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.user
new file mode 100644
index 00000000..88a55094
--- /dev/null
+++ b/atomics/T1137.002/src/officetest/officetest/officetest.vcxproj.user
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>
\ No newline at end of file
diff --git a/atomics/T1137.002/src/officetest/officetest/pch.cpp b/atomics/T1137.002/src/officetest/officetest/pch.cpp
new file mode 100644
index 00000000..64b7eef6
--- /dev/null
+++ b/atomics/T1137.002/src/officetest/officetest/pch.cpp
@@ -0,0 +1,5 @@
+// pch.cpp: source file corresponding to the pre-compiled header
+
+#include "pch.h"
+
+// When you are using pre-compiled headers, this source file is necessary for compilation to succeed.
diff --git a/atomics/T1137.002/src/officetest/officetest/pch.h b/atomics/T1137.002/src/officetest/officetest/pch.h
new file mode 100644
index 00000000..885d5d62
--- /dev/null
+++ b/atomics/T1137.002/src/officetest/officetest/pch.h
@@ -0,0 +1,13 @@
+// pch.h: This is a precompiled header file.
+// Files listed below are compiled only once, improving build performance for future builds.
+// This also affects IntelliSense performance, including code completion and many code browsing features.
+// However, files listed here are ALL re-compiled if any one of them is updated between builds.
+// Do not add files here that you will be updating frequently as this negates the performance advantage.
+
+#ifndef PCH_H
+#define PCH_H
+
+// add headers that you want to pre-compile here
+#include "framework.h"
+
+#endif //PCH_H
diff --git a/atomics/T1137.006/T1137.006.yaml b/atomics/T1137.006/T1137.006.yaml
index 78e7bae0..2fab69af 100644
--- a/atomics/T1137.006/T1137.006.yaml
+++ b/atomics/T1137.006/T1137.006.yaml
@@ -23,6 +23,7 @@ atomic_tests:
     prereq_command: |
      if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")) {exit 0} else {exit 1}
     get_prereq_command: |-
+      New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null
       Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x64.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll"
       Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x86.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll"
   executor:
@@ -37,6 +38,8 @@ atomic_tests:
         Write-Host "32-bit Office"
         $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")
       }
+    cleanup_command: |
+      Stop-Process -Name "notepad","Excel" -ErrorAction Ignore
 
 - name: Persistent Code Execution Via Excel Add-in File (XLL)
   auto_generated_guid: 9c307886-9fef-41d5-b344-073a0f5b2f5f
@@ -60,6 +63,7 @@ atomic_tests:
     prereq_command: |
      if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")) {exit 0} else {exit 1}
     get_prereq_command: |-
+      New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null
       Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x64.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll"
       Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x86.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll"
   executor:
@@ -111,6 +115,7 @@ atomic_tests:
     prereq_command: |
      if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll")) {exit 0} else {exit 1}
     get_prereq_command: |-
+      New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null
       Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/wordwll_x64.wll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll"
       Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/wordwll_x86.wll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll"
   executor:
@@ -155,6 +160,7 @@ atomic_tests:
     prereq_command: |
      if (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam") {exit 0} else {exit 1}
     get_prereq_command: |-
+      New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null
       Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam"
   executor:
     name: powershell
@@ -188,6 +194,7 @@ atomic_tests:
     prereq_command: |
      if (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam") {exit 0} else {exit 1}
     get_prereq_command: |-
+      New-Item -Type Directory "PathToAtomicsFolder\T1137.006\bin\Addins\" -Force | Out-Null
       Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/PptVBAaddin.ppam" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam"
   executor:
     name: powershell