From b1124e01ae71bd81fdd35b0233fdc7ea735725e8 Mon Sep 17 00:00:00 2001 From: Carrie Roberts Date: Fri, 6 Jan 2023 09:51:02 -0700 Subject: [PATCH] WLL, XLL and VBA Addin Atomics (#2268) * new atomics * cleanup stuff * added prereq * adding source code * fix typo * note testing of office versions * remove copying file --- atomics/T1137.006/T1137.006.yaml | 210 +++++++++++++++-- .../T1137.006/bin/Addins/ExcelVBAaddin.xlam | Bin 0 -> 11601 bytes atomics/T1137.006/bin/Addins/PptVBAaddin.ppam | Bin 0 -> 5854 bytes atomics/T1137.006/bin/Addins/excelxll_x64.xll | Bin 0 -> 10752 bytes atomics/T1137.006/bin/Addins/excelxll_x86.xll | Bin 0 -> 8704 bytes atomics/T1137.006/bin/Addins/wordwll_x64.wll | Bin 0 -> 10240 bytes atomics/T1137.006/bin/Addins/wordwll_x86.wll | Bin 0 -> 8704 bytes atomics/T1137.006/src/COPYING | 12 - atomics/T1137.006/src/HelloWorldXll.sln | 28 --- .../src/HelloWorldXll/HelloWorldXll.cpp | 21 -- .../src/HelloWorldXll/HelloWorldXll.def | 2 - .../T1137.006/src/HelloWorldXll/dllmain.cpp | 19 -- .../T1137.006/src/HelloWorldXll/stdafx.cpp | 8 - atomics/T1137.006/src/HelloWorldXll/stdafx.h | 15 -- .../T1137.006/src/HelloWorldXll/targetver.h | 8 - atomics/T1137.006/src/excelxll/excelxll.sln | 37 +++ .../src/excelxll/excelxll/dllmain.cpp | 23 ++ .../src/excelxll/excelxll/excelxll.vcxproj | 220 ++++++++++++++++++ .../excelxll/excelxll.vcxproj.filters} | 23 +- .../excelxll/excelxll/excelxll.vcxproj.user | 4 + .../src/excelxll/excelxll/framework.h | 5 + .../T1137.006/src/excelxll/excelxll/pch.cpp | 5 + atomics/T1137.006/src/excelxll/excelxll/pch.h | 13 ++ atomics/T1137.006/src/readme.md | 70 ------ atomics/T1137.006/src/wordwll/wordwll.sln | 37 +++ .../T1137.006/src/wordwll/wordwll/dllmain.cpp | 30 +++ .../T1137.006/src/wordwll/wordwll/framework.h | 5 + atomics/T1137.006/src/wordwll/wordwll/pch.cpp | 5 + atomics/T1137.006/src/wordwll/wordwll/pch.h | 13 ++ .../wordwll/wordwll.vcxproj} | 186 ++++++++------- .../wordwll/wordwll/wordwll.vcxproj.filters | 33 +++ .../src/wordwll/wordwll/wordwll.vcxproj.user | 4 + 32 files changed, 741 insertions(+), 295 deletions(-) create mode 100644 atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam create mode 100644 atomics/T1137.006/bin/Addins/PptVBAaddin.ppam create mode 100644 atomics/T1137.006/bin/Addins/excelxll_x64.xll create mode 100644 atomics/T1137.006/bin/Addins/excelxll_x86.xll create mode 100644 atomics/T1137.006/bin/Addins/wordwll_x64.wll create mode 100644 atomics/T1137.006/bin/Addins/wordwll_x86.wll delete mode 100644 atomics/T1137.006/src/COPYING delete mode 100644 atomics/T1137.006/src/HelloWorldXll.sln delete mode 100644 atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.cpp delete mode 100644 atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.def delete mode 100644 atomics/T1137.006/src/HelloWorldXll/dllmain.cpp delete mode 100644 atomics/T1137.006/src/HelloWorldXll/stdafx.cpp delete mode 100644 atomics/T1137.006/src/HelloWorldXll/stdafx.h delete mode 100644 atomics/T1137.006/src/HelloWorldXll/targetver.h create mode 100644 atomics/T1137.006/src/excelxll/excelxll.sln create mode 100644 atomics/T1137.006/src/excelxll/excelxll/dllmain.cpp create mode 100644 atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj rename atomics/T1137.006/src/{HelloWorldXll/HelloWorldXll.vcxproj.filters => excelxll/excelxll/excelxll.vcxproj.filters} (65%) create mode 100644 atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.user create mode 100644 atomics/T1137.006/src/excelxll/excelxll/framework.h create mode 100644 atomics/T1137.006/src/excelxll/excelxll/pch.cpp create mode 100644 atomics/T1137.006/src/excelxll/excelxll/pch.h delete mode 100644 atomics/T1137.006/src/readme.md create mode 100644 atomics/T1137.006/src/wordwll/wordwll.sln create mode 100644 atomics/T1137.006/src/wordwll/wordwll/dllmain.cpp create mode 100644 atomics/T1137.006/src/wordwll/wordwll/framework.h create mode 100644 atomics/T1137.006/src/wordwll/wordwll/pch.cpp create mode 100644 atomics/T1137.006/src/wordwll/wordwll/pch.h rename atomics/T1137.006/src/{HelloWorldXll/HelloWorldXll.vcxproj => wordwll/wordwll/wordwll.vcxproj} (57%) create mode 100644 atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.filters create mode 100644 atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.user diff --git a/atomics/T1137.006/T1137.006.yaml b/atomics/T1137.006/T1137.006.yaml index 6ee10ecc..3a1d1d37 100644 --- a/atomics/T1137.006/T1137.006.yaml +++ b/atomics/T1137.006/T1137.006.yaml @@ -4,25 +4,201 @@ atomic_tests: - name: Code Executed Via Excel Add-in File (XLL) auto_generated_guid: 441b1a0f-a771-428a-8af0-e99e4698cda3 description: | - Downloads a XLL file and loads it using the excel add-ins library. - This causes excel to display the message "Hello World". This does not include persistent code execution. - - The provided XLL is for 64-bit versions of Excel only. If you are using a 32-bit version this will fail and "False" will - be printed to the screen. - - [Source of XLL](https://github.com/edparcell/HelloWorldXll) + Loads an XLL file using the excel add-ins library. + This causes excel to launch Notepad.exe as a child process. This atomic test does not include persistent code execution as you would typically see when this is implemented in malware. supported_platforms: - windows - input_arguments: - xll_url: - description: url of the file HelloWorldXll.xll - type: Url - default: 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/HelloWorldXll.xll' - local_file: - description: name of the xll file - type: Path - default: $env:tmp\HelloWorldXll.xll + dependencies: + - description: | + Microsoft Excel must be installed + prereq_command: | + try { + New-Object -COMObject "Excel.Application" | Out-Null + Stop-Process -Name "Excel" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Excel manually to meet this requirement" + - description: XLL files must exist on disk at specified location + prereq_command: | + if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")) {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x64.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll" + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x86.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll" executor: name: powershell command: | - iwr -URI '#{xll_url}' -o "#{local_file}"; (new-object -ComObject excel.application).RegisterXLL("$env:tmp\HelloWorldXll.xll") + $excelApp = New-Object -COMObject "Excel.Application" + if(-not $excelApp.path.contains("Program Files (x86)")){ + Write-Host "64-bit Office" + $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") + } + else{ + Write-Host "32-bit Office" + $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll") + } + +- name: Persistent Code Execution Via Excel Add-in File (XLL) + description: | + Creates an Excel Add-in file (XLL) and sets a registry key to make it run automatically when Excel is started + The sample XLL provided launches the notepad as a proof-of-concept for persistent execution from Office. + supported_platforms: + - windows + dependencies: + - description: | + Microsoft Excel must be installed + prereq_command: | + try { + New-Object -COMObject "Excel.Application" | Out-Null + Stop-Process -Name "Excel" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Excel manually to meet this requirement" + - description: XLL files must exist on disk at specified location + prereq_command: | + if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")) {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x64.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll" + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x86.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll" + executor: + name: powershell + command: | + $excelApp = New-Object -COMObject "Excel.Application" + if(-not $excelApp.path.contains("Program Files (x86)")){ + Write-Host "64-bit Office" + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll" "$env:APPDATA\Microsoft\AddIns\notepad.xll" + } + else{ + Write-Host "32-bit Office" + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll" "$env:APPDATA\Microsoft\AddIns\notepad.xll" + } + $ver = $excelApp.version + $ExcelRegPath="HKCU:\Software\Microsoft\Office\$Ver\Excel\Options" + Remove-Item $ExcelRegPath -ErrorAction Ignore + New-Item -type Directory $ExcelRegPath | Out-Null + New-ItemProperty $ExcelRegPath OPEN -value "/R notepad.xll" -propertyType string | Out-Null + $excelApp.Quit() + Start-Process "Excel" + cleanup_command: | + $ver = (New-Object -COMObject "Excel.Application").version + Remove-Item "HKCU:\Software\Microsoft\Office\$Ver\Excel\Options" -ErrorAction Ignore + Stop-Process -Name "notepad","Excel" -ErrorAction Ignore + Start-Sleep 3 + Remove-Item "$env:APPDATA\Microsoft\AddIns\notepad.xll" -ErrorAction Ignore + +- name: Persistent Code Execution Via Word Add-in File (WLL) + description: | + Creates a Word Add-in file (WLL) which runs automatically when Word is started + The sample WLL provided launches the notepad as a proof-of-concept for persistent execution from Office. + Successfully tested on 32-bit Office 2016. Not successful from microsoft 365 version of Office. + supported_platforms: + - windows + dependencies: + - description: | + Microsoft Word must be installed + prereq_command: | + try { + New-Object -COMObject "Word.Application" | Out-Null + Stop-Process -Name "winword" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Word manually to meet this requirement" + - description: WLL files must exist on disk at specified location + prereq_command: | + if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll")) {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/wordwll_x64.wll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll" + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/wordwll_x86.wll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll" + executor: + name: powershell + command: | + $wdApp = New-Object -COMObject "Word.Application" + if(-not $wdApp.path.contains("Program Files (x86)")) + { + Write-Host "64-bit Office" + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll" "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" + } + else{ + Write-Host "32-bit Office" + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll" "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" + } + Stop-Process -Name "WinWord" + Start-Process "WinWord" + cleanup_command: | + Stop-Process -Name "notepad","WinWord" -ErrorAction Ignore + Start-Sleep 3 + Remove-Item "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" -ErrorAction Ignore + +- name: Persistent Code Execution Via Excel VBA Add-in File (XLAM) + description: | + Creates an Excel VBA Add-in file (XLAM) which runs automatically when Excel is started + The sample XLAM provided launches the notepad as a proof-of-concept for persistent execution from Office. + supported_platforms: + - windows + dependencies: + - description: | + Microsoft Excel must be installed + prereq_command: | + try { + New-Object -COMObject "Excel.Application" | Out-Null + Stop-Process -Name "Excel" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Excel manually to meet this requirement" + - description: XLAM file must exist on disk at specified location + prereq_command: | + if (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam") {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam" + executor: + name: powershell + command: | + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam" "$env:APPDATA\Microsoft\Excel\XLSTART\notepad.xlam" + Start-Process "Excel" + cleanup_command: | + Stop-Process -Name "notepad","Excel" -ErrorAction Ignore + Start-Sleep 3 + Remove-Item "$env:APPDATA\Microsoft\Excel\XLSTART\notepad.xlam" -ErrorAction Ignore + +- name: Persistent Code Execution Via PowerPoint VBA Add-in File (PPAM) + description: | + Creates a PowerPoint VBA Add-in file (PPAM) which runs automatically when PowerPoint is started + The sample PPA provided launches the notepad as a proof-of-concept for persistent execution from Office. + supported_platforms: + - windows + dependencies: + - description: | + Microsoft Excel must be installed + prereq_command: | + try { + New-Object -COMObject "PowerPoint.Application" | Out-Null + Stop-Process -Name "PowerPnt" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft PowerPoint manually to meet this requirement" + - description: PPAM file must exist on disk at specified location + prereq_command: | + if (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam") {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/PptVBAaddin.ppam" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam" + executor: + name: powershell + command: | + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam" "$env:APPDATA\Microsoft\Addins\notepad.ppam" + $ver = (New-Object -COMObject "PowerPoint.Application").version + $ExcelRegPath="HKCU:\Software\Microsoft\Office\$Ver\PowerPoint\AddIns\notepad" + New-Item -type Directory $ExcelRegPath -Force | Out-Null + New-ItemProperty $ExcelRegPath "Autoload" -value "1" -propertyType DWORD | Out-Null + New-ItemProperty $ExcelRegPath "Path" -value "notepad.ppam" -propertyType string | Out-Null + Stop-Process -Name "PowerPnt" -ErrorAction Ignore + Start-Process "PowerPnt" + cleanup_command: | + $ver = (New-Object -COMObject "PowerPoint.Application").version + Remove-Item "HKCU:\Software\Microsoft\Office\$Ver\PowerPoint\AddIns\notepad" -ErrorAction Ignore + Stop-Process -Name "notepad","PowerPnt" -ErrorAction Ignore + Start-Sleep 3 + Remove-Item "$env:APPDATA\Microsoft\AddIns\notepad.ppam" -ErrorAction Ignore \ No newline at end of file diff --git a/atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam b/atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam new file mode 100644 index 0000000000000000000000000000000000000000..424c7938af3dfa75d172294de4f28847d4dc5d73 GIT binary patch literal 11601 zcmeHt1y@~5()PjK-QC^YEw}{&1b26L2`4zg-Ccvby9IX*?hxGJ8`4$yQ-9A!NAc0kN{`^06+qG`tT{z9s~do0tW!l0MMYH#q4aIO>CX@ zK6==jIO#CD+gKClf`d|L13=&3|6lt*JOkybvWlQA$Q^0-M4auZHr+uiz~G=QWuBi% z*vlZaYYm6!U;NHbEFD7TK`Ho7>S~uJk~GIQroh5)?N<} zWOWB)bT99Nl!kv?_|$$uNs6I;T7r6&z8$2Jzpnu{j68KU%$|?S+F6(qmW{Lj9vL~r9Rx}smyQtW>riJ!opidQma&dDLMZUcsOerUj`GQ z;x3gD%nO@1IfYaAJ$5uhdpLoC?1xQ0-t9G*nA2tLs?HkS9gk*EKeUQ(K&pI6y($q2 z10@Olj>WeOGi@tpRCvV?^VzD{p2^%hzWz5}!BolSQOVNvjb}{MogAhsj%e34doVI# zFx_?f^>LALw+|6fV=N+bx=cxvJ?SL*Z4MvaPF&$U!%|lIx+D4m6z|<`eW25hSXq$^ ztuK&!jl=|*FB`P2vC>@F&7*;qtEOtsV^L+8>Bvj!p=WH} zbtRtGiT2{nppZVKLduSM&pIJBNRfTxr&Y&(F`D7g#|6_{HuP&aFr27({hhP^(@4C& z!;^@B0RZIh07nY3zq&<6 zA)}QZsZO(gm|B7nK#|eO9k>BB%sbRfVQG_vgV_1HL#Rz zsv1*4h6JzFfaaWjPFfO9jioSc+0i;p17VjT6sh!P!9Xj&%itbZ_+lY)WL;*q#2KIn zxS6s!;w2M+<ij3uHpc3|LF{33xOT6yZC z(Cc_pZDd?f3=^`twa3yekf$w*bvUeQWO;=$MGy<+8reMb{fX_1-+Zv{+JLHqS7z8a z#O|Crei167)_fUhS0UVc^u%;*(qI$tpbNvf#M0jBzEbm-8i1_b+T-J}vNRtP;yitd zQ>%7hEH`p6E*ZIf8wdzF=3MG&R)LG`Bue=U~EML&Tgcp3C~SmmIY zJ(6~{tdhzI-Fdh=SS~#ba7QtRH*H87;C4{)c;|XYcU}40HiIiM&G$UP z$+=H`^q(uIzrhp5BCLO)I^j9kWNFYzH_^0=wI)nqq>RBapHq-$L8efTC{vqjkV9m@5v3Q*Y%W|VVq0ni}t*7grp`gfcA7ej%( zZz12`{lDGHW4jgp;i22acKGD^kVVZ88KEt>zKnnwm#hFe95B9$Y-CPKJI4()ouCdk zT)t&pnKeH;wl5m!%j$~6>=IAnl~&kcw5d&SArW(1>K$kD(_+UMsOjo4=v6PU=xmK6 z(#M9GLFh#E=EYm{I;XPXP8Lavbsr{=Opb`8RoE&sUOwvr#So~Y+5216k>_t1LM-uP zuilnt+2?KNhwDy{m5)wiMh2cIJQC4wbPGev=YCTY z4Qoj%J!)v@Glf>KlDFBHReO6v%pX=Cq0oZKHyGnTkJ!%;%J?XYsGq^kTjYSP462nZ zb7Z67_evcELox28b1`o|bcloRqvid~EQH(Ygy2v0VUn>Z@@_4Hg$h?`HMkHglB&Ks z%uUuK*PxpP6EiQ(-RlYN@x-_}TDZb8 z#W-Su??O;Sj6Pq_#uH} z=hC*)JQL~7jdUL_+Cy+`G`_a-_<}Us@Q)N4gmF!NHdoJB_zCWbRnUuKsQ0J4cwf!8 zw;G!95AqBS()7}^jqgkR{^XyJKgcQG$kWSAjM1qNNz2n!tFcb9eNv$wk(=c&Fu zP=Epe28jPS*#5Z{a5guwF=6`i`ln8vX#NPt<3jJmdK7|pa(m|3j;2`uIbj{QMsA!D zk6+(#qO8uw8rz1421>zmqe7iukR)m+5I-#phR}W;4MSdcNHj(DW09<4mpsi{M#~i; zT6hPl9vxF3E2rkf{dS6Nt@y(ON=N&1og(J(rSvF>h0bd(U9N+l`{g8iW;uOtjVY(g!*0uIV(1_(uL3== zV(r13;}@;YhUp>@bN0Z5!iGiO;{@Ap1_(-zb2+V_&ecXS*C+LKYMTj4qk|W+Kl)Vx ziQrp)O2B;=p%K*X{hDD~WOlrejjs2(cR}`4SE=#ZN=aPWu?ff+TyN>tyo_Poa}b5L z4j&}a9!oQ!{0*V(L`79jgOqDmE8>h*5a180LN2{E+z+of30>0^PR;YPZ-rt88r2Sn zN~z!Ukp@9V?f$!9z-u8{SOYU_eu9pEs0Nw2B9zm6`r4ri$@dipw_A4Zcp-!6D>sn+}+cvoz-Fy1ZAyaA-f9#tXpzbq1R`~ z--AMCD8wA~DO4Ei#0*15drXMGEMNXuxB1>%Y&9p~ZA@nH{vFJ|Atk#5qvnjtCn`MR zEF1(K;l?|xj(*)zl$A{6;+|nNSC2;YUu5@qzuw@Abi%@KBR&!8^l`?@Ivz|nhhwwF z2)HgrD)Bol%f$}$`BEa1NW{1WNn?3OFY$>Bh~X>Mu&g%1H1xcfk~Tr?Sf<8Pg*=*! z6I8cFq_h)ZIR{pSn=JD;EY|-BW#i+$DoI#w#a4BW7{K;w6m-&0ds6?r}S|ow5C~-C+3;Ajy;{PUG1R0-nzhP2RM$mB@Xdzmj{`OZPmMMB=KjX5dE#9Za&~`QxQEW)`ql6jgr5Nng3??>X3=0Hoz*I8D@X2WJYN4BF#Bor$NQmUo^ zN=ntqK0e!rdQ0d=S~7O42ebq1-UWBaX0qAOSh=cAt~k<}w)buZi8xp_U&Z5jwc`{< zAX#FPz2f^A^cegS5ZI^ib8YB8`6CNzZKn#;5v4gGJM#^>vv!kN0N1dUGZlyeHdQO_ zUrYNp2+GNq@O#>cBBR^Ec=x$b@-;M==%AuP{lkMCkAAQOq*Y^`_{>5rH%w1rLc z#7B|whAX+|CL3q=aD-NlO)1h5VJj}BcIO;3@+X&q-L@;PaS_dpI6+$MnHBca9?d$( z9e(B8K`6Tvo2{WOuzgWraICaqY(_+#^N?xVob?F@>t<%i8e^5$Y*XkBtF2XDsbiyu zhF6^Byti?Y1?-HOlW2%c+IQ~3P9+Q|?Qm*;Gij=5m#9UDJGTT+<#=4lo~CCKm< zH{!iyzYxF?6`7yD7 zWHLtLuf*B=c|R3`q+yj+`ZU2dIgqKIGnRKT6`?xPpswci8#*~+FHKB59X~O>@q-X? zZ0ddkj0^+b(S0i1*{uMkWR3Q!T|B2VgTEz~ym@GgxuxN3ic#$P6KV8L!Ib*K8LWM1 zrIl_?lJmZ?g1Ltz=*|L(1Psh}_%h#>Og;>Y^Du5@Z0vn-8L5}u)?3}||)QS8^ z2X}Z@2Hz`iDbJm%G}Mj%3m7>_l!vfr2b9q92}KGaTgJ*)Jd9c3>&<#`!C>Zrg08b| zw%2|MVAfY(Ylg`A)b&udz_lL_!K+-I+R!7AA!vGU?PrK#XW||9*yFZ*gN!4%f}~qw ze&kd&E}((Uq@ir(4)j}R5E}dBCV@ZJvrC_>T}z%!HLCVa&Nit`jRk4@*X_aqhLkaCm(cC?Sj!^{vv@_EOU3lxge(p@~8hdTl?m6YMJW(U25b%{wbde~TZ&z6&uXz7$Hz^tJ z=En~IuE*2>0Lnkq+11cM$oBk-#WmVuSdiNsNpBAhw8iBBP5Zy*(O$b`d6!kQ4@#ss=( z^&x&jsDp9{Gbll6LkL4?v3MW`;xG2XKVzf}v2#YTP7r<($9gLd7~r;(=XJ`F zl6$Ut<+*_0&lNeYhyjx`2&FjX_Nsy+9A3)0cI()mtDqY5@rj&&O)z>~B1trXXu#4Q zs#Q*8d0=TV55vWon0htl`pD?IwIN5zJpc8@%^j7W zf^WL7`m)dicg&O;G<7&BC?%PBiCA36(_bjP~&iEY-vNXC(k z>UsKnjiWWaY~jqx-dv=Yf7Eu^hWp?jUuBdDoL0qeSj^!c@f>9KMFFmak zNPm=;xE{-WXA2vFKG{iTpji&yUJlKTEilRb;TpR9bMqu%{{g4QtVUBSU{AGzR3^RO zr0mXHP_KARvsxwdO14yG@0T57_bAOohisS)OM%LpHAwp-tt@)@gSBbRkh6m@kG+>C zd_vQ~xzLwd-&gS0z6)^3%Yaeci{ zWrbm5+0)epEcErUCLNrX5GdKNy=%RHq)HeTox&b%AwrF1y!>`0BwO`{HlbJjHhMtL znDi2d)nxd#<6`RFhh_D~#AN>F^Yz-b9h={9#~PY;m|YYWCq)^|}{2O@2J zW0abREC-IHN<<1!yiGJfXN8LJW^EKO!CJ9!u#m(9NPEE4ETOnsD@s6#DS18jVC4N% z8{3{C8wGsGQ~~A$GimwrRzs>=ycy2ZMr4AqA$I1H-3tKkGbsbY=%P@N0JUVne)^l= zP}Cb?|CCf<`oKA#S-)RnMm}Ndp={`zbtc1DZvUWP(o_tS6OAVvRi)GV5G)Vk*8a#N z=DOx0uIAyIDL3=N9&Knz8RA%#Q6~cS2kGxdiQ;h()yUg6vhHKd%lCg>V=4G$F4u1Le%_2~L_=R&C?A#pTb~BW6@#4E9^i_>6h1 z6Pu+p7bHzXjwy_Bb|eU#w&*vZ*Y@Fp1>3B2xq24S`o`Fw6ttF>K=dt&#I>M$`R4pUIxu$$r(PJ z`jYgjtp#-Gs;Smj3E@`c-sL8C9b|wu}jQ5Ywb;0%&1seU#Cj(8U zbWC$_I!$*u4(XD0(-xgY={n7WxJv?@F@oGboi65J`7U;~b4BxAU}LXD|?}w|}_I8l8ss#;c*&m+|=mEB=k=R31 zcusP%>65KyeB<#@9c1KxGMP0LR;$kE7cqyIL|)m4pP6sUZmB~%qZZ{$I9Lg0=69u` z#5oe!DW(^eZxAc2rraXiehK<^qVuy6GP5q(1;J~)F?XP_%VTW^^T(GGe<>Q{$?Uv? zoODAj*Rf>OjI>YB5H-B}R%-XLhD!kUu;SvK8C@l2L;>bSutLfkl1@#44R0My#6{2^ z(-DVR+(w!J-r_x-0R71ZyLEHq=u2$6ym}xh!#~_354S zK(ozFgVl0E-)0a*XM`%u8_9Ti{|&*nax`c?5& z?$J=EkUf(DsXcZoJP#Tx?UYt`#ODhyuT0sthn+Js&hxj|gT7Z7Rkm!Z^Vf&GMz`16 z&o2Xtifz|xj1|2WZ%^T!l^!<7jjDFnzQ5K}h}P<8 zviDFtuLcajB}mRW1otpu`whs7gj^;E+t`=So_AMflW=i{5f96#e99$-OUH+2BMD#n z2G#v%Yr>77>YiqrrTet3CMMDQ^qMC9<`0bKKyx`^ms!i0wV1^?!xkaMk-H-zFiJDj ztGU@`T+u56D*c2Y9dUxqkOV%U(FkZ{t8MVe&aN!=Oik4{$;|ltB-Wt3+^MEVYKoC^ zhqN;SS`?BucJZ}nARCox5FG8+*oB(zadxgb?j@m);?dvvRqocK_J@jRuvew|1$t%e zx2jjI1J%wL9WSH(XrVy`Nw`va%(*1gf)zzy$}{d-JnYi%)a^E}w1Wn9Is?Do`QC#z zKj8Y_DXi0#8)&D|D2a3i>q+h3GS@~QEklZXaGjV{{s;<@|8ZhT{)|Mf$sd@_%A_|q z$Hvx-`^|wBBHzEo2f4fJzUo5Q09jc$r#L!zS7f|kl%Zdn(tlf*ZTnYs^h|#_3u5$$ zKzV542!C$DqAVE&Y*v(&5Osy4kj_>i2hS2puQHKxP=yTC`29C@l|Y%xFY{W{sG+gA zG-}PeQuWidce^u2A*8iD?aalv9n~yG+V*$GC=Iv}M)}mFy7FYre91i`ZL)KsQ{9;= zdZiRgYXtX&(Oykb@DiWNS^CWiH&9w@Q@mSv-iQT1ID8^_>*|00MC3O2v4Zc_QAp5u z8TTcSWqEi$vGR;J3cS*)~!;oz2mz;cH>6y_jr`~MKy*E-Iw7|`?RNB{d*nT6AD}&{H(1baV@SJZk{W)e9bvuq601Q&iMrP5%ny9aD?4W zh$*Jr`&K13(N5z%1s0c;#;bnf;gYe+9QbgQS_S6JxiXH(zLco5q&A_P4231JHK*8T zmeNM%j&ejy19T-86W+9v8sHO0wL_6B9~V3?=7gi4%)HS#52l^aN?CMgi^9Z{ zzZ8N9==t-O4lIISv&PNzI<6Ag!j0BM2(SpB9!5MRsGEEyCkZBlk%%-;Ag=LBXc9^d z8Cceea}<{bGGrI2>gdkf00-mW@{&g$%p0-KdVxzsdvJY;hhJ!;8)dIdN7G)^)`iZH zT)xDn#+%1c$V*GIClJ#qMQNRPFy<+t*O%l93YPEp>ui$^wAZgYJrafy!3_2|vf{=B zT1us%!w1hs>C1(G35t#XHrt@|Ayx}*&=sC~IZB4Edt{F$L{Wzqv%IdbX_h|osfbj- z5chReeFeB>(5y-R#SldP3lNiVA`Q02?Q@5E$e=V7tp|!q-kl%DYZKDlGh4HpUx}(cuE){kvA{#uyynuBDw!J**kU_@# zr{rZJhf)rhdtEUTlZ-)%IRSt3d>|aGH>&gin*m)NTsLb(`(nVJU^pULzx**f(#2uJ zqT@w(qra1AWi_yi0tx@FYgR$rSzLyN%a-(l)`BniJ?9Q5jV+LIehd5CHaU3=nBL+1!wv2-$0<(N*-fE3DfD_r*0GUkr#?nEDGAVTvgKElE9Zl{9=bV@H1o zDe!V}*?4u8T$>!WCVif&>AqE*EzWZjYh1HU&gCRT(BZP0wnTekXpY&WLv-rGJ~c%m zgo-?Z`(F-ja`5GIjqz=@!286*9Ogs-Fqz;bDgj`g%2ad5j6^jh0rCUpb(T z2i(CaHXx4($ExZg9dPQ8Earj=lHr{F+-*MP-rFEUrpsJY@}Y%PL$1t5)GL0_6zYGD zU;yOAS|6yoRd&Avf3G$A3p)ND^Zc#y=y&knODFz<0s#E5e}ex%g%rQb`8|F9mn8r9 zXw^SI;y;qfhl1^oB~Z5bsM10KmTgeBNoggZ7WR{|5yg BynX-x literal 0 HcmV?d00001 diff --git a/atomics/T1137.006/bin/Addins/PptVBAaddin.ppam b/atomics/T1137.006/bin/Addins/PptVBAaddin.ppam new file mode 100644 index 0000000000000000000000000000000000000000..3bb0654737a115db181d7e85d8a0b2af059428f1 GIT binary patch literal 5854 zcmeHL2Uk<;whb*HAV{^-F-Y%7Zz4@8p-Sii3WN@!H<2ne6hT@*S`ZMCF1-ZlA}B~n zC{kh~AiV^5INrVEoZ~(3{eg48J$4&ot@-V5?={ETbLwf6kTL>*015yAzz!e?G#^qE z0RU^~I|G1%7^3Rt>TU1pZDr{1ZtrCw=;s1uD&!)Z#X^_wEqQ!Jl$k(w@=anTG?>gn_?tQAB$kL2}V zp)#B5>wupPy9FDi#QAsMI1oi2B+ZNtd^I!SUhe8aANi$+iCx(K7SvH5sCjk+8evNw zo^NwMZ7;8m_DZU&&1Z}buDkWPXFiwP_+ya;lJ34cs)4|dY0mZ`#?k5Q3A{xD@*&ETvbw*J6zGCwj)~Au`OI%(^8l@8`)}-7~EbFq@ z!E^iZ1pX$aX)+=OXB3QjSln`Vi802$HziD@*nK`{C&pNRfuvau8(hn~EJ`EC6Kq7X z70nqu=|7WTHTGGEe0pt0#ySulLyQjU^dCRczc64+7)i8di$8KqaU+a17<#T$l z0w{=n<@_&2e$V_jWr)uE&3W)Ydq77!ow|jof%Abj8`j=dY3ssTv8gkN29aiRy_?(~ zmmw%o`{3il`i#A@v(+=Dxy|dwUJDhLg^@1fPZ!qgc0B4gg9(0f;bSTuMMfNu#+t5= z?a*c+OXNg~paK%9Wk{uc+cBxkbwO!bW6?BQ(-Q$6m3zdouPU|#nQ42}CV^-d8@8!U zrd?tl`uXyplLl?CpQW|Lg}9&UJ8IaHvnDo}Wr4i3ob^2NtU~&bV#?QVU+0Yc@2ciD zh`SFqxQ>d3yl(p}E)dhYKN~nIzn`=1iJjY{ z9krU;q;p1C458X8_#Y2vh^mF9rivI5PHVu(4~qj5M`mN8;r6z)KQyud)7#95i>5Sp z!kCo!s=+Pq2N;RI&{P1c7?vm3aBAeHEV{8xrcWQR3sf&9lv`VxQN^YNr&J87zYshH zZN}q*d!vFdx86ZBvHZ_d~afGSkp)-d3Dqv>7z*! zT-a_0(3(>Ta(ZzdIMzUgO$fWbMk+}nMFa`U4zKJG=#ZQ@Mo?`6EaxF%z>hBv!vU8_ zRg|u*0Xb}QesIji*1o{F#0O{FU1IzCs`<*N#t)#Bb>JQ#Fg&=!MM)7OgmNVZcd%8n z-T_b(`2u`BvmEejn>Xj*cUW}Hbx^p|x(f+Y&XN~}QwyW)QOdx-!t6M~3R}zONbG9CS6J(o)yn{=WSEy9H~`al%-S+2>$cqv&7(gMhf=pFtz8 zc<|)q0xMLk5B**}&Co_kV3y0w2UnQNxOh7=HNjxJn)$sv>c)31dx`N{>jS$|%wVlf zrC5FNH?~2Ygw-Tw^{AWWRLQa^WsI5bhoiA@~0{shB|j&Et^)) zPT)iN^+S&I*yXXd{m>Df#Gb8@{(eGQt3R78it^Alr10A{+vst!M?qZacKxkyp9#r{ z>al3~FP)s^Cds6WkqBB%y>0?KtxTwygi0D{_%bD`BGQaXF$PmuoX(8r@-Fn@*G}Np zl9+UN!?8y_*wH~qS*WbtZ>&#}-|eR?L^2&>_3ZxlxQ$_~#B!>$+ef2fq&8+#a}6aC zFj(2VIDr$N>C$-U{Af6zW1CF8BT&Oi|GruciRjybLN3o`T@^#lbo`qXlY=nu4?|u7 z=mKT6enJ*+43O)y0h4ZI8q;#(1vLqwtZrH^JMucwemwbN!!}=oq2_yK6KSse>t=R3 zb4@z#$aV2SuKiD^k}p;y2&QiXvU#UdWRN4}9`<>_kqh!*x6)K}>9*S^&J_hijQ%Jz zE_m!t}EEjzt=tK(CW6Q>g*~|DmTZcHJnoy{>-I{`dB&_!j9}st>E`agS71}C zgrat3p7KFeFajeH1kD;*4X1zE2j(+1w>MR;w;b|M~U4_M9_Ux?NBHa=d zN$9-1yCsv$QE?7MujX75*(FmKq(*qOA6z$pxH)>2O)av&`Zn4Dj&iXf4)Mh1hWHG!FXs7bk<36~kmx}UjH zz80Of{pJswKOL?;7C=K>}p@dBTnz?8o`Nn3+(Jrd@<`Am{ zWyB%gP*caQoqLfDROl&nRRxN4ZixA?V-G5nz{gHO(feq0{*Y2*^)}4J?%@bNjuMy@j)hj>SZzMbGSnksIfYQ@KQn8W} zI=!>krJ1TW93J$V3*;BC7jmBsESD4xAeh=eU|B9#&gX;Wy31ei53?|5zk6zXo%|u) zX&}-1vbdbN(9WUFoknRnTMkCKET5=l<$@=a7S^S9k@jY8ulX`ZuNl9~xly2IQeNL( z@yhcgbu+acb1Ha~WQB$SYbZ2{6 z06i@$3A3|YcUrO%OmCo*PW}?|WcAwN+eFBWf4Y$D&3LK|c`eA+j|@V{^IjMl9{R9| zk()!Nr}sEn%VG8L14=~As^Plt)NL3nV>REPe@R2?CfI+XB9=gXeWomLdD(4RP~vOn z9J}BXQ29{}*$7+0cq922e@JBP5!fbl$VlB>qxfESW|c8g4*nQO8f{7*iD4GFNA)8A z>#@YlmZ&^};@J1(0VOE5&1;C;(YWx=tSx90c4S1Kp*75l#0GnM7_NXncuf!MbhMT9 z(UN-X!G}1tYMafW##y@;x+G*T(DKI^{7|1J>6wDX3sYQ7dmOzfHGFFU%~g=Z^U?UO z1+_$~-_}R!U5Qs5#ENly z7s)u86q?p&a#{7JcBWz$pe_}*Tbs5)3kUM>3~-lH+}{*Z_6{x9cbH$lLbt^}?)o8D zm!P$2mva#mer35CJS95HkNR&O)HycadH9x*OD`Lf8*{n^097G)pr z?!<}oV_}Xu7L|>NRUJaqqSzIxFJH-7C&d0j zInXSU6mxbpE#+4EkGAxB<9#$OQp?tDDd*J{OyEs!{kHvU2+q=13gIu0T0xE?gD0P} z?lQORznDxjQMi4(CEqS^OudVP>h|E(Cb*q|{n>5!)R6H~Ax@8}p4l{-04&M|NF|wl z*?D?(7ZN})Bwbkf$kkLstco}dbm+_J?9sA+K7HU&tdf7Z++^?NE#w!*-r^9SGh>w@ z^J7r>n>?M6fIaol(}jp5U5wNBfCaQ-D`%u$RL7vX=NG=ow+@kQ46ZzOBxg3)xqMibrpVl%`se)H=X!V8B zhAmDbAC+i}EAh)>4vdGxnG8U``#`uz&#EE-63@|xkzKcY?U$cEP^NHX-7L(TJy%cn zg)W!vXny`1Jm{U%#mr%K!F1~D2EkBcn+0Rz@(J)lRT$W3wE}fS-=?^pu-~lvEXZSS zb=x`5j_1ZEX?KBZ63b6)o|5=H?X&LiGUiF0=9wESqI+?lpe$`XWH{`^ORqmN6Ic>pmb7O)FE}I*pGn z&KRMfP`2O9uyD6pmhr;gT8cH-)eBilKh{m($f6l0BgWiC%NPR6#wGja0=IhMd>$2c z_Ya!jr#UM(Ay#qoB}BKlKHc(yh46SWFg3x z8W(%>v+=c!L+dv8P!Ab-hgr_cy_45BeVZuSH1u$uYJ>v8$#eyliN&WTC!sv&xX zH2RmECL$I9{9gv_?~3{vbRzXJT#eEKth+WC}!vZ8)Z{1y6VDgQ^RF!1k%{qG2W y750DR0|0jaLim4V{_kMFYs5d`9L}xk|5S{6+GOXG003m?o94M$5X$uH?tcKdq+5Xi literal 0 HcmV?d00001 diff --git a/atomics/T1137.006/bin/Addins/excelxll_x64.xll b/atomics/T1137.006/bin/Addins/excelxll_x64.xll new file mode 100644 index 0000000000000000000000000000000000000000..32a2c1cd93f30eeded12a61bf64368802279dab3 GIT binary patch literal 10752 zcmeHN4|G&jdcTv*3rQeM&=2jmm|b+Wwbea^bh~v=Jv~@m3|Q?X6G>2TBeh%5ZcXd1J_y=K{R6u8_4mE^ zh9oTRIX$P_)3bWdx%c~Xzx&9@{Y~#w|I`tZ|Vrd#7H#U9`$vKeqSgQmc>ny7>$R-KuD~;b*YZ_6&(WfL)0zBY@Lc*8(20(F1`QY*Jgn2Co+7+VDr@EW-L`6F$DE7f}zW07Ktegw!1tUi_!$?K4~=N zt}z8n;MV1&U>JhrBl4B54?dlm+>G5gmHr~)hiGl^WWmF80JM^KZHyhAn)<0eJ(WXv zTbu3b9lE>t@`8b@8H*S4fq}xdj|Vg@Zb|cjBZa5_B%4(6#F^5b;JqrC4rqP_$rJ5shCBWS4JCNQ?^#LilW+x@I1QT;xxCR@*oD2IiA13@EG zABWJ6lzglDH+i6bVMXy73ZAqtz{-bXE(cKmbtYpysrX`bnISHs{w%CR{aXNPKkA2t z-B3!)+g+jUdRhJ38NhaE@s;Waz_@aPC#sn2;L3>lscxoR>`@LMq6YQKD_qI;C((G_@MRrtiWt)S;7h=uE^g(E4>JupUU`BMm+zw|r-Mh{! zf`s-xsrw6z#%?rmdehoSui!z2x)dYSJtHQnUtb8L<4e_BFf#RR%$fSjT*eY5gWxj^ z;~m)QI_}=}bJc>bK00y58;Q3pY6GN|^mw0P#6mJ+&rz-n@!k!hr`KKF+lcw$x$AG& zC&*o|OemjVih7R6ZOiNlxv!2Z!Wd!*hnw?oKBIPKJ*g5pXoR$Z^~Jf@5%2~VW3{e%Xh72ziYdWEk* zoFv`AuK;UUc>fBm8a>9aA|ee1IZ>w3w)^A?No!Y zF5`(-M-?paI6An3T8}b9ZgFDzh#4WG)OCcWN7U@A(M%goXj$8yqRI1ayel(z;ySLJ zF{VK1p9kg7RrI}C_Gi}uTb_=~JRudMmxf}^{(3$cRaeY=>k2jdYoL@AUqbk(fhQY8 zgB~HePDC?A)iIH~fV=7nxodzQ)bs>R3qiOhyW+Om0eJtLWCB(S=O2%PyoyN7{M~7| z>{Y~Rtbm)L9qTTs$L&*RvAuaxcoB7wF(G2M`VKnciCl;Jwt-|pPib0@=jvah5u7+* z;)=C|4t1{Z+;M>~ACZe(sR?d-s$e%A3hz}I@qE8!{9{_{r1xH8+YDlcdN+{qGgI2D zw}7LrMqx51_g#?A5!q2}ZocyrsIdP|sY3{Gh#GSfpIYK`^svB{V_X^5>@VSSMiMS0Wd}*}D;UX+Wo*0#ALx&@QMy)kWc0bDaB3`qZO9 zjJ<6;AlyXJ{K#{(jcm2)ox)NI;+rW}|1rc&4-~1b29XDU-2rs`^e(8ywx_jf=<2Ti z4Yns!PR834=Pmc$qy7?;fSD}qc_Z$Cm2aa~%|lxZoveP3=<|k5IlSy@vxS8_$N`BF z?LTez3qOMZ*4YaHL=pr!3~*R@5T!-;I7~PQrA++t2zH(!3_JC)3DvCfiSUUcu>o~{ZLo1~yvDLx8Ls&l6We#AL zzD$eLhL3igREObO*Kzn|=8iYwGx+!HFHnHfU77LY)AT*C>!fVmaXdatJ&gu9E8hah z44BqfQurr`r4uF3lXO~-_3L=@Nr(GW3~~FJ6r7@*G^6nASfA+9s=Rz`@j)nJ>JWAw z>`pdJ)bx*H64YD3CQ`GngD_Wqq(Y1*A31?a#C=3M&F-Qa=vk48aLF;fRu`I#a@g!i zl`1ICkxoKHIz;F`#+9BCszfAg{Yx*ChUiEXJXD8YD3??Yk0ta;qj_*c0 zmM>rvty#_f3I>W(o=yhuu^P;YL{{#~G0ezV~E+$7IdU(nC! z#~q_2vVDkrb~oY>-2?Sq%ad2WNl`sneF9+oGTfwS{5hIkq>&`jxqSJX(No4wrTuBl zL#FN1M%yPZYWpkd?GkMVv4E-X$*@uAO1X~M`f8PdI@cSu%JG`*6Cqg&)@(l;2uby| z%FD`x>qt#s2;rQI%CdaJ!T|80nLwrMNB@-(( z8y^NxaX&4_a`PGE%Bhicnyr_;Ahr*+ZesW&oPxQo8fXxG*P%3cYDpYMH=MgQJ7O;8CsQ&(WDy zvRg0d8$~M_)yqM>d`2&SqL(SXd`K^M=q1J6qeu5!(nnpXv{tfGCrRx^Y4ZC>8@s4V zC#TexY=si{I>dkY=k%@yH^rH|Pel+Rj!t2V>PB$(=#}Zo3PboGaE2N@d?uXcibcWl z#J(n{dy)lRXEn{E)J2qaxa%~us0`wy$%%c0F7y_zBipOs?3C@{0c8Mu`2EZD1@OSw zVq=h{*BY?MgzHThHQ^o;{@8>!f8CI;G~qlGT21(#DfgNQ`%QSG2{W$UXv!DV6b9&{h}%B;M8N{4wPH$klThTZ_E#tBlRXiOiAPaia_(A3$!w z6V)CVT!{-eo$n6-J_NXCZSC53Z>W9X=?6B~JvaNkjj#WDTQ*JCs_UEA#iVGg*%#{! z$Q{kGa6Ialnxj%A9BY=k{8F$h7;NskuCjTJ6qI~1=>ik4w40y+iF`wue0Ul1O{vHbtJY9}Y<2CAXjnjF$+=gkqCS9%tJPg&e zrAe2I5D(7Cyo+OzUfJbZ335A5u=V$RhjR%~ z)&kz6lRVuf;{UFMA+kC4TxOT^n7wrdvsdOYd&Qiw3G54)$kamY@j1qxAU%hGzc_`q z;4Yn0k<~aS-^%hUb6NhHoCvkGLRN#^Rao3V!WyRZ0qE;MA28{az;B*XPxLKQ>Md3a zv)+h@uz5LbUZsuAi_RS@id^18`pNF?kZs4^^d;ycsN1q8tI=Z1VK$7#hOyWxW=1S| z7M8aO^|@A-8?{EVTe6&{-A+q^l@(Oxv4V=6#ysk80p`op|7}dBfSAGXTtLv0Wno$H zv85=N6}2Ka&0t07qo|@VVzCSG-63YT^s^k2(fyIb@+)#8hCQ&QQed{rW=6;tWIv@0 zG$^B__OGNSpLTzDhs}z%?;Vs@^ASN?*1M8GJV-m3StJbXh zR#SaL-I7YDq4PS176Dn7qMdB%B<_{iO6HA89p1J;5S3n<=wjyeheK_F_IOnChJ4Xz z_&%>M+P)bN4Mxj=FBsT*p-KvE4n)JDPAP<*E2l|>LsC~j_R79ZL0pj*FfXo3{u{b%NPM+E zctk;Att5YLbw$=qlDsM&jbfyY(Xd}a_#6_N;L#DfR6w!!(;H1z*hjO$SL4O_@4O&GWF#I448Nj zaIc9I{F#aO1CE(E!4FOR9N-3gyL|vX1a~5nPJ)k{IKf{dlWi(s4EG|!Wx!du7aavo z(1}cZf_IpB5b)V~7(4DF^!wfi$i=`3;tfH^D*?xF=W>9L_XM^Hxe7Sm6!dQ$H*oqU z)9;bcPf))@0w+lKKL%WfxU203PItCqC}pqU7bO3Grl%)1XeFvQtn(NN+Ex^H4tjAUbL=hby?LSF(%{s;S1uxu3of7 ziY;1sLqYxuUo0kdZVGM@p&%5iUKEdpu8;XUq)uO~tTW(`hGXG2xy&E#ydIyi<(ro* z5^>Z8+HhN0Keabf^^J@!5SOs=3(XSE|B>xIx0mh9-B-9z+}E|QdtYv!*jL)Ozi*^( TwC_aUSfASWh4#`P?BM?!eve{6 literal 0 HcmV?d00001 diff --git a/atomics/T1137.006/bin/Addins/excelxll_x86.xll b/atomics/T1137.006/bin/Addins/excelxll_x86.xll new file mode 100644 index 0000000000000000000000000000000000000000..d4f39bcbce3e69246961f68811e16ee723e33039 GIT binary patch literal 8704 zcmeHM0d$mAc7Bu0Bm+#ysEGz;b&!d{O0pCF2_eh`f?+fuk%5FjG$9PhA7gR+9Gnu76{o^uC23mhTFuFoSd2V zl04dU@=G#_8cynK*GC^x@Brp18pK9X{W7ALQiYzr9VRD2n%3Z6nI>UX)+$!7~OF1Y7Vda1dJu}f55{h^Vx z_~$X!b#>bm`he}KwFB*+(tdTdL=w9tFu$|_k$p7Rl-;QD&&Jr6l1Q6R@-gv z5b3i4rhHY5-93f;w))@jK!?Hqw2fJ{d^pvbJb7}6{Cw2HTsc@ht87SqqF^OADCZQ9 zC8jb-h^Yq2M(8?1CLvKZ?oiDL|8bN0p^35FR}Mtl{R`tOdjCC-z92y$?61jcvppRMtMFXCXUN#Ige;gAhS*&uCfauKa z|2bNRO+=8LYAfXW5>l;t2w|y45x43Ofc!f#8GkpB8lDBcjr|GvPIZ81 zhdS+D%~Sxdkxz2}xcOsE{z!e9#FIioshwzx=RhNCY}x$aXtE<){RmAb;f5vThI&k3 zA9e0eJZcmYnWXKPx@6e0~ut4fR!^T)4_Y#+` zz(^g87J(bwnEUF)#b4cWVgALqd^SD7+aaSIyV^3P=d31=slS1@8k35AR(%YEki7!8 z*W%wo_C7~G>9O={a&AQ>S^8+Ukoe@6(8$+IGe|RIT83m&nyurdKy@3*mQfmU0w(ld z$nDz?LT5kopPF`=z56n|E6t8+2DzyJf;_*@OIkL8-+v|@QHQWtjdcyw(1EV~nq-P; znR1P;`tG!j{tHr>&RWTh7`H36=M=*_&EdbpinXJNwUClkaA)kzf}|phL=DWq_EF>hg`kE_HefP**ktFev|}BqT8DAdLkTwA>jX_3PNx-~Y~pK7 zmp~sGV@i$@?L_*|Mm(+|~vpB(ZM zRzD-9HO83P9X;iWvnplwe@2+>HIZCa? zwb~MysoZVOyxZa$iCAJs7r5S)KNS+2o0H1X@h=)w9|lD%*xL3{+CAKaVHK}&+~_(j zAtNcrCvsn!jXXH9D6u*DqG5AVb?6xg%q`ZAIo9d=SttlQ3Z&Pyfw7Y*aLDV}o*6GnF}f!ajw-XqEpN^mKGMb{ip zv~E^}1$5>1l5=MWiPtEkzMu9Rxtd8?y*(BtUr%}SyAY?c2xVg<`EzJDWUeHvx~UmU zsWrcKXGf;`1&kjy+D~HcgFL5nAO;Wc6l{t2@5Y4Ug9C&g?<4$7FX2~q68@WR;P%~* zKgWx~CwcLV#EX79JKA^uG{}pe`B6OmSpU-~6pu09zZaE3syvIzFdvt)m{K*_;f?q2 z;jIVAl3QU3dLTy+dk*B|8anLxOS*Z)JqNXXqm5ZR*x)AZ;+a9ufwv;9qjp_F83$O=MV0QXU88l#@CvK z(fCG-;`u=78H;<)@49%e7?Kr_S{4Y2tKeS6bG9rbi9wi&+g7UYVDks@OiW>x=hCd< zc+?ob&m6C_$kk9&II&#ItxRMYm^8m~OI8Mx=2mu5kzeV}%4E`PFi~WKnaSkql*&HX z9(&sm=aum+ouSm8?a1B~ubr&$oZsmXMyHOekEhg5Vo0TV>|&CB(MYpnZ)c=*WGc-Q z`^XWok&Iyz`Gx{%KXEP|!477*eLn;vHe%FU(fvv*GfO*2idm)a38T4&({aza_=XAE z)wL5HS)1n{a~+d6rqr8t1qfYT!G)wva>Yh$I-Bwe9~C(z^Yr}pUGK}cLeHTw@S$w} zQP)v9M_;n4cp2G=uoDuaxWrZgDolB>n9c#M(2cOx3Y{D;;n>UZ8jfo?-okM`$D25A z;&>%6P75JH(X}pC$sMw@eOHh9U zNMobP=QH3#=?|VaV@HAcr#jP$yEG_xlSFLzRV&XPdW=&;dw7AYIhw?Lzx|%OgRxT! z@a_ZnGr#~K0@ws_0~P@C02hiF`v(AhAE3{#0e=mk?*;G|0&WFd57-2F1n?ukG5~$` zNJDzmb?=Ue%TZeib^8pl#%;HhQ-CpL{qT7~K~$dNX?GLhnM< zYfutT!5B{g9)rvYK=mz%6Ts_$!+;}zEWGW^2H+fEBQqEyeK*3!9`ODUI@Z^%teeQV zw8OjomHYZ{+^76t%V~vNUcIzwLsX1Jn|#sEfaGtAhUG}B*c1`F!qFzNyHyN!2ZK%P z#h~bmikBHBU2R*@8Q+a5z);*@_g2@hp%tKaEdHit?+lR~v+3_&B>{Svvh#BgF~H1d zDsebk+qdC84Ky9eCDrTe?VGAspvt7_ya$NaJ&m`D%k7-b<8r;zcwR2oH=W1j2Bz`q zx!msQJTA8fyea`n0#-gDRhjn56TccaSE@0%r} zZX~^Px=BV~k3}T20C|MMImHu*=LXMzh36z5<*H>g554bV;^FGSV>SKmh^GkFjgzlr zYc$H+t1y35_3^h>r8iGWTQJDF zgDYeyytYfE%|Jd)e=ktohPax-W60Gw%vtXg-Vk^z!TY-J|LW{0%GwwRdAh|`cAsbc z{hl?#B0e`($XZ&WQd^6(qf2ZFgxbR`ZDLf4gm<(A15pWijCG2gQ4zH=)Up3kDv!+$4s!2O{B6rx=1wi*?;8iEv2l z4oEGMZ);Fw%ue=-t+FJxOl!Cap0^$@A$%zRa#T(Esd29mOfSb zYU!y`VUcH%QCJ~7DC`k_EIcRtg>YCnDf~isU-*@9R`^u-H{p_?30ck@XP)yG=X~c~ zPQkg{S>vpA);XJ<+nf(Ozwdm)`KUQmN{mAv_u2Zh} zTw|_(bzOALaogO2yV70lUgciv-r#=F?Q?H)cefp9YW!+_a%bw)FCjNiN&wl~mOYjN+ literal 0 HcmV?d00001 diff --git a/atomics/T1137.006/bin/Addins/wordwll_x64.wll b/atomics/T1137.006/bin/Addins/wordwll_x64.wll new file mode 100644 index 0000000000000000000000000000000000000000..90b991039ac3660c9c82f391eb1f563db3598cf6 GIT binary patch literal 10240 zcmeHNeRNbsmak6wvr^Nl<71S^wB^-Z@pjdvD#Ux^=7SR=wA~X5#^t%NVmG={jQrKzh79|6ej2W3#S0 zHj6!3cyj)Lt?}gi)~&&~7>z}?#Qa@iz#k4r6mhdG#u8yM7#8d9Xc4<29dc!Hagobx zdhV_E2RAMKPS#56TP|eVz|UU4Eps==NT!uzIJ1spkjtGd+cKoLY3a7?cY(iIAK?6N z)<2x}aeixtusImmN^O7HNSf*y>-dX2*6n;MVChV-1>%gHSqoSRBy$aE|2KfdGqwlA zHs~D2@`%P`A&Y_`XX43W?NBu;S@3!OqJ-C3Ud~t(QOM2{dKv5I9TJ15ow08bE@Zqb zBERU#%tzI!^+d)dzDUuORVs3~0(!$NWMncWa~z=fBck`pSchNngPn;40mo9{l*fy% zD@`>oImV3yUvYha^>`V}R7MR&K1K+*-U3U*K#0ASv3QIoi2I}o1hr=^B9QcWxt<(~ zK#}{X9YWH(8fnVoW$dOY?AMxsiccWg>2WmhIYwkfUwS~^nlc=@1|F7BR< z*x-BuD+0_m&iu$=HgV>l!Q9Ci70hJq5##CXbX?WL{Vc62e&8y`5+zbLThjSaR@W1@ zK`DEpWbAvnjE#(#_N*jR$|;*e_7qLFsBOfG8W*&s0LN1qZexRbig3(Fj;DKNJG%)UC8*ZZ_B zS)HZT<>>tx@*&}IFys>L5R`f{${pH|3&H);j_fmJQrh_edWV1B0BG;cV5~QjSfZ^o z)J2p(Z1?&q&D?OmRu-u=WWzQz>gy zUpPh;8q}91HMdbMz5$KZ=&$HP;!jMkkLP$YlG^5SORC~pA*s7v5_}=nY#Ka@R+;t~ z@&lL@?w9p&hTFUUf+}2t`n{QZi;c=&RB`(T_2HCoB?`3bFhcGbF$KZ2 zGVLwQnfB`f#*&L3gq&d*Z^Ks4Y484@Yc_Os?#vahCEu`VYoM(Tj`tZxEF>cij7aKn zDYZdtOnJ*vO_(34VBLB?LEZ*+Lj4$1)O$MNSm``CkFk66J(;oh&_((tJ$c@?qh3;l ze#9yXZY~# zBa;i$8*Esa?(tGfS9ksy$_(?y^E|InsX9ng*^Sxo)@<@^8not(uVSjRoG6D65hVT(DZ^HN7W%A3kh{QBs>F(=5k2*nMn;`eKBcUhIZG# zQq3W|je4GxtHsqMPc_;_OK6kSV$l+!;$OmMO{eKg9$x`RdRx|!1HF=ZR(IxOJ4)(L z>1^@n_1FXHR#!WGs5{>*LJ7vYQc8BXR=|Qr*H%eIX`?z!ZgFG!NEjui+;f7qm8d)4 zLp6OUspsr|oF>n==`L&T#I=(8t}z9|KHM#&XR7*MulW8_P^$(Lijbwt`bL(lVkC8gzP%Xz&M!uNP4bQFT<5JfJ=GC6XsA9o6}RmKK8XOm-zX z>ay^@Kqg?NNYY2Az`l1mSj_z06!woGPGbdJhSm`;(mZaDi=QtHV}NRG#g+vreuugZw$ z{kHLsXsuJbaiea&_7sB9_~qJN;1LoJ8e)4@W;|be08GD)cSv;**sHOG5ZE6!+Oyh9 zLa!&2ph}l%+YKgP>jE+U?v(nx4{hCKqm%nCMCXX&Dl<3V1qxKye`DGR0vz`Boa86A z#B3fGB=w}E4(ZOn#z8?#W`o-3YBG0ah(fdC@{+H8V=tgCAM1U*5v2sqZbRIq0gYuL z(_S`O7qp{Xm5ya&oR6FQ*kd4!z3q5P_$Ed36VK2#a?}m(6Y?pDZ>Lzj7iy*lN;Sn` z3gNFH$nkgfqgiZwTB}A|d#XpUW0`t3u_bxIw&Oe6o0tU5WO?sv2^Xw<3Z>fRsEeVK z)z1-M$a$p_UiNf4BEk}KKyq0Bo#S4i*9ZXj1BfNWvU>#Zg5XDPEO96DFllqFglmp<=!`p!}* z`Fxp_`-=8ICQ)YY)+6{SqQb!OwLY^+GVsUSDoxGEDvpnJZ2{B_T1 z35O4@l+xrb7yB+zMOc@4z#P6z%LWY}?LVvi9Io}8hF@m%yq3t9?sMLcpk}zz@?#Pb zw*RbR?>U{AseOzJI4ge#um((PEG_&9YJ zeORC9(yqRAa>-FN#I)nsd9XXZW};@`6edc$3u0n*=OQRe>JK!iN$H2rpb&8%kxqB! zQVH5wZAG~BC@o>V^#A!kU4D)GI#+ zdiQZVF+q}Q)WAXAj^n$@iRBAyr8TQNzlVY1l&2E}?cqiyrRygg55XgKE{Qsop+LQP zb!Rh3EWep>eL-5v)t=*L^dZ+NQrUZ)e0DeD5Zwd$u9edB{*K~(y80ks{4(66X#9D) zbAoCl2MeTCugAuWol5)DmP()EDdpAec{xm(UmYcwEA(IZ6jvv4hf6wY z!x2lKmK;CK#!Kr|VLr}*n&hypE+xzXIi3$$F^B<#dsdg0K3O%f`)V>9hSaHaIk8)2 zIF7wh7%!@ykwx8CaefR5&*EK~TCYnL9|h?+_I9Zw`G6sK6oO~4VpwY44~()a;ya;n zWjv1NZKtH{Z$)XwDG37<=`tZM7`%Qkv0fD-&`u5)3<;Y+&~i@+ZJ=t-4T{Q&P(`Hx8xdKJ(?&^7Q0aDP0gDNph+&LJFkKZbMknJZ;-!e zAOLzYD}@qh;0U2`c=6E}HKTLfi+FxJ&kykY&v~x!yp!h}cz!F-SM$6Q`N&AWZ4m7b z>We^nT-nBRn;IDV~ukljcxqGY~5o2VESk!KZY`{>i-^7Zt?$D*yJ|)oiNdAmtWVXWO2nGQ$&16m81TSO1WFM6ixI}p#2J-f=leO zx|k5n@1OHcvG^s9wP^s0-; zD#Pm|qtkV{3#p7sCd=^N&Lq0ipiH`?3||UR^t9fpAlF3@ydzW{s?*xXXra{TJOedo@s20 zq-nAyuGchO#`QK#leKcacE~VP)0S4Q7bO{-VSOLRx@2vn!@rliwnsurR|j}nTTfop zbM4x-t79{U#|~U=jxVMJTn#n6pM%q68+kv6r^;Fly~n1>484BHdTi*w+xWgtzbmXJ zdkh~}fn-t0Xswwt56SjHHZdt%PBMzk`^aXaE=?!@rtbw@{Lb$NlLvltJPrz1661FZ z>-#?ap3x35|Bml+F9XTiAv-uJ<2I4}_dPbdjoEK9?w7Nj1=#Gs+9>tRQBO=CB2JNQe6&j}=wrMGbpk z%W{D^E}Ic0|B?OlaGY|c9s}JiVt-DN?Z%mW7&2N*)}zsRFIwE^@#}UEDPTTdtuG#x z1HsNkNia=%Z?7%om7+ zJA+#iG1(XP$6}EkK7VY>cD%wHHG}?8aM#5mIlMg>i-f!6Fl<;pO(PPPyMu~P@ox^{ znzDfTa9s%`6xlbeU=I2tJ;waeU`1EFVn;As5r`=j_?1`*cF7f?WfjXRj3Iq!Z&pIJ z{-^@mY9n|}#&49Lk*qNi*_MdjoCpV$U?f~0R$@D`cLkKJ3&xa$KeRTCW)X1T64r(d z=XTV02jnQJ-^>Tk*rP&=tbA#4Rn9H4Qk#gyFw&-2Bp@TO9T!^R(qP!H$d-sbmfH|F znMmwr*-y4M#pF0SC~ChmA;)$$$+6Bztjiw`U=$c7Cff7))*Cw5byK9RTVt}n1434m z3rkw~)V9JwHE|3;CW`IPZNM}e6V%d(1tOseI}D5Jv~ilfG<#0k#w{me6q zw)N(U6^li@PfPGuj_eKCY1Ou0KUkTZ0ka9kJyH82GwqOsiul5jMo6YlUGDSTjG@f=KIIxf23 z+fO2PXv^G8r!$?hGwr5SCpHPyUJI9<> zojm!>Ki~W8vEdBdcV@$IAL!w?k|Vvm9vbQA_3?ClbmZ?qpE#2oA-Q{>O%6Ydy8Nx5 zbGrPks$uFce=EV|HU?V#q&u?`kDIX?jgDP?^^2_;-YCnuX0B%5GByvK`6~BEm!mcU zOq@3Ib{1o^IC-&V+rS{_p=7aY4If0~XaKLjtcc0>6)@(ZMm1xTR9{-q>4BEcYXFz_ zO`{K+F4-f{{%QS}HcLdIO9b=QTp+TG)|$2(EnZBFZ7YfRyrP$}@9V(=gUtb?eS#J* z)tI_O6=VA;cq{<;hAjb1E7go8N+Qt+IhwB(3@&#y>S?8#^hJbV7=pBR?jX`<0!%B_ zjNLSi{HFOQ@W3W{Ty`5`li54V8f3>-6EmjFeKiPo|0C2s6MJ3z$6L*Vv|~-j3~YZH zhAjdt2NVOGxrhv-q)C1xBTCXUDNMA*6pd&ibQvL?Em1vYQS>-kV>;!(b&Tb`m>64{ zl8h-yuPlW2#xY~8+sN`BN}$K17%*ca&Dd`A>kF7s*)f~3cBYg;Lt}3uulF>@C?!y| z*ZuzUn!QaQ#)K&rtJ-2i_}^u~vB*A+JPnCX{~w^6$p_{arxH z-^_*H#=eAfoibMyHu**B?WEq#yjN97L0ftj6ArnjzDT7~N);HrXQkDOJ%=%QBDRu= zOBzi;|5CB3gaPvS{iLav?g#p(RA z#+K$gN0RM1%KPX#0XGzp8@6EqhiGtL;(Jjd?FlT=>r`&o93am(FDtxC}D#@k=d} zyU(ShQRTPrR%23@&MEg}60+CE?KSv4Wba|}Nw=XdCFNCAk)_|uu_ZqG6*ThwN@>J7 zu~e3*lbeiVR-n4gWXlN6H~|y-&gb%Rdr5{JOKGISzVp)ZIuB{l zg5P&G6HzZ?vl{CfsG}W2`%*3DW>kE^zpxDk|^ww7$g+qa3w;vl1)A&KS99j?zTu&w>nkm>J8tXP_B%RWW zxV<>nv#>q(x*;us{mR!;97+0A{t`6&v$ZUd%GaamN#z?*H6@{H&$t;jwtp*?Zv?9^ zA?n(*8sE5Xz+`2{cjoL9Lw@aif(uXI{o6);{EPhmSB zxnE}iCA-;xnb+EZBGmnE{eYe5zIUfmsUck_L^Vvq4pHa84WNc}CSWprNN47~bYd;( zR=ak~T?sbSV+TzKPNij@Y~nS#Nzg|}nVhRdKhgdJSfMfsH;vHBW8({A!e^}C{aH+y zWbg??x9py@xj&1$r&9SQkXCA#)keR297080XrjM%%H|%oxu$EYwIlfM-e3+rKK+(cvx4uDM=gJ<=`|*tn z`Zp}hK841tyC#aV|JQj&TqM^ToVOSvbL5-!**6)S!x2O5SdsIL^sz0`+?14$jeXvr zbYN1%g2{J?((bEUF|F*;j%l5zL}VoSXA^nP%|jlXC`~jc4{Mr}ic1}kquhxDKDJOP z0_{;6$ad(-E=?qr+d&-GB$1y_L1%BG5r;0RYyh`6A#n+}+RowH#{LJwN-0=Mu{sh< zQ{F}#%XLyDg%6gXz=^62IZH;PAczlW?t`` zsL7xc#Qx|wFvUf;o=G{!b=xpNqtF*ic?LZ&Qd^pU#z$3R4#pjzabq7H*6^d$Q{}}F zCTfXpkR?6Rgf8}lM%u1i1wr`XS{&|WswHb_C{~i^?N*9oR_HY`lFr=%JWEe^sy5QV_jyp`n!f=dgOe&zE-`?dsO0bO}Lc&R$=iolbTufMX(=(P_tAFFV_H5;I7(b*npTOGtc}{6Z3?AVr*bwjAhXuv^ z_Y!`nm+-+J!Y}M5{F5%=wtWvh&a3{1d38|aRbMBso(S^lU;U^axxeobRI*ze?>m4- zKQ$ghV~Ed7Sxl~;YWKwZ_VeB+$&zow5{y8O9&$gKkGt-W`x&^O#ob3z`3p?U*v|U5 zq%NH8cRv|-PpT_ed=|Ori=>*%``wesK$Of8I0jrN^jI`J#2Rr4h!yN6FDC06UY#;C z<12)mpGFsLmRI64Hb*|0J|e%29oITPjeLZg1IcO;Ew2#zI@uF5i(gvIjJ}iuvom>( z*%%L+js1Y@N9!6kAEK;=+-du%CoU){X;OAirNe_(=AQ5k&^X#oIwz?WiU)g^k`}~g zso%2(|5hVDS)@k!96pM@z63#jOg*0kJ+#o+xH*<lS9y_Ut^TyaLl_A%jYtPvdubrxJf419V8<{?@I-guS zg(>Bx(F;lX$d;QX4v`~b!&yT*@(l&m0C6rH#c5`Fy$^yB8`i457=E#r z>BU_n#f;*2Z6kS_Q*rlreA5J-@Y;#?SM1S!BIOL;hm zd;_2wa0SF>oHyaIssA98xc)-LlQc@z7nBJz|h3k5C6jw z(8-pm=fsb2nIVXc|5Fq#^#49R!D;hl-k#`0ZUAgs23Vku%JdmP66*;1j$G203%&(| zhtW5DNgqAy{C^74IitH?R!>&X66m`D?RBV$cM`haBY@16S2Fe>K#w<`xqx|q%K#04 zW&rXwdwVuc24t^*ZEt}0x6rY%ZcUwK*KZoVzxd8g2cQ1;&A&c%;SO^3>dLK~qCzCP z)f?>yi2kk7uoP((wnl``aCGa=aKyJW7~Hy12nyb)kfBRDecLgVmn(n?FctUH+ST~eG?_S) zhuaimT{C#=x!mrVJTBKWgXiILy)$`SZto0UJ(t@zlgH)ugV(8ned)J3#IR~Fr_Ir> z^jjQak8NccIrH7&pxEI9P4V?G9Hovo-*eABzU^2xn>1(ih^^-JH}d&$eMsvj-W_~? zRxpiMugc--a8a&amBU*M>!ta*LFO(r`Fp2}c&h(Pi8l;63fnZ#M!a{y^IzoIiAT9+ zCE2ZxT|qot4R~y3-XHO7z`F2dD%l>5^8RY97Y+XIXvWV^lx@{m|3x0Rf%wx4z19$Y zDqUyjgO{o2IYVFC-#Y)|d2c{FBlq?+J*zHf#%2KN&-A}Dt^bCF%(x0*NasqD+l#iv zgeTQ$yjv*Gf=9l}6cM?ZnKIPO`p=cy3s_4_RP?ooyE=uIK&UO;;uE4`B)qF77>J6< zC#*y0hze*qSc}lrDs+l1es9PZ6e9MP)^JBhIK&!OZ`^cS{rXzB)ov;A1%r$QSaerZ z6gn6yXV4lDMIq9`DlWEL1a>29i3V22bDT0-7PB)qf58`*I; zpPRG$hy91GMs6z0bOpo~(Yrk;FlHvpg;q%vT4r>73-gg2 zW8Tg{aYwXxXCPGE8WD@}pNAOe5Q>A=Vr#Lwq+jSZh17NX+}sO+aOh@kI%5ZPb%OW@ zyKl%^D~PM5NCb9zBH>m6!G1(n4~GOoUQx)f*b~|7qiG@>xmoav@Pa2IL}_^)+6|Hr z+2s);ZQ)3VH`FSu4#P$v!ivADeZ7xar*Z535y9&NlVxYak~+RI^;q7GQ7k~97Tc4( z{!91P)nMb-VF)`2i`EF+r5!tjNXC*|-5YOn*VszceV!S!-%x*E575)qbBkVEgLK66 zA3ihq5&KQ~>-2zze_L_)>zTQJ4ZmmMQ~MP@9%+%^)o<(rGY4_XwW_NlXu2CWJtVuT zLTibo&?JOf!@fXhM^)jb`kRZ(3r)D_hkV{35^GiAE+JaDYGv*mmp2*}I<^OQnV=vP zttylvp~`5hU+C~gi#r0Xk#IEJCKluKQHd*L$=%jM6Ovk>4PTyy>9dil?__j=_&qlM zRkLs_DZ+uDXUVrLwwNs?mU2st#bc?rY_T+35|(kx=a$9RrPgw5mGu_uKI;MNkoC0n zJ?n3+^GkP@#!J`P`fQKd-nRXRO|gAq%d#8oSJ;=>m)VQ#C3c71WnXQ-#lFG5#ol7y zVGrAP+GF;8_6O`guphENZGXl7bNgBQIeWHazT-+qkz=K!%dy9?*KwcYfa5X84;@#n zIJ)A$R?IJRm)%u%PuT-yKPWp`Hc<9d*}s*&Q1-L3_sTvf8!!8!Okdtv-d%pE{789E z#bXsesz_Fxs5o75u41y{cNNA;YvpZ~`zs%+e5Ufn%GWCW&hI*RIbU$T<{WmOc7EXe z#Cf%=&}DJ0bggv-T%E3%tKapY>mOZ@x}I=7?Rw7jW7khyN!N($S1!6^(N)WDIbeAh dUYW2=T0B<2)#Rvl)Hr+&zoQqH|K&x}{{fX}{38GW literal 0 HcmV?d00001 diff --git a/atomics/T1137.006/src/COPYING b/atomics/T1137.006/src/COPYING deleted file mode 100644 index cd20731c..00000000 --- a/atomics/T1137.006/src/COPYING +++ /dev/null @@ -1,12 +0,0 @@ -Copyright (c) 2015, Edward Parcell -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - -1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - -2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - -3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. \ No newline at end of file diff --git a/atomics/T1137.006/src/HelloWorldXll.sln b/atomics/T1137.006/src/HelloWorldXll.sln deleted file mode 100644 index d86a261b..00000000 --- a/atomics/T1137.006/src/HelloWorldXll.sln +++ /dev/null @@ -1,28 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio 14 -VisualStudioVersion = 14.0.24720.0 -MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HelloWorldXll", "HelloWorldXll\HelloWorldXll.vcxproj", "{0A5476B7-2700-4B0C-A72C-3054B5064E96}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|x64 = Debug|x64 - Debug|x86 = Debug|x86 - Release|x64 = Release|x64 - Release|x86 = Release|x86 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Debug|x64.ActiveCfg = Debug|x64 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Debug|x64.Build.0 = Debug|x64 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Debug|x86.ActiveCfg = Debug|Win32 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Debug|x86.Build.0 = Debug|Win32 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Release|x64.ActiveCfg = Release|x64 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Release|x64.Build.0 = Release|x64 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Release|x86.ActiveCfg = Release|Win32 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Release|x86.Build.0 = Release|Win32 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.cpp b/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.cpp deleted file mode 100644 index d6bc4bf6..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.cpp +++ /dev/null @@ -1,21 +0,0 @@ -// HelloWorldXll.cpp : Defines the exported functions for the DLL application. -// - -#include "stdafx.h" - - -short __stdcall xlAutoOpen() -{ - char *text = "Hello world"; - size_t text_len = strlen(text); - XLOPER message; - message.xltype = xltypeStr; - message.val.str = (char *)malloc(text_len + 2); - memcpy(message.val.str + 1, text, text_len + 1); - message.val.str[0] = (char)text_len; - XLOPER dialog_type; - dialog_type.xltype = xltypeInt; - dialog_type.val.w = 2; - Excel4(xlcAlert, NULL, 2, &message, &dialog_type); - return 1; -} \ No newline at end of file diff --git a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.def b/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.def deleted file mode 100644 index e1759e99..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.def +++ /dev/null @@ -1,2 +0,0 @@ -EXPORTS - xlAutoOpen diff --git a/atomics/T1137.006/src/HelloWorldXll/dllmain.cpp b/atomics/T1137.006/src/HelloWorldXll/dllmain.cpp deleted file mode 100644 index 69b58914..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/dllmain.cpp +++ /dev/null @@ -1,19 +0,0 @@ -// dllmain.cpp : Defines the entry point for the DLL application. -#include "stdafx.h" - -BOOL APIENTRY DllMain( HMODULE hModule, - DWORD ul_reason_for_call, - LPVOID lpReserved - ) -{ - switch (ul_reason_for_call) - { - case DLL_PROCESS_ATTACH: - case DLL_THREAD_ATTACH: - case DLL_THREAD_DETACH: - case DLL_PROCESS_DETACH: - break; - } - return TRUE; -} - diff --git a/atomics/T1137.006/src/HelloWorldXll/stdafx.cpp b/atomics/T1137.006/src/HelloWorldXll/stdafx.cpp deleted file mode 100644 index 5708c398..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/stdafx.cpp +++ /dev/null @@ -1,8 +0,0 @@ -// stdafx.cpp : source file that includes just the standard includes -// HelloWorldXll.pch will be the pre-compiled header -// stdafx.obj will contain the pre-compiled type information - -#include "stdafx.h" - -// TODO: reference any additional headers you need in STDAFX.H -// and not in this file diff --git a/atomics/T1137.006/src/HelloWorldXll/stdafx.h b/atomics/T1137.006/src/HelloWorldXll/stdafx.h deleted file mode 100644 index bf593989..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/stdafx.h +++ /dev/null @@ -1,15 +0,0 @@ -// stdafx.h : include file for standard system include files, -// or project specific include files that are used frequently, but -// are changed infrequently -// - -#pragma once - -#include "targetver.h" - -#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers -// Windows Header Files: -#include - -#include -#include "xlcall.h" diff --git a/atomics/T1137.006/src/HelloWorldXll/targetver.h b/atomics/T1137.006/src/HelloWorldXll/targetver.h deleted file mode 100644 index 87c0086d..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/targetver.h +++ /dev/null @@ -1,8 +0,0 @@ -#pragma once - -// Including SDKDDKVer.h defines the highest available Windows platform. - -// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and -// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. - -#include diff --git a/atomics/T1137.006/src/excelxll/excelxll.sln b/atomics/T1137.006/src/excelxll/excelxll.sln new file mode 100644 index 00000000..b04c77d4 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll.sln @@ -0,0 +1,37 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.4.33122.133 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "excelxll", "excelxll\excelxll.vcxproj", "{C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|arm64 = Debug|arm64 + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|arm64 = Release|arm64 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|arm64.ActiveCfg = Debug|arm64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|arm64.Build.0 = Debug|arm64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|x64.ActiveCfg = Debug|x64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|x64.Build.0 = Debug|x64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|x86.ActiveCfg = Debug|Win32 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|x86.Build.0 = Debug|Win32 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|arm64.ActiveCfg = Release|arm64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|arm64.Build.0 = Release|arm64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|x64.ActiveCfg = Release|x64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|x64.Build.0 = Release|x64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|x86.ActiveCfg = Release|Win32 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {75066D4B-3C40-4314-9DBD-6EAE82744BC4} + EndGlobalSection +EndGlobal diff --git a/atomics/T1137.006/src/excelxll/excelxll/dllmain.cpp b/atomics/T1137.006/src/excelxll/excelxll/dllmain.cpp new file mode 100644 index 00000000..cf04090b --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/dllmain.cpp @@ -0,0 +1,23 @@ +#include "pch.h" +#pragma comment(linker, "/EXPORT:xlAutoOpen=?xlAutoOpen@@YAXXZ") + +void xlAutoOpen() +{ + WinExec("notepad.exe", SW_SHOWNORMAL); +} + +BOOL APIENTRY DllMain(HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved +) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: + break; + } + return TRUE; +} \ No newline at end of file diff --git a/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj new file mode 100644 index 00000000..e3c80a58 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj @@ -0,0 +1,220 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + Debug + arm64 + + + Release + arm64 + + + + 16.0 + Win32Proj + {c0fff8e1-6c0f-4071-9825-3bd96f8b4d10} + excelxll + 10.0 + + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + WIN32;NDEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + + + + + + Create + Create + Create + Create + Create + Create + + + + + + \ No newline at end of file diff --git a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj.filters b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.filters similarity index 65% rename from atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj.filters rename to atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.filters index 26e577de..1e57c7b1 100644 --- a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj.filters +++ b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.filters @@ -3,11 +3,11 @@ {4FC737F1-C7A5-4376-A066-2A32D752A2FF} - cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} - h;hh;hpp;hxx;hm;inl;inc;xsd + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} @@ -15,30 +15,19 @@ - - - - + Header Files - + Header Files - - Source Files - - - Source Files - Source Files - - - + Source Files - + \ No newline at end of file diff --git a/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.user b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.user new file mode 100644 index 00000000..88a55094 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/atomics/T1137.006/src/excelxll/excelxll/framework.h b/atomics/T1137.006/src/excelxll/excelxll/framework.h new file mode 100644 index 00000000..54b83e94 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/framework.h @@ -0,0 +1,5 @@ +#pragma once + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files +#include diff --git a/atomics/T1137.006/src/excelxll/excelxll/pch.cpp b/atomics/T1137.006/src/excelxll/excelxll/pch.cpp new file mode 100644 index 00000000..64b7eef6 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/pch.cpp @@ -0,0 +1,5 @@ +// pch.cpp: source file corresponding to the pre-compiled header + +#include "pch.h" + +// When you are using pre-compiled headers, this source file is necessary for compilation to succeed. diff --git a/atomics/T1137.006/src/excelxll/excelxll/pch.h b/atomics/T1137.006/src/excelxll/excelxll/pch.h new file mode 100644 index 00000000..885d5d62 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/pch.h @@ -0,0 +1,13 @@ +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H diff --git a/atomics/T1137.006/src/readme.md b/atomics/T1137.006/src/readme.md deleted file mode 100644 index 9f82d7ee..00000000 --- a/atomics/T1137.006/src/readme.md +++ /dev/null @@ -1,70 +0,0 @@ -# Hello World XLL - -This is a simple XLL, showing how to create an XLL from scratch. - -## Requirements - -* A 64-bit version of Excel -* [Microsoft Visual Studio 2015 Community Edition](https://www.visualstudio.com/en-us/products/visual-studio-community-vs.aspx) -* [The Excel 2010 SDX](https://www.microsoft.com/en-us/download/details.aspx?id=20199). Instructions assume this is installed at C:\2010 Office System Developer Resources\Excel2010XLLSDK - -## Reference - -For further details on creating XLLs, dealing with XLOPERs and correct memory handling, I recommend Steve Dalton's excellent [Financial Applications using Excel Add-in Development in C/C++](http://www.amazon.com/Financial-Applications-using-Excel-Development/dp/0470027975) - -## Build and Load Instructions - -Instructions assume the solution is at "C:\Users\Jameson\Documents\Visual Studio 2015\Projects\HelloWorldXll\HelloWorldXll.sln". Adjust the steps below according to the location your cloned this project on your system. - -- Load the solution in Visual Studio. -- Build the solution (Menu: Build... Build Solution) -- In Excel, open the Add-Ins dialog (this can be done quickly with Alt-T, I) -- Click "Browse..." -- Select the XLL at "C:\Users\Jameson\Documents\Visual Studio 2015\Projects\HelloWorldXll\x64\Debug\HelloWorldXll.xll". Click OK. -- If Excel asks "A file name '...' already exists in this location. Do you want to replace it?", click Yes. -- Click Ok. -- Excel should display a dialog that says "Hello world". This is from the XLL. Click OK to dismiss the dialog. - -## Creation instructions - -- Create a new solution (Mone: File... New... Project) -- In Templates... Other Languages... Visual C++ select Win32. Select Win32 Project. Set Name to "HelloWorldXll". Set Solution name to "HelloWorldXll". Ensure "Create directory for solution" is checked. Click OK. Note: These instructions assume the Location is set to "C:\Users\Jameson\Documents\Visual Studio 2015\Projects". Adjust the steps below according to the location you use. -- Click Next at the Overview page. -- Select Application type "DLL". Clear the checkboxes for Precompiled header and Security Development Lifecycle. Click Finish. -- In the Solution Explorer, right click the HelloWorldXll and select Properties. -- Select Configuration "All Configurations" and Platform "x64". -- In Configuration Properties...General, Set Target Extension to ".xll". -- In Configuration Properties...C/C++...General, select "Additional Include Directories", click the dropdown arrow on the right, select "Edit...". In the Additional Include Directories dialog, click the New Line icon (it looks like a folder with a red star, in the top-right corner of the window). This will create a new line in the top input box (the ungreyed one). Click the "..." button on the right of that line, which will open a Select Directory dialog. Navigate to "C:\2010 Office System Developer Resources\Excel2010XLLSDK\INCLUDE" and click "Select Folder". Click OK to set the Additional Include Directories. -- In Configuration Proporties...Linker..Input, edit the "Additional Dependencies" as with the previous step. In the top edit box (the ungreyed one), add the text "C:\2010 Office System Developer Resources\Excel2010XLLSDK\LIB\x64\XLCALL32.LIB". Click OK to set the Additional Dependencies. -- In stdafx.h, add the following lines at the end of the file: -```c -#include -#include "xlcall.h" -``` -- In HelloWorldXll.cpp add the following lines at the end of the file: -```c -short __stdcall xlAutoOpen() -{ - char *text= "Hello world"; - size_t text_len = strlen(text); - XLOPER message; - message.xltype = xltypeStr; - message.val.str = (char *)malloc(text_len + 2); - memcpy(message.val.str + 1, text, text_len + 1); - message.val.str[0] = (char)text_len; - XLOPER dialog_type; - dialog_type.xltype = xltypeInt; - dialog_type.val.w = 2; - Excel4(xlcAlert, NULL, 2, &message, &dialog_type); - return 1; -} -``` -- In the Solution Explorer, right click the HelloWorldXll and select Add..New Item. -- In the Add New Item dialog, in the tree on the left, select Visual C++... Code. Then select Module-Definition File (.def). Set Name to "HelloWorldXll.def". Click Add. -- Change the contents of HelloWorldXll.def to: -``` -EXPORTS - xlAutoOpen -``` - -The solution is now ready to build and load using the instructions above. diff --git a/atomics/T1137.006/src/wordwll/wordwll.sln b/atomics/T1137.006/src/wordwll/wordwll.sln new file mode 100644 index 00000000..09876d1a --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll.sln @@ -0,0 +1,37 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.4.33122.133 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "wordwll", "wordwll\wordwll.vcxproj", "{224BEC9E-0E52-4718-A47F-D8BE31A400C3}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|arm64 = Debug|arm64 + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|arm64 = Release|arm64 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|arm64.ActiveCfg = Debug|arm64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|arm64.Build.0 = Debug|arm64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|x64.ActiveCfg = Debug|x64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|x64.Build.0 = Debug|x64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|x86.ActiveCfg = Debug|Win32 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|x86.Build.0 = Debug|Win32 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|arm64.ActiveCfg = Release|arm64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|arm64.Build.0 = Release|arm64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|x64.ActiveCfg = Release|x64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|x64.Build.0 = Release|x64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|x86.ActiveCfg = Release|Win32 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {1AB94236-2120-44B9-8EF8-0FECAD2CFB2B} + EndGlobalSection +EndGlobal diff --git a/atomics/T1137.006/src/wordwll/wordwll/dllmain.cpp b/atomics/T1137.006/src/wordwll/wordwll/dllmain.cpp new file mode 100644 index 00000000..af8ab633 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/dllmain.cpp @@ -0,0 +1,30 @@ +#include "pch.h" +#include +#include + +BOOL APIENTRY DllMain(HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved +) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: { + //MessageBoxA(NULL, "aaa", "bbb", MB_OK); + system("start notepad.exe"); + + } + case DLL_THREAD_ATTACH: + system("start notepad.exe"); + case DLL_THREAD_DETACH: + system("start notepad.exe"); + case DLL_PROCESS_DETACH: { + system("start notepad.exe"); + break; } + } + return TRUE; +} + + + //WinExec("notepad.exe", SW_SHOWNORMAL); + //MessageBoxA(NULL, "test", "test", MB_OK); diff --git a/atomics/T1137.006/src/wordwll/wordwll/framework.h b/atomics/T1137.006/src/wordwll/wordwll/framework.h new file mode 100644 index 00000000..54b83e94 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/framework.h @@ -0,0 +1,5 @@ +#pragma once + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files +#include diff --git a/atomics/T1137.006/src/wordwll/wordwll/pch.cpp b/atomics/T1137.006/src/wordwll/wordwll/pch.cpp new file mode 100644 index 00000000..64b7eef6 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/pch.cpp @@ -0,0 +1,5 @@ +// pch.cpp: source file corresponding to the pre-compiled header + +#include "pch.h" + +// When you are using pre-compiled headers, this source file is necessary for compilation to succeed. diff --git a/atomics/T1137.006/src/wordwll/wordwll/pch.h b/atomics/T1137.006/src/wordwll/wordwll/pch.h new file mode 100644 index 00000000..885d5d62 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/pch.h @@ -0,0 +1,13 @@ +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H diff --git a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj similarity index 57% rename from atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj rename to atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj index 2252a3a1..a8bf5736 100644 --- a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj +++ b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj @@ -1,5 +1,5 @@ - - + + Debug @@ -17,37 +17,59 @@ Release x64 + + Debug + arm64 + + + Release + arm64 + - {0A5476B7-2700-4B0C-A72C-3054B5064E96} + 16.0 Win32Proj - HelloWorldXll - 8.1 + {224bec9e-0e52-4718-a47f-d8be31a400c3} + wordwll + 10.0 DynamicLibrary true - v140 + v143 Unicode DynamicLibrary false - v140 + v143 true Unicode DynamicLibrary true - v140 + v143 Unicode DynamicLibrary false - v140 + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 true Unicode @@ -68,122 +90,130 @@ + + + + + + - - true - - - true - .xll - - - false - - - false - .xll - - Use Level3 - Disabled - WIN32;_DEBUG;_WINDOWS;_USRDLL;HELLOWORLDXLL_EXPORTS;%(PreprocessorDefinitions) true + WIN32;_DEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h Windows true - HelloWorldXll.def - - - - - Use - Level3 - Disabled - _DEBUG;_WINDOWS;_USRDLL;HELLOWORLDXLL_EXPORTS;%(PreprocessorDefinitions) - true - C:\2010 Office System Developer Resources\Excel2010XLLSDK\INCLUDE;%(AdditionalIncludeDirectories) - - - Windows - true - C:\2010 Office System Developer Resources\Excel2010XLLSDK\LIB\x64\XLCALL32.LIB;%(AdditionalDependencies) - HelloWorldXll.def + false Level3 - Use - MaxSpeed true true - WIN32;NDEBUG;_WINDOWS;_USRDLL;HELLOWORLDXLL_EXPORTS;%(PreprocessorDefinitions) true + WIN32;NDEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h Windows true true true - HelloWorldXll.def + false + + + + + Level3 + true + _DEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false Level3 - Use - MaxSpeed true true - NDEBUG;_WINDOWS;_USRDLL;HELLOWORLDXLL_EXPORTS;%(PreprocessorDefinitions) true - C:\2010 Office System Developer Resources\Excel2010XLLSDK\INCLUDE;%(AdditionalIncludeDirectories) + NDEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h Windows true true true - C:\2010 Office System Developer Resources\Excel2010XLLSDK\LIB\x64\XLCALL32.LIB;%(AdditionalDependencies) - HelloWorldXll.def + false + + + + + Level3 + true + _DEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false - + + - - - - - - false - - - false - - - false - - - false - - - - - - Create + + Create + Create + Create Create + Create Create - - - diff --git a/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.filters b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.filters new file mode 100644 index 00000000..1e57c7b1 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.filters @@ -0,0 +1,33 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + Header Files + + + + + Source Files + + + Source Files + + + \ No newline at end of file diff --git a/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.user b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.user new file mode 100644 index 00000000..88a55094 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file