From 3a3d28e49683912fc606f15fd4552df5dc591c47 Mon Sep 17 00:00:00 2001
From: LuxNoBu!!shit <51244609+LuxNoBulIshit@users.noreply.github.com>
Date: Sat, 8 Aug 2020 14:59:15 +0300
Subject: [PATCH] Update Extrac32.yml

another use case for extrace32.
---
 yml/OSBinaries/Extrac32.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/yml/OSBinaries/Extrac32.yml b/yml/OSBinaries/Extrac32.yml
index e243ed2..a19db9c 100644
--- a/yml/OSBinaries/Extrac32.yml
+++ b/yml/OSBinaries/Extrac32.yml
@@ -28,6 +28,14 @@ Commands:
     MitreID: T1105
     MitreLink: https://attack.mitre.org/wiki/Technique/T1105
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\*\Desktop\calc.exe
+    Description: Command for copying calc.exe to another folder
+    Usecase: Copy file
+    Category: Copy
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full_Path:
   - Path: C:\Windows\System32\extrac32.exe
   - Path: C:\Windows\SysWOW64\extrac32.exe
@@ -40,8 +48,10 @@ Resources:
   - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
   - Link: https://twitter.com/egre55/status/985994639202283520
 Acknowledgement:
+  - Person: Hai Vaknin(Lux) https://github.com/LuxNoBulIshit
+  - Person: Tamir Yehuda https://github.com/tamirye
   - Person: egre55
     Handle: '@egre55'
   - Person: Oddvar Moe
     Handle: '@oddvarmoe'
----
\ No newline at end of file
+---