From 3a3d28e49683912fc606f15fd4552df5dc591c47 Mon Sep 17 00:00:00 2001
From: LuxNoBu!!shit <51244609+LuxNoBulIshit@users.noreply.github.com>
Date: Sat, 8 Aug 2020 14:59:15 +0300
Subject: [PATCH 1/4] Update Extrac32.yml

another use case for extrace32.
---
 yml/OSBinaries/Extrac32.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/yml/OSBinaries/Extrac32.yml b/yml/OSBinaries/Extrac32.yml
index e243ed2..a19db9c 100644
--- a/yml/OSBinaries/Extrac32.yml
+++ b/yml/OSBinaries/Extrac32.yml
@@ -28,6 +28,14 @@ Commands:
     MitreID: T1105
     MitreLink: https://attack.mitre.org/wiki/Technique/T1105
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\*\Desktop\calc.exe
+    Description: Command for copying calc.exe to another folder
+    Usecase: Copy file
+    Category: Copy
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full_Path:
   - Path: C:\Windows\System32\extrac32.exe
   - Path: C:\Windows\SysWOW64\extrac32.exe
@@ -40,8 +48,10 @@ Resources:
   - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
   - Link: https://twitter.com/egre55/status/985994639202283520
 Acknowledgement:
+  - Person: Hai Vaknin(Lux) https://github.com/LuxNoBulIshit
+  - Person: Tamir Yehuda https://github.com/tamirye
   - Person: egre55
     Handle: '@egre55'
   - Person: Oddvar Moe
     Handle: '@oddvarmoe'
----
\ No newline at end of file
+---

From 2450b9fc0abad0f9c4f93fe47d350df3610b962f Mon Sep 17 00:00:00 2001
From: LuxNoBu!!shit <51244609+LuxNoBulIshit@users.noreply.github.com>
Date: Sat, 8 Aug 2020 15:01:46 +0300
Subject: [PATCH 2/4] Update Extrac32.yml

---
 yml/OSBinaries/Extrac32.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/yml/OSBinaries/Extrac32.yml b/yml/OSBinaries/Extrac32.yml
index a19db9c..2e00049 100644
--- a/yml/OSBinaries/Extrac32.yml
+++ b/yml/OSBinaries/Extrac32.yml
@@ -49,7 +49,9 @@ Resources:
   - Link: https://twitter.com/egre55/status/985994639202283520
 Acknowledgement:
   - Person: Hai Vaknin(Lux) https://github.com/LuxNoBulIshit
+  - handle: @VakninHai
   - Person: Tamir Yehuda https://github.com/tamirye
+  - handle: @tim8288
   - Person: egre55
     Handle: '@egre55'
   - Person: Oddvar Moe

From be19ca53ed9476a23785039802f4938edc023cf0 Mon Sep 17 00:00:00 2001
From: LuxNoBu!!shit <51244609+LuxNoBulIshit@users.noreply.github.com>
Date: Sat, 8 Aug 2020 15:02:05 +0300
Subject: [PATCH 3/4] Update Extrac32.yml

---
 yml/OSBinaries/Extrac32.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/yml/OSBinaries/Extrac32.yml b/yml/OSBinaries/Extrac32.yml
index 2e00049..7b913cb 100644
--- a/yml/OSBinaries/Extrac32.yml
+++ b/yml/OSBinaries/Extrac32.yml
@@ -48,12 +48,12 @@ Resources:
   - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
   - Link: https://twitter.com/egre55/status/985994639202283520
 Acknowledgement:
-  - Person: Hai Vaknin(Lux) https://github.com/LuxNoBulIshit
-  - handle: @VakninHai
-  - Person: Tamir Yehuda https://github.com/tamirye
-  - handle: @tim8288
   - Person: egre55
     Handle: '@egre55'
   - Person: Oddvar Moe
     Handle: '@oddvarmoe'
+      - Person: Hai Vaknin(Lux) https://github.com/LuxNoBulIshit
+  - handle: @VakninHai
+  - Person: Tamir Yehuda https://github.com/tamirye
+  - handle: @tim8288
 ---

From 631996950ab24390e0c5b740a298840b34eb34ee Mon Sep 17 00:00:00 2001
From: Oddvar Moe <oddvar.moe@gmail.com>
Date: Sat, 15 Aug 2020 00:05:16 +0200
Subject: [PATCH 4/4] Update Extrac32.yml

---
 yml/OSBinaries/Extrac32.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/yml/OSBinaries/Extrac32.yml b/yml/OSBinaries/Extrac32.yml
index 7b913cb..faa25ea 100644
--- a/yml/OSBinaries/Extrac32.yml
+++ b/yml/OSBinaries/Extrac32.yml
@@ -28,7 +28,7 @@ Commands:
     MitreID: T1105
     MitreLink: https://attack.mitre.org/wiki/Technique/T1105
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
-  - Command: extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\*\Desktop\calc.exe
+  - Command: extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\user\Desktop\calc.exe
     Description: Command for copying calc.exe to another folder
     Usecase: Copy file
     Category: Copy