From aa709b2d23c1d2f6c04a2fa877c71caedad612ef Mon Sep 17 00:00:00 2001
From: Avihay Eldad <46644022+avihayeldad@users.noreply.github.com>
Date: Tue, 30 Apr 2024 14:44:28 +0300
Subject: [PATCH 1/2] Add Winfile.yml

---
 yml/OSBinaries/Winfile.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 yml/OSBinaries/Winfile.yml

diff --git a/yml/OSBinaries/Winfile.yml b/yml/OSBinaries/Winfile.yml
new file mode 100644
index 00000000..c7108e55
--- /dev/null
+++ b/yml/OSBinaries/Winfile.yml
@@ -0,0 +1,24 @@
+---
+Name: Winfile.exe
+Description: Windows File Manager Executable.
+Author: Avihay Eldad
+Created: 2024-04-30
+Commands:
+  - Command: Winfile.exe calc.exe
+    Description: Execute an executable file with Winfile as a parent process.
+    Usecase: Performs execution of specified file, can be used as a defense evasion
+    Category: Execute
+    Privileges: User
+    MitreID: T1202
+    OperatingSystem: Windows
+Full_Path:
+  - Path: C:\Windows\System32\Winfile.exe
+  - Path: C:\Windows\Winfile.exe
+  - Path: C:\Program Files\Winfile\Winfile.exe
+  - Path: C:\Program Files (x86)\Winfile\Winfile.exe
+  - Path: C:\Program Files\WindowsApps\Microsoft.WindowsFileManager_10.3.0.0_x64__8wekyb3d8bbwe\Winfile\Winfile.exe
+Resources:
+  - Link: https://github.com/microsoft/winfile
+Acknowledgement:
+  - Person: Avihay Eldad
+    Handle: '@AvihayEldad'

From 2b3189542b8fe4107a58afacd92f56c4beced680 Mon Sep 17 00:00:00 2001
From: Wietze <wietze@users.noreply.github.com>
Date: Wed, 22 May 2024 23:59:07 +0100
Subject: [PATCH 2/2] Minor changes

---
 yml/OSBinaries/Winfile.yml      | 24 ------------------------
 yml/OtherMSBinaries/winfile.yml | 24 ++++++++++++++++++++++++
 2 files changed, 24 insertions(+), 24 deletions(-)
 delete mode 100644 yml/OSBinaries/Winfile.yml
 create mode 100644 yml/OtherMSBinaries/winfile.yml

diff --git a/yml/OSBinaries/Winfile.yml b/yml/OSBinaries/Winfile.yml
deleted file mode 100644
index c7108e55..00000000
--- a/yml/OSBinaries/Winfile.yml
+++ /dev/null
@@ -1,24 +0,0 @@
----
-Name: Winfile.exe
-Description: Windows File Manager Executable.
-Author: Avihay Eldad
-Created: 2024-04-30
-Commands:
-  - Command: Winfile.exe calc.exe
-    Description: Execute an executable file with Winfile as a parent process.
-    Usecase: Performs execution of specified file, can be used as a defense evasion
-    Category: Execute
-    Privileges: User
-    MitreID: T1202
-    OperatingSystem: Windows
-Full_Path:
-  - Path: C:\Windows\System32\Winfile.exe
-  - Path: C:\Windows\Winfile.exe
-  - Path: C:\Program Files\Winfile\Winfile.exe
-  - Path: C:\Program Files (x86)\Winfile\Winfile.exe
-  - Path: C:\Program Files\WindowsApps\Microsoft.WindowsFileManager_10.3.0.0_x64__8wekyb3d8bbwe\Winfile\Winfile.exe
-Resources:
-  - Link: https://github.com/microsoft/winfile
-Acknowledgement:
-  - Person: Avihay Eldad
-    Handle: '@AvihayEldad'
diff --git a/yml/OtherMSBinaries/winfile.yml b/yml/OtherMSBinaries/winfile.yml
new file mode 100644
index 00000000..f0171ed3
--- /dev/null
+++ b/yml/OtherMSBinaries/winfile.yml
@@ -0,0 +1,24 @@
+---
+Name: winfile.exe
+Description: Windows File Manager executable
+Author: Avihay Eldad
+Created: 2024-04-30
+Commands:
+  - Command: winfile.exe calc.exe
+    Description: Execute an executable file with WinFile as a parent process.
+    Usecase: Performs execution of specified file, can be used as a defense evasion
+    Category: Execute
+    Privileges: User
+    MitreID: T1202
+    OperatingSystem: Windows 10, Windows 11
+Full_Path:
+  - Path: C:\Windows\System32\winfile.exe
+  - Path: C:\Windows\winfile.exe
+  - Path: C:\Program Files\WinFile\winfile.exe
+  - Path: C:\Program Files (x86)\WinFile\winfile.exe
+  - Path: C:\Program Files\WindowsApps\Microsoft.WindowsFileManager_10.3.0.0_x64__8wekyb3d8bbwe\WinFile\winfile.exe
+Resources:
+  - Link: https://github.com/microsoft/winfile
+Acknowledgement:
+  - Person: Avihay Eldad
+    Handle: '@AvihayEldad'