Difference between revisions of "Expand"

From truxwiki.com
Jump to navigation Jump to search
Line 26: Line 26:
 
|-
 
|-
 
| [[Type_Physical_Artifacts]]
 
| [[Type_Physical_Artifacts]]
−
| Artifacts
+
| [[Entity Table|Artifacts]]
 
|-
 
|-
 
| [[Type_ASCII_Text]]
 
| [[Type_ASCII_Text]]
Line 32: Line 32:
 
|-
 
|-
 
| [[Type_JPEG]]
 
| [[Type_JPEG]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_JPEGWithExif]]
 
| [[Type_JPEGWithExif]]
−
| Artifacts, [[EXIF Table|EXIF]], [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_GIF]]
 
| [[Type_GIF]]
Line 56: Line 56:
 
|-
 
|-
 
| [[Type_Word_2007]]
 
| [[Type_Word_2007]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_Excel_2007]]
 
| [[Type_Excel_2007]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_PowerPoint_2007]]
 
| [[Type_PowerPoint_2007]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_Microsoft_ESE]]
 
| [[Type_Microsoft_ESE]]
Line 68: Line 68:
 
|-
 
|-
 
| [[Type_MPEG4Video]]
 
| [[Type_MPEG4Video]]
−
| Artifacts, [[EXIF Table|EXIF]], [[Type_File_Details|File Details]], [[Location Table|Locations]]
+
| [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]], [[Location Table|Locations]]
 
|-
 
|-
 
| [[Type_Adobe_PDF]]
 
| [[Type_Adobe_PDF]]
−
| Artifacts
+
| [[Entity Table|Artifacts]]
 
|-
 
|-
 
| [[Type_Internet_Explorer_History]]
 
| [[Type_Internet_Explorer_History]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_SQLite_Database]]
 
| [[Type_SQLite_Database]]
−
| Artifacts, Files, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_PNG]]
 
| [[Type_PNG]]
Line 83: Line 83:
 
|-
 
|-
 
| [[Type_Firefox_Form_History]]
 
| [[Type_Firefox_Form_History]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_Firefox_Downloads]]
 
| [[Type_Firefox_Downloads]]
Line 89: Line 89:
 
|-
 
|-
 
| [[Type_Firefox_Web_Sites_Visited]]
 
| [[Type_Firefox_Web_Sites_Visited]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_Chrome_Archived_History]]
 
| [[Type_Chrome_Archived_History]]
Line 98: Line 98:
 
|-
 
|-
 
| [[Type_Chrome_History]]
 
| [[Type_Chrome_History]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_Chrome_History_Index]]
 
| [[Type_Chrome_History_Index]]
Line 113: Line 113:
 
|-
 
|-
 
| [[Type_RichText]]
 
| [[Type_RichText]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_Java_Archive]]
 
| [[Type_Java_Archive]]
Line 119: Line 119:
 
|-
 
|-
 
| [[Type_XP_Prefetch]]
 
| [[Type_XP_Prefetch]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_Vista7_Prefetch]]
 
| [[Type_Vista7_Prefetch]]
−
| Artifacts, [[Type_File_Details|File Details]]
+
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]]
 
|-
 
|-
 
| [[Type_Binary_PList]]
 
| [[Type_Binary_PList]]
Line 140: Line 140:
 
|-
 
|-
 
| [[Type_KMZ]]
 
| [[Type_KMZ]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Flash_Cookie]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Apple_Addressbook_Thumbnails]]
 +
| Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_iOS_Locations]]
 +
| [[Type_File_Details|File Details]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_ZIP_Code_Database]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Bible_Database]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_ATT_Mark_The_Spot_Database]]
 +
| [[Type_File_Details|File Details]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_Shazam_Database]]
 +
| [[Type_File_Details|File Details]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_Apple_Calendar_Database]]
 +
| [[Event Table|Events]], [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Ancestry_Database]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_iOS_SMS]]
 +
| Messages, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_iOS_Call_History]]
 +
| [[Event Table|Events]], [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Skype_Main]]
 +
| [[Entity Table|Artifacts]], [[Event Table|Events]], [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_3G2_Video]]
 
| [[Type_File_Details|File Details]]
 
| [[Type_File_Details|File Details]]
 
|}
 
|}

Revision as of 11:25, 22 July 2020

Details
Executable Expand.exe
Stage 3
Percent Complete 48%
Message Queue expand

Expand is the most capable exploitation process. It produces files and artifacts.

Capabilities

Expand exploits the following file types.

File Type Produces
Type_Physical_Artifacts Artifacts
Type_ASCII_Text File Details
Type_JPEG Artifacts, File Details
Type_JPEGWithExif Artifacts, EXIF, File Details
Type_GIF File Details
Type_PE File Details
Type_ZIP Files, File Details
Type_32bit_Windows_Executable Files, File Details
Type_64bit_Windows_Executable Files, File Details
Type_ROM_Windows_Executable Files, File Details
Type_Word_2007 Artifacts, File Details
Type_Excel_2007 Artifacts, File Details
Type_PowerPoint_2007 Artifacts, File Details
Type_Microsoft_ESE File Details
Type_MPEG4Video Artifacts, EXIF, File Details, Locations
Type_Adobe_PDF Artifacts
Type_Internet_Explorer_History Artifacts, File Details
Type_SQLite_Database Artifacts, Files, File Details
Type_PNG File Details
Type_Firefox_Form_History Artifacts, File Details
Type_Firefox_Downloads File Details
Type_Firefox_Web_Sites_Visited Artifacts, File Details
Type_Chrome_Archived_History File Details
Type_Chrome_Cookies File Details
Type_Chrome_History Artifacts, File Details
Type_Chrome_History_Index File Details
Type_Chrome_Thumbnails File Details
Type_Chrome_Web_Data File Details
Type_Zip_Fragment Files, File Details
Type_RichText Artifacts, File Details
Type_Java_Archive Files, File Details
Type_XP_Prefetch Artifacts, File Details
Type_Vista7_Prefetch Artifacts, File Details
Type_Binary_PList Files
Type_3GP_Video File Details
Type_BZip_Archive Files
Type_TrueType_Font File Details
Type_OpenType_Font File Details
Type_KMZ File Details
Type_Flash_Cookie File Details
Type_Apple_Addressbook_Thumbnails Files, File Details
Type_iOS_Locations File Details, Locations
Type_ZIP_Code_Database File Details
Type_Bible_Database File Details
Type_ATT_Mark_The_Spot_Database File Details, Locations
Type_Shazam_Database File Details, Locations
Type_Apple_Calendar_Database Events, File Details
Type_Ancestry_Database File Details
Type_iOS_SMS Messages, File Details
Type_iOS_Call_History Events, File Details
Type_Skype_Main Artifacts, Events, File Details
Type_3G2_Video File Details
Retrieved from "https://truxwiki.com/index.php?title=Expand&oldid=2025"