Expand

Details

Executable	Expand.exe
Stage	3
Percent Complete	48%
Message Queue	expand

Expand is the most capable exploitation process. It produces files and artifacts.

Capabilities

Expand exploits the following file types.

File Type	Produces
Type_Physical_Artifacts	Artifacts
Type_ASCII_Text	File Details
Type_JPEG	Artifacts, File Details
Type_JPEGWithExif	Artifacts, EXIF, File Details
Type_GIF	File Details
Type_PE	File Details
Type_ZIP	Files, File Details
Type_32bit_Windows_Executable	Files, File Details
Type_64bit_Windows_Executable	Files, File Details
Type_ROM_Windows_Executable	Files, File Details
Type_Word_2007	Artifacts, File Details
Type_Excel_2007	Artifacts, File Details
Type_PowerPoint_2007	Artifacts, File Details
Type_Microsoft_ESE	File Details
Type_MPEG4Video	Artifacts, EXIF, File Details, Locations
Type_Adobe_PDF	Artifacts
Type_Internet_Explorer_History	Artifacts, File Details
Type_SQLite_Database	Artifacts, Files, File Details
Type_PNG	File Details
Type_Firefox_Form_History	Artifacts, File Details
Type_Firefox_Downloads	File Details
Type_Firefox_Web_Sites_Visited	Artifacts, File Details
Type_Chrome_Archived_History	File Details
Type_Chrome_Cookies	File Details
Type_Chrome_History	Artifacts, File Details
Type_Chrome_History_Index	File Details
Type_Chrome_Thumbnails	File Details
Type_Chrome_Web_Data	File Details
Type_Zip_Fragment	Files, File Details
Type_RichText	Artifacts, File Details
Type_Java_Archive	Files, File Details
Type_XP_Prefetch	Artifacts, File Details
Type_Vista7_Prefetch	Artifacts, File Details
Type_Binary_PList	Files
Type_3GP_Video	File Details
Type_BZip_Archive	Files
Type_TrueType_Font	File Details
Type_OpenType_Font	File Details
Type_KMZ	File Details
Type_Flash_Cookie	File Details
Type_Apple_Addressbook_Thumbnails	Files, File Details
Type_iOS_Locations	File Details, Locations
Type_ZIP_Code_Database	File Details
Type_Bible_Database	File Details
Type_ATT_Mark_The_Spot_Database	File Details, Locations
Type_Shazam_Database	File Details, Locations
Type_Apple_Calendar_Database	Events, File Details
Type_Ancestry_Database	File Details
Type_iOS_SMS	Messages, File Details
Type_iOS_Call_History	Events, File Details
Type_Skype_Main	Artifacts, Events, File Details
Type_3G2_Video	File Details
Type_GZip	Files
Type_Bitmap_Image	File Details
Type_TIFF	EXIF
Type_Cellebrite_1	Artifacts, Events, Locations, Messages
Type_Cellebrite_2	Artifacts, Events, Locations, Messages, URLs
Type_MPEG2Video	EXIF
Type_Windows_Registry	File Details
Type_SAM_Registry	File Details
Type_System_Registry	File Details
Type_Boot_Registry	File Details
Type_User_Registry	File Details
Type_Software_Registry	File Details
Type_Vista7_Thumbnail_Cache	Files
Type_Microsoft_Cabinet	Files
Type_Adobe_Flash_Video_New	File Details
Type_Evernote_Database	File Details
Type_vCard	Artifacts
Type_vCard_Unicode	Artifacts
Type_xCard	Artifacts
Type_Ogg_Theora	File Details
Type_Encrypted_ZIP	File Details
Type_Outlook_Personal_Folders	File Details
Type_Torrent	File Details
Type_Setup_API_Log	Artifacts, Events
Type_QuickTime_Container	File Details
Type_Digital_Media_Broadcasting	File Details
Type_Digital_Media_Protection	File Details
Type_Dirac_Video	File Details
Type_Digital_Video_Broadcast	File Details
Type_JPEG_2000	File Details
Type_AAC_Audio	File Details
Type_AAC_Audio_Book	File Details
Type_Motion_JPEG	File Details
Type_MPEG_21	File Details
Type_MPEG_7	File Details
Type_QuickTime_Video	File Details, Locations
Type_QuickTime_Cache	File Details
Type_Safari_Cache	File Details
Type_XRY_XML_File	Artifacts, Events, Locations, Messages, URLs
Type_Apple_Voicemail_Database	Artifacts, Events, File Details
Type_Apple_Find_My_iPhone_Database	File Details, Locations
Type_Windows_Link	Artifacts, File Details, URLs
Type_Precompiled_INF	File Details
Type_ELF_Executable	File Details
Type_Firefox_Offline_Cache	Files, File Details, URLs
Type_Microsoft_DPAPI_Key	File Details
Type_Recycle_Bin_INFO2	Events, File Details