Difference between revisions of "Expand"
Jump to navigation
Jump to search
| Line 18: | Line 18: | ||
=Capabilities= | =Capabilities= | ||
| − | Expand | + | ==File Types== |
| + | Expand processes the following types of files. | ||
{| class="wikitable" | {| class="wikitable" | ||
| Line 357: | Line 358: | ||
| [[Type_Windows_XML_Event_Log]] | | [[Type_Windows_XML_Event_Log]] | ||
| [[Entity Table|Artifacts]], [[Event Table|Events]], Files | | [[Entity Table|Artifacts]], [[Event Table|Events]], Files | ||
| + | |} | ||
| + | |||
| + | ==Event Log Records== | ||
| + | Expand processes the following event log record numbers | ||
| + | |||
| + | |||
| + | {| class="wikitable" | ||
| + | |- | ||
| + | ! ID | ||
| + | |- | ||
| + | | 21 | ||
| + | |- | ||
| + | | 22 | ||
|} | |} | ||
Revision as of 15:38, 22 July 2020
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
Event Log Records
Expand processes the following event log record numbers
| ID |
|---|
| 21 |
| 22 |
