Difference between revisions of "Expand"
Jump to navigation
Jump to search
| Line 357: | Line 357: | ||
|- | |- | ||
| [[Type_Windows_XML_Event_Log]] | | [[Type_Windows_XML_Event_Log]] | ||
| − | | [[Entity Table|Artifacts]], [[Event Table|Events]], Files | + | | [[Entity Table|Artifacts]], [[Event Table|Events]], Files, [[#Event Log Records|Supported Record Numbers]] |
|} | |} | ||
Revision as of 15:44, 22 July 2020
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
Event Log Records
Expand processes the following event log record numbers
| ID | Description |
|---|---|
| 21 | |
| 22 | |
| 25 | |
| 300 | |
| 600 | |
| 1001 | |
| 1002 | |
| 1006 | |
| 1102 | |
| 1149 | |
| 2003 | |
| 2102 | |
| 2104 | |
| 4616 | |
| 4624 | |
| 4663 | |
| 6100 | |
| 7045 | |
| 8001 | |
| 8003 | |
| 11001 | |
| 20001 | |
| 20003 | |
| 24576 | |
| 24577 | |
| 24578 | |
| 50067 |
