Difference between revisions of "Expand"
Jump to navigation
Jump to search
| Line 477: | Line 477: | ||
|- | |- | ||
| [[Type_Limewire_Properties]] | | [[Type_Limewire_Properties]] | ||
| − | | [[Entity Table|Artifacts]], [[Location Table|Locations]] | + | | [[Entity Table|Artifacts]], [[Location Table|Locations]] |
|- | |- | ||
| [[Type_Apple_Note_Database]] | | [[Type_Apple_Note_Database]] | ||
| [[Event Table|Events]], Files, [[Type_File_Details|File Details]] | | [[Event Table|Events]], Files, [[Type_File_Details|File Details]] | ||
| + | |- | ||
| + | | [[Type_ipconfig_Report]] | ||
| + | | [[Entity Table|Artifacts]] | ||
| + | |- | ||
| + | | [[Type_UUEncoded_Data]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Base64_Encoded_Data]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_TIFFWithExif]] | ||
| + | | [[Entity Table|Artifacts]], [[EXIF Table|EXIF]] | ||
| + | |- | ||
| + | | [[Type_Firefox_Signons]] | ||
| + | | [[Event Table|Events]], [[Type_File_Details|File Details]], [[WebsiteVisit Table|URLs]] | ||
| + | |- | ||
| + | | [[Type_Firefox_Cookies]] | ||
| + | | [[Type_File_Details|File Details]] | ||
| + | |- | ||
| + | | [[Type_Services_Plist]] | ||
| + | | [[Entity Table|Artifacts]] | ||
|} | |} | ||
Revision as of 16:50, 22 July 2020
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
Event Log Records
Expand processes the following event log record numbers
| ID | Description |
|---|---|
| 21 | |
| 22 | |
| 25 | |
| 300 | |
| 600 | |
| 1001 | |
| 1002 | |
| 1006 | |
| 1102 | |
| 1149 | |
| 2003 | |
| 2102 | |
| 2104 | |
| 4616 | |
| 4624 | |
| 4663 | |
| 6100 | |
| 7045 | |
| 8001 | |
| 8003 | |
| 11001 | |
| 20001 | |
| 20003 | |
| 24576 | |
| 24577 | |
| 24578 | |
| 50067 |
