Difference between revisions of "Expand"
Jump to navigation
Jump to search
| (20 intermediate revisions by the same user not shown) | |||
| Line 1,062: | Line 1,062: | ||
|- | |- | ||
| [[Type_ATT_Phone_Backup]] | | [[Type_ATT_Phone_Backup]] | ||
| − | | | + | | [[Entity Table|Artifacts]] |
|- | |- | ||
| [[Type_Embedded_Plist]] | | [[Type_Embedded_Plist]] | ||
| − | | | + | | Files |
|- | |- | ||
| [[Type_Core_Location]] | | [[Type_Core_Location]] | ||
| − | | | + | | [[Location Table|Locations]] |
|- | |- | ||
| [[Type_Android_Installed_Applications]] | | [[Type_Android_Installed_Applications]] | ||
| − | | | + | | [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]] |
|- | |- | ||
| [[Type_Facebook_Omni_Store]] | | [[Type_Facebook_Omni_Store]] | ||
| − | | | + | | Files, [[Type_File_Details|File Details]] |
|- | |- | ||
| [[Type_Safari_Key_Value_Items]] | | [[Type_Safari_Key_Value_Items]] | ||
| − | | | + | | Files, [[Type_File_Details|File Details]] |
|- | |- | ||
| − | | [[ | + | | [[Type_CPHD]] |
| − | | | + | | Tags |
|- | |- | ||
| − | | [[ | + | | [[Type_AirTag_Data]] |
| − | | | + | | [[Entity Table|Artifacts]], [[Location Table|Locations]] |
| + | |- | ||
| + | | [[Type_Apple_SEGB]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Android_Call_Log_Backup]] | ||
| + | | [[Entity Table|Artifacts]], [[Event Table|Events]] | ||
| + | |- | ||
| + | | [[Type_Protocol_Buffer_Archive]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Olympus_Raw_Image]] | ||
| + | | [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]] | ||
| + | |- | ||
| + | | [[Type_Fuji_Raw_Image]] | ||
| + | | [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]] | ||
| + | |- | ||
| + | | [[Type_Discord_User_Information]] | ||
| + | | [[Entity Table|Artifacts]] | ||
| + | |- | ||
| + | | [[Type_AlpineQuest_Track]] | ||
| + | | [[Location Table|Locations]] | ||
| + | |- | ||
| + | | [[Type_Samsung_CMH]] | ||
| + | | [[Type_File_Details|File Details]], [[Location Table|Locations]] | ||
| + | |- | ||
| + | | [[Type_Gemini_Activity]] | ||
| + | | [[Entity Table|Artifacts]], [[Event Table|Events]] | ||
| + | |- | ||
| + | | [[Type_Volley_Cache]] | ||
| + | | Files, [[WebsiteVisit Table|URLs]] | ||
| + | |- | ||
| + | | [[Type_Glide_Disk_Cache]] | ||
| + | | Files, [[WebsiteVisit Table|URLs]] | ||
| + | |- | ||
| + | | [[Type_Android_Binary_XML]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Envelope_Index]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Apple_Shutdown_Log]] | ||
| + | | [[Event Table|Events]] | ||
|} | |} | ||
| Line 1,092: | Line 1,134: | ||
! ID | ! ID | ||
! Description | ! Description | ||
| + | ! Items Produced | ||
|- | |- | ||
| − | | | + | | 1 || VHD || [[Event Types|EVENT_TYPE_DISK_MOUNTED]] |
| − | | | ||
| − | | | ||
|- | |- | ||
| − | | | + | | 2 || VHD || [[Event Types|EVENT_TYPE_DISK_DISMOUNTED]] |
|- | |- | ||
| − | | | + | | 22 || RDP Connection || [[Event Types|EVENT_TYPE_RDP_CONNECTION]] |
|- | |- | ||
| − | | | + | | 25 || RDP Connection || [[Event Types|EVENT_TYPE_RDP_CONNECTION]] |
|- | |- | ||
| − | | | + | | 300 || Word Document Recovery || [[Event Types|EVENT_TYPE_OFFICE_ALERT]] |
|- | |- | ||
| − | | | + | | 600 || Powershell Command Line || [[Event Types|EVENT_TYPE_POSSIBLE_INFECTION]] |
|- | |- | ||
| − | | | + | | 1001<br />1002 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_USB_DEVICE]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]] |
|- | |- | ||
| − | | | + | | 1006 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]] |
|- | |- | ||
| − | | | + | | 1102 || Event Log Cleared|| [[Event Types|EVENT_TYPE_LOG_CLEARED]] |
|- | |- | ||
| − | | | + | | 2003 || USB Info || [[Event Types|EVENT_TYPE_USB_INSERTED]] |
|- | |- | ||
| − | | | + | | 2102 || USB Info || [[Event Types|EVENT_TYPE_USB_REMOVED]] |
|- | |- | ||
| − | | | + | | 2104 || USB Info || [[Entity Types|ENTITY_TYPE_USB_DEVICE]] |
|- | |- | ||
| − | | | + | | 4616 || Change System Time || [[Event Types|EVENT_TYPE_TIME_CHANGED]] |
|- | |- | ||
| − | | | + | | 4624 || Logon || [[Event Types|EVENT_TYPE_LOGON]] |
|- | |- | ||
| − | | | + | | 4625 || Failed Logon || [[Event Types|EVENT_TYPE_FAILED_LOGON]] |
|- | |- | ||
| − | | | + | | 4663<br />6100 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_HEARD_WIFI]] |
|- | |- | ||
| − | | | + | | 4720 || Account Created || [[Event Types|EVENT_TYPE_ACCOUNT_CREATED]] |
|- | |- | ||
| − | | | + | | 7045 || Service Installed || [[Event Types|EVENT_TYPE_SERVICE_INSTALLED]]<br />[[Type_Shell_Script]] |
|- | |- | ||
| − | | | + | | 8001 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]] |
|- | |- | ||
| − | | | + | | 8003 || WiFi Data || [[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_DISCONNECTED_FROM_NETWORK]] |
|- | |- | ||
| − | | | + | | 11001 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]] |
|- | |- | ||
| − | | 24577 || USB Data | + | | 20001<br />20003<br />24576<br />24577 || USB Data || [[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]] |
|- | |- | ||
| − | | 50067 || WiFi Data | + | | 50067 || WiFi Data || [[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]] |
|} | |} | ||
Latest revision as of 15:00, 29 June 2025
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
Event Log Records
Expand processes the following event log record numbers
