Difference between revisions of "Expand"
Jump to navigation
Jump to search
| (16 intermediate revisions by the same user not shown) | |||
| Line 1,079: | Line 1,079: | ||
| Files, [[Type_File_Details|File Details]] | | Files, [[Type_File_Details|File Details]] | ||
|- | |- | ||
| − | | [[ | + | | [[Type_CPHD]] |
| − | | | + | | Tags |
|- | |- | ||
| − | | [[ | + | | [[Type_AirTag_Data]] |
| − | | | + | | [[Entity Table|Artifacts]], [[Location Table|Locations]] |
| + | |- | ||
| + | | [[Type_Apple_SEGB]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Android_Call_Log_Backup]] | ||
| + | | [[Entity Table|Artifacts]], [[Event Table|Events]] | ||
| + | |- | ||
| + | | [[Type_Protocol_Buffer_Archive]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Olympus_Raw_Image]] | ||
| + | | [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]] | ||
| + | |- | ||
| + | | [[Type_Fuji_Raw_Image]] | ||
| + | | [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]] | ||
| + | |- | ||
| + | | [[Type_Discord_User_Information]] | ||
| + | | [[Entity Table|Artifacts]] | ||
| + | |- | ||
| + | | [[Type_AlpineQuest_Track]] | ||
| + | | [[Location Table|Locations]] | ||
| + | |- | ||
| + | | [[Type_Samsung_CMH]] | ||
| + | | [[Type_File_Details|File Details]], [[Location Table|Locations]] | ||
| + | |- | ||
| + | | [[Type_Gemini_Activity]] | ||
| + | | [[Entity Table|Artifacts]], [[Event Table|Events]] | ||
| + | |- | ||
| + | | [[Type_Volley_Cache]] | ||
| + | | Files, [[WebsiteVisit Table|URLs]] | ||
| + | |- | ||
| + | | [[Type_Glide_Disk_Cache]] | ||
| + | | Files, [[WebsiteVisit Table|URLs]] | ||
| + | |- | ||
| + | | [[Type_Android_Binary_XML]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Envelope_Index]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Apple_Shutdown_Log]] | ||
| + | | [[Event Table|Events]] | ||
|} | |} | ||
| Line 1,108: | Line 1,150: | ||
| 1001<br />1002 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_USB_DEVICE]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]] | | 1001<br />1002 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_USB_DEVICE]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]] | ||
|- | |- | ||
| − | | 1006 || USB Info | + | | 1006 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]] |
| + | |- | ||
| + | | 1102 || Event Log Cleared|| [[Event Types|EVENT_TYPE_LOG_CLEARED]] | ||
|- | |- | ||
| − | | 2003 || USB Info | + | | 2003 || USB Info || [[Event Types|EVENT_TYPE_USB_INSERTED]] |
|- | |- | ||
| − | | 2102 || USB Info | + | | 2102 || USB Info || [[Event Types|EVENT_TYPE_USB_REMOVED]] |
|- | |- | ||
| − | | 2104 || USB Info | + | | 2104 || USB Info || [[Entity Types|ENTITY_TYPE_USB_DEVICE]] |
|- | |- | ||
| − | | 4616 || Change System Time | + | | 4616 || Change System Time || [[Event Types|EVENT_TYPE_TIME_CHANGED]] |
|- | |- | ||
| 4624 || Logon || [[Event Types|EVENT_TYPE_LOGON]] | | 4624 || Logon || [[Event Types|EVENT_TYPE_LOGON]] | ||
|- | |- | ||
| − | | | + | | 4625 || Failed Logon || [[Event Types|EVENT_TYPE_FAILED_LOGON]] |
| − | | | ||
| − | | | ||
| − | |||
| − | |||
|- | |- | ||
| − | | | + | | 4663<br />6100 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_HEARD_WIFI]] |
|- | |- | ||
| − | | | + | | 4720 || Account Created || [[Event Types|EVENT_TYPE_ACCOUNT_CREATED]] |
|- | |- | ||
| − | | | + | | 7045 || Service Installed || [[Event Types|EVENT_TYPE_SERVICE_INSTALLED]]<br />[[Type_Shell_Script]] |
|- | |- | ||
| − | | | + | | 8001 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]] |
|- | |- | ||
| − | | | + | | 8003 || WiFi Data || [[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_DISCONNECTED_FROM_NETWORK]] |
|- | |- | ||
| − | | | + | | 11001 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]] |
|- | |- | ||
| − | | 24577 || USB Data | + | | 20001<br />20003<br />24576<br />24577 || USB Data || [[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]] |
|- | |- | ||
| − | | 50067 || WiFi Data | + | | 50067 || WiFi Data || [[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]] |
|} | |} | ||
Latest revision as of 15:00, 29 June 2025
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
Event Log Records
Expand processes the following event log record numbers
