Difference between revisions of "Expand"
Jump to navigation
Jump to search
| Line 35: | Line 35: | ||
|- | |- | ||
| [[Type_JPEGWithExif]] | | [[Type_JPEGWithExif]] | ||
| − | | [[EXIF Table|EXIF]] | + | | Artifacts, [[EXIF Table|EXIF]], [[Type_File_Details|File Details]] |
|- | |- | ||
| [[Type_GIF]] | | [[Type_GIF]] | ||
| Line 63: | Line 63: | ||
| [[Type_PowerPoint_2007]] | | [[Type_PowerPoint_2007]] | ||
| Artifacts, [[Type_File_Details|File Details]] | | Artifacts, [[Type_File_Details|File Details]] | ||
| + | |- | ||
| + | | [[Type_Microsoft_ESE]] | ||
| + | | [[Type_File_Details|File Details]] | ||
| + | |- | ||
| + | | [[Type_MPEG4Video]] | ||
| + | | Artifacts, [[EXIF Table|EXIF]], [[Type_File_Details|File Details]], [[Location Table|Locations]] | ||
| + | |- | ||
| + | | [[Type_Adobe_PDF]] | ||
| + | | Artifacts | ||
|} | |} | ||
Revision as of 10:42, 22 July 2020
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
Expand exploits the following file types.
| File Type | Produces |
|---|---|
| Type_Physical_Artifacts | Artifacts |
| Type_ASCII_Text | File Details |
| Type_JPEG | Artifacts, File Details |
| Type_JPEGWithExif | Artifacts, EXIF, File Details |
| Type_GIF | File Details |
| Type_PE | File Details |
| Type_ZIP | Files, File Details |
| Type_32bit_Windows_Executable | Files, File Details |
| Type_64bit_Windows_Executable | Files, File Details |
| Type_ROM_Windows_Executable | Files, File Details |
| Type_Word_2007 | Artifacts, File Details |
| Type_Excel_2007 | Artifacts, File Details |
| Type_PowerPoint_2007 | Artifacts, File Details |
| Type_Microsoft_ESE | File Details |
| Type_MPEG4Video | Artifacts, EXIF, File Details, Locations |
| Type_Adobe_PDF | Artifacts |
