Expand

Details

Executable	Expand.exe
Stage	3
Percent Complete	48%
Message Queue	expand

Expand is the most capable exploitation process. It produces files and artifacts.

Capabilities

File Types

Expand processes the following types of files.

File Type	Produces
Type_Physical_Artifacts	Artifacts
Type_ASCII_Text	File Details
Type_JPEG	Artifacts, File Details
Type_JPEGWithExif	Artifacts, EXIF, File Details
Type_GIF	File Details
Type_PE	File Details
Type_ZIP	Files, File Details
Type_32bit_Windows_Executable	Files, File Details
Type_64bit_Windows_Executable	Files, File Details
Type_ROM_Windows_Executable	Files, File Details
Type_Word_2007	Artifacts, File Details
Type_Excel_2007	Artifacts, File Details
Type_PowerPoint_2007	Artifacts, File Details
Type_Microsoft_ESE	File Details
Type_MPEG4Video	Artifacts, EXIF, File Details, Locations
Type_Adobe_PDF	Artifacts
Type_Internet_Explorer_History	Artifacts, File Details
Type_SQLite_Database	Artifacts, Files, File Details
Type_PNG	File Details
Type_Firefox_Form_History	Artifacts, File Details
Type_Firefox_Downloads	File Details
Type_Firefox_Web_Sites_Visited	Artifacts, File Details
Type_Chrome_Archived_History	File Details
Type_Chrome_Cookies	File Details
Type_Chrome_History	Artifacts, File Details
Type_Chrome_History_Index	File Details
Type_Chrome_Thumbnails	File Details
Type_Chrome_Web_Data	File Details
Type_Zip_Fragment	Files, File Details
Type_RichText	Artifacts, File Details
Type_Java_Archive	Files, File Details
Type_XP_Prefetch	Artifacts, File Details
Type_Vista7_Prefetch	Artifacts, File Details
Type_Binary_PList	Files
Type_3GP_Video	File Details
Type_BZip_Archive	Files
Type_TrueType_Font	File Details
Type_OpenType_Font	File Details
Type_KMZ	File Details
Type_Flash_Cookie	File Details
Type_Apple_Addressbook_Thumbnails	Files, File Details
Type_iOS_Locations	File Details, Locations
Type_ZIP_Code_Database	File Details
Type_Bible_Database	File Details
Type_ATT_Mark_The_Spot_Database	File Details, Locations
Type_Shazam_Database	File Details, Locations
Type_Apple_Calendar_Database	Events, File Details
Type_Ancestry_Database	File Details
Type_iOS_SMS	Messages, File Details
Type_iOS_Call_History	Events, File Details
Type_Skype_Main	Artifacts, Events, File Details
Type_3G2_Video	File Details
Type_GZip	Files
Type_Bitmap_Image	File Details
Type_TIFF	EXIF
Type_Cellebrite_1	Artifacts, Events, Locations, Messages
Type_Cellebrite_2	Artifacts, Events, Locations, Messages, URLs
Type_MPEG2Video	EXIF
Type_Windows_Registry	File Details
Type_SAM_Registry	File Details
Type_System_Registry	File Details
Type_Boot_Registry	File Details
Type_User_Registry	File Details
Type_Software_Registry	File Details
Type_Vista7_Thumbnail_Cache	Files
Type_Microsoft_Cabinet	Files
Type_Adobe_Flash_Video_New	File Details
Type_Evernote_Database	File Details
Type_vCard	Artifacts
Type_vCard_Unicode	Artifacts
Type_xCard	Artifacts
Type_Ogg_Theora	File Details
Type_Encrypted_ZIP	File Details
Type_Outlook_Personal_Folders	File Details
Type_Torrent	File Details
Type_Setup_API_Log	Artifacts, Events
Type_QuickTime_Container	File Details
Type_Digital_Media_Broadcasting	File Details
Type_Digital_Media_Protection	File Details
Type_Dirac_Video	File Details
Type_Digital_Video_Broadcast	File Details
Type_JPEG_2000	File Details
Type_AAC_Audio	File Details
Type_AAC_Audio_Book	File Details
Type_Motion_JPEG	File Details
Type_MPEG_21	File Details
Type_MPEG_7	File Details
Type_QuickTime_Video	File Details, Locations
Type_QuickTime_Cache	File Details
Type_Safari_Cache	File Details
Type_XRY_XML_File	Artifacts, Events, Locations, Messages, URLs
Type_Apple_Voicemail_Database	Artifacts, Events, File Details
Type_Apple_Find_My_iPhone_Database	File Details, Locations
Type_Windows_Link	Artifacts, File Details, URLs
Type_Precompiled_INF	File Details
Type_ELF_Executable	File Details
Type_Firefox_Offline_Cache	Files, File Details, URLs
Type_Microsoft_DPAPI_Key	File Details
Type_Recycle_Bin_INFO2	Events, File Details
Type_Opera_Typed_URL_Cache	Events
Type_MIME_Message	Files
Type_BluRay_PlayList	File Details
Type_NTFS_Log_File	File Details
Type_Android_WiFi_Cache	Artifacts, Events, Locations
Type_Android_Cell_Tower_Cache	Events, Locations
Type_Android_Executable_35	File Details
Type_Android_Executable_36	File Details
Type_Android_Settings_Database	File Details
Type_Android_Suggestions_Database	Artifacts, Events, File Details
Type_TigerText_Database	File Details
Type_Windows_XML_Event_Log	Artifacts, Events, Files, Supported Record Numbers
Type_XML_PList	Artifacts, Files
Type_Apple_Addressbook	Artifacts
Type_ydjp	Files
Type_TAR	Files
Type_Windows_Hibernation	File Details
Type_Kies_Backup_Data	Files
Type_Kies_Backed_Up_Items	Artifacts, Files, Messages
Type_Kies_Zip	Files
Type_WPA_Supplicant_Configuration	Artifacts, Locations
Type_Kies_Internal_Blob	Files
Type_Kies_Container	Files
Type_Kies_Message_Backup	Files, Messages
Type_Kies_Contacts_Backup	Artifacts, Files, URLs
Type_Google_Search_Results	Artifacts
Type_Opera_Browser_Cache	Files, URLs
Type_RDP_Configuration_File	Artifacts
Type_cpio	Files
Type_Facebook_App_Database	Artifacts, File Details, Locations
Type_Apple_Mach_O_Executable	File Details
Type_Facebook_Contacts_Sync	Artifacts, Files, File Details
Type_81_Prefetch	Artifacts, File Details
Type_iOS_Routine_Location	File Details, Locations
Type_Facebook_Orca_Database	Artifacts, File Details, Locations, Messages
Type_Windows_Wireless_LAN_Config	Artifacts, Files
Type_Windows_Wifi_AP_Profile	Artifacts, Files
Type_HomeGroup_Credential_Cache	Artifacts
Type_Unix_Compress	Files
Type_Printer_Spool	Artifacts, File Details
Type_Jumplist_Custom_Destination	Artifacts, File Details, URLs
Type_IE_DOMStore	Events
Type_1Password_Encrypted_Entry	Events
Type_Firefox_Encrypted_Credentials	Events, URLs
Type_Windows_Mini_Dump	File Details
Type_Amazon_Music_Player_Database	File Details
Type_Mozilla_LZ4_Compressed_Data	Files
Type_Master_Boot_Record	Artifacts, File Details
Type_Firefox_Cache2_Entry	Files, URLs
Type_Apple_Lockdown_Plist	Artifacts
Type_Apple_iWork	File Details
Type_Limewire_Properties	Artifacts, Locations
Type_Apple_Note_Database	Events, Files, File Details
Type_ipconfig_Report	Artifacts
Type_UUEncoded_Data	Files
Type_Base64_Encoded_Data	Files
Type_TIFFWithExif	Artifacts, EXIF
Type_Firefox_Signons	Events, File Details, URLs
Type_Firefox_Cookies	File Details
Type_Services_Plist	Artifacts
Type_Cryptnet_Cache_Entry	File Details, URLs
Type_Media_Monkey_Database	File Details
Type_Local_Storage	File Details
Type_iTag_Database	File Details
Type_Firefox_Health_Report	File Details
Type_Dropbox_Aggregation	File Details
Type_Github_API_Cache	File Details
Type_Firefox_DOM_Storage	File Details
Type_Android_Manifest_Binary_XML	Files
Type_Empty_SQLite	File Details
Type_Empty_SQLite_With_Freespace	File Details
Type_Apple_Advertising	File Details
Type_Apple_Downloads	File Details
Type_Firefox_Cache2_Entry_URL	URLs
Type_NTFS_Boot	Artifacts
Type_iOS_Accounts3	Artifacts, File Details
Type_Safari_History	File Details, URLs
Type_Chrome_Resource_Package	File Details
Type_Cisco_AnyConnect_Preferences	Artifacts
Type_vCard_Cache	Artifacts
Type_ZLib	Files
Type_QuickTime_Image	Files
Type_Open_Package	File Details
Type_Kies_Backup_History	Artifacts
Type_SQLite_with_WAL	File Details
Type_iOS_Diagnostic_Log	Artifacts
Type_Compressed_Prefetch	Files
Type_10_Prefetch	Artifacts, File Details
Type_VMWare_Disk	File Details
Type_PAX_Archive	Files
Type_Internet_Explorer_Cookie	File Details, URLs
Type_Facebook_Friends	Artifacts, File Details
Type_Google_Photos	File Details, Locations
Type_GUID_Partition_Table	File Details
Type_Steam_User_Local_Config	Artifacts
Type_Truevision_TGA_Image	File Details
Type_GoPro_Version	Artifacts
Type_Android_Gallery_Image_Cache	Files
Type_BIF	File Details
Type_NEF	Artifacts, EXIF
Type_Android_Thumbnail_Cache	Files
Type_Android_MMS_SMS_Database	Files, Messages, File Details
Type_Android_Messages	Artifacts, Files, Messages, File Details
Type_Berkeley_Database	File Details
Type_Google_Quick_Search	Artifacts
Type_Android_Call_Log	Artifacts, Events, File Details
Type_iPhoto_Faces	Artifacts, File Details
Type_SRUM_Database	File Details
Type_Samsung_Thumbnail	Files
Type_DJI_DAT_Flight_Log	Artifacts, Files, Locations
Type_Recycle_Bin_I	Events, File Details
Type_Apple_SINF	Artifacts
Type_ETC_Password	Artifacts
Type_Password_Shadow	Artifacts
Type_Outlook_14_Mac_Message	Files
Type_Android_Calendar_Database	Artifacts, File Details
Type_Verizon_FIOS_Database	Artifacts, File Details
Type_QNAP_Photo_Database	Artifacts, Events, File Details
Type_Android_Contacts_Database	Artifacts, Events, File Details
Type_PGP_Private_Key	Artifacts, Events, File Details
Type_PGP_Public_Key	Artifacts, Events, File Details
Type_Samsung_Motion_Photo_Video	Files
Type_GMail_Mailstore_Database	Files, File Details
Type_GMail_Webapp_Database	Files, File Details
Type_Android_Browser_Database	Artifacts, File Details, URLs
Type_QSB_Log	Artifacts, Events, File Details
Type_Telephony_Database	Artifacts, File Details
Type_GeoPosition_Cache	File Details, Locations
Type_Webview_Database	Artifacts, File Details, URLs
Type_Twitter_Database	Artifacts, File Details, URLs
Type_PGP_Public_Keyring	Artifacts, Events, File Details
Type_WhatsApp_Database	Artifacts, Files, File Details, Locations, Messages, URLs
Type_iOS_Device_Values	Artifacts
Type_Chromium_Disk_Cache	Files, URLs
Type_Amcache	File Details
Type_SparkPeople	Artifacts
Type_Apple_Bluetooth	Artifacts, File Details
Type_Pandora_Music	Artifacts, File Details
Type_AFLogical_Info	Artifacts
Type_Android_Chrome_Cache	Artifacts, Events, File Details
Type_Android_Icing_Contacts	Artifacts, File Details
Type_Yahoo_Mail_Database	Files, File Details
Type_Android_eBook_Database	Artifacts, File Details
Type_HTC_EMail	Artifacts, Files, File Details
Type_Google_Hangout_Database	Artifacts, File Details, Locations, Messages

Event Log Records

Expand processes the following event log record numbers

ID	Description
21
22
25
300
600
1001
1002
1006
1102
1149
2003
2102
2104
4616
4624
4663
6100
7045
8001
8003
11001
20001
20003
24576
24577
24578
50067