Difference between revisions of "Expand"

From truxwiki.com
Jump to navigation Jump to search
Line 880: Line 880:
 
! Description
 
! Description
 
|-
 
|-
−
| 21 ||
+
| 21 || Login
 
|-
 
|-
−
| 22 ||
+
| 22 || RDP Connection
 
|-
 
|-
−
| 25 ||
+
| 25 || RDP Connection
 
|-
 
|-
−
| 300 ||
+
| 300 || Word Document Recovery
 
|-
 
|-
−
| 600 ||
+
| 600 || Powershell Command Line
 
|-
 
|-
−
| 1001 ||
+
| 1001 || USB Info
 
|-
 
|-
−
| 1002 ||
+
| 1002 || USB Info
 
|-
 
|-
−
| 1006 ||
+
| 1006 || USB Info
 
|-
 
|-
−
| 1102 ||
+
| 2003 || USB Info
 
|-
 
|-
−
| 1149 ||
+
| 2102 || USB Info
 
|-
 
|-
−
| 2003 ||
+
| 2104 || USB Info
 
|-
 
|-
−
| 2102 ||
+
| 4616 || Change System Time
 
|-
 
|-
−
| 2104 ||
+
| 4624 || Logon
 
|-
 
|-
−
| 4616 ||
+
| 4663 || WiFi Data
 
|-
 
|-
−
| 4624 ||
+
| 6100 || WiFi Data
 
|-
 
|-
−
| 4663 ||
+
| 7045 || Service Installed
 
|-
 
|-
−
| 6100 ||
+
| 8001 || WiFi Data
 
|-
 
|-
−
| 7045 ||
+
| 8003 || WiFi Data
 
|-
 
|-
−
| 8001 ||
+
| 11001 || WiFi Data
 
|-
 
|-
−
| 8003 ||
+
| 20001 || USB Data
 
|-
 
|-
−
| 11001 ||
+
| 20003 || USB Data
 
|-
 
|-
−
| 20001 ||
+
| 24576 || USB Data
 
|-
 
|-
−
| 20003 ||
+
| 24577 || USB Data
 
|-
 
|-
−
| 24576 ||
+
| 50067 || WiFi Data
−
|-
 
−
| 24577 ||
 
−
|-
 
−
| 24578 ||
 
−
|-
 
−
| 50067 ||
 
 
|}
 
|}

Revision as of 06:20, 23 July 2020

Details
Executable Expand.exe
Stage 3
Percent Complete 48%
Message Queue expand

Expand is the most capable exploitation process. It produces files and artifacts.

Capabilities

File Types

Expand processes the following types of files.

File Type Produces
Type_Physical_Artifacts Artifacts
Type_ASCII_Text File Details
Type_JPEG Artifacts, File Details
Type_JPEGWithExif Artifacts, EXIF, File Details
Type_GIF File Details
Type_PE File Details
Type_ZIP Files, File Details
Type_32bit_Windows_Executable Files, File Details
Type_64bit_Windows_Executable Files, File Details
Type_ROM_Windows_Executable Files, File Details
Type_Word_2007 Artifacts, File Details
Type_Excel_2007 Artifacts, File Details
Type_PowerPoint_2007 Artifacts, File Details
Type_Microsoft_ESE File Details
Type_MPEG4Video Artifacts, EXIF, File Details, Locations
Type_Adobe_PDF Artifacts
Type_Internet_Explorer_History Artifacts, File Details
Type_SQLite_Database Artifacts, Files, File Details
Type_PNG File Details
Type_Firefox_Form_History Artifacts, File Details
Type_Firefox_Downloads File Details
Type_Firefox_Web_Sites_Visited Artifacts, File Details
Type_Chrome_Archived_History File Details
Type_Chrome_Cookies File Details
Type_Chrome_History Artifacts, File Details
Type_Chrome_History_Index File Details
Type_Chrome_Thumbnails File Details
Type_Chrome_Web_Data File Details
Type_Zip_Fragment Files, File Details
Type_RichText Artifacts, File Details
Type_Java_Archive Files, File Details
Type_XP_Prefetch Artifacts, File Details
Type_Vista7_Prefetch Artifacts, File Details
Type_Binary_PList Files
Type_3GP_Video File Details
Type_BZip_Archive Files
Type_TrueType_Font File Details
Type_OpenType_Font File Details
Type_KMZ File Details
Type_Flash_Cookie File Details
Type_Apple_Addressbook_Thumbnails Files, File Details
Type_iOS_Locations File Details, Locations
Type_ZIP_Code_Database File Details
Type_Bible_Database File Details
Type_ATT_Mark_The_Spot_Database File Details, Locations
Type_Shazam_Database File Details, Locations
Type_Apple_Calendar_Database Events, File Details
Type_Ancestry_Database File Details
Type_iOS_SMS Messages, File Details
Type_iOS_Call_History Events, File Details
Type_Skype_Main Artifacts, Events, File Details
Type_3G2_Video File Details
Type_GZip Files
Type_Bitmap_Image File Details
Type_TIFF EXIF
Type_Cellebrite_1 Artifacts, Events, Locations, Messages
Type_Cellebrite_2 Artifacts, Events, Locations, Messages, URLs
Type_MPEG2Video EXIF
Type_Windows_Registry File Details
Type_SAM_Registry File Details
Type_System_Registry File Details
Type_Boot_Registry File Details
Type_User_Registry File Details
Type_Software_Registry File Details
Type_Vista7_Thumbnail_Cache Files
Type_Microsoft_Cabinet Files
Type_Adobe_Flash_Video_New File Details
Type_Evernote_Database File Details
Type_vCard Artifacts
Type_vCard_Unicode Artifacts
Type_xCard Artifacts
Type_Ogg_Theora File Details
Type_Encrypted_ZIP File Details
Type_Outlook_Personal_Folders File Details
Type_Torrent File Details
Type_Setup_API_Log Artifacts, Events
Type_QuickTime_Container File Details
Type_Digital_Media_Broadcasting File Details
Type_Digital_Media_Protection File Details
Type_Dirac_Video File Details
Type_Digital_Video_Broadcast File Details
Type_JPEG_2000 File Details
Type_AAC_Audio File Details
Type_AAC_Audio_Book File Details
Type_Motion_JPEG File Details
Type_MPEG_21 File Details
Type_MPEG_7 File Details
Type_QuickTime_Video File Details, Locations
Type_QuickTime_Cache File Details
Type_Safari_Cache File Details
Type_XRY_XML_File Artifacts, Events, Locations, Messages, URLs
Type_Apple_Voicemail_Database Artifacts, Events, File Details
Type_Apple_Find_My_iPhone_Database File Details, Locations
Type_Windows_Link Artifacts, File Details, URLs
Type_Precompiled_INF File Details
Type_ELF_Executable File Details
Type_Firefox_Offline_Cache Files, File Details, URLs
Type_Microsoft_DPAPI_Key File Details
Type_Recycle_Bin_INFO2 Events, File Details
Type_Opera_Typed_URL_Cache Events
Type_MIME_Message Files
Type_BluRay_PlayList File Details
Type_NTFS_Log_File File Details
Type_Android_WiFi_Cache Artifacts, Events, Locations
Type_Android_Cell_Tower_Cache Events, Locations
Type_Android_Executable_35 File Details
Type_Android_Executable_36 File Details
Type_Android_Settings_Database File Details
Type_Android_Suggestions_Database Artifacts, Events, File Details
Type_TigerText_Database File Details
Type_Windows_XML_Event_Log Artifacts, Events, Files, Supported Record Numbers
Type_XML_PList Artifacts, Files
Type_Apple_Addressbook Artifacts
Type_ydjp Files
Type_TAR Files
Type_Windows_Hibernation File Details
Type_Kies_Backup_Data Files
Type_Kies_Backed_Up_Items Artifacts, Files, Messages
Type_Kies_Zip Files
Type_WPA_Supplicant_Configuration Artifacts, Locations
Type_Kies_Internal_Blob Files
Type_Kies_Container Files
Type_Kies_Message_Backup Files, Messages
Type_Kies_Contacts_Backup Artifacts, Files, URLs
Type_Google_Search_Results Artifacts
Type_Opera_Browser_Cache Files, URLs
Type_RDP_Configuration_File Artifacts
Type_cpio Files
Type_Facebook_App_Database Artifacts, File Details, Locations
Type_Apple_Mach_O_Executable File Details
Type_Facebook_Contacts_Sync Artifacts, Files, File Details
Type_81_Prefetch Artifacts, File Details
Type_iOS_Routine_Location File Details, Locations
Type_Facebook_Orca_Database Artifacts, File Details, Locations, Messages
Type_Windows_Wireless_LAN_Config Artifacts, Files
Type_Windows_Wifi_AP_Profile Artifacts, Files
Type_HomeGroup_Credential_Cache Artifacts
Type_Unix_Compress Files
Type_Printer_Spool Artifacts, File Details
Type_Jumplist_Custom_Destination Artifacts, File Details, URLs
Type_IE_DOMStore Events
Type_1Password_Encrypted_Entry Events
Type_Firefox_Encrypted_Credentials Events, URLs
Type_Windows_Mini_Dump File Details
Type_Amazon_Music_Player_Database File Details
Type_Mozilla_LZ4_Compressed_Data Files
Type_Master_Boot_Record Artifacts, File Details
Type_Firefox_Cache2_Entry Files, URLs
Type_Apple_Lockdown_Plist Artifacts
Type_Apple_iWork File Details
Type_Limewire_Properties Artifacts, Locations
Type_Apple_Note_Database Events, Files, File Details
Type_ipconfig_Report Artifacts
Type_UUEncoded_Data Files
Type_Base64_Encoded_Data Files
Type_TIFFWithExif Artifacts, EXIF
Type_Firefox_Signons Events, File Details, URLs
Type_Firefox_Cookies File Details
Type_Services_Plist Artifacts
Type_Cryptnet_Cache_Entry File Details, URLs
Type_Media_Monkey_Database File Details
Type_Local_Storage File Details
Type_iTag_Database File Details
Type_Firefox_Health_Report File Details
Type_Dropbox_Aggregation File Details
Type_Github_API_Cache File Details
Type_Firefox_DOM_Storage File Details
Type_Android_Manifest_Binary_XML Files
Type_Empty_SQLite File Details
Type_Empty_SQLite_With_Freespace File Details
Type_Apple_Advertising File Details
Type_Apple_Downloads File Details
Type_Firefox_Cache2_Entry_URL URLs
Type_NTFS_Boot Artifacts
Type_iOS_Accounts3 Artifacts, File Details
Type_Safari_History File Details, URLs
Type_Chrome_Resource_Package File Details
Type_Cisco_AnyConnect_Preferences Artifacts
Type_vCard_Cache Artifacts
Type_ZLib Files
Type_QuickTime_Image Files
Type_Open_Package File Details
Type_Kies_Backup_History Artifacts
Type_SQLite_with_WAL File Details
Type_iOS_Diagnostic_Log Artifacts
Type_Compressed_Prefetch Files
Type_10_Prefetch Artifacts, File Details
Type_VMWare_Disk File Details
Type_PAX_Archive Files
Type_Internet_Explorer_Cookie File Details, URLs
Type_Facebook_Friends Artifacts, File Details
Type_Google_Photos File Details, Locations
Type_GUID_Partition_Table File Details
Type_Steam_User_Local_Config Artifacts
Type_Truevision_TGA_Image File Details
Type_GoPro_Version Artifacts
Type_Android_Gallery_Image_Cache Files
Type_BIF File Details
Type_NEF Artifacts, EXIF
Type_Android_Thumbnail_Cache Files
Type_Android_MMS_SMS_Database Files, Messages, File Details
Type_Android_Messages Artifacts, Files, Messages, File Details
Type_Berkeley_Database File Details
Type_Google_Quick_Search Artifacts
Type_Android_Call_Log Artifacts, Events, File Details
Type_iPhoto_Faces Artifacts, File Details
Type_SRUM_Database File Details
Type_Samsung_Thumbnail Files
Type_DJI_DAT_Flight_Log Artifacts, Files, Locations
Type_Recycle_Bin_I Events, File Details
Type_Apple_SINF Artifacts
Type_ETC_Password Artifacts
Type_Password_Shadow Artifacts
Type_Outlook_14_Mac_Message Files
Type_Android_Calendar_Database Artifacts, File Details
Type_Verizon_FIOS_Database Artifacts, File Details
Type_QNAP_Photo_Database Artifacts, Events, File Details
Type_Android_Contacts_Database Artifacts, Events, File Details
Type_PGP_Private_Key Artifacts, Events, File Details
Type_PGP_Public_Key Artifacts, Events, File Details
Type_Samsung_Motion_Photo_Video Files
Type_GMail_Mailstore_Database Files, File Details
Type_GMail_Webapp_Database Files, File Details
Type_Android_Browser_Database Artifacts, File Details, URLs
Type_QSB_Log Artifacts, Events, File Details
Type_Telephony_Database Artifacts, File Details
Type_GeoPosition_Cache File Details, Locations
Type_Webview_Database Artifacts, File Details, URLs
Type_Twitter_Database Artifacts, File Details, URLs
Type_PGP_Public_Keyring Artifacts, Events, File Details
Type_WhatsApp_Database Artifacts, Files, File Details, Locations, Messages, URLs
Type_iOS_Device_Values Artifacts
Type_Chromium_Disk_Cache Files, URLs
Type_Amcache File Details
Type_SparkPeople Artifacts
Type_Apple_Bluetooth Artifacts, File Details
Type_Pandora_Music Artifacts, File Details
Type_AFLogical_Info Artifacts
Type_Android_Chrome_Cache Artifacts, Events, File Details
Type_Android_Icing_Contacts Artifacts, File Details
Type_Yahoo_Mail_Database Files, File Details
Type_Android_eBook_Database Artifacts, File Details
Type_HTC_EMail Artifacts, Files, File Details
Type_Google_Hangout_Database Artifacts, File Details, Locations, Messages
Type_Android_Credentials_Store Files, File Details
Type_StartUpInfo_Log Events
Type_DBeaver_Settings Artifacts
Type_Encrypted_Expert_Witness File Details
Type_Office_Telemetry_User File Details
Type_Office_Telemetry_Solution File Details
Type_Office_Telemetry_Event File Details
Type_NTFS_USN_Change_Journal Files, File Details
Type_Windows_Error_Report Events
Type_Windows_Activities Events, File Details
Type_RDP_Tile_Cache Files
Type_PCAP File Details
Type_MBOX_Mail Files
Type_PostgreSQL_Binary_Package File Details
Type_Security_Registry File Details
Type_iOS_Backup_Keybag Files
Type_Movie_Filmroll_File Files
Type_Restore_Point_Log File Details
Type_Inno_Uninstall_Log File Details
Type_Windows_Error_Report_Snapshot Events
Type_Unity_Asset_Bundle File Details
Type_Jumplist_Automatic_Destination Events, Files
Type_Git_Blob Files
Type_Android_Package File Details
Type_Viber_Data Artifacts, Events
Type_Viber_Messages Events, File Details, Locations, Messages
Type_Android_Bug_Report Artifacts, Events
Type_Snapchat_Preferences Artifacts, Locations
Type_Kik_Preferences Artifacts
Type_Apple_Partition_Map File Details
Type_Snapchat_Data Artifacts, File Details, Messages
Type_Signal File Details, Messages
Type_Icing_MMS_SMS File Details, Messages
Type_HEIF File Details
Type_MPEG4Video_With_DRM File Details
Type_Firefox_Snappy Files
Type_Google_Analytics_Cookie URLs
Type_Extended_Audible_dot_com_Audio File Details

Event Log Records

Expand processes the following event log record numbers

ID Description
21 Login
22 RDP Connection
25 RDP Connection
300 Word Document Recovery
600 Powershell Command Line
1001 USB Info
1002 USB Info
1006 USB Info
2003 USB Info
2102 USB Info
2104 USB Info
4616 Change System Time
4624 Logon
4663 WiFi Data
6100 WiFi Data
7045 Service Installed
8001 WiFi Data
8003 WiFi Data
11001 WiFi Data
20001 USB Data
20003 USB Data
24576 USB Data
24577 USB Data
50067 WiFi Data
Retrieved from "https://truxwiki.com/index.php?title=Expand&oldid=2064"