Expand

Details

Executable	Expand.exe
Stage	3
Percent Complete	48%
Message Queue	expand

Expand is the most capable exploitation process. It produces files and artifacts.

Capabilities

File Types

Expand processes the following types of files.

File Type	Produces
Type_Physical_Artifacts	Artifacts
Type_ASCII_Text	File Details
Type_JPEG	Artifacts, File Details
Type_JPEGWithExif	Artifacts, EXIF, File Details
Type_GIF	File Details
Type_PE	File Details
Type_ZIP	Files, File Details
Type_32bit_Windows_Executable	Files, File Details
Type_64bit_Windows_Executable	Files, File Details
Type_ROM_Windows_Executable	Files, File Details
Type_Word_2007	Artifacts, File Details
Type_Excel_2007	Artifacts, File Details
Type_PowerPoint_2007	Artifacts, File Details
Type_Microsoft_ESE	File Details
Type_MPEG4Video	Artifacts, EXIF, File Details, Locations
Type_Adobe_PDF	Artifacts
Type_Internet_Explorer_History	Artifacts, File Details
Type_SQLite_Database	Artifacts, Files, File Details
Type_PNG	File Details
Type_Firefox_Form_History	Artifacts, File Details
Type_Firefox_Downloads	File Details
Type_Firefox_Web_Sites_Visited	Artifacts, File Details
Type_Chrome_Archived_History	File Details
Type_Chrome_Cookies	File Details
Type_Chrome_History	Artifacts, File Details
Type_Chrome_History_Index	File Details
Type_Chrome_Thumbnails	File Details
Type_Chrome_Web_Data	File Details
Type_Zip_Fragment	Files, File Details
Type_RichText	Artifacts, File Details
Type_Java_Archive	Files, File Details
Type_XP_Prefetch	Artifacts, File Details
Type_Vista7_Prefetch	Artifacts, File Details
Type_Binary_PList	Files
Type_3GP_Video	File Details
Type_BZip_Archive	Files
Type_TrueType_Font	File Details
Type_OpenType_Font	File Details
Type_KMZ	File Details
Type_Flash_Cookie	File Details
Type_Apple_Addressbook_Thumbnails	Files, File Details
Type_iOS_Locations	File Details, Locations
Type_ZIP_Code_Database	File Details
Type_Bible_Database	File Details
Type_ATT_Mark_The_Spot_Database	File Details, Locations
Type_Shazam_Database	File Details, Locations
Type_Apple_Calendar_Database	Events, File Details
Type_Ancestry_Database	File Details
Type_iOS_SMS	Messages, File Details
Type_iOS_Call_History	Events, File Details
Type_Skype_Main	Artifacts, Events, File Details
Type_3G2_Video	File Details
Type_GZip	Files
Type_Bitmap_Image	File Details
Type_TIFF	EXIF
Type_Cellebrite_1	Artifacts, Events, Locations, Messages
Type_Cellebrite_2	Artifacts, Events, Locations, Messages, URLs
Type_MPEG2Video	EXIF
Type_Windows_Registry	File Details
Type_SAM_Registry	File Details
Type_System_Registry	File Details
Type_Boot_Registry	File Details
Type_User_Registry	File Details
Type_Software_Registry	File Details
Type_Vista7_Thumbnail_Cache	Files
Type_Microsoft_Cabinet	Files
Type_Adobe_Flash_Video_New	File Details
Type_Evernote_Database	File Details
Type_vCard	Artifacts
Type_vCard_Unicode	Artifacts
Type_xCard	Artifacts
Type_Ogg_Theora	File Details
Type_Encrypted_ZIP	File Details
Type_Outlook_Personal_Folders	File Details
Type_Torrent	File Details
Type_Setup_API_Log	Artifacts, Events
Type_QuickTime_Container	File Details
Type_Digital_Media_Broadcasting	File Details
Type_Digital_Media_Protection	File Details
Type_Dirac_Video	File Details
Type_Digital_Video_Broadcast	File Details
Type_JPEG_2000	File Details
Type_AAC_Audio	File Details
Type_AAC_Audio_Book	File Details
Type_Motion_JPEG	File Details
Type_MPEG_21	File Details
Type_MPEG_7	File Details
Type_QuickTime_Video	File Details, Locations
Type_QuickTime_Cache	File Details
Type_Safari_Cache	File Details
Type_XRY_XML_File	Artifacts, Events, Locations, Messages, URLs
Type_Apple_Voicemail_Database	Artifacts, Events, File Details
Type_Apple_Find_My_iPhone_Database	File Details, Locations
Type_Windows_Link	Artifacts, File Details, URLs
Type_Precompiled_INF	File Details
Type_ELF_Executable	File Details
Type_Firefox_Offline_Cache	Files, File Details, URLs
Type_Microsoft_DPAPI_Key	File Details
Type_Recycle_Bin_INFO2	Events, File Details
Type_Opera_Typed_URL_Cache	Events
Type_MIME_Message	Files
Type_BluRay_PlayList	File Details
Type_NTFS_Log_File	File Details
Type_Android_WiFi_Cache	Artifacts, Events, Locations
Type_Android_Cell_Tower_Cache	Events, Locations
Type_Android_Executable_35	File Details
Type_Android_Executable_36	File Details
Type_Android_Settings_Database	File Details
Type_Android_Suggestions_Database	Artifacts, Events, File Details
Type_TigerText_Database	File Details
Type_Windows_XML_Event_Log	Artifacts, Events, Files, Supported Record Numbers
Type_XML_PList	Artifacts, Files
Type_Apple_Addressbook	Artifacts
Type_ydjp	Files
Type_TAR	Files
Type_Windows_Hibernation	File Details
Type_Kies_Backup_Data	Files
Type_Kies_Backed_Up_Items	Artifacts, Files, Messages
Type_Kies_Zip	Files
Type_WPA_Supplicant_Configuration	Artifacts, Locations
Type_Kies_Internal_Blob	Files
Type_Kies_Container	Files
Type_Kies_Message_Backup	Files, Messages
Type_Kies_Contacts_Backup	Artifacts, Files, URLs
Type_Google_Search_Results	Artifacts
Type_Opera_Browser_Cache	Files, URLs
Type_RDP_Configuration_File	Artifacts
Type_cpio	Files
Type_Facebook_App_Database	Artifacts, File Details, Locations
Type_Apple_Mach_O_Executable	File Details
Type_Facebook_Contacts_Sync	Artifacts, Files, File Details
Type_81_Prefetch	Artifacts, File Details
Type_iOS_Routine_Location	File Details, Locations
Type_Facebook_Orca_Database	Artifacts, File Details, Locations, Messages
Type_Windows_Wireless_LAN_Config	Artifacts, Files
Type_Windows_Wifi_AP_Profile	Artifacts, Files
Type_HomeGroup_Credential_Cache	Artifacts
Type_Unix_Compress	Files
Type_Printer_Spool	Artifacts, File Details
Type_Jumplist_Custom_Destination	Artifacts, File Details, URLs
Type_IE_DOMStore	Events
Type_1Password_Encrypted_Entry	Events
Type_Firefox_Encrypted_Credentials	Events, URLs
Type_Windows_Mini_Dump	File Details
Type_Amazon_Music_Player_Database	File Details
Type_Mozilla_LZ4_Compressed_Data	Files
Type_Master_Boot_Record	Artifacts, File Details
Type_Firefox_Cache2_Entry	Files, URLs
Type_Apple_Lockdown_Plist	Artifacts
Type_Apple_iWork	File Details
Type_Limewire_Properties	Artifacts, Locations
Type_Apple_Note_Database	Events, Files, File Details
Type_ipconfig_Report	Artifacts
Type_UUEncoded_Data	Files
Type_Base64_Encoded_Data	Files
Type_TIFFWithExif	Artifacts, EXIF
Type_Firefox_Signons	Events, File Details, URLs
Type_Firefox_Cookies	File Details
Type_Services_Plist	Artifacts
Type_Cryptnet_Cache_Entry	File Details, URLs
Type_Media_Monkey_Database	File Details
Type_Local_Storage	File Details
Type_iTag_Database	File Details
Type_Firefox_Health_Report	File Details
Type_Dropbox_Aggregation	File Details
Type_Github_API_Cache	File Details
Type_Firefox_DOM_Storage	File Details
Type_Android_Manifest_Binary_XML	Files
Type_Empty_SQLite	File Details
Type_Empty_SQLite_With_Freespace	File Details
Type_Apple_Advertising	File Details
Type_Apple_Downloads	File Details
Type_Firefox_Cache2_Entry_URL	URLs
Type_NTFS_Boot	Artifacts
Type_iOS_Accounts3	Artifacts, File Details
Type_Safari_History	File Details, URLs
Type_Chrome_Resource_Package	File Details
Type_Cisco_AnyConnect_Preferences	Artifacts
Type_vCard_Cache	Artifacts
Type_ZLib	Files
Type_QuickTime_Image	Files
Type_Open_Package	File Details
Type_Kies_Backup_History	Artifacts
Type_SQLite_with_WAL	File Details
Type_iOS_Diagnostic_Log	Artifacts
Type_Compressed_Prefetch	Files
Type_10_Prefetch	Artifacts, File Details
Type_VMWare_Disk	File Details
Type_PAX_Archive	Files
Type_Internet_Explorer_Cookie	File Details, URLs
Type_Facebook_Friends	Artifacts, File Details
Type_Google_Photos	File Details, Locations
Type_GUID_Partition_Table	File Details
Type_Steam_User_Local_Config	Artifacts
Type_Truevision_TGA_Image	File Details
Type_GoPro_Version	Artifacts
Type_Android_Gallery_Image_Cache	Files
Type_BIF	File Details
Type_NEF	Artifacts, EXIF
Type_Android_Thumbnail_Cache	Files
Type_Android_MMS_SMS_Database	Files, Messages, File Details
Type_Android_Messages	Artifacts, Files, Messages, File Details
Type_Berkeley_Database	File Details
Type_Google_Quick_Search	Artifacts
Type_Android_Call_Log	Artifacts, Events, File Details
Type_iPhoto_Faces	Artifacts, File Details
Type_SRUM_Database	File Details
Type_Samsung_Thumbnail	Files
Type_DJI_DAT_Flight_Log	Artifacts, Files, Locations
Type_Recycle_Bin_I	Events, File Details
Type_Apple_SINF	Artifacts
Type_ETC_Password	Artifacts
Type_Password_Shadow	Artifacts
Type_Outlook_14_Mac_Message	Files
Type_Android_Calendar_Database	Artifacts, File Details
Type_Verizon_FIOS_Database	Artifacts, File Details
Type_QNAP_Photo_Database	Artifacts, Events, File Details
Type_Android_Contacts_Database	Artifacts, Events, File Details
Type_PGP_Private_Key	Artifacts, Events, File Details
Type_PGP_Public_Key	Artifacts, Events, File Details
Type_Samsung_Motion_Photo_Video	Files
Type_GMail_Mailstore_Database	Files, File Details
Type_GMail_Webapp_Database	Files, File Details
Type_Android_Browser_Database	Artifacts, File Details, URLs
Type_QSB_Log	Artifacts, Events, File Details
Type_Telephony_Database	Artifacts, File Details
Type_GeoPosition_Cache	File Details, Locations
Type_Webview_Database	Artifacts, File Details, URLs
Type_Twitter_Database	Artifacts, File Details, URLs
Type_PGP_Public_Keyring	Artifacts, Events, File Details
Type_WhatsApp_Database	Artifacts, Files, File Details, Locations, Messages, URLs
Type_iOS_Device_Values	Artifacts
Type_Chromium_Disk_Cache	Files, URLs
Type_Amcache	File Details
Type_SparkPeople	Artifacts
Type_Apple_Bluetooth	Artifacts, File Details
Type_Pandora_Music	Artifacts, File Details
Type_AFLogical_Info	Artifacts
Type_Android_Chrome_Cache	Artifacts, Events, File Details
Type_Android_Icing_Contacts	Artifacts, File Details
Type_Yahoo_Mail_Database	Files, File Details
Type_Android_eBook_Database	Artifacts, File Details
Type_HTC_EMail	Artifacts, Files, File Details
Type_Google_Hangout_Database	Artifacts, File Details, Locations, Messages
Type_Android_Credentials_Store	Files, File Details
Type_StartUpInfo_Log	Events
Type_DBeaver_Settings	Artifacts
Type_Encrypted_Expert_Witness	File Details
Type_Office_Telemetry_User	File Details
Type_Office_Telemetry_Solution	File Details
Type_Office_Telemetry_Event	File Details
Type_NTFS_USN_Change_Journal	Files, File Details
Type_Windows_Error_Report	Events
Type_Windows_Activities	Events, File Details
Type_RDP_Tile_Cache	Files
Type_PCAP	File Details
Type_MBOX_Mail	Files
Type_PostgreSQL_Binary_Package	File Details
Type_Security_Registry	File Details
Type_iOS_Backup_Keybag	Files
Type_Movie_Filmroll_File	Files
Type_Restore_Point_Log	File Details
Type_Inno_Uninstall_Log	File Details
Type_Windows_Error_Report_Snapshot	Events
Type_Unity_Asset_Bundle	File Details
Type_Jumplist_Automatic_Destination	Events, Files
Type_Git_Blob	Files
Type_Android_Package	File Details
Type_Viber_Data	Artifacts, Events
Type_Viber_Messages	Events, File Details, Locations, Messages
Type_Android_Bug_Report	Artifacts, Events
Type_Snapchat_Preferences	Artifacts, Locations
Type_Kik_Preferences	Artifacts
Type_Apple_Partition_Map	File Details
Type_Snapchat_Data	Artifacts, File Details, Messages
Type_Signal	File Details, Messages
Type_Icing_MMS_SMS	File Details, Messages
Type_HEIF	File Details
Type_MPEG4Video_With_DRM	File Details
Type_Firefox_Snappy	Files
Type_Google_Analytics_Cookie	URLs
Type_Extended_Audible_dot_com_Audio	File Details
Type_Chrome_Local_State	Files
Type_Generic_Password_Dump	Artifacts
Type_Speedtest_Database	Artifacts, Files, File Details, Locations
Type_ProtonMail_Messages	Files, File Details
Type_Apple_Account_Token	Artifacts
Type_Android_IWC_Log	Artifacts
Type_Flashpoint_Data	Artifacts
Type_Google_Duo_Database	Artifacts, Files, File Details
Type_Android_Bluetooth_Config	Artifacts
Type_Android_Phonebook_Access	Artifacts
Type_Android_Common_User_Settings	Artifacts
Type_Android_Coffee_Preferences	Artifacts
Type_Android_Bluetooth_Volume_Map	Artifacts
Type_Android_Bluetooth_Database
Type_Waze_Database
Type_Waze_Log
Type_Foursquare_Pilgrim
Type_Android_Network_Policy
Type_Android_Power_Off_Log
Type_Windows_Photo_Database
Type_Google_Plus_Contacts_Database
Type_Safari_Browser_State
Type_Safari_Session_Entry_Data
Type_Network_Interfaces_PList
Type_Known_Networks_PList
Type_Comm_Center_PList
Type_Snapchat_Config_PList
Type_LinkedIn_Messenger_Database
Type_Apple_Sharing_PList
Type_Safari_Bookmarks
Type_Data_Ark_PList
Type_iPod_Preferences
Type_iOS_Routine_Locations_Database
Type_Protocol_Buffer
Type_WhatsApp_Contacts_Database
Type_LinkedIn_Imported_Contacts
Type_TraceV3_Log
Type_Berla_CSV
Type_SubRip_Subtitle
Type_iOS_Bluetooth_Pairings
Type_Apple_Advertisers
Type_Twitter_Message_Store
Type_Apple_KTX
Type_Keychain_Dump
Type_Android_ID_Settings
Type_Android_PCW_Device
Type_Generic_Log
Type_Android_Browser_Bookmarks
Type_Android_Settings
Type_Samsung_Notes
Type_Android_Access_Point_XML
Type_Android_Access_Point_Config
Type_LastPass_Database
Type_Realm_Database
Type_Device_Analytics_Database
Type_WhatsApp_Crypt14
Type_Android_Messages
Type_NITF
Type_KnowledgeC
Type_Shared_Cache_Strings
Type_ADF_Properties
Type_JSON_Log_Lines
Type_ADF_Bundle
Type_ATT_Phone_Backup
Type_Embedded_Plist
Type_Core_Location
Type_Android_Installed_Applications
Type_Facebook_Omni_Store
Type_Safari_Key_Value_Items
Type_Apple_Maps_Geo_History
Type_Apple_Maps_Activity

Event Log Records

Expand processes the following event log record numbers

ID	Description
21	Login
22	RDP Connection
25	RDP Connection
300	Word Document Recovery
600	Powershell Command Line
1001	USB Info
1002	USB Info
1006	USB Info
2003	USB Info
2102	USB Info
2104	USB Info
4616	Change System Time
4624	Logon
4663	WiFi Data
6100	WiFi Data
7045	Service Installed
8001	WiFi Data
8003	WiFi Data
11001	WiFi Data
20001	USB Data
20003	USB Data
24576	USB Data
24577	USB Data
50067	WiFi Data