Difference between revisions of "Expand"
Jump to navigation
Jump to search
| Line 1,112: | Line 1,112: | ||
| 2003 || USB Info || [[Event Types|EVENT_TYPE_USB_INSERTED]] | | 2003 || USB Info || [[Event Types|EVENT_TYPE_USB_INSERTED]] | ||
|- | |- | ||
| − | | 2102 || USB Info | + | | 2102 || USB Info || [[Event Types|EVENT_TYPE_USB_REMOVED]] |
|- | |- | ||
| − | | 2104 || USB Info | + | | 2104 || USB Info || [[Entity Types|ENTITY_TYPE_USB_DEVICE]] |
|- | |- | ||
| − | | 4616 || Change System Time | + | | 4616 || Change System Time || [[Event Types|EVENT_TYPE_TIME_CHANGED]] |
|- | |- | ||
| 4624 || Logon || [[Event Types|EVENT_TYPE_LOGON]] | | 4624 || Logon || [[Event Types|EVENT_TYPE_LOGON]] | ||
|- | |- | ||
| − | | 4663 || WiFi Data | + | | 4663<br />6100 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_HEARD_WIFI]] |
|- | |- | ||
| − | | | + | | 7045 || Service Installed || [[Event Types|EVENT_TYPE_SERVICE_INSTALLED]]<br />[[Type_Shell_Script]] |
| − | | | ||
| − | | | ||
|- | |- | ||
| 8001 || WiFi Data | | 8001 || WiFi Data | ||
Revision as of 06:33, 2 June 2024
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
Event Log Records
Expand processes the following event log record numbers
