# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Elsa

# ELSA User Manual

27 September, 2013

- 1
- 2
…
- 31
- 32
- 33
- 34
- 35
…
- 41
- 42

Elsa User Manual.doc
28
SECRET//NOFORN
</wifi-ap>
<wifi-ap>
<ssid>Cisco12345</ssid>
<mac>C0:C1:C0:F5:B2:16</mac>
<rssi>-81</rssi>
</wifi-ap>
<wifi-ap>
<ssid>Madison113</ssid>
<mac>C4:3D:C7:AD:96:72</mac>
<rssi>-81</rssi>
</wifi-ap>
</wifi-ap-entry>
</wifi-ap-list>
<geo-list>
<geo-entry>
<timestamp format="UTC">Wed Jun 13 14:39:25 2012</timestamp>
<accuracy>350</accuracy>
<provider>google</provider>
<location>38.12345, -77.12345</location>
</geo-entry>
<geo-entry>
<timestamp format="UTC">Wed Jun 13 14:35:39 2012</timestamp>
<accuracy>350</accuracy>
<provider>google</provider>
<location>38.12345, -77.12345</location>
</geo-entry>
<geo-entry>
<timestamp format="UTC">Wed Jun 13 14:35:43 2012</timestamp>
<accuracy>350</accuracy>
<provider>google</provider>
<location>38.12345, -77.12345</location>
</geo-entry>
<geo-entry>
<timestamp format="UTC">Wed Jun 13 14:40:25 2012</timestamp>
<accuracy>350</accuracy>
<provider>google</provider>
<location>38.12345, -77.12345</location>
</geo-entry>
<geo-entry>
<timestamp format="UTC">Wed Jun 13 14:36:19 2012</timestamp>
<accuracy>350</accuracy>
<provider>google</provider>
<location>38.12345, -77.12345</location>
</geo-entry>
<geo-entry>
<timestamp format="UTC">Wed Jun 13 14:41:25 2012</timestamp>
<accuracy>350</accuracy>
<provider>google</provider>
<location>38.12345, -77.12345</location>
</geo-entry>
<geo-entry>
<timestamp format="UTC">Wed Jun 13 14:38:25 2012</timestamp>
<accuracy>350</accuracy>
<provider>google</provider>
<location>38.12345, -77.12345</location>
</geo-entry>
</geo-list>
</Log>
Figure 26 - (S) Example of an ELSA xml collection
(S) This log file contains several coordinate pairs for the target machine as well as a
single wifi ap list entry. Because we selected the default option to delete geolocated wifi

- 1
- 2
…
- 31
- 32
- 33
- 34
- 35
…
- 41
- 42