# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Brutal Kangaroo

# EzCheese v6.3 - User Guide

18 July, 2013

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
- 20
- 21

SECRET//20350629
4.5 (U) Contingencies and Alternate States and Modes of Operation
(S) If the link file is removed from the drive, the tool will not execute. Removing this file
is a way to disarm the drive if desired.
(S) **Note**: remove the link(s) using a command prompt (for example, type: del
h:\docs\thumbs.lnk ) Browsing to the link in explorer will trigger the tool to collect
on the local computer.
4.6 (U) Assistance and Problem Reporting
(S) Please contact EDG/AED/OSB for assistance.
5. (U) Additional Operational Procedures
5.1 (U) Post Processing
(S) The following guidelines should be used to post process any survey/collection results
from the EzCheese tool:
1. (S) Plug the target thumb drive into an appropriately classified, controlled
computer. Note the letter assigned to the drive.
2. (S) From a command line prompt, copy the CheeseProcessor.exe to the directory
where the processed data should be written.
3. (S) Run the CheeseProcessor.exe and specify the full path to the survey data
directory (e.g. CheeseProcessor.exe f:\apps\cache\www\0000). The collected
files are processed and written to the current directory.
4. (S) Run the CheeseProcessor.exe and specify the full path to a specific file to
extract the files collected there (e.g. CheeseProcessor.exe
f:\apps\cache\html.cache). The files that met specific criteria (established during
the configuration phase) are processed and written to a directory within the
current directory named CollectedFiles.
5. (S) To post-process the dll output file, run CheeseProcessor.exe –o surveyfile.
This will create a file “BasicSurvey.txt” in the same directory as
CheeseProcessor.exe.
(S) The collected data will be extracted to the current directory. The following
directories and files will be created:
• Directory Listing.txt
• SysInfo.txt
• Arp Table.txt
• Routing Table.txt
• IP config.txt
SECRET//20350629
14

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
- 20
- 21