# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# Assassin v1.3 Users Guide

11 June, 2013

- 1
- 2
…
- 159
- 160
- 161
- 162
- 163
…
- 191
- 192

SECRET//ORCON//NOFORN
The whitelist is a list of programs that must be running for the target to
attempt a beacon. For a more detailed description of the blacklist see the
Assassin Receipt file description of whitelist.
Status Result ICE
The status result ice field is a custom status result that provides information on
all currently running or forgotten ICE and FAF DLLs.
XML Example
<StatusResultICE>
<ICEStatus>
<ID>1</ID>
<StartTime>2013-04-01T00:00:00</StartTime>
<ICEBehavior>faf</ICEBehavior>
</ICEStatus>
<ICEStatus>
<ID>2</ID>
<StartTime>2013-04-01T01:00:00</StartTime>
<ICEBehavior>forget</ICEBehavior>
</ICEStatus>
</StatusResultICE>
Field Definitions
ICE Status
The ICE status field includes information for a specific ICE / FAF DLL load. It
includes the sequential DLL id, the time the DLL was loaded, and the
behavior of the DLL.
161
SECRET//ORCON//NOFORN

- 1
- 2
…
- 159
- 160
- 161
- 162
- 163
…
- 191
- 192