# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dumbo

# Dumbo v3.0 -- Field Guide

6 July, 2015

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8

A list of camera devices are displayed on the left by their unique device name. By default, the
last camera detected is selected. The currently selected camera device is highlighted in blue and
filters which processes and files with write-permission are displayed on the right of the screen.
To ensure all files and processes are viewed and considered, the user must filter through all
detected camera devices!
Processes Using Selected Camera Table
This table contains the following information:
• Path to the process’ binary
• Process Unique Identifier (PID)
• Status of the process (Running, Suspended, or Terminated)
Entries in the “Processes” table are color-coded with the following scheme:
Color Meaning
Green The process is currently suspended
Red The process is running
Gray The process has been terminated, and the PID is no longer valid
The “Processes” table is interactive. The currently selected entry in the table is highlighted
blue. Right-clicking an entry in the table will display a menu with the several options.
Files with Write-Access Table
This table contains the following information:
• Path to the file
• Last time the file’s been written to
o ISO 8601 format (Year-Month-Day 24Hour:Minutes:Seconds)
• If the file has ever been modified by this instance of Dumbo (Yes/No)
Entries in the “Files” table are color-coded with the following scheme:
Color Meaning
Green The file has been modified, but still exists
Orange The file has not been modified
Gray The file has been deleted, and the path is no longer valid
The “Files” table is interactive. The currently selected entry in the table is highlighted blue.
Right-clicking an entry in the table will display a menu with several options.
A deleted file (whose entry should be color-coded gray) cannot be “shown in folder”.
Microphones Section

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8