# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dumbo

# Dumbo v3.0 -- User Guide

25 June, 2015

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 14
- 15

SECRET//NOFORN
3.2.3 (U) Camera & Microphone Tab
The “Camera & Microphone” tab displays the following information:
• Number of camera devices detected
• Status of all microphones (muted or unmuted)
• Table of processes using the selected camera and their statuses
• Table of all files with write-permission detected and their statuses
A list of camera devices are displayed on the left by their unique device name. By default, the
last camera detected is selected. The currently selected camera device is highlighted in blue and
filters which processes and files with write-permission are displayed on the right of the screen.
To ensure all files and processes are viewed and considered, the operator must filter through all
detected camera devices!
Processes Using Selected Camera Table
This table contains the following information:
• Path to the process’ binary
• Process Unique Identifier (PID)
• Status of the process (Running, Suspended, or Terminated)
Entries in the “Processes” table are color-coded with the following scheme:
Color Meaning
Green The process is currently suspended
Red The process is running
Gray The process has been terminated, and the PID is no longer valid
The “Processes” table is interactive. The currently selected entry in the table is highlighted
blue. Right-clicking an entry in the table will display a menu with the following options:
• Show in Folder –
• Suspend / Resume – Attempt to suspend the process, if it is running, or resume it if it
is suspended
• Terminate – Terminates the process
If Dumbo fails to terminate a process, a warning will be displayed to the operator.
Files with Write-Access Table
This table contains the following information:
• Path to the file
• Last time the file’s been written to
o ISO 8601 format (Year-Month-Day 24Hour:Minutes:Seconds)
• If the file has ever been corrupted by this instance of Dumbo (Yes/No)
Entries in the “Files” table are color-coded with the following scheme:
SECRET//NOFORN
4

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 14
- 15