# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dumbo

# Dumbo v2.0 -- Field Guide

10 June, 2015

- 1
- 2
- 3
- 4

1.0 Overview
Dumbo is meant to be executed directly from a USB thumb drive. The application will require
being run as SYSTEM. Dumbo will output details on network adapters, camera devices, and
files. The output will also be logged in a file called “log.txt” in the same folder as the program’s
execution.
Runner.exe: Main executable for Dumbo. Takes no parameters, and should be run from
a SYSTEM cmd.exe shell. This file can be renamed as desired.
scanner.sys: Driver necessary for Dumbo to run correctly on 32 bit Windows XP.
Driver will automatically be installed and removed, if necessary. Driver must be named
“scanner.sys” and located in the same folder as Runner.exe to be installed correctly. The
driver is not needed, and will not be installed, on any operating system other than 32 bit
Windows XP.
2.0 Getting Started
2.1 Pre-Execution
Dumbo requires that the user be logged in to run.
Dumbo requires being run as SYSTEM, and should be executed from a SYSTEM level
cmd.exe shell. The program will prevent itself from being run outside of such conditions and
produce output such as seen below in the “Sample Failure Output” section.
64 bit Windows XP is not supported. If run on Windows XP 64, the program will not
attempt to do any of its features. An example of this can be seen in a screenshot below in the
“Sample Failure Output” section
Although Dumbo attempts to output details of Bluetooth adapters, it cannot validate them.
2.2 Execution
• Run the program from a SYSTEM level cmd.exe shell
• The program prompts for an exit timer once all of its steps are completed. The exit
timer will not begin until the thumb drive the program is run from is ejected. If the
drive is ejected before the user manually inputs an exit time, the time is assumed to be
7 minutes.
NOTE: If the user enters an exit time to override the default 7 minutes, they
MUST hit “Enter”. Failure to hit “Enter” will cause Dumbo to wait infinitely
and not exit, despite drive ejection.
• The program stores a log file back to the USB drive

- 1
- 2
- 3
- 4