WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# AlphaGremlin v0.1.0 Users Guide

1 June, 2014

- 1
- 2
…
- 4
- 5
- 6
- 7

Inside the AlphaGremlin folder will be an idToCommand.log, an idToCRC.log,
and one or more folders. The idToCommand.log is a folder than if used to
track which commands have been seen before and correlate them to a
randomly generated ID. This is necessary because, by default, the
AfterMidnight suite deletes files after processing. If data is gathered over a
long period of time, processing may occur more than once, this file reduces
the complexity and time required to sort and aggregate new data with
existing data.
The idToCRD.log file acts as a sort of Table of Contents for an operator. It
matches a 10 digit number to the string of the command that generated it.
For example,
0598096397ipconfig
2461799734%comspec% /u /c dir /s
1437661029ping 12.12.12.12
All output from an hourly ipconfig is in the folder named 059809637, etc.

- 1
- 2
…
- 4
- 5
- 6
- 7