# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Brutal Kangaroo

# Emotional Simian v2.1 - User Guide

15 April, 2013

- 1
- 2
…
- 17
- 18
- 19
- 20
- 21
- 22
- 23

3. Up / Down Arrows: The file collection will collect based on a priority
scheme. For example: if secret.doc gets a hit on the third file collection,
but then the next file checked gets a hit on the first file collection it will be
put at the top of the file collection queue. This way the most important
stuff will be placed on the covert partition.
4. Min / Max Modified Date: If the file exceeds the max, file will not be
collected; if the file falls below min, file will not be collected.
5. Min / Max Accessed Date: If the file exceeds the max, file will not be
collected; if the file falls below min, file will not be collected.
6. Min / Max Creation Date: If the file exceeds the max, file will not be
collected; if the file falls below min, file will not be collected.
7. File Pattern Wild Cards: This is a bit tricky. File wildcards are compared
against the entire file path. Meaning if you want to collect any file ending
with Secret.doc, you must type “*Secret.doc;” because
Secret.doc; != c:\user\desktop\Secret.doc, but
*Secret.doc; does equal c:\user\desktop\Top Secret.doc
Each file wild card must be separated by a semi-colon and end with a semi-
colon; if you do not separate them with a semi-colon the program will think
the two items are one. e.g. “*\secret.doc blah.txt;” will be compared to
every file on the box.
If you only want files from the C:\ drive then typing c*\secret.doc; will
work. Putting the slash before the * means you only files matching that
exact name. c*Secret.doc; will collect c:\junkfolder\Not-A-Secret.doc
8. Folder Exclusion: These are folders you do not want files from. They
must be separated by semi-colons, and end with a semi-colon. Wildcards
do not work on these folders, you must type the name perfectly although
capitalization does not matter. Program Files and Program Files (x86) are
two different folders. If you want exclude all program files you must write
both; Program Files;Program Files (x86);.
9. Min / Max File Size: If the file exceeds the max, file will not be collected;
if the file falls below min, file will not be collected.
19
SECRET//X1
CL BY: 2397517
REASON: 1.4(c)
DECL: 20361019
DRV: COL S-06

- 1
- 2
…
- 17
- 18
- 19
- 20
- 21
- 22
- 23