# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# AfterMidnight v1.0 Users Guide

18 August, 2014

- 1
- 2
…
- 40
- 41
- 42
- 43
- 44
…
- 67
- 68

SECRET//NOFORN
5.2.1 Log
The gremlin log is the single file that contains information about what an AM has
been doing. Each target has exactly one log, placed in:
<workspace>/processed/<target_name>/<target_name>.log
This file contains easily grepable text entries, in the format below:
2014-08-26 11:18:33 - INFO Core [2014-08-26 15:18:37] Beaconing
2014-08-26 11:18:33 - ERROR Core [2014-08-26 15:18:40] Error, unable to get index,
HTTP Code: 404
2014-08-26 11:18:33 - INFO Core [2014-08-26 15:19:20] Beaconing
2014-08-26 11:18:33 - INFO Core [2014-08-26 15:19:22] Successfully received index
file
2014-08-26 11:18:33 - INFO Core [2014-08-26 15:19:22] Found a new index
2014-08-26 11:18:33 - INFO Core [2014-08-26 15:19:22] Reloading Master
2014-08-26 11:18:33 - INFO Core [2014-08-26 15:19:22] Loaded Gremlin blob 00000106
2014-08-26 11:18:33 - INFO Core [2014-08-26 15:19:22] Finished reloading Master
2014-08-26 11:18:33 - INFO Process [2014-08-26 15:19:22] feature:kill
apphash:0x86DA8992 status:0x00000000
…
The columns, in order, are:
• Date decryption/processing occurred
• Time decryption/processing occurred
• A single dash
• The log ‘level’ denoting importance of the event
• Name of Gremlin that generated the log.
• [Date log message was generated on target
• Time log message was generated on target]
• Gremlin-specific component of the message
Note that any files that are processed at the same time will be shown in the
correct order (i.e, sorted by the 6
th
/7
th
column).
If files are processed out of order via different am process commands they will
not be in chronological order. This shouldn’t happen in normal operation unless
a file is misplaced and found later. In this case the data will be appened to the
end of the log, but with the correct timestamps in the 6
th
/7
th
columns.
Gremlins are, by convention, required to generate log entries when there is an
error condition or when successful sabotage has occurred. Gremlins are
expected to summarize any super-frequent events to avoid over-producing data.
42
SECRET//NOFORN

- 1
- 2
…
- 40
- 41
- 42
- 43
- 44
…
- 67
- 68