Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//ORCON//NOFORN
13.5.4 Execute File Result
The execute file result tag contains the additional data provided by the Implant all
execute file tasks.
XML Example
<ExecuteFileResult>
<WinResult>87</ WinResult>
<OutputDataSize>5m</OutputDataSize>
<LocalFileName>data\execute_data.txt</LocalFileName>
</ExecuteFileResult>
Field Definitions
Win Result
This is an embedded windows result object that will contain the windows
“GetLastError” code after the task is executed. For more information see the
earlier section describing the windows result field.
Output Data Size
When running an execute file in the foreground, the Implant will capture
everything sent to standard out and standard error and return that data to the
LP. This field contains the size of the data that is returned.
In the example above, 5 megabytes of data was returned from the execution of
the task.
Local File name
When the result file is received by the LP, the Assassin post processor will
generate the result XML and then output any data files that are included in the
result. The local file name field will contain the relative local file path to the data
file that has all of the execute file output information. It will only be created if
there is output data in the result.
In the example above, the local file name field was set to
“data\execute_data.txt”. This is a local relative path from the location of the XML
file.
150
SECRET//ORCON//NOFORN