Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
4.3.1 Optional Dll Parameters:
1. ES_Dll Kill Date: DllPayload(64).dll will exit if this date is surpassed. Default
is two years into the future.
2. Recharge Number of Runs: After an infected thumb drive comes back to the
Primary Host computer, if checked, ES Server(64).exe will put the number of
surveys and payload runs back to their original amounts.
3. Allow Retasking on Previous Targets: Once DllPayload(64).dll whacked a
computer, it places a GUID in Registry under HKLM\Software\ Microsoft\Active
Setup or HKLM\Software\ Microsoft\MNU depending whether you checked the
Persist Completed Reg Key box. If the thumb drive has not made it back to the
Primary Host running ES Server(64).exe, the thumb drive will not run on that
11
SECRET//X1
CL BY: 2397517
REASON: 1.4(c)
DECL: 20361019
DRV: COL S-06