# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# Assassin v1.3 Quick Start

1 June, 2013

- 1
- 2
…
- 32
- 33
- 34
- 35
- 36
…
- 51
- 52

SECRET//ORCON//NOFORN
2.4.3 DLL Memory Load
The following tasks are used to memory load DLLs meeting either the Fire and
Forget V2 or ICE V3 specifications.
load_faf_bg<run_mode><dll_file_path> [args=’’]
Load a Fire and Forget V2 (FAF) DLL into memory and execute its ordinal
function.
The DLL is loaded and executed in a separate thread, and based on the ordinal
return value, it complete and be unloaded or it will be “forgotten” and remain
running.
The implant will continue to operate while the DLL is being executed.
run_mode
Code specifying the run mode, represented by combining the
following keys:
‘r’ - run the task on receipt
‘s’ - run the task on every Implant startup
‘p’ - push the task results to the LP immediately
dll_file_path
Local FAF DLL to be loaded and executed
args
Command line arguments to the DLL
load_ice_bg<run_mode><dll_file_path> [args=’’] [feature_set=’’]
Load an ICE V3 (ICE) DLL into memory and execute its defined ordinal function.
The DLL is loaded and executed in a separate thread based on the feature set
selected
The implant will continue to operate while the DLL is being executed.
Assassin currently support the ICE Fire and Forget feature sets.
run_mode
Code specifying the run mode, represented by combining the
following keys:
‘r’ - run the task on receipt
‘s’ - run the task on every Implant startup
‘p’ - push the task results to the LP immediately
dll_file_path
Local ICE DLL to be loaded and executed
args
Command line arguments to the DLL
feature_set
The ICE feature set to use when loading and executing the
DLL. Only required if the provided DLL supports multiple
feature sets
34
SECRET//ORCON//NOFORN

- 1
- 2
…
- 32
- 33
- 34
- 35
- 36
…
- 51
- 52