# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-ScheduledTask-v1_0-UserGuide

- 1
- 2
- 3

SECRET//NOFORN
2.2 Supported Payload Types
ScheduledTask accepts input payloads in EXE or DLL formats for the x86 or x64
architectures. ScheduledTask is a terminating component and does not output a
payload.
Input Type Output Type(s)
x86 EXE None
x64 EXE None
x86 DLL None
x64 DLL None
2.3 Uninstall Procedure
Manual
The manual uninstall procedure consists of the following steps:
1. Stop the scheduled task, if it is running.
schtasks /End /TN <TASK_NAME>
2. Kill the process executing the payload (if payload was an EXE).
taskkill /F /IM <PAYLOAD_NAME>
3. Remove the scheduled task from the Windows Task Scheduler.
schtasks /Delete /TN <TASK_NAME>
4. Delete the stub and payload executables from the filesystem.
del /F <TASK_PATH> <PAYLOAD_PATH>
Autonomous
The autonomous uninstall procedure consists of the following steps:
1. Delete the payload from the filesystem.
When the stub detects that the payload has been deleted, it will execute the
autonomous uninstall. The stub checks for the payload every 90 seconds. The
autonomous uninstall will perform the following steps:
1. Remove the scheduled task from the Windows Task Scheduler.
2. Delete itself from the filesystem.
3 Footprint
File System
- Payload Executable, located at a user specified location
- Payload Directory, may have been created
- Task Stub Executable, located at a user specified location
- Task Stub Directory, may have been created
- Scheduled Task XML, located at %SYSTEMROOT%\System32\Tasks\<TASK_NAME>
3
SECRET//NOFORN

- 1
- 2
- 3