# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-ServiceDLL-v1_3-UserGuide

- 1
- 2
…
- 4
- 5
- 6

SECRET//NOFORN
Registry Keys
Created
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\ImagePath
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\ObjectName
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\DelayedAutoStart
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\ErrorControl
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Start
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Type
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Parameters
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Parameters\ServiceDll
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Description
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\DisplayName
Modified
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs
Modified (during hijack)
- HKLM\SYSTEM\CurrentControlSet\Services\<HIJACKED_SERVICE>\Parameters\ServiceDll
- HKLM\SYSTEM\CurrentControlSet\Services\<HIJACKED_SERVICE>\Parameters\ServiceDll
UnloadOnStop
6
SECRET//NOFORN

- 1
- 2
…
- 4
- 5
- 6