Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//NOFORN
5.3 Has Exactly Loaded
The “has_exactly_loaded” verb states that a process has exactly loaded a set of
modules (DLLs). No additional modules may be loaded into the process
Usage
process(<process_name>|*).has_exactly_loaded([<module_name>, ...])
process_name
Name of process running on target system
module_name
Name of module loaded into process
Truth Table
TRUE
A process named process_name has loaded exactly the module_name
DLLs
FALSE
No processes named process_name have loaded exactly the
module_name DLLs
INVALID
Error occurred while collecting process information
118
SECRET//NOFORN