# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Brutal Kangaroo

# Shadow v1.0 - User Guide

31 August, 2012

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14

Shadow v1.0 User Guide SECRET
Version 6.0. The virtual folder that represents the My Documents desktop item. This
value is equivalent to CSIDL_PERSONAL.
CSIDL_MYMUSIC (FOLDERID_Music)
The file system directory that serves as a common repository for music files. A typical
path is C:\Documents and Settings\User\My Documents\My Music.
CSIDL_MYPICTURES (FOLDERID_Pictures)
Version 5.0. The file system directory that serves as a common repository for image
files. A typical path is C:\Documents and Settings\ username\My Documents\My
Pictures.
CSIDL_MYVIDEO (FOLDERID_Videos)
Version 6.0. The file system directory that serves as a common repository for video files.
A typical path is C:\Documents and Settings\ username\My Documents\My Videos.
CSIDL_NETHOOD (FOLDERID_NetHood)
A file system directory that contains the link objects that may exist in the My Network
Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the
network namespace root. A typical path is C:\Documents and Settings\
username\NetHood.
CSIDL_NETWORK (FOLDERID_NetworkFolder)
A virtual folder that represents Network Neighborhood, the root of the network
namespace hierarchy.
CSIDL_PERSONAL (FOLDERID_Documents)
Version 6.0. The virtual folder that represents the My Documents desktop item. This is
equivalent to CSIDL_MYDOCUMENTS.
Previous to Version 6.0. The file system directory used to physically store a user's
common repository of documents. A typical path is C:\Documents and Settings\
username\My Documents. This should be distinguished from the virtual My Documents
folder in the namespace. To access that virtual folder, use SHGetFolderLocation, which
returns the ITEMIDLIST for the virtual location, or refer to the technique described in
Managing the File System.
CSIDL_PRINTERS (FOLDERID_PrintersFolder)
The virtual folder that contains installed printers.
CSIDL_PRINTHOOD (FOLDERID_PrintHood)
The file system directory that contains the link objects that can exist in the Printers
virtual folder. A typical path is C:\Documents and Settings\ username\PrintHood.
CSIDL_PROFILE (FOLDERID_Profile)
Version 5.0. The user's profile folder. A typical path is C:\Users\ username. Applications
should not create files or folders at this level; they should put their data under the
locations referred to by CSIDL_APPDATA or CSIDL_LOCAL_APPDATA. However,
if you are creating a new Known Folder the profile root referred to by CSIDL_PROFILE
is appropriate.
CSIDL_PROGRAM_FILES (FOLDERID_ProgramFiles)
Version 5.0. The Program Files folder. A typical path is C:\Program Files.
CSIDL_PROGRAM_FILESX86 (FOLDERID_ProgramFilesX86)
CSIDL_PROGRAM_FILES_COMMON (FOLDERID_ProgramFilesCommon)
SECRET
9

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14