forked from EricZimmerman/KapeFiles
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathPeaZip.tkape
31 lines (30 loc) · 1.4 KB
/
PeaZip.tkape
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
Description: PeaZip
Author: Andrew Rathbun
Version: 1.0
Id: 38efad53-1899-4b73-8a07-e8d12712f579
RecreateDirectories: true
Targets:
-
Name: PeaZip Configuration Files
Category: FileKnowledge
Path: C:\Users\%user%\AppData\Roaming\PeaZip\
Recursive: true
# Documentation
# N/A
#
# This directory contained the following files in my research VM:
# C:\Users\*\AppData\Roaming\PeaZip\conf-lastgood.txt
# C:\Users\*\AppData\Roaming\PeaZip\custedit.txt
# C:\Users\*\AppData\Roaming\PeaZip\bookmarks.txt
# C:\Users\*\AppData\Roaming\PeaZip\conf.txt
# The two conf*.txt files contained a history of archives that were recently opened with PeaZip
# Each file was identical to each other and had 650ish lines of data after about 10 minutes of testing with PeaZip. Except much more for a user who uses PeaZip as their primary archiving program
# Bookmarks.txt appeared to contain entries for the default bookmarks that ship with PeaZip as well as user added bookmarks
# Within this file, it stores the equivalent to a Shellbags-esque timestamp for the first time the user navigated to the bookmark and the last time
# The most recently visited timestamp is overwritten each time the user visits that bookmark and a number above the timestamps is incremented for each visits
# For instance, my Bookmarks.txt had this entry:
# 4
# 2021-03-28 15:37:36
# 2021-03-28 11:02:20
# 0
# C:\Users\%user$\Downloads