EricZimmerman · AndrewRathbun · Dec 16, 2024 · Dec 15, 2024 · Dec 15, 2024 · Dec 15, 2024
diff --git a/Targets/Browsers/360SecureBrowser.tkape b/Targets/Browsers/360SecureBrowser.tkape
@@ -0,0 +1,146 @@
+Description: 360 Secure Browser
+Author: Reece394
+Version: 1.0
+Id: c7cedaf5-e952-48ec-909e-c2aac1f66abc
+RecreateDirectories: true
+Targets:
+    -
+        Name: 360 Secure Browser Bookmarks
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: 360Bookmarks*
+    -
+        Name: 360 Secure Browser Cookies
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        Recursive: true
+        FileMask: Cookies*
+    -
+        Name: 360 Secure Browser Current Session
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Current Session
+    -
+        Name: 360 Secure Browser Current Tabs
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Current Tabs
+    -
+        Name: 360 Secure Browser Download Metadata
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: DownloadMetadata
+    -
+        Name: 360 Secure Browser Extension Cookies
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Extension Cookies
+    -
+        Name: 360 Secure Browser Favicons
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Favicons*
+    -
+        Name: 360 Secure Browser History
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: 360History*
+    -
+        Name: 360 Secure Browser Last Session
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Last Session
+    -
+        Name: 360 Secure Browser Last Tabs
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Last Tabs
+    -
+        Name: 360 Secure Browser Sessions Folder
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\Sessions\
+        Recursive: false
+    -
+        Name: 360 Secure Browser Login Data
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Login Data*
+    -
+        Name: 360 Secure Browser Media History
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Media History*
+    -
+        Name: 360 Secure Browser Network Action Predictor
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Network Action Predictor
+    -
+        Name: 360 Secure Browser Network Persistent State
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        Recursive: true
+        FileMask: Network Persistent State
+    -
+        Name: 360 Secure Browser Preferences
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Preferences
+    -
+        Name: 360 Secure Browser Quota Manager
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: QuotaManager
+    -
+        Name: 360 Secure Browser Reporting and NEL
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        Recursive: true
+        FileMask: Reporting and NEL
+    -
+        Name: 360 Secure Browser Shortcuts
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Shortcuts*
+    -
+        Name: 360 Secure Browser Top Sites
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Top Sites*
+    -
+        Name: 360 Secure Browser Trust Tokens
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        Recursive: true
+        FileMask: Trust Tokens*
+    -
+        Name: 360 Secure Browser SyncData Database
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\Sync Data
+        Recursive: true
+    -
+        Name: 360 Secure Browser Visited Links
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Visited Links
+    -
+        Name: 360 Secure Browser Web Data
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\*\
+        FileMask: Web Data*
+    -
+        Name: Windows Protect Folder
+        Category: FileSystem
+        Path: C:\Users\%user%\AppData\Roaming\Microsoft\Protect\*\
+        Recursive: true
+        Comment: "Required for offline decryption"
+    -
+        Name: 360 Secure Browser Snapshots Folder
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Roaming\360se6\User Data\Snapshots\*\
+        Recursive: true
+        Comment: "Grabs folder that appears to have snapshots of 360 Secure Browser SQLite DBs organized by version #."
+
+# Documentation
+# https://browser.360.cn/
+# https://forensafe.com/blogs/360securebrowser.html
diff --git a/Targets/Browsers/Arc.tkape b/Targets/Browsers/Arc.tkape
@@ -0,0 +1,84 @@
+Description: Arc Browser
+Author: Reece394
+Version: 1.0
+Id: f094335b-ec3c-4be8-9f80-e74e758da16e
+RecreateDirectories: true
+Targets:
+    -
+        Name: Arc Cookies
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Network
+        FileMask: Cookies*
+    -
+        Name: Arc Favicons
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: Favicons*
+    -
+        Name: Arc History
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: History*
+    -
+        Name: Arc Sessions Folder
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Sessions\
+        Recursive: false
+    -
+        Name: Arc Login Data
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: Login Data*
+    -
+        Name: Arc Network Action Predictor
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: Network Action Predictor
+    -
+        Name: Arc Preferences
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: Preferences
+    -
+        Name: Arc Shortcuts
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: Shortcuts*
+    -
+        Name: Arc Top Sites
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: Top Sites*
+    -
+        Name: Arc SyncData Database
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Sync Data
+        Recursive: true
+    -
+        Name: Arc Bookmarks
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: Bookmarks*
+    -
+        Name: Arc Visited Links
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: Visited Links
+    -
+        Name: Arc Web Data
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\
+        FileMask: Web Data*
+    -
+        Name: Arc JSON Files
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc
+        FileMask: Storable*.json
+    -
+        Name: Arc PLIST Files
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local
+        FileMask: com*.plist
+
+# Documentation
+# https://arc.net/
diff --git a/Targets/Browsers/CocCoc.tkape b/Targets/Browsers/CocCoc.tkape
@@ -0,0 +1,142 @@
+Description: CocCoc Browser
+Author: Reece394
+Version: 1.0
+Id: 423349b1-9ab2-4aa1-8dc2-d96a55a58029
+RecreateDirectories: true
+Targets:
+    -
+        Name: CocCoc Bookmarks
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Bookmarks*
+    -
+        Name: CocCoc Cookies
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        Recursive: true
+        FileMask: Cookies*
+    -
+        Name: CocCoc Current Session
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Current Session
+    -
+        Name: CocCoc Current Tabs
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Current Tabs
+    -
+        Name: CocCoc Download Metadata
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: DownloadMetadata
+    -
+        Name: CocCoc Extension Cookies
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Extension Cookies
+    -
+        Name: CocCoc Favicons
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Favicons*
+    -
+        Name: CocCoc History
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: History*
+    -
+        Name: CocCoc Last Session
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Last Session
+    -
+        Name: CocCoc Last Tabs
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Last Tabs
+    -
+        Name: CocCoc Sessions Folder
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\Sessions\
+        Recursive: false
+    -
+        Name: CocCoc Login Data
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Login Data*
+    -
+        Name: CocCoc Media History
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Media History*
+    -
+        Name: CocCoc Network Action Predictor
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Network Action Predictor
+    -
+        Name: CocCoc Network Persistent State
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Network Persistent State
+    -
+        Name: CocCoc Preferences
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Preferences
+    -
+        Name: CocCoc Quota Manager
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: QuotaManager
+    -
+        Name: CocCoc Reporting and NEL
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Reporting and NEL
+    -
+        Name: CocCoc Shortcuts
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Shortcuts*
+    -
+        Name: CocCoc Top Sites
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Top Sites*
+    -
+        Name: CocCoc Trust Tokens
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Trust Tokens*
+    -
+        Name: CocCoc SyncData Database
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\Sync Data
+        Recursive: true
+    -
+        Name: CocCoc Visited Links
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Visited Links
+    -
+        Name: CocCoc Web Data
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\*\
+        FileMask: Web Data*
+    -
+        Name: Windows Protect Folder
+        Category: FileSystem
+        Path: C:\Users\%user%\AppData\Roaming\Microsoft\Protect\*\
+        Recursive: true
+        Comment: "Required for offline decryption"
+    -
+        Name: CocCoc Snapshots Folder
+        Category: Communications
+        Path: C:\Users\%user%\AppData\Local\CocCoc\Browser\User Data\Snapshots\*\
+        Recursive: true
+        Comment: "Grabs folder that appears to have snapshots of CocCoc SQLite DBs organized by version #."
+
+# Documentation
+# https://coccoc.com/
diff --git a/Targets/Browsers/EdgeChromium.tkape b/Targets/Browsers/EdgeChromium.tkape
@@ -1,14 +1,9 @@
 Description: Microsoft Edge Chromium Artifacts
 Author: Chad Tilbury and Andrew Rathbun
-Version: 1.1
+Version: 1.2
 Id: 2844dba2-fb47-466c-8d57-dab2bc02294f
 RecreateDirectories: true
 Targets:
-    -
-        Name: Edge bookmarks
-        Category: Communications
-        Path: C:\Users\%user%\AppData\Local\Microsoft\Edge\User Data\*\
-        FileMask: Bookmarks*
     -
         Name: Edge Collections
         Category: Communications