Apps artifacts
194 KAPE targets for Windows forensic collection in the Apps category.
Targets
194 in the Apps category
- 1Password1Password Password Manager3 paths
- 4KVideoDownloader4K Video Downloader2 paths
- AccessRemotePCRemotePC artifacts1 path
- AceTextAceText1 path
- AcronisTrueImageAcronis True Image3 paths
- Action1Action1 Application Logs and Data3 paths
- AdvancedIPScannerAdvanced IP Scanner Artifacts29 paths
- AdvancedPortScannerAdvanced Port Scanner Artifacts29 paths
- AgentRansackAgent Ransack - Free File Searching Utility4 paths
- AlpemixAlpemix artifacts1 path
- AmmyyAmmyy Data1 path
- AnyDeskAnyDesk11 paths
- AsperaConnectAspera Connect Log Files2 paths
- AspiaAspia artifacts3 paths
- AteraAgentAteraAgent5 paths
- BoxDrive_MetadataBox Cloud Storage Metadata2 paths
- BoxDrive_UserFilesBox Cloud Storage Files2 paths
- BreezeRMMBreezeRMM artifacts3 paths
- ChatGPTA Target to collect files related to ChatGPT Desktop5 paths
- ChocolateyChocolatey1 path
- CiscoJabberJabber1 path
- ClaudeCodeClaude Code (Anthropic agentic coding CLI) session transcripts, prompt history, configuration, hooks, and IDE integration artifacts34 paths
- ClineCline (VS Code AI coding agent) task conversation histories, MCP settings, checkpoints, and global state13 paths
- ClipboardMasterClipboardMaster3 paths
- ConfluenceLogsConfluence Log Files2 paths
- ControlRControlR artifacts3 paths
- ControlioControlio artifacts1 path
- CursorCursor AI editor agent chat history, composer data, local file history, MCP and hook configuration, and logs20 paths
- DWAgentDWAgent Log Files1 path
- DeveloperCloudCredentialsCollect common developer and cloud credential artifacts useful during incident response9 paths
- DirectoryOpusDirectory Opus4 paths
- DiscordDiscord Cache and LevelDB Files2 paths
- DoubleCommanderDouble Commander7 paths
- Dropbox_MetadataDropbox Cloud Storage Metadata6 paths
- Dropbox_UserFilesDropbox Cloud Storage Files1 path
- EFCommanderEF Commander1 path
- EvernoteEvernote3 paths
- Everything (VoidTools)Everything (VoidTools)4 paths
- FaronicsDeepFreezeFaronics Deep Freeze artifacts1 path
- FaronicsDeployFaronics Deploy artifacts2 paths
- FastStoneImageViewerFastStone Image Viewer1 path
- FencesFences1 path
- FileZillaClientFileZilla XML and SQLite Log Files2 paths
- FileZillaServerFileZilla Server Logs2 paths
- FleetDeckFleetDeck artifacts1 path
- FortiClientVPNForti Client VPN2 paths
- FreeCommanderFreeCommander XE7 paths
- FreeDownloadManagerFree Download Manager3 paths
- FreeFileSyncFreeFileSync1 path
- FreshserviceFreshservice Discovery Agent artifacts4 paths
- GLPIAgentGLPI Agent artifacts3 paths
- GeminiCLIGoogle Gemini CLI chat session logs, prompt history, shell history, checkpoints, and configuration17 paths
- GetScreenGetScreen artifacts3 paths
- GitHubCopilotGitHub Copilot CLI and Copilot Chat (VS Code) agent sessions, prompt history, configuration, and MCP settings18 paths
- GoToMyPCGoToMyPC artifacts1 path
- GoogleDriveBackupSync_UserFilesGoogle Backup and Sync Storage Files1 path
- GoogleDrive_MetadataGoogle Drive Metadata2 paths
- GoogleEarthGoogle Earth4 paths
- GoreloRMMGorelo RMM artifacts2 paths
- HeidiSQLHeidiSQL2 paths
- HexChatHexChat1 path
- HopToDeskHopToDesk artifacts1 path
- IDriveIDrive Backup Artifacts14 paths
- ISLOnlineISLOnline Remote Access Tool8 paths
- ITarianITarian RMM4 paths
- IceChatIceChat1 path
- ImgBurnImgBurn1 path
- ImmyBotImmyBot artifacts4 paths
- InvGateInvGate artifacts3 paths
- IrfanViewIrfanView1 path
- JDownloader2JDownloader 25 paths
- JavaWebCacheJava WebStart Cache - (IDX Files)11 paths
- KaseyaKaseya Data9 paths
- KeepassKeepass3 paths
- KeepassXCKeepassXC2 paths
- KopiaKopia config file1 path
- LevelLevel.io Application Logs1 path
- LocalXposeLocalXpose artifacts1 path
- LogMeInLogMeIn Data1 targets
- MacriumReflectMacrium Reflect3 paths
- MattermostMattermost1 path
- MediaMonkeyMediaMonkey2 paths
- MegasyncMegaSync Data Collection1 path
- MeshAgentMeshAgent log and configuration files2 paths
- MicrosoftAzureCopyMicrosoft Azure Copy2 paths
- MicrosoftOneNoteMicrosoft OneNote5 paths
- MicrosoftStickyNotesMicrosoft Sticky Notes2 paths
- MicrosoftTeamsMicrosoft Teams5 paths
- MicrosoftToDoMicrosoft To Do2 paths
- MidnightCommanderMidnight Commander1 path
- MobaXTermMobaXTerm1 path
- MoniticMonitic artifacts1 path
- MouseWithoutBordersMouse Without Borders4 paths
- MstyDatabaseMsty is a UI to interact with large language models (LLMs)1 path
- MultiCommanderMulti Commander5 paths
- NVDANVDA artifacts2 paths
- NessusNessus2 paths
- NetBirdNetBird artifacts1 path
- NetLockRMMNetLock RMM artifacts2 paths
- NetMonitorforEmployeesProfessionalNet Monitor for Employees Pro6 paths
- NiniteNinite Pro artifacts2 paths
- Notepad++Notepad++ Backups, recently searched/replaced terms and recently opened documents3 paths
- NotionNotion Note-Taking App2 paths
- OneCommanderOne Commander2 paths
- OneDrive_MetadataMicrosoft OneDrive Storage Metadata1 path
- OneDrive_UserFilesMicrosoft OneDrive Storage Files1 path
- OpenAICodexOpenAI Codex CLI (agentic coding CLI) session rollouts, prompt history, state databases, and configuration19 paths
- OpenCodeOpenCode (open-source terminal coding agent) session database, logs, snapshots, and configuration13 paths
- OpenSSHClientOpenSSH Client config, known hosts and keys9 paths
- OpenSSHServerOpenSSH Server Config and Logs9 paths
- OpenVPNClientOpenVPN Client Config and Log3 paths
- OpsBridgeAgentOpsBridge Agent artifacts3 paths
- OutlookPSTOSTOutlook PST and OST files8 paths
- PDQConnectPDQ Connect artifacts1 path
- PDQDeployPDQ Deploy database1 path
- PaloAltoPalo Alto Networks GlobalProtect VPN logs2 paths
- PeaZipPeaZip1 path
- ProtonVPNProtonVPN4 paths
- PulseSecurePulse Secure4 paths
- Q-DirQ-Dir2 paths
- QFinderPro (QNAP)QFinderPro (QNAP)1 path
- QlikSenseQlik Sense4 paths
- RDCManA Target to collect files that are related to RDCMan4 paths
- RMMmaxRMMmax artifacts2 paths
- RadminRadmin Server/Viewer Logs and Chats5 paths
- RcloneConfRclone config file25 paths
- RemSuppRemSupp artifacts4 paths
- RemcosRemcos RAT10 paths
- RemoteDesktopManagerA Target to collect files that are related to Remote Desktop Manager from Devolutions6 paths
- RemoteManipulatorSystemRemote Manipulator System (RMS)3 paths
- RemoteRippleRemote Ripple artifacts2 paths
- RemoteUtilities_appRemote Utilities3 paths
- RemotelyRemotely artifacts2 paths
- Robo-FTPRobo-FTP14 paths
- RooCodeRoo Code (VS Code AI coding agent, archived May 2026) task conversation histories, MCP settings, custom modes, and checkpoints4 paths
- RustDeskRustDesk2 paths
- SSHTunnelCommandArtifactsCollect command history, scripts, and SSH client artifacts useful for identifying SSH tunneling and pivoting commands10 paths
- ScreenConnectScreenConnect Data (now known as ConnectWise Control)1 targets
- SessionSession Desktop1 path
- SetMePROSetMe PRO artifacts3 paths
- ShareXShareX1 path
- SiemensTIACopy Siemens TIA Settings1 path
- SignalSignal (Please view this tkape file for documentation on decryption!)4 paths
- SimpleHelpSimpleHelp Remote Access Client3 paths
- SkypeSkype7 paths
- SlackSlack5 paths
- SnagitSnagit1 path
- SoftPerfectNetscanSoft Perfect Network Scanner Output1 path
- SpeedCommanderSpeedCommander1 path
- SplashtopSplashtop7 paths
- SteamSteam12 paths
- SublimeTextSublime Text 2/3/4 Auto Save Session2 paths
- SugarSyncSugarSync3 paths
- SumatraPDFSumatraPDF2 paths
- SupremoRemoteDesktopSupremo Remote Desktop Control Logs2 paths
- SyncthingSyncthing Configuration and Logs3 paths
- TablacusExplorerTablacus Explorer3 paths
- TailscaleA Target to collect files from Tailscale3 paths
- TeamViewerLogsTeamViewer Logs7 paths
- TelegramTelegram Desktop2 paths
- TeleportConnectTeleport Connect artifacts4 paths
- TeraCopyTeraCopy log history1 path
- TeramindTeramind Agent artifacts3 paths
- ThunderbirdMozilla Thunderbird Email Client11 paths
- TiFLUXTiFLUX artifacts3 paths
- TotalCommanderTotal Commander7 paths
- TreeSizeTreeSize - Scan History1 path
- TrustConnectTrustConnect artifacts2 paths
- UEMSUEMS Manage Engine Agent2 paths
- UltraviewerUltraViewer4 paths
- VIZORVIZOR Asset Management Client artifacts1 path
- VLC Media PlayerVLC Media Player2 paths
- VMwareInventoryVMware - Virtual Machine Inventory1 path
- VMwareMemoryVMware - Virtual Machine Memory3 paths
- VNCLogsVNC Logs1 targets
- VeyonVeyon artifacts2 paths
- ViberViberPC Messaging App5 paths
- VirtualBoxConfigCollects VirtualBox configuration files2 paths
- VirtualBoxLogsCollects VirtualBox log files3 paths
- VirtualBoxMemoryVirtualBox - Memory1 path
- VisualStudioCodeVisual Studio Code artifacts9 paths
- WhatsAppWhatsApp Local Files4 paths
- WhatsApp_MediaWhatsApp Shared Media Files2 paths
- WinSCPWinSCP1 path
- WindowsYourPhoneWindows Your Phone1 path
- XYplorerXYplorer4 paths
- XeoxXeox Application Logs1 path
- ZScalerZscaler Logs1 path
- ZohoAssistZoho Assist artifacts7 paths
- ZoomZoom client artifacts4 paths
- iTunesBackupiTunes Backups3 paths
- mIRCmIRC2 paths
- mRemoteNGmRemoteNG3 paths
- pCloudDatabasepCloud Database3 paths