Dump QQ Preferences
Overview
Section titled “Overview”Evidence: Dump QQ Preferences
Description: Dump QQ Preferences
Category: Applications
Platform: macos
Short Name: qqprefs
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Browser preference files store sign-in, sync, and per-profile settings. During an infostealer investigation they show whether a browser profile was signed in, whether sync was enabled, and which account settings the browser stored.
This browser keeps Preferences and Secure Preferences in each profile.
Data Collected
Section titled “Data Collected”The collector copies the preference files into the acquired evidence. It does not parse them into Investigation Hub tables.
Collection Method
Section titled “Collection Method”The collector copies these files when they exist:
/Users/*/Library/Application Support/QQBrowser3/*/Preferences/Users/*/Library/Application Support/QQBrowser3/*/Secure Preferences
Forensic Value
Section titled “Forensic Value”The copied files let an analyst inspect sync status, signed-in accounts, and related browser settings from the evidence itself.
Preference files can contain account identifiers and sync settings. Handle them with the same access controls as other browser evidence.