Image for post
Image for post

Browsers Artifacts

Mozilla Firefox

C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\C:\Users\XXX\AppData\Local\Mozilla\Firefox\Profiles\[profileID].default\
C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\places.sqlite
C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\bookmarkbackups\
C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\cookies.sqlite
C:\Users\XXX\AppData\Local\Mozilla\Firefox\Profiles\[profileID].default\cache2\entriesC:\Users\XXX\AppData\Local\Mozilla\Firefox\Profiles\[profileID].default\startupCache
C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\formhistory.sqlite
C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\addons.sqliteC:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\extensions.sqlite
C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\favicons.sqlite
C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\prefs.js
- LoginsC:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\logins.json- PasswordsC:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\key4.dbC:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\key3.db (Older Version)
C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\sessionstore.jsonlz4C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\sessionstore-backups\
C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\[profileID].default\downloads.sqlite
C:\Users\XXX\AppData\Local\Mozilla\Firefox\Profiles\[profileID].default\thumbnails

Google Chrome

C:\Users\XXX\AppData\Local\Google\Chrome\User Data\DefaultC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData
C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\HistoryC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\History
C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\CookiesC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Cookies
C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\CacheC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Cache
C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\BookmarksC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Bookmarks
C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\Web DataC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Web Data
C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\FaviconsC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Favicons
C:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Login Data
- Current Sessions / TabsC:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\Current SessionC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Current SessionC:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\Current TabsC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Current Tabs- Last (Previous) Sessions / TabsC:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\Last SessionC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Last SessionC:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\Last TabsC:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Last Tabs
C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\C:\Users\XXX\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\
C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\Top SitesC:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\Thumbnails (Older versions)

Microsoft Edge

C:\Users\XX\AppData\Local\Packages\Microsoft.MicrosoftEdge_XXX\AC
C:\Users\XX\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
C:\Users\XX\AppData\Local\Packages\Microsoft.MicrosoftEdge_XXX\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\XXX\DBStore\spartan.edb
C:\Users\XXX\AppData\Local\Packages\Microsoft.MicrosoftEdge_XXX\AC\#!XXX\MicrosoftEdge\Cache
- Last Active SessionC:\Users\XX\AppData\Local\Packages\Microsoft.MicrosoftEdge_XXX\AC\MicrosoftEdge\User\Default\Recovery\Active

Internet Explorer [Coming Soon]

Opera [Coming Soon]

Safari [Coming Soon]

Tools

Resources

Written by

#ThreatHunting #WindowsInternals #Malware #DFIR and occasionally #Python.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store