ChromeCracker

You are conducting a digital forensics investigation on a compromised Windows system. Preliminary analysis indicates the attacker accessed several online services, including a specific cryptocurrency website (chaincrypto.com, as revealed later in the process). Your primary objective is to recover the login credentials the attacker used or saved for this cryptocurrency site by analyzing artifacts recovered from the system. These artifacts include a memory dump of the critical LSASS process and the attacker's Chrome browser profile data, which contain the encrypted secrets needed. This challenge focuses on decrypting passwords saved in Google Chrome using offline artifacts obtained during the investigation. You are provided with a single archive, **chrome_cracker.zip**, which contains: **lsass.DMP** (a memory dump file of the Local Security Authority Subsystem Service) and **Google.zip** (an archive containing a user's Chrome profile directory). The goal is to leverage these files, along with tools like Mimikatz and specialized decryption scripts, to extract the DPAPI master key, decrypt Chrome's encryption key, and finally decrypt the passwords stored in the Login Data database.