{
	"id": "225a3010-b829-407c-ba1c-3a345d8d6507",
	"created_at": "2026-04-06T00:17:05.680702Z",
	"updated_at": "2026-04-10T03:36:47.794627Z",
	"deleted_at": null,
	"sha1_hash": "b0f5cfe11316d478f04d4dcf06a4bb6b33a8763e",
	"title": "ChromeCookiesView - Chrome Cookies Viewer",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 105723,
	"plain_text": "ChromeCookiesView - Chrome Cookies Viewer\r\nArchived: 2026-04-05 17:25:30 UTC\r\n \r\nChromeCookiesView v1.85 - View / delete cookies of Google Chrome Web browser\r\nCopyright (c) 2011 - 2025 Nir Sofer\r\nDescription\r\nChromeCookiesView is an alternative to the standard internal cookies viewer of Google Chrome Web browser. it\r\ndisplays the list of all cookies stored by Google Chrome Web browser, and allows you to easily delete unwanted\r\ncookies. It also allows you export the cookies into text/csv/html/xml file.\r\nFor every cookie, the following information is displayed: Host Name, Path, Name, Value, Secure (Yes/No), HTTP\r\nOnly Cookie (Yes/No), Last Accessed Time, Creation Time, Expiration Time.\r\nSystem Requirements\r\nThis utility works on any version of Windows, starting from Windows XP and up to Windows 11, and with\r\nany version of Google Chrome.\r\nVersions History\r\nVersion 1.85:\r\nhttps://www.nirsoft.net/utils/chrome_cookies_view.html\r\nPage 1 of 9\n\nUpdated the external drive feature to decrypt the version 3 of Chrome App-Bound Encryption.\r\nThere is a new field you have to fill: CNG System Keys Folder (For example:\r\nK:\\ProgramData\\Microsoft\\Crypto\\SystemKeys ).\r\nVersion 1.84:\r\nAdded support for decrypting cookies encrypted with app-bound encryption on new versions of\r\nChrome (Version 3 of Chrome App-Bound Encryption)\r\nBe aware: The new app-bound encryption (version 3) uses the Next Generation Cryptography API\r\n(CNG) to encrypt and decrypt the encryption key. Currently, the external drive feature cannot\r\ndecrypt the CNG key and thus it fails to recover the cookies if you have the version 3 of Chrome\r\napp-bound encryption.\r\nVersion 1.83:\r\nUpdated to decrypt the cookies properly when the app-bound encryption feature is disabled\r\n(ApplicationBoundEncryptionEnabled Registry value set to 0).\r\nVersion 1.82:\r\nFixed problem from version 1.81: On some systems, the following error was displayed when trying\r\nto run the .exe file: \"This application failed to start because side-by-side configuration is incorrect\".\r\nVersion 1.81:\r\nUpdated to decrypt the new app-bound encryption key (Chrome version 134).\r\nVersion 1.80:\r\nAdded support for decrypting cookies encrypted with app-bound encryption on new versions of\r\nChrome. This feature only works when you run ChromeCookiesView as Administrator.\r\nAdded 'System Protect Folder' and 'Registry Hives Folder' fields to the external drive feature. You\r\nmust fill these fields if the cookies are encrypted with the new app-bound encryption.\r\nAdded 'Encryption Type' column. (for app-bound encryption, this column displays 'v20', for\r\nprevious encryption method, this column displays 'v10' )\r\nAdded 'Run As Administrator' option (Ctrl+F11) under the help menu.\r\nAdded /RunAsAdmin command-line option for running ChromeCookiesView as administrator.\r\nVersion 1.76:\r\nAdded 'Sort By' toolbar button.\r\nVersion 1.75:\r\nWhen the cookies file is locked by Chrome Web browser, ChromeCookiesView now displays an\r\nerror message.\r\nVersion 1.74:\r\nFixed a problem with decrypting cookies from external drive on Windows 11 22H2.\r\nVersion 1.73:\r\nUpdated to keep the scroll position after you delete cookies.\r\nAdded 'Brave Cookies File' button to the 'Advanced Options' window.\r\nVersion 1.72:\r\nIf you try to delete cookies while the cookies file is locked by the Web browser,\r\nChromeCookiesView now displays the appropriate message.\r\nVersion 1.71:\r\nAdded 'Show Milliseconds In Time' option.\r\nhttps://www.nirsoft.net/utils/chrome_cookies_view.html\r\nPage 2 of 9\n\nVersion 1.70:\r\nChromeCookiesView now automatically detects the cookies file of the last used profile, when there\r\nare multiple profiles.\r\nVersion 1.69:\r\nFixed bug in the 'Edge Cookies File' button.\r\nVersion 1.68:\r\nUpdated to work properly with the new cookies file location (Under the Network subfolder).\r\nFixed the external drive feature to work properly if you sign in with Microsoft account.\r\nBe aware that in order to decrypt the cookies created while you signed in with Microsoft account,\r\nyou have to provide the random DPAPI password generated for your Microsoft account instead of\r\nthe actual login password. You can find this DPAPI password with the MadPassExt tool.\r\nVersion 1.67:\r\nAdded 'Copy Clicked Cell' option to the right-click context menu, which copies to the clipboard the\r\ntext of cell that you right-clicked with the mouse.\r\nVersion 1.66:\r\nAdded option to change the sorting column from the menu (View -\u003e Sort By). Like the column\r\nheader click sorting, if you click again the same sorting menu item, it'll switch between ascending\r\nand descending order. Also, if you hold down the shift key while choosing the sort menu item, you'll\r\nget a secondary sorting.\r\nVersion 1.65:\r\nAdded 'Decode Escape Sequence' option (turned on by default). You can turn off this option if you\r\nwant to get the original name/value without escape sequence decoding.\r\nVersion 1.61:\r\nFixed ChromeCookiesView to decrypt the new cookies encryption on Opera Web browser (The\r\n'Local State' file is stored inside the profile instead of the parent folder)\r\nVersion 1.60:\r\nAdded support for decrypting the encrypted cookie values of Chrome/Chromium version 80 or later\r\n(They changed the encryption algorithm).\r\nBe aware that the 'Local State' file ( located inside the 'User Data' folder) contains the encryption\r\nkey needed to decrypt the cookies of Chromium 80.\r\nIn most cases, ChromeCookiesView will find your 'Local State' file automatically, but if it fails to\r\nfind this file from some reason, you can manually type the 'Local State' filename in the 'Advanced\r\nOptions' window.\r\nVersion 1.58:\r\nAdded 'Edge Cookies File' button to the 'Advanced Options' window, which automatically fills the\r\ncookies file of the new Chromium-Based Edge Web browser.\r\nVersion 1.57:\r\nThe decryption process of external drive cookies is now much faster.\r\nVersion 1.56:\r\nAdded 'Add Remark Line To cookies.txt' option. When it's turned on, '# Netscape HTTP Cookie\r\nFile' header line is added to cookies.txt file format.\r\nhttps://www.nirsoft.net/utils/chrome_cookies_view.html\r\nPage 3 of 9\n\nWhen pressing F5 (Refresh) the refresh process is smoother, keeping the selected item and scroll\r\nposition.\r\nVersion 1.55:\r\nAdded /DeleteCookiesWildcard which allows you to delete cookies from command-line that match\r\nthe specified wildcard, for example:\r\n/DeleteCookiesWildcard \"*.Google.com\"\r\nVersion 1.51:\r\nAdded 'Put Icon On Tray' option.\r\nVersion 1.50:\r\nAdded /DeleteCookies command-line option to delete cookies from command-line.\r\nVersion 1.48:\r\nAdded 'Add Header Line To CSV/Tab-Delimited File' option (Turned on by default).\r\nFixed bug: ChromeCookiesView failed to remember the last size/position of the main window if it\r\nwas not located in the primary monitor.\r\nVersion 1.47:\r\nFixed to read the cookies file in the latest versions of Chrome.\r\nVersion 1.46:\r\nAdded 'Auto Size Columns+Headers' option.\r\nVersion 1.45:\r\nAdded 'Decrypt cookies from external drive' option (In 'Advanced Options' window). In order to\r\ndecrypt the cookies from external drive, you have to specify the Protect folder of Windows (e.g:\r\nF:\\Users\\user1\\AppData\\Roaming\\Microsoft\\Protect ) and the login password of the user.\r\nVersion 1.40:\r\nAdded option to specify the cookies file from command-line, for example:\r\nChromeCookiesView.exe /CookiesFile \"c:\\temp\\cookies\"\r\nAdded Auto-Complete support for the cookies file text-box.\r\nVersion 1.35:\r\nAdded 'Quick Filter' feature (View -\u003e Use Quick Filter or Ctrl+Q). When it's turned on, you can\r\ntype a string in the text-box added under the toolbar and ChromeCookiesView will instantly filter\r\nthe cookies, showing only lines that contain the string you typed.\r\nVersion 1.30:\r\nAdded option to save in cookies.txt format (In File -\u003e Save Selected Items option)\r\nAdded /scookiestxt command-line option to save in cookies.txt format.\r\nVersion 1.25:\r\nAdded new buttons to easily choose the cookies file of Chrome-base Web browsers: 'Vivaldi\r\nCookies File', 'Yandex Cookies File' (Advanced Options window).\r\nVersion 1.20:\r\nFixed ChromeCookiesView to display the value of encrypted cookies.\r\nVersion 1.15:\r\nFixed to work properly with the latest version of Chrome.\r\nVersion 1.12:\r\nhttps://www.nirsoft.net/utils/chrome_cookies_view.html\r\nPage 4 of 9\n\nAdded 'Opera Cookies File' button to the 'Advanced Options' window, which allows you to easily\r\nuse this tool to view the cookies of Opera Web browser. (Opera is now based on the code of Chrome\r\nWeb browser...)\r\nFixed the 'Default Cookies File' button in the 'Advanced Options' window.\r\nVersion 1.11:\r\nFixed bug: ChromeCookiesView deleted cookies that are not selected if they had the same creation\r\ntime.\r\nVersion 1.10:\r\nAdded secondary sorting support: You can now get a secondary sorting, by holding down the shift\r\nkey while clicking the column header. Be aware that you only have to hold down the shift key when\r\nclicking the second/third/fourth column. To sort the first column you should not hold down the Shift\r\nkey.\r\nFixed to display date/time values according to daylight saving time settings.\r\nFixed a crash problem occurred in some systems.\r\nVersion 1.05 - Added option to copy the selected cookies in Netscape cookies.txt format (Ctrl+N)\r\nVersion 1.02 - Fixed a crash problem that occurred when loading the cookies.\r\nVersion 1.01 - Fixed bug: The date/time columns displayed incorrect values.\r\nVersion 1.00 - First release.\r\nUsing ChromeCookiesView\r\nChromeCookiesView doesn't require any installation process or additional DLL files. In order to start using it,\r\nsimply run the executable file - ChromeCookiesView.exe\r\nThe main window of ChromeCookiesView displays the list of all cookies stored in your Google Chrome Web\r\nbrowser. You can select one or more chookie entries, and then use the 'Delete Selected Cookies' (Ctrl+Del) to\r\ndelete them.\r\nIf you want to view the cookies stored in another cookies file, go to 'Advanced Options' window (F9) and choose\r\nthe desired cookies file.\r\nCommand-Line Options\r\n/RunAsAdmin\r\nRuns ChromeCookiesView as\r\nadministrator.\r\n/DeleteCookies \u003cHost\u003e {Cookie Name} Deletes cookies from command-line.\r\nIf you specify only the host name, all\r\ncookies of this host name will be\r\ndeleted. If you also specify the\r\ncookie name, only this specific\r\ncookie will be deleted.\r\nExamples:\r\nChromeCookiesView.exe\r\nhttps://www.nirsoft.net/utils/chrome_cookies_view.html\r\nPage 5 of 9\n\n/DeleteCookies \".amazon.com\"\r\nChromeCookiesView.exe\r\n/DeleteCookies \".amazon.com\"\r\n\"session-token\"\r\n/DeleteCookiesWildcard \u003cHost Wildcard\u003e {Cookie Name Wildcard}\r\nSimilar to /DeleteCookies, but it also\r\nallows you to specify the host name\r\nand cookie name as wildcard. For\r\nexample, if you specify\r\n\"*.google.com\", all google.com\r\ncookies will be deleted (including\r\nwww.google.com,\r\naccounts.google.com, and so on)\r\nExamples:\r\nChromeCookiesView.exe\r\n/DeleteCookiesWildcard\r\n\"*.google.com\"\r\nChromeCookiesView.exe\r\n/DeleteCookiesWildcard\r\n\"*.amazon.*\" \"session*\"\r\n/CookiesFile \u003cFilename\u003e\r\nSpecifies the cookies file to load\r\nfrom command-line, for example:\r\nChromeCookiesView.exe\r\n/CookiesFile\r\n\"c:\\temp\\Chrome\\cookies\"\r\n/stext \u003cFilename\u003e\r\nSave the cookies list into a regular\r\ntext file.\r\n/stab \u003cFilename\u003e\r\nSave the cookies list into a tab-delimited text file.\r\n/scomma \u003cFilename\u003e\r\nSave the cookies list into a comma-delimited text file (csv).\r\n/stabular \u003cFilename\u003e\r\nSave the cookies list into a tabular\r\ntext file.\r\n/shtml \u003cFilename\u003e\r\nSave the cookies list into HTML file\r\n(Horizontal).\r\nhttps://www.nirsoft.net/utils/chrome_cookies_view.html\r\nPage 6 of 9\n\n/sverhtml \u003cFilename\u003e\r\nSave the cookies list into HTML file\r\n(Vertical).\r\n/sxml \u003cFilename\u003e Save the cookies list into XML file.\r\n/scookiestxt \u003cFilename\u003e\r\nSave the cookies list in cookies.txt\r\nformat.\r\n/sort \u003ccolumn\u003e\r\nThis command-line option can be\r\nused with other save options for\r\nsorting by the desired column. If you\r\ndon't specify this option, the list is\r\nsorted according to the last sort that\r\nyou made from the user interface.\r\nThe \u003ccolumn\u003e parameter can specify\r\nthe column index (0 for the first\r\ncolumn, 1 for the second column, and\r\nso on) or the name of the column,\r\nlike \"Host Name\" and \"Path\". You\r\ncan specify the '~' prefix character\r\n(e.g: \"~Secure\") if you want to sort in\r\ndescending order. You can put\r\nmultiple /sort in the command-line if\r\nyou want to sort by multiple\r\ncolumns.\r\nExamples:\r\nChromeCookiesView.exe /shtml\r\n\"f:\\temp\\cookies.html\" /sort 2 /sort\r\n~1\r\nChromeCookiesView.exe /shtml\r\n\"f:\\temp\\cookies.html\" /sort \"Host\r\nName\" /sort \"Path\"\r\n/nosort\r\nWhen you specify this command-line\r\noption, the list will be saved without\r\nany sorting.\r\nRead more about using ChromeCookiesView\r\nDelete Chrome cookies from command line and GUI\r\nTranslating ChromeCookiesView to other languages\r\nhttps://www.nirsoft.net/utils/chrome_cookies_view.html\r\nPage 7 of 9\n\nIn order to translate ChromeCookiesView to other language, follow the instructions below:\r\n1. Run ChromeCookiesView with /savelangfile parameter:\r\nChromeCookiesView.exe /savelangfile\r\nA file named ChromeCookiesView_lng.ini will be created in the folder of ChromeCookiesView utility.\r\n2. Open the created language file in Notepad or in any other text editor.\r\n3. Translate all string entries to the desired language. Optionally, you can also add your name and/or a link to\r\nyour Web site. (TranslatorName and TranslatorURL values) If you add this information, it'll be used in the\r\n'About' window.\r\n4. After you finish the translation, Run ChromeCookiesView, and all translated strings will be loaded from\r\nthe language file.\r\nIf you want to run ChromeCookiesView without the translation, simply rename the language file, or move\r\nit to another folder.\r\nLicense\r\nThis utility is released as freeware. You are allowed to freely use it at your home or in your company. However,\r\nyou are not allowed to make profit from this software or to charge your customers for recovering their passwords\r\nwith this software, unless you got a permission from the software author.\r\nYou are also allowed to freely distribute this utility via floppy disk, CD-ROM, Internet, or in any other way, as\r\nlong as you don't charge anything for this. If you distribute this utility, you must include all files in the distribution\r\npackage, without any modification !\r\nDisclaimer\r\nThe software is provided \"AS IS\" without any warranty, either expressed or implied, including, but not limited to,\r\nthe implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any\r\nspecial, incidental, consequential or indirect damages due to loss of data or any other reason.\r\nFeedback\r\nIf you have any problem, suggestion, comment, or you found a bug in my utility, you can send a message to\r\nnirsofer@yahoo.com\r\nChromeCookiesView is also available in other languages. In order to change the language of\r\nChromeCookiesView, download the appropriate language zip file, extract the 'chromecookiesview_lng.ini', and\r\nput it in the same folder that you Installed ChromeCookiesView utility.\r\nLanguage Translated By Date Version\r\nDutch Jan Verheijen 27/11/2025 1.85\r\nFrench Largo 26/11/2025 1.85\r\nGerman «Latino» 26/11/2025 1.85\r\nhttps://www.nirsoft.net/utils/chrome_cookies_view.html\r\nPage 8 of 9\n\nGreek iguru.gr 20/11/2022 1.73\r\nHebrew Chabadnik 07/03/2011 1.01\r\nHebrew peterg 12/06/2011 1.02\r\nHungarian Timinoun 16/12/2025 1.85\r\nItalian Styb 05/04/2025 1.81\r\nJapanese coolvitto 26/11/2025 1.85\r\nPersian ZendegiyeSabz 16/06/2025 1.83\r\nPolish Mariusz 05/09/2025 1.83\r\nRomanian Jaff (Oprea Nicolae) 30/12/2018 1.47\r\nRussian Ñïðàâêà ChromeCookiesView 03/12/2025 1.85\r\nSimplified Chinese DickMoore 20/12/2025 1.85\r\nSlovak František Fico 11/01/2026 1.85\r\nSwedish Lars-E 10/02/2012 1.02\r\nTraditional Chinese cjf8@Taiwan 27/05/2015 1.01\r\nTraditional Chinese Danfong Hsieh 26/11/2025 1.85\r\nTurkish HARUN ARI 16/02/2024 1.76\r\n  \r\nSource: https://www.nirsoft.net/utils/chrome_cookies_view.html\r\nhttps://www.nirsoft.net/utils/chrome_cookies_view.html\r\nPage 9 of 9",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.nirsoft.net/utils/chrome_cookies_view.html"
	],
	"report_names": [
		"chrome_cookies_view.html"
	],
	"threat_actors": [
		{
			"id": "2864e40a-f233-4618-ac61-b03760a41cbb",
			"created_at": "2023-12-01T02:02:34.272108Z",
			"updated_at": "2026-04-10T02:00:04.97558Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "ETDA:WildCard",
			"tools": [
				"RustDown",
				"SysJoker"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "9f101d9c-05ea-48b9-b6f1-168cd6d06d12",
			"created_at": "2023-01-06T13:46:39.396409Z",
			"updated_at": "2026-04-10T02:00:03.312816Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"CHROMIUM",
				"ControlX",
				"TAG-22",
				"BRONZE UNIVERSITY",
				"AQUATIC PANDA",
				"RedHotel",
				"Charcoal Typhoon",
				"Red Scylla",
				"Red Dev 10",
				"BountyGlad"
			],
			"source_name": "MISPGALAXY:Earth Lusca",
			"tools": [
				"RouterGod",
				"SprySOCKS",
				"ShadowPad",
				"POISONPLUG",
				"Barlaiy",
				"Spyder",
				"FunnySwitch"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "18a7b52d-a1cd-43a3-8982-7324e3e676b7",
			"created_at": "2025-08-07T02:03:24.688416Z",
			"updated_at": "2026-04-10T02:00:03.734754Z",
			"deleted_at": null,
			"main_name": "BRONZE UNIVERSITY",
			"aliases": [
				"Aquatic Panda",
				"Aquatic Panda ",
				"CHROMIUM",
				"CHROMIUM ",
				"Charcoal Typhoon",
				"Charcoal Typhoon ",
				"Earth Lusca",
				"Earth Lusca ",
				"FISHMONGER ",
				"Red Dev 10",
				"Red Dev 10 ",
				"Red Scylla",
				"Red Scylla ",
				"RedHotel",
				"RedHotel ",
				"Tag-22",
				"Tag-22 "
			],
			"source_name": "Secureworks:BRONZE UNIVERSITY",
			"tools": [
				"Cobalt Strike",
				"Fishmaster",
				"FunnySwitch",
				"Spyder",
				"njRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "256a6a2d-e8a2-4497-b399-628a7fad4b3e",
			"created_at": "2023-11-30T02:00:07.299845Z",
			"updated_at": "2026-04-10T02:00:03.484788Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "MISPGALAXY:WildCard",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "6abcc917-035c-4e9b-a53f-eaee636749c3",
			"created_at": "2022-10-25T16:07:23.565337Z",
			"updated_at": "2026-04-10T02:00:04.668393Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"Bronze University",
				"Charcoal Typhoon",
				"Chromium",
				"G1006",
				"Red Dev 10",
				"Red Scylla"
			],
			"source_name": "ETDA:Earth Lusca",
			"tools": [
				"Agentemis",
				"AntSword",
				"BIOPASS",
				"BIOPASS RAT",
				"BadPotato",
				"Behinder",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"Doraemon",
				"FRP",
				"Fast Reverse Proxy",
				"FunnySwitch",
				"HUC Port Banner Scanner",
				"KTLVdoor",
				"Mimikatz",
				"NBTscan",
				"POISONPLUG.SHADOW",
				"PipeMon",
				"RbDoor",
				"RibDoor",
				"RouterGod",
				"SAMRID",
				"ShadowPad Winnti",
				"SprySOCKS",
				"WinRAR",
				"Winnti",
				"XShellGhost",
				"cobeacon",
				"fscan",
				"lcx",
				"nbtscan"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "d53593c3-2819-4af3-bf16-0c39edc64920",
			"created_at": "2022-10-27T08:27:13.212301Z",
			"updated_at": "2026-04-10T02:00:05.272802Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"Earth Lusca",
				"TAG-22",
				"Charcoal Typhoon",
				"CHROMIUM",
				"ControlX"
			],
			"source_name": "MITRE:Earth Lusca",
			"tools": [
				"Mimikatz",
				"PowerSploit",
				"Tasklist",
				"certutil",
				"Cobalt Strike",
				"Winnti for Linux",
				"Nltest",
				"NBTscan",
				"ShadowPad"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775434625,
	"ts_updated_at": 1775792207,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b0f5cfe11316d478f04d4dcf06a4bb6b33a8763e.pdf",
		"text": "https://archive.orkl.eu/b0f5cfe11316d478f04d4dcf06a4bb6b33a8763e.txt",
		"img": "https://archive.orkl.eu/b0f5cfe11316d478f04d4dcf06a4bb6b33a8763e.jpg"
	}
}