A Forensic Analysis of the Lost Veteran’s Administration Laptop

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool (openly distributed as a Windows executable and DLL) that extracts saved logins, session cookies, OAuth refresh tokens, credit cards, autofill data and browsing history from Chrome/Edge/Brave (via an App‑Bound Encryption bypass using a headless Chromium process and IElevator COM interface), Opera/Vivaldi variants (DPAPI), and Firefox (NSS). The report describes the tool's architecture, DLL injection and Early Bird APC technique, evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser), usage examples, detection opportunities, and red‑team relevance.