Discover & Remove Alternate Data Streams (ADS)

DumpBrowserSecrets is a publicly documented post‑exploitation tool that extracts credentials and session material from major Windows browsers (Chrome/Edge/Brave via an App‑Bound Encryption bypass using IElevator and injected DLLs; Opera/Vivaldi via DPAPI keys; Firefox via NSS). The tool spawns headless browser processes, uses Early Bird APC DLL injection to retrieve decryption keys, parses SQLite/JSON stores, outputs structured JSON containing saved logins, cookies, OAuth tokens and more, and includes multiple evasion techniques intended to reduce EDR detection; the report describes attack scenarios, detection opportunities, and mitigation advice.