Evidence — Antivirus Scan Report — BoosterMod_v2.exe

// digital evidence analysis

0 pts

Details

File: BoosterMod_v2.exe SHA256: a3f9c1... Verdict: MALICIOUS — Infostealer.TokenGrabber Behaviour: Reads browser cookie store, extracts tokens matching ".ROBLOSECURITY" and "dcfduid" (Discord session token), sends via HTTP POST to 185.220.xx.xx Note: File was downloaded by Alex on 2024-11-01, 13 days before the breach. No login alert was generated because the attacker used Alex's valid session token — 2FA was never prompted.

File Type: Log

Mini-Game 25 pts

Alex had 2FA enabled, yet the attacker logged in with no 2FA challenge. The antivirus report explains why. What happened?

A Alex must have approved the login by mistake

B The attacker bribed Discord to disable 2FA on Alex's account

C The malware stole Alex's session token, so the attacker never needed to log in at all

D 2FA only works on mobile, not desktop

Back to Evidence List

NOTEBOOK

DOSSIER // ID: 1d51fba9