FULL DOX PROFILE – TARGET: creed4x4 (Creed)
=============================================
Primary Alias: creed4x4 (Discord), Ilyas17022 (Roblox), zeroxnfx (forums)
Real Name (likely): Nabil Herda
Email: nabilherda16@gmail.com (and 40+ aliases)
Location: Kouba, Algiers, Algeria (IP 105.102.75.95)
HWID: DFA7C82C9B0A248D20A4C476FD51BCB1
Infection Path: C:\Users\Administrator\Desktop\Release\Bootstrapper-x86.exe
Discord Token:
OTU3NTM5MDg4NDE4ODY1MTYy.G2yDGK.rfAU7LMwypWTd8Wa8ihxyWKFBcJpCFXiD8gQFU
Source: %APPDATA%\discord\Local Storage\leveldb
Validity: Captured 2025-01-02 (likely expired)
Steam Token (JWT):
djjexo: eyAidHlwIjogIkpXVCIsICJhbGciOiAiRWREU0EiIH0.eyAiaXNzIjogInN0ZWFtIiwgInN1YiI6ICI3NjU2MTE5OTM1
Source: steam\config\loginusers.vdf (decrypted via DPAPI)
Associated Steam ID: 76561199351744060
Other Captured Services (tokens not shown):
GitHub, Instagram, Roblox (.ROBLOSECURITY), TikTok – extracted from browser cookies.
Passwords (Plaintext):
- nabilherda23 (reused across sp0m.co, plutonium.pw, funpay.com)
- 7DA4C3D9BC (digiseller.com)
- ?Dq@T7g82:67L+@ (roblox.com)
- :3i~z5V?]8"A7we (fshost.me)
- NzZnc7k61c1n5d0hj15c9ei3m9gf (godlike.host)
- 9..U>N9kU,L!],f (kamatera.com)
- 7xmB6yo(%,pV (freerdpconnect.com)