Raw data
An unlocked inventory item gives access to the infected machine’s archive. The archive can be browsed as a tree and read file by file without downloading it whole.
Structure of an archive
A typical archive is grouped under a folder for the infected machine. Inside you find:
passwords.txt — saved credentials stolen from browsers (URL, user, password).Autofill/ — form autofill data (name, address, phone).Cookies/ — session cookies (usable for session hijacking).System info — operating system, hardware id, installed antivirus, IP and country.
Masking
When the archive is served, passwords are masked — the password of a credential that belongs to your own protected asset stays visible, while other passwords in the archive become ****. So you see your own leak, not third parties’ passwords.