Manifests, cookies, and per-file downloads from stealer log_id.
Stealer rows sometimes include log_id, a pointer to the full infostealer package for that victim machine. OsintX opens a file tree: system info, browser folders, cookies, passwords, and screenshots. You download individual files without pulling the entire archive when the upstream supports per-file access.
Manifests routinely list dozens of files across Chrome, Edge, Firefox, Discord tokens, wallet extensions, and desktop screenshots. Investigators use this layer to prove device compromise, recover session cookies for timeline analysis, and correlate machine names with FiveM or gaming logins from stealer rows.
How you get there
- Run stealer search on email, username, IP, domain, or Discord ID
- Click log_id on any row that includes it
- Or call API v1 stealer victims routes with the logId from JSON export
What the explorer shows
log_id · a3f9…c21
System.txt
▸ Browsers/
Chrome · Default · Cookies
Edge · Passwords
▸ Screenshots/
desktop_001.png
| Type | Login | Password | URL |
|---|---|---|---|
| analyst@example.com | •••••••• | login.example.com | |
| user | player_2849 | •••••• | discord.com |
| billing@corp.io | •••••••••• | paypal.com |
Manifest JSON lists file names, sizes, and MIME hints. Cookie and password files open in the viewer with secrets masked in the UI. Screenshots download as binary attachments through the same logId and fileId pair.
API v1
- GET /api/v1/stealer/victims/{logId}, file manifest and metadata
- GET /api/v1/stealer/victims/{logId}/files/{fileId}, raw file bytes
- Use the same logId string shown in dashboard rows (validated server-side)
Timing
Large manifests can take tens of seconds to list; file downloads may stream. Keep the investigation tab open until the tree finishes loading.
