# E04. Authenticated payload-decryption analysis

## Material and recorded procedure

The analysis record dated 22 July 2026 describes recovery of three encrypted payloads from the VSIX through static analysis. An Acorn parse identified decoder wrappers and the expression constructing an AES-256 key from sixteen fragments: nine decoder-wrapper calls and seven literals. String-array rotation was resolved across multiple call sites before decoding. The target JavaScript was not imported or executed as part of that procedure. [S1]

The recorded encrypted layout is a 12-byte initialization vector, a 16-byte authentication tag and the remaining ciphertext. The record reports successful AES-GCM authentication for all three payloads using a cryptographic library. This is stronger than judging the plaintext by appearance. The decryption was not rerun in preparing this document, so the authentication result remains a reported case result rather than a new independent verification. Key material is omitted.

## Recovered payload identities

- `detect_malware.py`: 60,054 bytes; SHA-256 `4c3fdd86a59d52a0e29f472666cbf9472b6fd83c38ef2a4b547f31c72b8ee87e`.
- `windows-agent-node.js`: 56,093 bytes; SHA-256 `e5b7d6411d0c95da047185d94fca98d454b73df2e7f46f2753e212af2ca45da5`.
- `windows-js-pipeline.js`: 32,324 bytes; SHA-256 `bf820623e8deaa37092650c7fae594e56b8d81c27b541419006cca2d0536353b`.

The outputs are readable, commented Python and JavaScript. Encryption at rest and source obfuscation are separate properties. [S1]

## Functional observations

The Python source describes Chromium key recovery through DPAPI and browser elevation services, with caller-path conditions for App-Bound Encryption. The pipeline coordinates local collection, elevated decryption, upload and cleanup. The Node agent implements a Windows collection route that does not require the native Go agent. These observations support platform-specific execution branches and explain why native-agent hashes alone do not cover all variants. [S1]

## Limits

Comments describe intended behavior and may be incomplete or inaccurate. Authentication ties plaintext to encrypted input but does not show successful browser decryption, elevation or exfiltration. Those outcomes depend on browser version, policy, user context and host state. E19 separately assesses the elevation attempt. Distinct recovered keys establish key differences between the examined branches, not independent authorship or a universal deployment policy.