# E05. Payload capability re-examination

## Scope and method

The 24 July re-examination used static text searches, binary strings and archive listings across eighteen decrypted or text samples, a Go implant and a Windows agent bundle. No sample was executed. The analysis sought password-manager collection, keylogging indicators, shortener references and capture components. Conclusions here apply to the examined material and search methods. [S1]

## Password-manager files

Two large JavaScript payloads include `.kdbx` in a private-key extension set used by collection predicates. This supports selection of encrypted KeePass databases through a generic file sweep. It does not establish a KeePass-specific parser, master-password recovery or successful database unlocking. Chance matches inside encoded dropper content were excluded. Negative searches for other password-manager names do not prove those products are unaffected. [S1]

## Capture implementation

The Go binary contains capture-related symbols including `CaptureAndSend`, `Loop`, `encodeBlocks`, `blockChanged`, `copyPrev` and `frameFPS`. Their combination is consistent with repeated capture and block-level frame differencing. The Windows bundle includes `node-screenshots`, its native capture module, `jpeg-js`, MessagePack and WebSocket dependencies. Installer checks reject a bundle missing required capture files. A task named `GoogleUpdateSupporterNode` is recorded for that component. [S1]

These findings support a capture-streaming implementation assessment, not proof of an observed stream. Dependency presence, linked symbols and runtime reachability are different evidence types. An earlier dependency comparison suggested a capture-free Linux build; E18 explains why that conclusion is not sufficient to dismiss the later symbol evidence.

## Negative searches and corrections

The tested key-listener packages and platform hook strings were not found. Go TLS symbols containing `keylog` refer to TLS key logging, not keystroke capture. The original categorical claim that keylogging was impossible is narrowed here to a bounded negative search. Likewise, absence of family names or shortener strings does not establish absence of related behavior or code lineage. [S1]

The content comparison in Exhibit E05-7 finds that the two equal-length payloads differ only in ZIP timestamps for two package-lock members inside their embedded Windows bundles. Their configuration is identical. This corrects the source note’s configuration-difference claim. The Windows bundle also includes synthetic input injection and clipboard modules; its capture/transport dependency list is not a complete inventory of capabilities. Synthetic input injection is distinct from keystroke capture.

## Artifact identity

The examined Go implant has SHA-256 `ef183bbb40f4c7c3f4b52994cdba3295f3eab2604fdad99eefa3b67b8d966e8d`. The large JavaScript sample has SHA-256 `694626bed2df1f0d0026a3f7ead7692b44c7e73041cdd799b79a025335533cdc`. [S2]