# E18. Framework and sample comparison

## Comparison scope

The July analysis compares recovered Go build information with selected files from the public Overlord project, including its module dependencies and configuration examples. The comparison is bounded to the material examined at that time. It is not a comprehensive audit of all historical versions, forks or plugins. No upstream resource was fetched again for this document. [S1]

## Shared framework components

The module path, WebAssembly runtime, remote-control functions and transport configuration appear in the framework comparison. Those features identify software lineage rather than this campaign's operator. The framework's authors and other users cannot be attributed to the campaign merely because the samples derive from its code. [S1]

A recorded build revision was not found in the public repository examined. That result is compatible with a private clone, unpublished work, removed history or other metadata explanations. It does not by itself prove a particular private fork or who maintained it.

## Sample-specific findings

The comparison identifies SQLite-related dependencies and wallet/browser-collection markers absent from the selected upstream files. It also distinguishes GUS-prefixed configuration and deployment logic from the generic framework surface. This supports sample-specific extensions relative to the comparison baseline. It does not establish that every similarly named function was authored by the same operator or absent from every other framework version. [S1]

## Capture discrepancy

The original dependency review inferred that the Linux sample lacked screen capture because selected upstream capture dependencies were absent. The later capability review reports capture-related symbols and frame-difference routines in the held binary. Dependency lists and binary symbols answer different questions. The earlier categorical capture-free conclusion is therefore not retained. Build-specific reachability and functioning capture require further analysis or controlled runtime evidence. [S1, S2]

## Assessment

Detection should distinguish framework markers from the narrower combination of collection, configuration and delivery indicators. A generic Overlord hit is not campaign attribution. The strongest supported conclusion is a framework-derived agent with additional collection-related components in the examined material. E05 details the capture observations, and E15 documents the companion's deliberately combined selectors.