# CrashCapture CrashCapture is preserved as an exact log-context label associated by Bryant McGill with the RT Buddy/Pegasus observation. ## Observed relationship Bryant states that the RT Buddy/Pegasus identification arose when the relevant activity or resources appeared in logs together with CrashCapture or [[Heimdallr|Heimdallr]], particularly through documented resources visible in those logs. ## Evidentiary boundary The exact CrashCapture component, platform, version, process, bundle identifier, and resource path have not yet been recovered into this wiki. The label must not be silently expanded into a specific vendor component until the originating logs are preserved and parsed. Log proximity is observational evidence, not by itself proof of infection, control, authorship, or attribution. ## Related notes [[RTBuddy|RTBuddy]] · [[Pegasus Spyware|Pegasus Spyware]] · [[NSO Group|NSO Group]] · [[Heimdallr|Heimdallr]]. ## Pegasus heuristic caution **Owner-supplied interpretation:** Bryant McGill states that finding Pegasus heuristics, standing alone, means nothing as proof of the underlying system or attribution. In his interpretation, “Pegasus” is a very clumsy cover for something else, which later documents in this archive will detail. Until those materials are incorporated, heuristic matches must not be treated as proof of Pegasus infection, NSO Group attribution, or final identification of the underlying mechanism. ## Scanned_20260730-1946 overlay CrashCapture is not visibly written in [[Scanned_20260730-1946]]. It is linked only to preserve the vault owner's stated observational basis for normalizing the page-5 and page-8 RT Buddy strings: documented resources seen together in logs with CrashCapture or [[Heimdallr]]. This cross-reference must not be promoted into independent page evidence. Preserve the original log, timestamp, device/build, process or bundle ID, and resource path before drawing technical conclusions; Pegasus heuristics alone remain non-dispositive.