{
  "case_id": "lockbit",
  "sha256": "99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658",
  "value": "https://docrack.me",
  "encoding": "UTF-16LE",
  "file_offset_decimal": 236048,
  "bytes_checked": 267264,
  "verification": "Literal independently located in the hash-verified sample held only in memory. Control-flow role comes from the updated Caronte report. No sample execution or endpoint contact."
}