{
  "method": "Anonymised local evidence views rendered offline. Identifiers removed from HTML and replaced by opaque grey rectangles before rasterisation. Original evidence retained privately.",
  "figures": [
    {
      "image": "images_en/00-cover.png",
      "view": "evidence/views_en/00-cover.html",
      "kind": "editorial_cover",
      "source_descriptions": [
        "Based on the preserved incident evidence; editorial illustration, not a runtime screenshot."
      ],
      "source_view_sha256": "f25de3b10d5238b34276c16758746f6a180b36368d287c9a6d8e4c988c369db8",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 802.5,
      "device_scale_factor": 1.5,
      "title": "",
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "a15af823044ed1454a86c15049b1951fa85a519d81d95becd8819e15c47e4cb7",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/01-email-branches.png",
      "view": "evidence/views_en/01-email-branches.html",
      "kind": "evidence_view",
      "title": "The request to open the NDA branch",
      "source_descriptions": [
        "Source: original HTML EML preserved in private_evidence.",
        "SHA-256 EML: f7007ed3053d3ba2ef71ea01c74ec0c4aebfd48417f757ecec8d9d7d5884bf33"
      ],
      "line_ranges": null,
      "source_view_sha256": "b9e5b729dcfb114f981541c4aeb9e2330f1f06fc9488b222638c5b712c9be5b1",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 770.453125,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "6cd4f6a779bf206d8ee53fd6d47cbd30ee33ab7467bd6bc5514e4ea00cd03467",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/02-archive-hook.png",
      "view": "evidence/views_en/02-archive-hook.html",
      "kind": "evidence_view",
      "title": "An executable hook inside the original archive",
      "source_descriptions": [
        "Archive: 6f44ff4e461828dd1fe6ede75ca8d9d4b579c2ac223463629e9a7537b9df5040",
        "post-checkout: 854b3b88b06fad9d9ffec36b35be0133b1d502084d4d7cce232eda2b2dd03092"
      ],
      "line_ranges": null,
      "source_view_sha256": "d1aff2b1704284e393229e845b6d5e6bb46cee186a50eff4731c57e4495aff53",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 968.34375,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "88e49cf6ad7631a554a2368ebc3884624692c94254ab849d3204a395ad48caa7",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/03-trigger.png",
      "view": "evidence/views_en/03-trigger.html",
      "kind": "evidence_view",
      "title": "The threshold never restricts the download",
      "source_descriptions": [
        "Source: .git/hooks/post-checkout, original lines 19-30 and 39-49.",
        "SHA-256: 854b3b88b06fad9d9ffec36b35be0133b1d502084d4d7cce232eda2b2dd03092"
      ],
      "line_ranges": [
        [
          19,
          30
        ],
        [
          39,
          49
        ]
      ],
      "source_view_sha256": "fe862730c2ba5ce88c915bc7caf6c8ff1d99ec8f5e0012954151de8325a42094",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1275.953125,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "b6d0a45996cd190535191b795a969a82c1bf9448c140c10f21dbd7130d2522c2",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/04-platforms.png",
      "view": "evidence/views_en/04-platforms.html",
      "kind": "evidence_view",
      "title": "Downloads for three operating systems",
      "source_descriptions": [
        "Source: .git/hooks/post-checkout, original lines 51-75.",
        "SHA-256: 854b3b88b06fad9d9ffec36b35be0133b1d502084d4d7cce232eda2b2dd03092"
      ],
      "line_ranges": [
        [
          51,
          75
        ]
      ],
      "source_view_sha256": "3c9906daddbdcc845919b73cdbb39d22bf499e56f9cdd1fc27601c4779430f6c",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1306.953125,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "c021ed667d120cb00a8f03631482ef8fc9c51930a601bc85c653385382564eac",
      "anonymised": true,
      "grey_rectangles": 5
    },
    {
      "image": "images_en/05-download-execute.png",
      "view": "evidence/views_en/05-download-execute.html",
      "kind": "evidence_view",
      "title": "Download and background execution instructions",
      "source_descriptions": [
        "Source: .git/hooks/post-checkout, original lines 77-101.",
        "SHA-256: 854b3b88b06fad9d9ffec36b35be0133b1d502084d4d7cce232eda2b2dd03092"
      ],
      "line_ranges": [
        [
          77,
          101
        ]
      ],
      "source_view_sha256": "8ab1da8333d165b81874a1271a177ed4119d780f4a1e46a8f485bb88968942cd",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1306.953125,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "9338e2267b2e74789170707af18401916f32b04112a238836337b7c55f1f9fa7",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/06-chain.png",
      "view": "evidence/views_en/06-chain.html",
      "kind": "analytical_diagram",
      "title": "From a project enquiry to an execution attempt",
      "source_descriptions": [
        "Sources: preserved email, TAR and original hook.",
        "Git trigger: git-scm.com/docs/githooks#_post_checkout"
      ],
      "line_ranges": null,
      "source_view_sha256": "bfb7362b98427d92f684e55a404bf435fbfe4338b9081531de9a94982855b4c2",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1068.234375,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "ae77dbd5c901587052ce64809c3303eb8cf1e979f742371f5048980947f9882b",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/07-responses.png",
      "view": "evidence/views_en/07-responses.html",
      "kind": "evidence_view",
      "title": "No second-stage code was obtained",
      "source_descriptions": [
        "Sources: preserved response.bin files and manifest.json.",
        "Observed: 2026-10-19, 17:29:27 to 17:29:28 UTC."
      ],
      "line_ranges": null,
      "source_view_sha256": "bc7079511bde7af158479b8d41e4e87a303d3ef2992288b3d5f6c6ef54df66df",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 937.84375,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "c0407bb38f91eed55654d4cd09979c3bbf4032674dca0c9d602d921c7b4d917a",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/08-inventory.png",
      "view": "evidence/views_en/08-inventory.html",
      "kind": "evidence_view",
      "title": "Every supplied Git object checked",
      "source_descriptions": [
        "Source: byte-level TAR/Git audit, evidence/static_audit.json.",
        "Archive SHA-256: 6f44ff4e461828dd1fe6ede75ca8d9d4b579c2ac223463629e9a7537b9df5040"
      ],
      "line_ranges": null,
      "source_view_sha256": "8c415387da0b4f6bb5affd79ce73c6d48d54620a5530608550693e21d52dc47b",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 974.84375,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "cc9445ab352c232ad698127ee99cfcf01058484154591eae720ad4cfaf563298",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/09-full-hook.png",
      "view": "evidence/views_en/09-full-hook.html",
      "kind": "evidence_view",
      "title": "The complete original post-checkout",
      "source_descriptions": [
        "Original file: 2774 bytes. UTF-8 display with original line numbers.",
        "SHA-256: 854b3b88b06fad9d9ffec36b35be0133b1d502084d4d7cce232eda2b2dd03092"
      ],
      "line_ranges": [
        [
          1,
          101
        ]
      ],
      "source_view_sha256": "b74ab35eb82409b6d5ffb11a9ef025f43953aa955c9264bb7b15dd09ff0f2429",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 3662.953125,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "fb00f6b1f374f720057fee1f8614983cbc7799a21fbd16f5949f0e850732f60d",
      "anonymised": true,
      "grey_rectangles": 6
    },
    {
      "image": "images_en/10-first-contact.png",
      "view": "evidence/views_en/10-first-contact.html",
      "kind": "redacted_correspondence_view",
      "title": "The first enquiry through our website",
      "source_descriptions": [
        "Source: original EML. Exact body and headers preserved privately.",
        "Original EML SHA-256: bf7d0f3a59b84f509ca436e0750640e844e9731ce363a42a99d5be60cdf8597e"
      ],
      "line_ranges": null,
      "source_view_sha256": "e9446fd944155840f54ee4b7cd3b9cec5caca76392ddcadc9962d31d7538e8f5",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1447.296875,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "df5baf5ffa6de95e6e5a63ab240860e9621f6a505bc0cbbfd740b68069b40e53",
      "anonymised": true,
      "grey_rectangles": 8
    },
    {
      "image": "images_en/11-our-initial-reply.png",
      "view": "evidence/views_en/11-our-initial-reply.html",
      "kind": "redacted_correspondence_view",
      "title": "Our reply requesting the materials",
      "source_descriptions": [
        "Source: original EML. Exact body and headers preserved privately.",
        "Original EML SHA-256: 1e5330dd82e02911254722744a3202e9b761c8c1d2950be937cd5d539c1bcad9"
      ],
      "line_ranges": null,
      "source_view_sha256": "0ce9cd7fab9cd1dfff978c0a7948358e1d0226d557b08e1bce6b59b0e07a3fa0",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1740.21875,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "b5f64ca6302041fd03451e2732be7477c4b7fa9a1b5a7835ad9927cd780fedc8",
      "anonymised": true,
      "grey_rectangles": 13
    },
    {
      "image": "images_en/12-archive-email.png",
      "view": "evidence/views_en/12-archive-email.html",
      "kind": "redacted_correspondence_view",
      "title": "The archive email naming the NDA / conf branches",
      "source_descriptions": [
        "Source: original EML. Exact body and headers preserved privately.",
        "Original EML SHA-256: f7007ed3053d3ba2ef71ea01c74ec0c4aebfd48417f757ecec8d9d7d5884bf33"
      ],
      "line_ranges": null,
      "source_view_sha256": "a5a96995ba499ea48c1156e298416d158e5d76dfcb9bbfd4973edfb38968a9b6",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1549.59375,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "4c62c1f8a6d1fbae7aea9fe3387bccbb6375cd8e4d8fffabba296f0e682d6a2c",
      "anonymised": true,
      "grey_rectangles": 6
    },
    {
      "image": "images_en/13-security-reply.png",
      "view": "evidence/views_en/13-security-reply.html",
      "kind": "redacted_correspondence_view",
      "title": "Our reply after discovering the hook",
      "source_descriptions": [
        "Source: original EML. Exact body and headers preserved privately.",
        "Original EML SHA-256: 31df91adb2eb52be2171836d3e26610328a0a1a1273dbf7d56efe4354bb62e19"
      ],
      "line_ranges": null,
      "source_view_sha256": "0876383ffd7abf9942bdc7f9f9a30b7c7b106a2b4c78105c0375065052e8b684",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1321.765625,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "1fc8c8f0f2c11a7f63a6220e1ce692f616ab26c7751d337d5434d8fc0a4e08f5",
      "anonymised": true,
      "grey_rectangles": 5
    },
    {
      "image": "images_en/14-tar-bytes.png",
      "view": "evidence/views_en/14-tar-bytes.html",
      "kind": "byte_level_evidence_view",
      "title": "The hook in the raw TAR header",
      "source_descriptions": [
        "deep_audit/01-tar-hook-header.txt",
        "Original archive SHA256: 6f44ff4e461828dd1fe6ede75ca8d9d4b579c2ac223463629e9a7537b9df5040"
      ],
      "source_view_sha256": "85ba17afaf47f64abdcf480fef6552a9345a7a3e5545a9385d8edadf60d4e994",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1180.125,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "70d7d251f5676c297fa4defa757302002c0767e61fb685aa18c94c7cc6d46f8b",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/15-git-blob.png",
      "view": "evidence/views_en/15-git-blob.html",
      "kind": "byte_level_evidence_view",
      "title": "Decoding the Git blob containing the DOCX",
      "source_descriptions": [
        "deep_audit/03-nda-blob-dump.txt",
        "Original archive SHA256: 6f44ff4e461828dd1fe6ede75ca8d9d4b579c2ac223463629e9a7537b9df5040"
      ],
      "source_view_sha256": "9c8473268de098a22f74b0d9df21466dc5c5f15f32a572a108bb863d101f6f77",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1016.140625,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "5ce200b4d8ed241f8a75af5adaf888cb6de84f104979e49029442b99ab71d6ec",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/16-git-tree.png",
      "view": "evidence/views_en/16-git-tree.html",
      "kind": "byte_level_evidence_view",
      "title": "The NDA branch references this blob",
      "source_descriptions": [
        "deep_audit/04-nda-tree-dump.txt",
        "Original archive SHA256: 6f44ff4e461828dd1fe6ede75ca8d9d4b579c2ac223463629e9a7537b9df5040"
      ],
      "source_view_sha256": "c199fd71aff8642e659b2ef10a988543289a4203e5be61494aa118d5177946d2",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 805.390625,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "29d56da1134e32ac655ed7224e0a0a4324bcbf6c6e132cc40eaa740ac3571c93",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/17-all-blobs.png",
      "view": "evidence/views_en/17-all-blobs.html",
      "kind": "byte_level_evidence_view",
      "title": "All 16 blobs classified",
      "source_descriptions": [
        "deep_audit/05-blob-types.txt, deep_audit.json",
        "Original archive SHA256: 6f44ff4e461828dd1fe6ede75ca8d9d4b579c2ac223463629e9a7537b9df5040"
      ],
      "source_view_sha256": "0d521e80aa9614072bfafb39215db886902b770ccf50fc958a4a627eb51d5cbc",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1491.34375,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "6a23b0bd04e5b928592c5fb5187e7a8cfc0995ffe4e7c069a66799e1cb7bc83d",
      "anonymised": true,
      "grey_rectangles": 0
    },
    {
      "image": "images_en/18-docx-parts.png",
      "view": "evidence/views_en/18-docx-parts.html",
      "kind": "byte_level_evidence_view",
      "title": "The DOCX inspected as a ZIP container",
      "source_descriptions": [
        "deep_audit/06-docx-parts.txt",
        "Original archive SHA256: 6f44ff4e461828dd1fe6ede75ca8d9d4b579c2ac223463629e9a7537b9df5040"
      ],
      "source_view_sha256": "6438e6da0192045ea3e1fb889c64645c628cb5deaa710d17bb08fab7a138d02e",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 1638.84375,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "f1b712ff38e34d31ebbb8b13c7547169bcc88a6af5d82e377a2bb4663b2686e4",
      "anonymised": true,
      "grey_rectangles": 1
    },
    {
      "image": "images_en/19-boundaries.png",
      "view": "evidence/views_en/19-boundaries.html",
      "kind": "byte_level_evidence_view",
      "title": "Container boundaries checked",
      "source_descriptions": [
        "deep_audit/07-container-boundaries.txt",
        "Original archive SHA256: 6f44ff4e461828dd1fe6ede75ca8d9d4b579c2ac223463629e9a7537b9df5040"
      ],
      "source_view_sha256": "827487b837281be25cbbc3edae50517622e13757d39704ac204cf2a5f57be259",
      "rendering": "Offline screenshot of an anonymised source view. No original identifier remains beneath the grey rectangles.",
      "css_width": 1400,
      "css_height": 831.734375,
      "device_scale_factor": 1.5,
      "translation": "Publication annotations translated where applicable. Identifying details removed.",
      "image_sha256": "434687c27af3b0d5714b14e61b4d4e13f440bce061b7c48bb893ad8f168cbb67",
      "anonymised": true,
      "grey_rectangles": 0
    }
  ]
}