{ "ok": "false" }

Sending a dump of entire system memory seems incredibly unsafe, to say the least.

Don’t run sha256sum -c on your suspect file — it expects to be passed a file containing hashes and other filenames. sha256sum the iso itself instead and check by eye, or make such a hash file.

(?=) for positive lookahead and (?!) for negative lookahead. Stick a < in the middle for lookbehind.