{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/lnk",
        "prob": 0.84,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T06:15:17Z"
  },
  "path": "0eef3a34404bda30d7437dcd1ca2dee51e2b386e50cb6fb2a4a296f154b8cde0.lnk",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 68,
        "ff": {
          "m": {
            "lnk": {
              "file_size": 0.0
            },
            "file": {
              "size": 2818.0,
              "entropy": 4.38,
              "size_bytes": 2818.0
            }
          },
          "s": [
            [
              222,
              "u8",
              "wheyface.cmd"
            ],
            [
              1010,
              "u8",
              "C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll"
            ]
          ],
          "v": {
            "file.stem": "0eef3a34404bda30d7437dcd1ca2dee51e2b386e50cb6fb2a4a296f154b8cde0",
            "file.basename": "0eef3a34404bda30d7437dcd1ca2dee51e2b386e50cb6fb2a4a296f154b8cde0.lnk",
            "lnk.blocks[0]": "environment_variable",
            "lnk.blocks[1]": "icon_environment",
            "lnk.icon_location": "C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll",
            "lnk.relative_path": "wheyface.cmd",
            "lnk.header.flags[0]": "has_relative_path",
            "lnk.header.flags[1]": "has_icon_location",
            "lnk.header.flags[2]": "is_unicode",
            "lnk.header.flags[3]": "has_exp_string",
            "lnk.header.flags[4]": "has_exp_icon",
            "lnk.header.icon_index": 1,
            "lnk.environment_target": "wheyface.cmd",
            "lnk.header.show_command": "minimized_no_active",
            "lnk.icon_environment_target": "C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll"
          },
          "id": "lnk"
        },
        "id": 0,
        "sz": 2818,
        "ts": [
          {
            "a": "T1204.002",
            "c": 0.800000011920929,
            "d": "LNK runs minimized without activation",
            "e": [
              "minimized_no_active"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::minimized-window",
            "l": 4,
            "el": [
              "value:lnk.header.show_command"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies scripting artefacts in shortcut (LNK) files.",
            "e": [
              ".cmd",
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/script_in_lnk",
            "l": 4,
            "el": [
              "offset:0xe6",
              "offset:0x5e"
            ]
          }
        ],
        "sha": "0eef3a34404bda30d7437dcd1ca2dee51e2b386e50cb6fb2a4a296f154b8cde0",
        "path": "0eef3a34404bda30d7437dcd1ca2dee51e2b386e50cb6fb2a4a296f154b8cde0.lnk",
        "type": "lnk"
      }
    ],
    "tv": "52045"
  }
}