{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9961373209953308,
        "class": 1
      }
    ],
    "prob": 0.9961373,
    "class": 1,
    "oprob": 0.9017224,
    "models": [
      {
        "m": "az",
        "prob": 0.9017224,
        "class": 0
      }
    ],
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-16T20:53:37Z"
  },
  "path": "Home Page 5.lnk",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 74,
        "id": 0,
        "ms": {
          "lnk": {
            "has_name": true,
            "has_arguments": false,
            "has_link_info": false,
            "has_working_dir": false,
            "has_icon_location": true,
            "has_link_target_id_list": true,
            "args_excessive_whitespace": false
          },
          "file": {
            "size": 674.0
          }
        },
        "ss": [
          [
            0,
            "@%SystemRoot%\\system32\\gameux.dll,-10035"
          ],
          [
            0,
            "%ProgramFiles%\\Microsoft Games\\hearts\\hearts.exe"
          ]
        ],
        "sz": 674,
        "ts": [
          {
            "a": "T1105",
            "c": 0.9300000071525574,
            "d": "LNK embeds two HTTP IP endpoints",
            "e": [
              "68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00"
            ],
            "i": "objectives/command-and-control/dropper/lnk/conhost-curl::http-ip-endpoint-pair",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies download artefacts in shortcut (LNK) files.",
            "e": [
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/download_in_lnk",
            "l": 4
          }
        ],
        "sha": "4e47eeb8b54670b59e113eef47827ed7fa49a32b4cd7a09b3a892d2f69b681e4",
        "path": "/data/samples/good/datasets/lnk/synthetic_test_files/WinVista/Home Page 5.lnk",
        "type": "lnk"
      }
    ],
    "tv": "529a0"
  }
}