{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9961373209953308,
        "class": 1
      }
    ],
    "prob": 0.9961373,
    "class": 1,
    "oprob": 0.69427526,
    "models": [
      {
        "m": "az",
        "prob": 0.69427526,
        "class": 0
      }
    ],
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-16T16:44:05Z"
  },
  "path": "58e508cd5c25a60e72bf9a755946fb154c86ce5b235bff0db3e432cfd9807202.lnk",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 66,
        "id": 0,
        "ms": {
          "lnk": {
            "has_name": true,
            "has_exp_icon": true,
            "has_arguments": true,
            "has_link_info": false,
            "has_working_dir": true,
            "has_icon_location": true,
            "has_relative_path": true,
            "args_whitespace_total": 1.0,
            "has_known_folder_data": true,
            "args_max_whitespace_run": 1.0,
            "has_link_target_id_list": true,
            "has_property_store_data": true,
            "has_special_folder_data": true,
            "args_excessive_whitespace": false,
            "has_icon_environment_data": true
          },
          "file": {
            "size": 2076.0
          }
        },
        "ss": [
          [
            0,
            "Возглавьте отряд бойцов в масштабных и реалистичных битвах, повторяю"
          ],
          [
            0,
            "..\\..\\..\\..\\..\\..\\..\\Windows\\system32\\rundll32.exe"
          ],
          [
            0,
            "url,OpenURL \"https://glclck.ru/gl/?cid=20885\u0026oid=34283\u0026v=3\u0026utm_campaign=repacks\u0026utm_medium=cpi\u0026trash=\""
          ],
          [
            0,
            "C:\\Windows\\system32"
          ],
          [
            0,
            "C:\\Users\\Пользователь\\AppData\\Local\\Links\\Enlisted.ico"
          ],
          [
            0,
            "%USERPROFILE%\\AppData\\Local\\Links\\Enlisted.ico"
          ],
          [
            0,
            "1ac14e77-02e7-4e5d-b744-2eb1ae5198b7"
          ],
          [
            137,
            "Windows"
          ],
          [
            223,
            "system32"
          ],
          [
            313,
            "rundll32.exe"
          ],
          [
            1095,
            "%USERPROFILE%\\AppData\\Local\\Links\\Enlisted.ico"
          ]
        ],
        "sz": 2076,
        "ts": [
          {
            "c": 0.800000011920929,
            "d": "LNK contains UTF-16 parent traversal",
            "e": [
              "2E 00 2E 00 5C 00 2E 00 2E 00 5C 00"
            ],
            "i": "micro-behaviors/fs/traversal/parent::lnk-utf16-relative-parent-chain",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "LNK has command-line arguments",
            "e": [
              "lnk.has_arguments = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::has-arguments",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.75,
            "d": "LNK arguments contain HTTPS URL",
            "e": [
              "url,OpenURL \"https://glclck.ru/gl/?cid=20885\u0026oid=34283\u0026v=3\u0026utm_campaign=repacks\u0026utm_medium=cpi\u0026trash=\""
            ],
            "i": "objectives/command-and-control/dropper/lnk/heuristic::kv-https-in-args",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies execution artefacts in shortcut (LNK) files.",
            "e": [
              "rundll32.exe",
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/execution_in_lnk",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies download artefacts in shortcut (LNK) files.",
            "e": [
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/download_in_lnk",
            "l": 4
          }
        ],
        "sha": "58e508cd5c25a60e72bf9a755946fb154c86ce5b235bff0db3e432cfd9807202",
        "path": "58e508cd5c25a60e72bf9a755946fb154c86ce5b235bff0db3e432cfd9807202.lnk",
        "type": "lnk"
      }
    ],
    "tv": "529a0"
  }
}