{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9995030164718628,
        "class": 1
      }
    ],
    "prob": 0.999503,
    "class": 1,
    "oprob": 0.90856314,
    "models": [
      {
        "m": "az",
        "prob": 0.90856314,
        "class": 0
      },
      {
        "m": "az/lnk",
        "prob": 0.62184876,
        "class": 0
      }
    ],
    "oclass": 0,
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-25T13:33:17Z"
  },
  "path": "Tools for Desktop Apps.lnk.test",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 66,
        "ff": {
          "m": {
            "lnk": {
              "file_size": 86.0
            },
            "file": {
              "size": 1450.0,
              "entropy": 4.6,
              "size_bytes": 1450.0
            }
          },
          "s": [
            [
              553,
              "u8",
              "DESKTO~2.URL"
            ],
            [
              740,
              "u8",
              "C:\\Program Files (x86)\\Windows Kits\\8.1\\Shortcuts\\DesktopDevCenterToolsDocumentation.url"
            ],
            [
              1232,
              "u8",
              "sagerez"
            ]
          ],
          "v": {
            "lnk.blocks[0]": "special_folder",
            "lnk.blocks[1]": "known_folder",
            "lnk.blocks[2]": "tracker",
            "lnk.blocks[3]": "property_store",
            "lnk.description": "Tools for Desktop Apps",
            "lnk.target_path": "C:\\PROGRA~2\\WI3CF2~1\\8.1\\SHORTC~1\\DESKTO~2.URL",
            "lnk.relative_path": "..\\..\\..\\..\\..\\..\\..\\Program Files (x86)\\Windows Kits\\8.1\\Shortcuts\\DesktopDevCenterToolsDocumentation.url",
            "lnk.volume.serial": 1780649898,
            "lnk.header.flags[0]": "has_link_target_id_list",
            "lnk.header.flags[1]": "has_link_info",
            "lnk.header.flags[2]": "has_name",
            "lnk.header.flags[3]": "has_relative_path",
            "lnk.header.flags[4]": "has_working_dir",
            "lnk.header.flags[5]": "is_unicode",
            "lnk.known_folder_id": "7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e",
            "lnk.header.file_size": 86,
            "lnk.header.write_time": 130160316280000000,
            "lnk.special_folder_id": 42,
            "lnk.volume.drive_type": "fixed",
            "lnk.working_directory": "C:\\Program Files (x86)\\Windows Kits\\8.1\\",
            "lnk.header.access_time": 130984896648805546,
            "lnk.tracker.file_droid": "d83a3b38-c5fa-11e5-b2af-a434d943f363",
            "lnk.tracker.machine_id": "sagerez",
            "lnk.header.show_command": "normal",
            "lnk.tracker.mac_address": "a4:34:d9:43:f3:63",
            "lnk.header.creation_time": 130160316280000000,
            "lnk.tracker.volume_droid": "38648bd4-606f-459b-91e5-d8883d4b70b1",
            "lnk.header.file_attributes[0]": "archive"
          },
          "id": "lnk"
        },
        "id": 0,
        "sz": 1450,
        "ts": [
          {
            "a": "T1204.002",
            "c": 0.75,
            "d": "LNK references URL file",
            "e": [
              ".url",
              ".URL"
            ],
            "i": "objectives/command-and-control/dropper/lnk/heuristic::lnk-url-file",
            "l": 4
          },
          {
            "c": 0.800000011920929,
            "d": "LNK contains UTF-16 parent traversal",
            "e": [
              "2E 00 2E 00 5C 00 2E 00 2E 00 5C 00"
            ],
            "i": "micro-behaviors/fs/traversal/parent::lnk-utf16-relative-parent-chain",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies download artefacts in shortcut (LNK) files.",
            "e": [
              ".URL",
              "$",
              ".url"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/download_in_lnk",
            "l": 4
          }
        ],
        "sha": "c3d4b7a2c95de1f31ad423b13388d8db8663541bb2f3ae4fcc529036edae7160",
        "path": "Tools for Desktop Apps.lnk.test",
        "type": "lnk"
      }
    ],
    "tv": "a7886"
  }
}