: Use tools like LECmd (LNK Explorer) to parse the shortcut.
: Often hidden in the C2 URL, a registry key created by the script, or the metadata of an extracted image.
