Sorry to keep bugging about obscure LNK files, but I see that exiftool is part of VirusTotal, so I figure its proper operation will help us weirdos who look at such things.

Anyway, there's a public Akamai writeup about in-the-wild exploitation using LNK files and CVE-2026-21513. In the end, Windows is coerced to open a LNK file. I have a completely sanitized version of this LNK file, which ends up retrieving and running http://example.com/payloads/calc32.dll by way of using the "Control Panel" Folder GUID of 26EE0668-A00A-44D7-9371-BEB064C98683

Current output from exiftool:

ExifTool Version Number         : 13.52
File Name                       : controlpanel.lnk
Directory                       : <redacted>
File Size                       : 308 bytes
File Modification Date/Time     : 2026:03:03 11:24:25-05:00
File Access Date/Time           : 2026:03:03 11:24:28-05:00
File Inode Change Date/Time     : 2026:03:03 11:24:25-05:00
File Permissions                : -rw-r--r--
File Type                       : LNK
File Type Extension             : lnk
MIME Type                       : application/octet-stream
Flags                           : IDList, Unicode, TargetMetadata
File Attributes                 : (none)
Target File Size                : 0
Icon Index                      : (none)
Run Window                      : Normal
Hot Key                         : (none)
Folder GUID                     : Unknown (26EE0668-A00A-44D7-9371-BEB064C98683)

Exiftool correctly reports that the Folder GUID is 26EE0668-A00A-44D7-9371-BEB064C98683. Not very important is that it says that it's "Unknown" as opposed to "Control Panel"

But perhaps more important is the lack of displaying the actual target of http://example.com/payloads/calc32.dll

TBH, I'm not too familiar with the LNK file format, and even beyond that, even the Windows GUI doesn't show the actual target for such LNK files. But if it's easy to add this info to exiftool, then I figure that'll be a win.