For the junk judge: a "movie" whose first bytes are a program is fake. Two bytes alone match random data too often, so the PE signature where the DOS header points must be there too. No PROBE_VERSION bump: new probes only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>