For example, one of these FIN7 LNK files contained the following properties:  Version: 0 NetBIOS name: andy-pc Droid volume identifier: e2c10c40-6f7d-4442-bcec-470c96730bca Droid file identifier: a6eea972-0e2f-11e7-8b2d-0800273d5268 Birth droid volume identifier: e2c10c40-6f7d-4442-bcec-470c96730bca Birth droid file identifier: a6eea972-0e2f-11e7-8b2d-0800273d5268 MAC address: 08:00:27:3d:52:68 UUID timestamp: 03/21/2017 (12:12:28.500) [UTC] UUID sequence number: 2861  From this LNK file, we can see not only what the shortcut launched within the string data, but that the attacker likely generated this file on a VirtualBox system with hostname “andy-pc” on March 21, 2017