Try VMRay Platform
Malicious
Classifications

Spyware Ransomware

Threat Names

Maze ChaCha Mal/Generic-S

Dynamic Analysis Report

Created on 2022-01-02T12:03:00

3885589a3c94d0475a6d994e4644e682f4cff93f8b4d65f37508ffe706861363.exe

Windows Exe (x86-32)
...

Remarks (1/1)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "37 minutes, 40 seconds" to "22 seconds" to reveal dormant functionality.

Remarks

(0x0200001D): The maximum number of extracted files was exceeded. Some files may be missing in the report.

Filters:
File Name Category Type Verdict Actions
C:\Users\kEecfMwgj\Desktop\3885589a3c94d0475a6d994e4644e682f4cff93f8b4d65f37508ffe706861363.exe Sample File Binary
malicious
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 453.50 KB
MD5 248c960c1ae54103dea5bfae924f28e2 Copy to Clipboard
SHA1 504ce8efee0f7f8329c09c6d045a21c795a84b42 Copy to Clipboard
SHA256 3885589a3c94d0475a6d994e4644e682f4cff93f8b4d65f37508ffe706861363 Copy to Clipboard
SSDeep 6144:/P2vVfY9RbTrI5Tm6oUAcEtKY/e8lmceEoAE77OvaHhdRwc9/P2wdAn7gJRKKRqX:aVw9prIVpb3F8ltQlBwc9/P2l7gT6 Copy to Clipboard
ImpHash fed6080d5570a9033baa7765bc13e05e Copy to Clipboard
File Reputation Information
»
Verdict
malicious
Names Mal/Generic-S
PE Information
»
Image Base 0x400000
Entry Point 0x407a2d
Size Of Code 0x11c00
Size Of Initialized Data 0x61600
File Type FileType.executable
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-05-13 05:04:13+00:00
Sections (4)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x11a33 0x11c00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.64
.rdata 0x413000 0x6a50 0x6c00 0x12000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.7
.data 0x41a000 0x594e0 0x57600 0x18c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 7.99
.reloc 0x474000 0x134c 0x1400 0x70200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.45
Imports (5)
»
USER32.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MessageBoxA - 0x413190 0x192d8 0x182d8 0x246
wsprintfW - 0x413194 0x192dc 0x182dc 0x37b
DeferWindowPos - 0x413198 0x192e0 0x182e0 0xa2
AnimateWindow - 0x41319c 0x192e4 0x182e4 0x7
MessageBoxW - 0x4131a0 0x192e8 0x182e8 0x24d
DestroyWindow - 0x4131a4 0x192ec 0x182ec 0xad
GDI32.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetPaletteEntries - 0x413020 0x19168 0x18168 0x2f7
SelectPalette - 0x413024 0x1916c 0x1816c 0x2d5
KERNEL32.dll (86)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MoveFileExA - 0x41302c 0x19174 0x18174 0x3c9
GetWindowsDirectoryA - 0x413030 0x19178 0x18178 0x30f
CreateFileA - 0x413034 0x1917c 0x1817c 0xba
GetFileSize - 0x413038 0x19180 0x18180 0x23b
LocalAlloc - 0x41303c 0x19184 0x18184 0x3ae
ReadFile - 0x413040 0x19188 0x18188 0x44f
GetVersionExA - 0x413044 0x1918c 0x1818c 0x304
WriteFile - 0x413048 0x19190 0x18190 0x5df
DeviceIoControl - 0x41304c 0x19194 0x18194 0x112
OpenMutexW - 0x413050 0x19198 0x18198 0x3ea
CreateMutexW - 0x413054 0x1919c 0x1819c 0xd1
lstrlenA - 0x413058 0x191a0 0x181a0 0x608
GetModuleHandleA - 0x41305c 0x191a4 0x181a4 0x264
LoadLibraryA - 0x413060 0x191a8 0x181a8 0x3a5
CloseHandle - 0x413064 0x191ac 0x181ac 0x7f
lstrcatA - 0x413068 0x191b0 0x181b0 0x5f9
GetProcAddress - 0x41306c 0x191b4 0x181b4 0x29d
VirtualQuery - 0x413070 0x191b8 0x181b8 0x5a1
TlsGetValue - 0x413074 0x191bc 0x181bc 0x573
VirtualProtect - 0x413078 0x191c0 0x181c0 0x59f
IsBadReadPtr - 0x41307c 0x191c4 0x181c4 0x35e
WaitForSingleObject - 0x413080 0x191c8 0x181c8 0x5a9
VirtualFree - 0x413084 0x191cc 0x181cc 0x59c
FreeLibrary - 0x413088 0x191d0 0x181d0 0x19e
ExitProcess - 0x41308c 0x191d4 0x181d4 0x151
TlsSetValue - 0x413090 0x191d8 0x181d8 0x574
lstrcmpA - 0x413094 0x191dc 0x181dc 0x5fc
OutputDebugStringW - 0x413098 0x191e0 0x181e0 0x3fa
VirtualAlloc - 0x41309c 0x191e4 0x181e4 0x599
CreateTimerQueueTimer - 0x4130a0 0x191e8 0x181e8 0xf0
Sleep - 0x4130a4 0x191ec 0x181ec 0x550
ExitThread - 0x4130a8 0x191f0 0x181f0 0x152
FlushFileBuffers - 0x4130ac 0x191f4 0x181f4 0x192
GetConsoleCP - 0x4130b0 0x191f8 0x181f8 0x1dc
GetConsoleMode - 0x4130b4 0x191fc 0x181fc 0x1ee
SetStdHandle - 0x4130b8 0x19200 0x18200 0x520
SetFilePointerEx - 0x4130bc 0x19204 0x18204 0x4fc
WriteConsoleW - 0x4130c0 0x19208 0x18208 0x5de
lstrcpyA - 0x4130c4 0x1920c 0x1820c 0x602
RaiseException - 0x4130c8 0x19210 0x18210 0x43f
GetStringTypeW - 0x4130cc 0x19214 0x18214 0x2c5
EncodePointer - 0x4130d0 0x19218 0x18218 0x121
DecodePointer - 0x4130d4 0x1921c 0x1821c 0xfe
RtlUnwind - 0x4130d8 0x19220 0x18220 0x4ac
GetCommandLineA - 0x4130dc 0x19224 0x18224 0x1c8
IsProcessorFeaturePresent - 0x4130e0 0x19228 0x18228 0x36d
HeapAlloc - 0x4130e4 0x1922c 0x1822c 0x32f
CreateFileW - 0x4130e8 0x19230 0x18230 0xc2
GetLastError - 0x4130ec 0x19234 0x18234 0x250
GetModuleHandleExW - 0x4130f0 0x19238 0x18238 0x266
MultiByteToWideChar - 0x4130f4 0x1923c 0x1823c 0x3d1
WideCharToMultiByte - 0x4130f8 0x19240 0x18240 0x5cb
HeapSize - 0x4130fc 0x19244 0x18244 0x338
HeapFree - 0x413100 0x19248 0x18248 0x333
SetLastError - 0x413104 0x1924c 0x1824c 0x50a
GetCurrentThreadId - 0x413108 0x19250 0x18250 0x20e
GetProcessHeap - 0x41310c 0x19254 0x18254 0x2a2
GetStdHandle - 0x413110 0x19258 0x18258 0x2c0
GetFileType - 0x413114 0x1925c 0x1825c 0x23e
DeleteCriticalSection - 0x413118 0x19260 0x18260 0x105
GetStartupInfoW - 0x41311c 0x19264 0x18264 0x2be
GetModuleFileNameA - 0x413120 0x19268 0x18268 0x262
GetModuleFileNameW - 0x413124 0x1926c 0x1826c 0x263
QueryPerformanceCounter - 0x413128 0x19270 0x18270 0x42d
GetCurrentProcessId - 0x41312c 0x19274 0x18274 0x20a
GetSystemTimeAsFileTime - 0x413130 0x19278 0x18278 0x2d6
GetEnvironmentStringsW - 0x413134 0x1927c 0x1827c 0x227
FreeEnvironmentStringsW - 0x413138 0x19280 0x18280 0x19d
UnhandledExceptionFilter - 0x41313c 0x19284 0x18284 0x580
SetUnhandledExceptionFilter - 0x413140 0x19288 0x18288 0x541
InitializeCriticalSectionAndSpinCount - 0x413144 0x1928c 0x1828c 0x348
GetCurrentProcess - 0x413148 0x19290 0x18290 0x209
TerminateProcess - 0x41314c 0x19294 0x18294 0x55f
TlsAlloc - 0x413150 0x19298 0x18298 0x571
TlsFree - 0x413154 0x1929c 0x1829c 0x572
GetModuleHandleW - 0x413158 0x192a0 0x182a0 0x267
EnterCriticalSection - 0x41315c 0x192a4 0x182a4 0x125
LeaveCriticalSection - 0x413160 0x192a8 0x182a8 0x3a2
IsDebuggerPresent - 0x413164 0x192ac 0x182ac 0x367
LoadLibraryExW - 0x413168 0x192b0 0x182b0 0x3a7
IsValidCodePage - 0x41316c 0x192b4 0x182b4 0x372
GetACP - 0x413170 0x192b8 0x182b8 0x1a4
GetOEMCP - 0x413174 0x192bc 0x182bc 0x286
GetCPInfo - 0x413178 0x192c0 0x182c0 0x1b3
HeapReAlloc - 0x41317c 0x192c4 0x182c4 0x336
LCMapStringW - 0x413180 0x192c8 0x182c8 0x396
ADVAPI32.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
EncryptionDisable - 0x413000 0x19148 0x18148 0x10b
EqualDomainSid - 0x413004 0x1914c 0x1814c 0x116
LsaCreateTrustedDomainEx - 0x413008 0x19150 0x18150 0x1b7
LsaClose - 0x41300c 0x19154 0x18154 0x1b3
AreAllAccessesGranted - 0x413010 0x19158 0x18158 0x22
InitializeSecurityDescriptor - 0x413014 0x1915c 0x1815c 0x18d
LookupAccountSidW - 0x413018 0x19160 0x18160 0x1a7
Secur32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
LsaConnectUntrusted - 0x413188 0x192d0 0x182d0 0x26
Memory Dumps (318)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
3885589a3c94d0475a6d994e4644e682f4cff93f8b4d65f37508ffe706861363.exe 1 0x00140000 0x001B5FFF Relevant Image False 32-bit 0x00148580 False
...
buffer 1 0x001C0000 0x001C0253 Marked Executable False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E26FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E28FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E22FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E22FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1AFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E27FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E18FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E19FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E27FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E20FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
desktop (create shortcut).desklink 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E13FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E27FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E20FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E27FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E26FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E20FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E13FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1AFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E12FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E18FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E13FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E28FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E22FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E18FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E26FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1AFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E27FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E28FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E16FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1FFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1AFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E16FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E27FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1FFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E16FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E12FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E28FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E19FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E15FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E20FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E22FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E28FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1AFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1FFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E18FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E22FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E26FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E16FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E27FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E19FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1AFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E19FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E13FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1BFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E18FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E26FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1AFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E26FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E15FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E22FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E16FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1AFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1FFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E10FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1FFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E22FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E20FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E26FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1EFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E28FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E27FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E16FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E22FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E12FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E17FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E14FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E19FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E11FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E15FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E15FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E19FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E16FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E23FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1FFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E13FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E16FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E20FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E18FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1DFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1FFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1FFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E21FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E18FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E25FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E1CFFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E19FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E28FFF Content Changed False 32-bit - False
...
buffer 1 0x01E10000 0x01E24FFF Content Changed False 32-bit - False
...
3885589a3c94d0475a6d994e4644e682f4cff93f8b4d65f37508ffe706861363.exe 1 0x00140000 0x001B5FFF Final Dump False 32-bit - False
...
C:\Boot\BOOTSTAT.DAT Modified File Stream
malicious
...
»
Also Known As C:\Boot\BOOTSTAT.DAT.8QpXV (Dropped File)
MIME Type application/octet-stream
File Size 64.26 KB
MD5 81ef5d0595eb27196c97c0e23e277e69 Copy to Clipboard
SHA1 b379793fdd1076fe62bdceff5bc7d26e6b1c523d Copy to Clipboard
SHA256 768b6ee1f7ba11f257739a82ea4ccd40daca09deb830abf71a3eb560330a8b76 Copy to Clipboard
SSDeep 1536:11cvhymjBVDv3FoCLdkZCkq2Ru9Td/iymmFDCbkeeoUJJhK:11cv0sbDOmCZrf08ymiHK Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Recovery\d327d5c2-7147-11eb-9862-d731c5aaa7a9\boot.sdi Modified File Stream
malicious
...
»
Also Known As C:\Recovery\d327d5c2-7147-11eb-9862-d731c5aaa7a9\boot.sdi.iM3sh (Dropped File)
MIME Type application/octet-stream
File Size 3.02 MB
MD5 cb99a7bcb596032085f396fd63850b2b Copy to Clipboard
SHA1 2960d1c5986072c52d93307e3d419967bad017e1 Copy to Clipboard
SHA256 057850506a0c547f6837ab1a03ce13b1e2894574f07865579466d0ce90d889fd Copy to Clipboard
SSDeep 98304:zWWkewuqqlHImy43Mz1HXyL2/x5brs6sRVTC8rV4nOI:zWWkFEI8w3yL2/rkTZJ4b Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms.0ot79 (Dropped File)
MIME Type application/octet-stream
File Size 6.76 KB
MD5 0816f794ec77d9d43f347c5c192fc296 Copy to Clipboard
SHA1 f5090c95ae6f59d8167ac898c0a823ff0e855a26 Copy to Clipboard
SHA256 cf4fb5a69a6a4fb87b7cf7413ca613469637396fbb1ecfea0d164880a6bebd20 Copy to Clipboard
SSDeep 192:+n1MGRpVLcborXpfjpplCTZwBfp0A0LTLZpAsrO:Un5cborXBLlwWBfQPFpI Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.8fId (Dropped File)
MIME Type application/octet-stream
File Size 28.26 KB
MD5 331fd32be86f56098eb6c81b4c990351 Copy to Clipboard
SHA1 b968e4774011ee6747ba981ea1e326b75af3e58f Copy to Clipboard
SHA256 31c5718463b7f5b6a51087757c6589c86a2fc411a2bc3ee1d775846bb5302ee5 Copy to Clipboard
SSDeep 768:7hvRl8Wx2o3FdsoK6IkOPB921VbB/LE6gWdURv69Ldprkmy5Y:x8Sdso2Bw1VbB/Ie/hpr2W Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms.q4ALte (Dropped File)
MIME Type application/octet-stream
File Size 28.26 KB
MD5 42e747a2277fd468679f213406c46cac Copy to Clipboard
SHA1 1962bd0b6e6094d8e19290cf645f15a50b45dc08 Copy to Clipboard
SHA256 db7a87e2bd59fe5b1b486d9cbcfdf197b22be5032133382e65d111f6bbbad490 Copy to Clipboard
SSDeep 768:OOvbrlT0kk6hY5GES63IIASAc1qOVQlREShIqK0vremGNE:OOjrRFh1lSTEaQHE7JmKE Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.DMEyT (Dropped File)
MIME Type application/octet-stream
File Size 28.26 KB
MD5 dfd02b9ea95782d5fb92185e67116d54 Copy to Clipboard
SHA1 2a422d665a41139b22dc929b535940fd213bc648 Copy to Clipboard
SHA256 4d1529279d206df5087cf20e1d6a51c09771eaa264e57a247127abff40efcab5 Copy to Clipboard
SSDeep 768:2QMO9BDTl92QXHmXFlHrt3782VlP38q2Vc8IH2LI02:2IB2iGXFdV78Om5c8s2Q Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms.MHQL2H (Dropped File)
MIME Type application/octet-stream
File Size 28.26 KB
MD5 ae3d15485179dba6c2405127ed0884b4 Copy to Clipboard
SHA1 50097939b6bf2b41b7f41b7d06497b676d965484 Copy to Clipboard
SHA256 37ce5a25fed59ab383237a5ab968db80b22eae2afe61b737bf846329c490356d Copy to Clipboard
SSDeep 768:/rtEVkCaWd52+95wyxjcXKUL3gi/Z8yJwOomL1q:/WVk3Wd5L+IoNgYjq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\index.dat Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\index.dat.Zfti (Dropped File)
MIME Type application/octet-stream
File Size 32.26 KB
MD5 5b959f4f226b44cc2c587bfa7f15bb57 Copy to Clipboard
SHA1 cb47d0a4d6ab31a45aee605f9edf0d2e404df01c Copy to Clipboard
SHA256 cfac9241532a85cb2c58d41d592950690f6875dba06f2d303218877d28bc5173 Copy to Clipboard
SSDeep 768:iBUco5jA53mCg5PK7S5/Aw1RUeZA3nwg+bcAatbfedafBML:uLb3LcC7GRRUeZA3czatbYSm Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.bak Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.ZUtDrB3 (Dropped File)
MIME Type application/octet-stream
File Size 12.17 KB
MD5 336c84d93dae0383717421d40d1da6f7 Copy to Clipboard
SHA1 5017732b9af4b3258b884c3b814a25573e53f15b Copy to Clipboard
SHA256 8e7a5f0474aba5cddd910a308b50bd0190135334663c8bf0de0aa3a906b24d34 Copy to Clipboard
SSDeep 384:YreP69KTCnx310GAZSAewIiflDpiOC0RONTdh:YesUCxNAzpiO/R+Jh Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.txt Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.bkZF (Dropped File)
MIME Type application/octet-stream
File Size 12.17 KB
MD5 b2b1c70f9a4db7402795d79d64fb3693 Copy to Clipboard
SHA1 0a895a37b38a3d8ef3810a198ec0764e47d783db Copy to Clipboard
SHA256 013395aff92f0deb0408c61d12bb92ba4e9ad2cded9719f104625ec05b985ffa Copy to Clipboard
SSDeep 384:iihY7AgAGrFYYtcBcJnkdmkRsayZ/9RDB3x2QYk7yXb7hZ:7C7AghukJnO0J9z8Q/IPL Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb.sTzFJC (Dropped File)
MIME Type application/octet-stream
File Size 1.02 MB
MD5 53d3b491c13c37f73be3d276def715a5 Copy to Clipboard
SHA1 9c8909a19e5635bf2b48f1de9a6ea77c0fbbddbf Copy to Clipboard
SHA256 de250144bdc91402242b8ea112741a7c21f97ceea54e9788a27c6a6a0cc34760 Copy to Clipboard
SSDeep 24576:T6C0yfXlR319b6H985TCZyADPiDacGCgQ8zO4Hj7lxXh9t:TfzlR3/bTKPiDanmAOE3lvL Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb.3ywf (Dropped File)
MIME Type application/octet-stream
File Size 68.36 KB
MD5 24d06cc44471734392269ca6f910cfd4 Copy to Clipboard
SHA1 4efb282c172379e31afc1a6739d8d384bba0eaac Copy to Clipboard
SHA256 7d030fbcddbe816480bbef37aba16ba2aeee96b37628f372e5e97a9e3921c771 Copy to Clipboard
SSDeep 1536:BkhrbhaxMeXw+6grxg4GXQWHiOkfUmQVTlgvRREkfePXTLNCXkGMP:u5t2Mow+F70QWHXkffQVTlgZSse7LD Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\01_Music_auto_rated_at_5_stars.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\01_Music_auto_rated_at_5_stars.wpl.W62nYJK (Dropped File)
MIME Type application/octet-stream
File Size 1.28 KB
MD5 ecb58180dfaf649bfce3e079d4035732 Copy to Clipboard
SHA1 3639382fd22ddcbb47c20c672a47d791952b1cad Copy to Clipboard
SHA256 e5b94687021d057f83446bafc9a3761a9529d22dd74b502c72c3b2c89d494b91 Copy to Clipboard
SSDeep 24:Z3H298YMcuVk8va6TBxyW//Trus8jHzvc7JbVC9TTkaisCntT:dH27McuVVaM//TKs2jAJ4NTJiscT Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\02_Music_added_in_the_last_month.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\02_Music_added_in_the_last_month.wpl.mqcoX5 (Dropped File)
MIME Type application/octet-stream
File Size 1.51 KB
MD5 f6852197d365e86ef3cbaee5fe83d9d1 Copy to Clipboard
SHA1 51fc48a4526ad88659a8ef08df40dcd52e822568 Copy to Clipboard
SHA256 a8d952aacff90fb7c26a4dcea472e37aca00413d53367465856545911e5faef3 Copy to Clipboard
SSDeep 24:yE1Q9Q0zXsxMMZb8+QVWTLvEsRLV2OU/zB6gZ4lecNMmD5WGPW1BINhORgh:y6EQ0LsxML3sR3U/N6gZ9ca8BPoBRA Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\03_Music_rated_at_4_or_5_stars.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\03_Music_rated_at_4_or_5_stars.wpl.Z55jRG (Dropped File)
MIME Type application/octet-stream
File Size 1.50 KB
MD5 ff5348c13b26c300e9cd04aa3e5e4737 Copy to Clipboard
SHA1 4e393dc341fbddfd463af3acc66d046997a63ce4 Copy to Clipboard
SHA256 a2de71b4b1b8b5b37c926be0086d8c087fc3fa1f4a5c6cb5f8be08f117ccd7ab Copy to Clipboard
SSDeep 24:hg0MKlac0olaW4Y7T1tDcrVYLeNychXuiGRZ+8GPkvLFhE3JBDajp2ipmRvlu3lB:GbKlac0lWJNJcryLPoXuhRZYEK2paVE7 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\04_Music_played_in_the_last_month.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\04_Music_played_in_the_last_month.wpl.L1Gnk (Dropped File)
MIME Type application/octet-stream
File Size 1.51 KB
MD5 8dbc4dcbc4f53b193cecf74c8452d444 Copy to Clipboard
SHA1 b23e31fc3f22f10f4ad6aad7f90fc603000e6c0c Copy to Clipboard
SHA256 ddaac17dc26b03e50f2d67eb137543350eaf7d6446e91c51f90bb8a5249bbe3c Copy to Clipboard
SSDeep 24:e6BPoyHUSW+HfjDPsFugOsOsYRAOm4Gag2cStFNMk/FyJfqiwzpMuNHY9fQxJIAe:eoDNWADsFrOtLm4Jg9Sek/FyqZb6P9 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\05_Pictures_taken_in_the_last_month.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\05_Pictures_taken_in_the_last_month.wpl.n0Pkr6q (Dropped File)
MIME Type application/octet-stream
File Size 1.04 KB
MD5 bcd083ca90d59231ad04a3e1f1ceca62 Copy to Clipboard
SHA1 9eb106e3f5d4b3464f59cbc8fff95370417e3763 Copy to Clipboard
SHA256 f0c9d531ae8e5dbd32abe48116b4856c1f04210b9e4cbdc2b945526e254f66ae Copy to Clipboard
SSDeep 24:Cr8IQMPhwZtzmPNSKR9JLQW52nmHPhWiBmRONZ5RHglNVww:CrlBet6BQW94iBmU5R2iw Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\06_Pictures_rated_4_or_5_stars.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\06_Pictures_rated_4_or_5_stars.wpl.SMe5QqU (Dropped File)
MIME Type application/octet-stream
File Size 1.02 KB
MD5 bf18608f66d672dc29a427f8eab533bd Copy to Clipboard
SHA1 ba34f231d4dcec5b1beac54be363b9cb33951b0b Copy to Clipboard
SHA256 dee83e885e176365a583ffa7d9a21bff336059b75628d6b9e7b3a611d3d6f9fc Copy to Clipboard
SSDeep 24:S2LN6axdsMZY5IFBFJoIrBW6P7Zarx/0rqj:S2psMsMBFpW68raOj Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\07_TV_recorded_in_the_last_week.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\07_TV_recorded_in_the_last_week.wpl.aWDJI (Dropped File)
MIME Type application/octet-stream
File Size 1.27 KB
MD5 283ca04f9a43a6eb3d3654a3f4d6c695 Copy to Clipboard
SHA1 a036c93c2ea292e23158d9f1bcee08d3147ddaa4 Copy to Clipboard
SHA256 c0bb45bd666dba7ef96a03bf6711a08a93d4f6ba591814ce352c83d54f486e12 Copy to Clipboard
SSDeep 24:dlBixiBBhYi9vmw+f0+Wa3fDEJmc379BmNN/IsDRG3YEPuUa2DUM35:ksHpGz3fDABBmNNwkG/PibM35 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\08_Video_rated_at_4_or_5_stars.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\08_Video_rated_at_4_or_5_stars.wpl.T1slk (Dropped File)
MIME Type application/octet-stream
File Size 1.25 KB
MD5 15c4b9e23b650999a5ca35e02cff58b7 Copy to Clipboard
SHA1 54372760f787dd0e2285397d23e48e601aa930a0 Copy to Clipboard
SHA256 810e8028ec7344174fce6d02d0eeebe1485c1cd5c2b1debd503eeeacbfb9a892 Copy to Clipboard
SSDeep 24:XCezaajnR0TZNlH0HZpoQBZc2wtJvxkes78qto2HBa+NN2eml/KiYHqnhW0vlxB0:XCe7RUZvGzOvNs7Xto2hLNMe8/KvKhD0 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\09_Music_played_the_most.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\09_Music_played_the_most.wpl.R5GO (Dropped File)
MIME Type application/octet-stream
File Size 1.26 KB
MD5 2e1de140c5eb26227d39cce86d3b5ccd Copy to Clipboard
SHA1 0d2ac0ccf9fefb2ac1142c6ec5a09a1034ee725c Copy to Clipboard
SHA256 f20a6e3d88c07f482faa857e74c7f5a6093f1004eb3004a89c00e3b510e4b247 Copy to Clipboard
SSDeep 24:WZYxvf+fUJXXKSP+qCUBUm3sxzNx+bHWMBUdxvnctwiIsM/8x1yy4tGjol4:WqxX9JX6wem3MzqHGxktXDW8xXjoi Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl.OIXNDJR (Dropped File)
MIME Type application/octet-stream
File Size 1.30 KB
MD5 3ea805792a1996b8b8013a8103275314 Copy to Clipboard
SHA1 a125689ade36ce91e5f01005dfa14f22065f8396 Copy to Clipboard
SHA256 137c36b7dfc77f6a5e30f5f0e2e7d32a82f613d1cbe3e13961d96d777245b476 Copy to Clipboard
SSDeep 24:EVXLIAtg+rEslhhZKFq0g1KKso6o8VtzOH9ajxYjdLq4PhCxMZ2nMGr7CgYTMq:qL5C8PKT8J6o8VFOc8d2CMvFrOLT5 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl.kMfs (Dropped File)
MIME Type application/octet-stream
File Size 849 Bytes
MD5 2ed00941b93f1688dc2edc6c388b85b4 Copy to Clipboard
SHA1 7e22c56441c5e52880f7dcf7170eb9fe88d861c5 Copy to Clipboard
SHA256 9a7584c002303744b15f9c5f79160aa5228a1423461963fd1709c96b33c9011d Copy to Clipboard
SSDeep 12:y9kWRufj4ozEyw/KKKNj48VJ8qUAyC5L9gglSasRxj3pGULxVeaw9jl+R/bJqpzJ:y9fo4XsnNj48V8LKL9OH3BSB8Rz4en1S Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl.P5qdJAn (Dropped File)
MIME Type application/octet-stream
File Size 1.31 KB
MD5 3fa4f411e57eec721af78c56ddef3348 Copy to Clipboard
SHA1 cd546df2b6d43d79c4b6bba54947321a35d3e539 Copy to Clipboard
SHA256 9d3600a7115d001bf2b88599a701d609654a08bbd41d02be58397286d6d46564 Copy to Clipboard
SSDeep 24:MIUr0Z/8lJyxLmdB/XQ1Auao07E9p8DHT+a5l54yhywNXv2IqhxBUE:MvOm/XQKu+7c/a5IyhTSxBUE Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.c4rtaO (Dropped File)
MIME Type application/octet-stream
File Size 40.26 KB
MD5 acb365a9e244fb531a6f2d19a5b89ff2 Copy to Clipboard
SHA1 b0160cab2630a3836f99dfc26ec8e8fa49169e95 Copy to Clipboard
SHA256 2c847cfdad49638a3aae38d9aa5f29899f9e7a1542a886cb84dddf2ad49cd87c Copy to Clipboard
SSDeep 768:wRFFHrfCkaKjXt6nidXSruUhtuYqAOCGbDUsT1Xc3UTDEnOW6VwX:wV3d6niuuUbuYqAsUi2EmX Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.AHUWV6Z (Dropped File)
MIME Type application/octet-stream
File Size 16.26 KB
MD5 39b61a1fbb12dbc03feeb7913c3ae102 Copy to Clipboard
SHA1 d61331b32222c35f959c6c77eeb034a21b594c24 Copy to Clipboard
SHA256 325ac52d97f8254f3744d20a938594982818332d5871b55c5758b6a2cb77413f Copy to Clipboard
SSDeep 384:ESgqKr7ZsaAnUDgcNCvArxMiLNfxWgV6HJ/GC9FK5qJ:MqKrKkDywXLvPqAK Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.VVef (Dropped File)
MIME Type application/octet-stream
File Size 1.00 MB
MD5 486b8014b9ea6e34390ee0786ad6c1c2 Copy to Clipboard
SHA1 13ea8f644a9538434aaca071645f6f44a9be34ba Copy to Clipboard
SHA256 b6d95fa2aec1061668c4d10ff2af6dec785fb724f9e573b6b9b262e6dc57f287 Copy to Clipboard
SSDeep 24576:dFit3NUM6ApIRSgvzMKi/b3FAAIOOdftTVsCmD8yGRkpaeK:YIsQcXe+FD8ygYaeK Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.4aFgzcs (Dropped File)
MIME Type application/octet-stream
File Size 3.44 KB
MD5 45f36eebdb6a83e376a2d56061d970cf Copy to Clipboard
SHA1 56af986708f547c1db97028eec91605d2cd1fdb0 Copy to Clipboard
SHA256 c78c3fb31df71ea7846bb81a510852509f01581bfa5da39228a5f36d1927593c Copy to Clipboard
SSDeep 96:UtE75uO7y3t5R58JPuBy9qtWbHZoMovxgz5raKh:m6xm7b8JPuoEt4Epehh Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat.X30Y (Dropped File)
MIME Type application/octet-stream
File Size 16.26 KB
MD5 2f4373948565770e4e4b6c726bc4399d Copy to Clipboard
SHA1 f3573c26c17fcfe42c79772bad0aad53712fbf71 Copy to Clipboard
SHA256 db78b302b7d602b654c5deaffa82ec908975b60413fa1d6e0b86626794950470 Copy to Clipboard
SSDeep 384:l7JpVvTZJsD2qzVnzbMuozJjbSjRr8/W72jBbRvL5:llpVvEr5nzbZotyx3AvL5 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat.D2nwT (Dropped File)
MIME Type application/octet-stream
File Size 32.26 KB
MD5 8be983266e14a400273e97e89bb3ce7a Copy to Clipboard
SHA1 9c9bbcd2c3b471ba2654f0ad4785ba4c5451cdae Copy to Clipboard
SHA256 e757e4d3fc660af1f8185278202d4c3270cada23b354c11582485a4c4beefc12 Copy to Clipboard
SSDeep 768:zahurHSc3jfh6ZfpDKG/NBjSsmuUUGJwwa3MHKyAs:zahCFbhGv/NVSuDGJwwa3MH Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat.iJHZvTo (Dropped File)
MIME Type application/octet-stream
File Size 256.26 KB
MD5 1cdefcadb13c5e83e0a11baab160ef30 Copy to Clipboard
SHA1 a8983035f0487c6362732378ab06f9fb8a4bcf77 Copy to Clipboard
SHA256 9210430a6c0350a3788482ffab7641c1b36acd8e3a0bc87b7698c303c54454a2 Copy to Clipboard
SSDeep 6144:5xND5f5M4PE3AEcyDeD3GOL+JMgqcQBH9X+:R5G4MwEcyDeD39LPSQ3X+ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1.7yg2uf8 (Dropped File)
MIME Type application/octet-stream
File Size 45.26 KB
MD5 9ae91885a4f3cf04dab4a6d8949314b7 Copy to Clipboard
SHA1 cfb5ded26549241a1d6108732703e70ddc77bab6 Copy to Clipboard
SHA256 a9f683887fd8d3427a8e301b891cba38472240db23f311eb6926796e0883d89c Copy to Clipboard
SSDeep 768:+03IM/y+HuVpXRKORv7wplw/KtMOX0MChFFWRip4za7Jb8bJTBWwATc:dypVxkORDcN0ZFFpGwZ8bDWwX Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf.4JdFvBx (Dropped File)
MIME Type application/octet-stream
File Size 64.26 KB
MD5 48d04dd0582b71579eed97a14cece334 Copy to Clipboard
SHA1 62f6544871a807659f01fdc6f8962ee2e72f391a Copy to Clipboard
SHA256 b3f47ef41d00304b3b20a629ea69c6d989b85229e39db820b4b25501dffb9658 Copy to Clipboard
SSDeep 1536:jofmvqWIJIb/r7YewXPjK83utKqdhzg2bgxwJPp+VXiWhWt16M:jlCpKzM3AfDpgxwJPgVL4f Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms.7NYjYet (Dropped File)
MIME Type application/octet-stream
File Size 512.26 KB
MD5 b48058ae5b4a00c31acaed8fa17868d1 Copy to Clipboard
SHA1 a8b75fb4889c83a2f9d7c73b69df1ad0732efe9e Copy to Clipboard
SHA256 de0f85c3f3b78f3b145987e6b5c8ed36193da3bf2c3ef67717fc86b81f4305de Copy to Clipboard
SSDeep 12288:YQgQlwO34nOnFGDvs/qZjgAKl27CeTpQuVmEVq1zrYCMnaiQOexo:75OO3hMCAKyZTGOhWzrY1naVe Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms.OdnT (Dropped File)
MIME Type application/octet-stream
File Size 512.26 KB
MD5 fa6ea85b6d9b50ab5025d4e68e322eca Copy to Clipboard
SHA1 f7eb9c5f962d620fad28f2fad0f6969da98192eb Copy to Clipboard
SHA256 ad1be52d6e62da02262b98d5a920267e7d818df8ff6f3cc57821f2bde78010dd Copy to Clipboard
SSDeep 12288:0hVt3ABTmFYQNvr+aBymRJgm2A+cF/Zo39EkmfNJGJ8/:0h/3AhAL9zwI+e/+NEkmw8/ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.bTfq (Dropped File)
MIME Type application/octet-stream
File Size 936 Bytes
MD5 00a274db1bb667aa30b70f1b454302b3 Copy to Clipboard
SHA1 56858d9e43332b3fd41234359a1b4a5a210f1bc8 Copy to Clipboard
SHA256 3577ff5e91fea601e917303f0d555a1a61c69da85a6757b8b36d74e108634ce1 Copy to Clipboard
SSDeep 24:luCPJ1bcWvEoFNQJTW7vIbkbfb7Zzv4dhciozhEFLd7:QCPJ1AOjQJTW7v+kH7ZzOGiozip1 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.HPqYEbs (Dropped File)
MIME Type application/octet-stream
File Size 1.95 KB
MD5 e6b9b661c42e2b8bac1811498728c005 Copy to Clipboard
SHA1 ca4bfda5c5584abb4488310e52616337154fa0e1 Copy to Clipboard
SHA256 371b59ad6a0714faf3eca9c6b6e01e0a19578cf4f4b2df7995f9e677b51c77a0 Copy to Clipboard
SSDeep 48:QJMrOTDHb1drp0xU+bf1afaEI4iv8x8MCMdulTioYLNl36sumc:Dr+7CG89aCv4i+fslmoYLNl36H Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\edb00001.log Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\edb00001.log.qhvDx5 (Dropped File)
MIME Type application/octet-stream
File Size 2.00 MB
MD5 413881d83f14314c095641f236d43311 Copy to Clipboard
SHA1 09d25cc68141240bbb0984d742c50125ff417156 Copy to Clipboard
SHA256 0b2fdc7bbdd5a508a7e334d85fbb28da5f28f1e338d8b2b3524aa03716a6c48d Copy to Clipboard
SSDeep 49152:YDnS1O/ZcdGoClwhX6wcbGewDyk7vYJX5xgNkukIRcZDI2:YeE/ZcdG6YJHgXkIRcZs2 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStore Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStore.sttnqT (Dropped File)
MIME Type application/octet-stream
File Size 2.02 MB
MD5 2e68c1bd399050d83bab3df1876635c1 Copy to Clipboard
SHA1 893d0420cc79726c5320694e12d850be5a35da3a Copy to Clipboard
SHA256 5502984fb8b79cf46a76abaf031d9ea2bfaecc5216f4425d27bb3976a114a788 Copy to Clipboard
SSDeep 49152:j/3lRh93ODikPSHg3sQiZbtCsuC7C88r2xKlMtxaV1T2EoBT8gpx:vv3uqA3Ybt6aq2ryvrGX Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat.Bq7VQU (Dropped File)
MIME Type application/octet-stream
File Size 16.26 KB
MD5 d8f42800552001d3846fdc5f8aab7ee5 Copy to Clipboard
SHA1 484e268674a1f798dfeecd6675588e600ed3a71d Copy to Clipboard
SHA256 776dcacc9f282d3a428086bbea5ed30a34f889cdfb12dfab04005683ee38f137 Copy to Clipboard
SSDeep 384:63AqClwHMAopzImliuOnwbjOK6JzM0CxfMoCdsi1y:dwHMfamHOwKzPsUZdsiA Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb.chk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb.chk.omY5ph (Dropped File)
MIME Type application/octet-stream
File Size 8.26 KB
MD5 ff4c88b73c180e1250c1d6a5441447a5 Copy to Clipboard
SHA1 43ac6c5b3c1e0ffd438891db76daefc467600971 Copy to Clipboard
SHA256 fdaaf42312b7a898586cb4b3b87b8c61a925c9446668e7d578d5385ffd7ddf0c Copy to Clipboard
SSDeep 192:WNVIl7YTzwobmhJgQiRNGUiea2CgRBv8TAunMhCtAF:kIlmzHRNGU3TFRBvEfAF Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb.log Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb.log.DXVDekp (Dropped File)
MIME Type application/octet-stream
File Size 2.00 MB
MD5 aab9946b89554d718427d0f4a733586f Copy to Clipboard
SHA1 1236c2840bb7fabf6f9ebdc39f3266bd8e05e82a Copy to Clipboard
SHA256 baaed3b65ec1c3b310131b77fe764d4a0649deb2a253eba912397792f42879b5 Copy to Clipboard
SSDeep 49152:Sqm+Qal9s7Xd+b3RwhP7WK4n3f5GGqikAAELWs/dAC4k3yp05:SqyIW7q3WP7WxPbkAzgkyu Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb00001.log Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edb00001.log.ixxkMTz (Dropped File)
MIME Type application/octet-stream
File Size 2.00 MB
MD5 470b15c631d91d2860c81ce1985a7233 Copy to Clipboard
SHA1 935e534b7b79a17662b3db50a2c17a15e9b7cb54 Copy to Clipboard
SHA256 a165f95755f23f88161eb64ec113ff4e699d8ca94b0a6c2bde7f28d47b0f99f8 Copy to Clipboard
SSDeep 49152:SydXIEshz3C354VBOBEAF/o68FSW+dfAmxa7mGXCnf10:eEUyCm/XqtufxxaZCnfm Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs.Pbz3 (Dropped File)
MIME Type application/octet-stream
File Size 2.00 MB
MD5 16e8df625ccc61ad61b12d318bd1f441 Copy to Clipboard
SHA1 084f97e3250bb464871239d25a5d4d1fee0bcdbd Copy to Clipboard
SHA256 ea1d7c9bfdd3160aca28e8dd91d3bb18e778fef7ae23051a8ab4a8bdf92c7202 Copy to Clipboard
SSDeep 49152:pOB/H61290VBkVj4DzTxnMXeUmPVjI77RJRt8Q0aaYt:wBAVBkJ4DtMOrP+77RJRmni Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs.dvZ4uP (Dropped File)
MIME Type application/octet-stream
File Size 2.00 MB
MD5 2c4d8cb8c4146b2d2a1ddc7fefef57ba Copy to Clipboard
SHA1 387ff2e9788e409327b979efafb5ae79543d9d55 Copy to Clipboard
SHA256 a102fa85a62786b3c9123b9d02f879eb2b399ff0163b4a91447743af5f1dd8f4 Copy to Clipboard
SSDeep 49152:nQ6GLW0g7lkQOEDFl8/Uylw/ogfzAvDJGGMyNLXycJYSwdsHK:qWN7jOEZa/bYzA7BC/dsq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\oeold.xml Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\oeold.xml.edNkytX (Dropped File)
MIME Type application/octet-stream
File Size 524 Bytes
MD5 2a48efaf9b25c200f2a86c356b68271d Copy to Clipboard
SHA1 a1b0053a168227855aeb21877947a82512157a41 Copy to Clipboard
SHA256 dfd710f3182299a621692d1e9c5ed8dc75490f05434c3302d99c110d11c501fc Copy to Clipboard
SSDeep 12:woGJZ8Ce5Tt4spavv+PZI7WWHvPABoXnpT9ST50rb6:FGJZbGZavv+u7WWgKPc5036 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm.FAQzzh (Dropped File)
MIME Type application/octet-stream
File Size 519 Bytes
MD5 46218a6697aa174518f22711da29802f Copy to Clipboard
SHA1 af03f483e9f40eb840883b823ed5be686dea7dc6 Copy to Clipboard
SHA256 ab9b6a4741160b1e6b3a4b8aa1f123c7f5035b905f99d7f8f3fac0c7279a4321 Copy to Clipboard
SSDeep 12:oN6wPu3zf1PpxHqhYh7j8ZMCIPxgZBNObR7xY4oDiECIp6509tZKEGVjJq:oIH3Rhc2h7QMpxcBsR7Wl65ktZKBVNq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.5HfB (Dropped File)
MIME Type application/octet-stream
File Size 1.31 KB
MD5 6f4bce6c4985e7ca30cf0cc6f17245f1 Copy to Clipboard
SHA1 93bd1765fd91094c27755da3ddbd64d3450a0102 Copy to Clipboard
SHA256 1706fb4062063128433855df60068cec66af0388324a1809ba5d6d98d5b195e4 Copy to Clipboard
SSDeep 24:+Lm/hdpqSzctKvx7fs3vzaGp6b0jJODaF+GoZ2Vm03Vwj:+LqMJ4W3m46b09oyRy2VBW Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm.8006e (Dropped File)
MIME Type application/octet-stream
File Size 495 Bytes
MD5 34b38a2757957fe7c3827c24758684d6 Copy to Clipboard
SHA1 298cadfe6dd99bb2f19ea2f32d217b6a57e9afd8 Copy to Clipboard
SHA256 8c66942e3dff70be6583f89362eba379b508a29209c2803cc6538246757c4fcb Copy to Clipboard
SSDeep 12:QB9H4FCDDwgvBfXtAtZf0z3pBwAxb859zztmjKM9FjWQ:QB9H4FCDD32YdBwMb85ltmjKM9EQ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.3ZJI9Uz (Dropped File)
MIME Type application/octet-stream
File Size 23.57 KB
MD5 d08c032fd4693d1e5100e8a3b6159639 Copy to Clipboard
SHA1 99dbbe584f93c2ba3465cf9278fd567f0cd83112 Copy to Clipboard
SHA256 5986e3c1fc37459c159484d1905be2511161e96b4afa57f3e2623620f122842a Copy to Clipboard
SSDeep 384:BxRmt93H8yLtpgPBsB71vFpsWn7czaVQxKtnkPRPC/Bf0Zq/+4J1O90AJlXM/z0r:sbH8yLfgPBiFjczaaUnkPdvZqlJDAJlL Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.ZAV7 (Dropped File)
MIME Type application/octet-stream
File Size 501 Bytes
MD5 6f579af0eb63c49d9c94411fec967777 Copy to Clipboard
SHA1 3314917d5473009ab77a4143bec6ddb0749158d7 Copy to Clipboard
SHA256 97454ce7cd52b74cd559ad30d3a92109ccdf5ef5840f7c6f505cd18e572667c3 Copy to Clipboard
SSDeep 12:W6vUQnNxalijOFQ8qUw+u5VexJXMQqnu/4iLEw9:HU2xaYjOFQB+dqc4iLD Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.oUaQu (Dropped File)
MIME Type application/octet-stream
File Size 6.51 KB
MD5 efde1229d6451286b7dd8df3bd822064 Copy to Clipboard
SHA1 fc231c4499dc7582e873e2ee9e132637edf929e8 Copy to Clipboard
SHA256 87640782aacb92bb5d966c5d41dc8e56e6c5f59e6f2fd8edcc31d7feb8bc9400 Copy to Clipboard
SSDeep 192:GBbUs/48UJgjpQ79P9nYoG0M3AZBPvBmYldPT8sN+l6N:GhUs/48B8VnYfNmmYll8Xlu Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm.9vjzy3 (Dropped File)
MIME Type application/octet-stream
File Size 499 Bytes
MD5 0d232ae3f755af6dc622fa0240b6b7bb Copy to Clipboard
SHA1 44f0d8c5916f0042f755593c0b3893dc0cf983a6 Copy to Clipboard
SHA256 aafcecb6212328a5a67c792c77394619e9e52fcd1e82dcb0b8842c4f26059237 Copy to Clipboard
SSDeep 12:+fREeEr6qd+jJQbRIyMfROztdUCrx5hjnCieoIyRswx5:neErB3Iy8ROr5T1nC5oIwsE5 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.4i76wWf (Dropped File)
MIME Type application/octet-stream
File Size 4.38 KB
MD5 c16ec894766d739bf40f692f856494ff Copy to Clipboard
SHA1 642590bffcdbb8b597a9c04b4c6c0d137650a673 Copy to Clipboard
SHA256 0b3d634b193d18375be2d38cbf4697aa1a8524aacefa5495dd296a9f19a93046 Copy to Clipboard
SSDeep 96:OXcuKtsc7U2MkFX/kvvoO1p6WVkYrX3VLCV248yD/N5+/eveU:OXcuKqcY2MBoOXJVRXFCVHD/N7j Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm.Z8eN (Dropped File)
MIME Type application/octet-stream
File Size 501 Bytes
MD5 e2b275789c288c92909f2481f75f13b0 Copy to Clipboard
SHA1 c7d60ffb68710f70d4ac252190851bd72003277b Copy to Clipboard
SHA256 0a784d4ad102f063dcd5d58e6a9b3270ec7e0e8bd0d152162c8ef402e33e7129 Copy to Clipboard
SSDeep 12:3DFTYGWcH8gCsYQ4he1OJ8NHCaoVPCjuytY1RusU7D9T:BYH5PNhe1f5cV8Y1RuxP1 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.YrMMWEW (Dropped File)
MIME Type application/octet-stream
File Size 6.49 KB
MD5 7d9288841eba7c6b298a0e580f625375 Copy to Clipboard
SHA1 2b53a24df456f442fa50fd22b8dd4324dc3e86e7 Copy to Clipboard
SHA256 287c2925e479d4065dcc61932ce169daf29ffced4c12df72aac0f7b66d57aa54 Copy to Clipboard
SSDeep 192:ELBtrpcRoZhzywGRUm0Mp/C9k9D4tLVfDJ:EXrAoZ76/C9kALNJ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm.LeUtCae (Dropped File)
MIME Type application/octet-stream
File Size 496 Bytes
MD5 cf857d4d4030478c15c6b3e995bb7f8f Copy to Clipboard
SHA1 70a5f67038dbf62b697e254d8f7d59d029986b5a Copy to Clipboard
SHA256 7768c1ca7d46b43c738403e7cb1b967a8036f06638ee5c2c68036a33c265c3a4 Copy to Clipboard
SSDeep 12:vnjIunJKjY1u4l+udzaRYy5v//rMUQK8wDz42nsqT:vnfnJj1uCdzgXAxwP7H Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.FeWFobi (Dropped File)
MIME Type application/octet-stream
File Size 5.25 KB
MD5 640217e5d2ca075f0e112c49c599a2f6 Copy to Clipboard
SHA1 12c0b966255b6073ae5a0e97c2fbca887d0b4d92 Copy to Clipboard
SHA256 4968b14f841adfd10c7557f13d22818fbd9f5faef87d8c742724c52386a9ad05 Copy to Clipboard
SSDeep 96:GwM/g6eejvXZ0S19YlWpFsYhEmWJzb0tS5s2o+n/sMDE2pP+5v:4aejvJRJsYhE9zb+SG2RbDE285v Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm.dGI3Z (Dropped File)
MIME Type application/octet-stream
File Size 497 Bytes
MD5 f1de18bf5a9a440a9ca792a3262fc6c1 Copy to Clipboard
SHA1 a959ea35a90e62cd8ab95505933a3ea202213760 Copy to Clipboard
SHA256 bd3a377d9aa768153c77c20c4800a9b87c483282b003ec7bc9720354bf2cd7e4 Copy to Clipboard
SSDeep 6:/hkelsJ6WL6P20CZKqxO9o6cDkomapTV6DqaLzug67pJ/BRo+KGSoTA1gtnhjjXG:/OoWOPqYd9sIqV6dLz67D/BTKvgPVo5r Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.W7qCcu7 (Dropped File)
MIME Type application/octet-stream
File Size 2.13 KB
MD5 cfe440b561d58b43bf0964b96449f6f5 Copy to Clipboard
SHA1 a22aacc2fe4f66aafe98acae63765c733dc8fea3 Copy to Clipboard
SHA256 4205a37406adff9c21bf5c6379eee1b052d00eaed2622a24357bee355fd250fe Copy to Clipboard
SSDeep 48:8OvtAyZs4y8hgKIaBMBI/z2TBZ05NXyBZKAwkOi3otqLbocr2E3KWRkaq:WCVrIcCu0Bm5wy364qoEhaWuaq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.GmfqskO (Dropped File)
MIME Type application/octet-stream
File Size 501 Bytes
MD5 8293135d30e21e4811541ff302e12c0d Copy to Clipboard
SHA1 2e41f66641c18cda958b3b78412825c151aab2c6 Copy to Clipboard
SHA256 54a84d303880a1ddaff893e6c050563b51888e8f75087b30c65148d662bc5e25 Copy to Clipboard
SSDeep 12:xc/oYjTApGwvG+zZcSnE5KMBvvzDv84tnKLmo7UL7tVkGSq:BYjTArG+zTERBvbo4ILp767UBq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.UPuwR (Dropped File)
MIME Type application/octet-stream
File Size 4.88 KB
MD5 727945534345034d7126f70cc8bd3eba Copy to Clipboard
SHA1 6cbb2e649708573b4921b8eb0f90655de173c1e6 Copy to Clipboard
SHA256 6b512cd9eb6d5938db4a042170e99bad80cb38b2c835371c150f2caf7a204d1a Copy to Clipboard
SSDeep 96:KrEp7aoX/o7k38ytCCHgtNMV3gp5TCUDfzzkEP9ztlmubyvfOzh7NN+m1Zlj:uCaoX6kDtCugbxppBfzTZSubyvY7Nsmt Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm.mTTYux (Dropped File)
MIME Type application/octet-stream
File Size 496 Bytes
MD5 08a16e5befc6c850619b5a4880c9600d Copy to Clipboard
SHA1 2290b20994cc4b964b99e185114128daa3e0e241 Copy to Clipboard
SHA256 04cd20f6f0d00406b7a2a9548c4674d9bb4a6ce70e2fedcbc45191a7cd8424ab Copy to Clipboard
SSDeep 12:M6uPufIKizPL6aHeffk4Cs/OpvxcH55izEvD+sq:euQFPL6hzpQ5cZ5i4rFq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.AFm537Y (Dropped File)
MIME Type application/octet-stream
File Size 10.58 KB
MD5 97b0eb6202e699e51221009a9e2e69cd Copy to Clipboard
SHA1 13f6a8cd24175fe7f0dbf8a38bba1f6efdee88a2 Copy to Clipboard
SHA256 216e7dec5c11531d61f17643c73a4aca204afbf8731447e00611a1444372ba92 Copy to Clipboard
SSDeep 192:oC7OMUqBDYdFfKbjN3/WEK5dJoxef1CnyCsUcnKYZt/7vehNH90VGt6K/neAFNES:pptdYdFfKbj6Kef1Cw1nTneR90VGt6AB Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm.kuDpsGS (Dropped File)
MIME Type application/octet-stream
File Size 494 Bytes
MD5 0cd570d73e1c87677528cb965d42a8fd Copy to Clipboard
SHA1 7b96ccf266dac8b06bb812f82b503af5a9fc280b Copy to Clipboard
SHA256 8c94d5af70552195c98b0c8d7ec149bb602e4d3a29671fab9c39490c486c7a75 Copy to Clipboard
SSDeep 12:aSLc8zzsyNqVkMQDMx7uahnN1tFvFwmhjiyCBkP6pCq:a4cvmqVkTD07rhNtv1myCiCpj Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.FhLOwdh (Dropped File)
MIME Type application/octet-stream
File Size 7.59 KB
MD5 7664ab839b2ac3c31b3fbaa60aa60bf6 Copy to Clipboard
SHA1 f39444a66a669ac495c6056173a2de85af634c99 Copy to Clipboard
SHA256 dfefaef1e22e975b4870232a40224d02f8f96c09b65e27b9901095074a84d6f1 Copy to Clipboard
SSDeep 192:BD7c8fdHJ/Bxv9Gsh0FI5PIrvrYhC4FTc:Rc8bpxvXh0a5PIrvrkCj Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore.ZtcsMS (Dropped File)
MIME Type application/octet-stream
File Size 2.02 MB
MD5 fe65d0899513388fd70119801ddc146f Copy to Clipboard
SHA1 b6a4a9e7801d5ce7fd859b7df79ccadffaa7c0b8 Copy to Clipboard
SHA256 262a0edd658035682f706462fc670ca5d4f49bb6050513bea0e9d9a14a888bc1 Copy to Clipboard
SSDeep 49152:Qb8JhwDsnQZUe02q60J7Pbo/Ixi1XLe3EV7+19OU1aISZP5EpHp:Qb8Jh8YQWe02qx7PbUTbe3y7r+aISZPA Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat.HzeBkau (Dropped File)
MIME Type application/octet-stream
File Size 16.26 KB
MD5 cd4d5e20db41de167bc0b95cba3e197d Copy to Clipboard
SHA1 3d4c7c8cf5919eaef71cd725cdcea4aad975ca35 Copy to Clipboard
SHA256 40f546b8048d7c6642a7136aebe5c909adfed469287c678f3044b255b44e1476 Copy to Clipboard
SSDeep 384:s/D9SaqAUFFZmIJb8CilC062hBfc/ba0isumzTT:s/5aAUFFZmIrilCB2hka0p93 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD.KDM6A (Dropped File)
MIME Type application/octet-stream
File Size 762 Bytes
MD5 98da73500148b8827d65bcb6b47b92da Copy to Clipboard
SHA1 ec81d5a4ab6f39338850a603e6ca0bc89a303ac1 Copy to Clipboard
SHA256 0be33970ac7b4c9dd35a3179daf793d0f00f3edb0c81aaee6059c5a686ac3b52 Copy to Clipboard
SSDeep 12:0SBsr5R4luYmBkc6HFwTnMQuRfKZXnI7iSotbKbrX2HyHiuH7W891W07yv6r:0SBsr5LBkc60nMXU8gbqbuubWwl78M Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.75NldK (Dropped File)
MIME Type application/octet-stream
File Size 10.21 KB
MD5 2baf65bbd9d5cfdae273618b7c9729fd Copy to Clipboard
SHA1 9c2df032fc6b49ca247745832e59f4ca2fa78249 Copy to Clipboard
SHA256 f35680e69bc5295bd92bf54a567a1d7fb33db2b7bfc9a272d8c7b32fb047211b Copy to Clipboard
SSDeep 192:LV8gZz99m/KxVJP66TN4fGB3Dn2j9euKt5wkKwfQNrGC9wsoYa:B8gZz99m/+PyfW3D2pK7wkKeC/a Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.qS2B (Dropped File)
MIME Type application/octet-stream
File Size 816 Bytes
MD5 fb7c9f9c5fd3d08873ba8c160b583a28 Copy to Clipboard
SHA1 01ed4fae72c83f911970503c75c7f29a3fd08085 Copy to Clipboard
SHA256 c45d85048b42070f32bfb9c9188c818ee22cf268838ea3b6f9b625e5f6c879ca Copy to Clipboard
SSDeep 24:A+a6paSOmXui7AHvioB99mpEt+YPqzhQt+wrq:Ad6pheaW99f+YizGtFrq Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.2zZtu (Dropped File)
MIME Type application/octet-stream
File Size 524 Bytes
MD5 f0fc324be311f9da8b2e7cbc75684dcd Copy to Clipboard
SHA1 2859afba3696d494458be0fc9985f8161e6dd37e Copy to Clipboard
SHA256 4daf7f9a9662321dc4fdf5a5ef70f3f9e2a569e055b1cefde786e1555f32c5d3 Copy to Clipboard
SSDeep 12:YjQPtCC+9kVXp58gafBmC75QBSChSidEjervSh0cWezb6N1:OQPICOcpigafBmWOHSidyNWsbw Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.ASfWLt (Dropped File)
MIME Type application/octet-stream
File Size 568 Bytes
MD5 735f6817a1c733216223070337d2e6f5 Copy to Clipboard
SHA1 b6517b2e83329f75573ea39cd4045159e8033eec Copy to Clipboard
SHA256 d58ae48e9253fbc156fd7bab505424cddd8a65896fc95616825ba1e065d538f3 Copy to Clipboard
SSDeep 12:D1bqqCXLOCWHq0IJMaYaHQ+AJOMIOezyvAxFtHqbnJB9:D1bsL+Hq0IJbYaYJakoxF0bnJB9 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk.E5uq (Dropped File)
MIME Type application/octet-stream
File Size 554 Bytes
MD5 b1c27e25ec51def9a4cc9e045541c18a Copy to Clipboard
SHA1 6e8f7a9274990fcf6d2164804604f04624bdde93 Copy to Clipboard
SHA256 f64828307aec04ac843282f19d2c2cb6942e7c6b852ce8b8c5cbbea9d533f713 Copy to Clipboard
SSDeep 12:rhgQQFJ4zh6aa1IjV/D8vLgv2Pw3ydREQ/jPz/c8Z9njDz:r6HJy6aiIlDcC2PwijEQ/j48TjX Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk.loEXV (Dropped File)
MIME Type application/octet-stream
File Size 1.67 KB
MD5 5fe50c53a696fce793036c54f46ca16a Copy to Clipboard
SHA1 c4d51b0945a033b9df8c3bad8f7fa39509ca8566 Copy to Clipboard
SHA256 c5196da2f37cba7f7d089b27e2d112a9f597572a5019de08c306bed4d517d876 Copy to Clipboard
SSDeep 24:MglqUytiVPHS44z5lSgi1lvO7Mqcb8GvV5tZIxQqQoXTG9+Au7KLNjVlrL06fSZ1:3FHSBz5lrMqcQGMxTXC92yeYR+ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk.O5WFn7O (Dropped File)
MIME Type application/octet-stream
File Size 1.46 KB
MD5 9eee728005db7ba599ed63513f044149 Copy to Clipboard
SHA1 6780ca279708a9600b0c9dbf1890425182c36be2 Copy to Clipboard
SHA256 828e0c70c620bc659fc4b7d8f0631eeb42de832e672cc2c7bf324fc37688f8ad Copy to Clipboard
SSDeep 24:fCzSkOS7mjTPEB7oKO4Thf0jnTRA6hSg7V3Hce0aPEssxF/+LYqIHaB1jVqdElVv:fomjbEBUY9sDNkOVXcm8ssqTD1jQylVv Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk.kd6q (Dropped File)
MIME Type application/octet-stream
File Size 1.77 KB
MD5 38a73e58c1da0b2640adaa4118e305af Copy to Clipboard
SHA1 e92df4d857a59f9479ba149e98721df9e85b3eff Copy to Clipboard
SHA256 bffa58c8da0c8c54a38dc57aa1eaba877bfbf152489813f9e6d36b43a0aa0c04 Copy to Clipboard
SSDeep 48:nxz7Xa9DVyQNPwAToFWQncmF89VDRotcBM:duPyYPlMFncmy9T4cBM Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk.mYrV (Dropped File)
MIME Type application/octet-stream
File Size 536 Bytes
MD5 3936cad7f9bf733c378f099b7c0eafa0 Copy to Clipboard
SHA1 97b1c537768731d47ccfe692e59af66ddc5776b5 Copy to Clipboard
SHA256 c330f06284914ffc060c8cc1f932b446c6c86251694dccbebe145a279bafef23 Copy to Clipboard
SSDeep 12:/OXey27P5UuaXG/TBrHs0yqhlbW7ADO83XDHPDkzBMAR7yUf3jjLibr/r:/OXw7PKuaXG/TBrHMqhlWABDHLk2Aly7 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9 Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9.U4HBKWc (Dropped File)
MIME Type application/octet-stream
File Size 732 Bytes
MD5 97faf02a01825c4e69c1a5d906e24f58 Copy to Clipboard
SHA1 eea3d40b33010aa3517115a51964e567dc91cbaa Copy to Clipboard
SHA256 437a70e7ca5e5965b5e29f92cdb28528aba58ed23983ebddf4e6041dd6449f7b Copy to Clipboard
SSDeep 12:ROL3AS23qt1YAKK0s27xa3QjJhBTKO0ZI8wWYymIMbTUPSuyxn:ROLV23qHYi0z7xWQjIRZf0I3Kuyt Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\index.dat.EYDBJ (Dropped File)
MIME Type application/octet-stream
File Size 16.26 KB
MD5 a449fafa6af378f06c0a05297c67a65f Copy to Clipboard
SHA1 9fac1365ff2826107dfd52e50af140643b7ee83d Copy to Clipboard
SHA256 b43a12c663bc805bc1f7e044c6d5c5778d16501799b87b6998fa40679604662b Copy to Clipboard
SSDeep 384:wNBf5d6Du1uFDeSICUw0hDUH/oFxjw5+k5Wi/GKiqG:y/1+SSIlLhDUH/MsjWitG Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat.64ivOp7 (Dropped File)
MIME Type application/octet-stream
File Size 240.26 KB
MD5 85e248ed3ba13257a686b05715f15e0f Copy to Clipboard
SHA1 ebf4da65feb174cd956233633af2d3bacfceb8cb Copy to Clipboard
SHA256 c4d158925bafc105907774d8d73aa0a4795d9a1c5416a518763fb33671b9b349 Copy to Clipboard
SSDeep 6144:qxDblH+IrhH4gdEiww1PH38oI3gUl8MPuEUwYWcHI:gtH4qT1vHIQViuK Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms.oht06CE (Dropped File)
MIME Type application/octet-stream
File Size 3.76 KB
MD5 393d4f03a9f375df7a0676f6294b05de Copy to Clipboard
SHA1 2058341063b2db1c3c06345fbc21f75dffa1e943 Copy to Clipboard
SHA256 b9f89119f795511fd559db900f37bbabd670806b32df893bf14044b08fd74e27 Copy to Clipboard
SSDeep 96:WZaWsdT+0Q1X8DqwgCppfjMGOO4o3PiOOdlt0fxsZf/M5s4D:WcWsdT9Q+RFppfjIxCPiOOdlt0Qus0 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms.Xs73cBH (Dropped File)
MIME Type application/octet-stream
File Size 3.72 KB
MD5 a985502602e6c163e32fb25f8afde20d Copy to Clipboard
SHA1 cb2f4d8ac27f2fd7efcddcf32355d0b63f1f5edf Copy to Clipboard
SHA256 daa957bd6fa3db8168e3bfe6ba79885a48babfc5f54ad0feec8b9de0e6e6f512 Copy to Clipboard
SSDeep 96:FrucReMj8OxK6p6mcmufBemzplNbIEfzgq:Fruc868Q6vMa1F Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms.8GFiG9C (Dropped File)
MIME Type application/octet-stream
File Size 3.75 KB
MD5 c7f7cb8c582a89fc2c94c0d410fbadf4 Copy to Clipboard
SHA1 320abcf9e4c2225bb044282edd920f94c6d51daa Copy to Clipboard
SHA256 3ac6b0e8a2008dbd28c9be551b95b0d4a30d2655a9771fad8e112c878c077ab7 Copy to Clipboard
SSDeep 96:D3BWNEGKMy7+Onz/ZGJgT+t7u27BO/KYUQ:D0ExM1OnzPqt7u27BOLUQ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms.ejfbV (Dropped File)
MIME Type application/octet-stream
File Size 3.73 KB
MD5 458d1b9b9381a143837e60127fa4e187 Copy to Clipboard
SHA1 b1c5aa45821f6ce81714b77b9fdc46fea60b374f Copy to Clipboard
SHA256 a4c2a67c3af807f67f1f78360c3f13b7185abd5fa31fa36b980a14ff29174f42 Copy to Clipboard
SSDeep 96:IAGILUxNY5DvWghprzOWu1Rlrye1MxETVzt7nE:qILUA5DvvTmryxsnE Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms.Nhhh (Dropped File)
MIME Type application/octet-stream
File Size 5.76 KB
MD5 af56468245e4a869330eb24ea96320c4 Copy to Clipboard
SHA1 280036419884fafff179ee6caced61a65f2dc03c Copy to Clipboard
SHA256 46d2055e812adcc7f353b18b985bed33232aa56a424fb0924c4e27d348f7113d Copy to Clipboard
SSDeep 96:5CU/D83GJpNIWMFhbz574IMMweke62ot8ja04YbgTnp44xNR4PmW:5CY8WbN6d4vs3o4f47V4+g Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5afe4de1b92fc382.customDestinations-ms Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5afe4de1b92fc382.customDestinations-ms.pRc5 (Dropped File)
MIME Type application/octet-stream
File Size 15.28 KB
MD5 f8a3cfa6d4069e659f8222b78dfcbdca Copy to Clipboard
SHA1 484b2bdd56da13823316e27b32d9a9008d0f14ed Copy to Clipboard
SHA256 5b6982f480dae6914570326746c6f3ade1507d55b94abb334caa2cc477c068d0 Copy to Clipboard
SSDeep 384:5waV5rle6ylbim/7RKuTLhHlnhwxgUEPAlji:/On0uTBsWUW Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk.TVf8MK (Dropped File)
MIME Type application/octet-stream
File Size 1.47 KB
MD5 89ca032c07503332b7d1e37261e05fe2 Copy to Clipboard
SHA1 b05362ec7be5e7273c1764d559ac7015552935cf Copy to Clipboard
SHA256 a794dc63bd59c21497498bdf868e7758f99b72d47efafa6a2a784366fe9f28e8 Copy to Clipboard
SSDeep 24:fvw31a7ivGE3Tw1VGlNDY3o+BfgFFD9XhdW8hh55N0nvOxi5BuN8rENpJYkeHZNn:f4Fkw9WBosgFFD9d5snn5Buqi/4HZ8D0 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk.RCWups (Dropped File)
MIME Type application/octet-stream
File Size 1.58 KB
MD5 6f62d0fd9952348f19eed7273175908d Copy to Clipboard
SHA1 9a770c2fe2d31a1b5ce15708c8a8972e2f8ea924 Copy to Clipboard
SHA256 ccf9b09dd7018832f50491f873ec2a77a9761d1d16d3b9c0bbcb6201335cb899 Copy to Clipboard
SSDeep 48:piciDohLZ29TaLmDSDA/zFXK8M36C4fdNgJAwAAa1:pinOI9TQq7/JXtM36C4FNMG Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk.C1giP (Dropped File)
MIME Type application/octet-stream
File Size 1.49 KB
MD5 330daedf6574f20555142f317bb1f0f5 Copy to Clipboard
SHA1 47f57d6ffca60bd41246667241777ce0437dd467 Copy to Clipboard
SHA256 7de5e78604303cad48278c1351daefc6803daa2c9701608cd971f44530df13e4 Copy to Clipboard
SSDeep 24:WSgYq4rnsyAPVrmJZXJdU6k/N8eP+kqrqNJ3xa6ZtJ7VCQKSw7w1pQGyRwRImAHK:WSgn4rnsUJtu5Q8Jg6ZtBzuG2Gy2KLHK Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk.TpKTdS (Dropped File)
MIME Type application/octet-stream
File Size 1.48 KB
MD5 009803871d2ec4138683298e18afd41b Copy to Clipboard
SHA1 a5c79336822a308b99e6b1723526a28f7bfe2e46 Copy to Clipboard
SHA256 8411155bf6e35e09b8cf6ccacaefdbe750b2f6b1a374c72503710a35287304b0 Copy to Clipboard
SSDeep 24:OeHLMQwdVJ7fs6KQje0vPadtXU1aLc49iMqkMe/EMS2gutIl3bhjbZGKKOPK9Bpm:OgM9dV9E6KaTadFS49iM5M1V2UlVj4RC Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk.UJCI (Dropped File)
MIME Type application/octet-stream
File Size 1.51 KB
MD5 44b459d9de87e7058e818b02e7ce5327 Copy to Clipboard
SHA1 26f8925e2a71c454009fe70ffb885b4ac0577ceb Copy to Clipboard
SHA256 b0f0c9ef8073be77e9ed7091fa3240c46ff100342ac7ce2b5124e540b3d02a16 Copy to Clipboard
SSDeep 24:JKXgM5oLrUUCwxpxcH2yThHItHq0/50JmszKRPEji5XC069JPQKgyGSC:JKywUCApxcrThHWSJmszWMIXCB73g8C Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk.P0IHZ (Dropped File)
MIME Type application/octet-stream
File Size 1.53 KB
MD5 88b8e5e6f9bffa45970a5890fa5f0f2b Copy to Clipboard
SHA1 13f8e91558524438a449e9a7e0baef59ee98e3a3 Copy to Clipboard
SHA256 2897d23ea26bf17dc94dd837b9e9f2d246629530f8d87785dbb46c3549852af4 Copy to Clipboard
SSDeep 24:uxgDjFnQqa7EBllqS6lNfy0ni2MiV+Q+39SAWOPIEbIvxtE41Af5XHu:Aibjpr6lxy0ni2Rg4AiEma5Xu Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk.oDF5 (Dropped File)
MIME Type application/octet-stream
File Size 526 Bytes
MD5 bc60de5a3284775b3d39d56ce20de129 Copy to Clipboard
SHA1 fd58fdfdc3888aa6c3db47b4ff5c719174b03537 Copy to Clipboard
SHA256 857a33fb8816d4fc10bb50ea1eabbb64c01f6f466f36db9cb265244d21b2d6db Copy to Clipboard
SSDeep 12:wm6CPTD10sMl/nyLGja6ijf1sMCn+sGnXtHcpMgS+sVR:wm3TOmR1s9IX1CK+sT Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk.Irwm (Dropped File)
MIME Type application/octet-stream
File Size 526 Bytes
MD5 12eaec3adbab134ddcdfd8594c531c98 Copy to Clipboard
SHA1 b3ab219959e62daec420fdafc38f04fea6dab823 Copy to Clipboard
SHA256 b2539862c6d8e4f7d20aabaee8065b526701b0aa505ef2a3a5aa8841f6571116 Copy to Clipboard
SSDeep 12:BHWI+Kb5h1pzrEY2I98Kvm2AgE/QOJB7rJOwBBYB9L5:/J/11Ma/EHPnBI55 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Control Panel.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Control Panel.lnk.uJuat1l (Dropped File)
MIME Type application/octet-stream
File Size 526 Bytes
MD5 b9a0ad71fda1465df08d4695ba6bca5b Copy to Clipboard
SHA1 55a055bfe48841be7fc3f3136e6178c3eb06f631 Copy to Clipboard
SHA256 2b05bdc5d2748eff46a09eb466db8e8eb3af78b235c2c4755d2392bb3e81dbe7 Copy to Clipboard
SSDeep 12:I/Vx3QXjHYqDP2vwy/Ui81v2K7sG/JEgBKbqoT8Zdk/r:I/OMeP+sJWbqQ Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk.zoBQnOn (Dropped File)
MIME Type application/octet-stream
File Size 1.72 KB
MD5 6ee821c5326f49ff52b38aca6eedb45b Copy to Clipboard
SHA1 3579e8e13ef2a4a2c24149fb86f0d2e9f575626c Copy to Clipboard
SHA256 c4e2850c2a81c0602d4431d9a16fd448c1233e269fbd9d269e9a4f7ab93345ce Copy to Clipboard
SSDeep 48:ktDe9WMoccGgUmlNDVQOjUupeFr+OsArIhnvoQj:GoDgUSEXukbFrCwA Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk.avpJ (Dropped File)
MIME Type application/octet-stream
File Size 1.53 KB
MD5 2b7e966929a799c1007f3834cb49516b Copy to Clipboard
SHA1 5e7170a60610f92bd5ea6974ea58138a15783b98 Copy to Clipboard
SHA256 11cfc005bc82789f5b4bffc0ec54ac1889de4edbecf45fd109bb293d71870f71 Copy to Clipboard
SSDeep 24:rBevA/n2SewSHL5q+Rvu19BmdmJcxNpykG1sovaOauhij3/Wak74bYfYZyOLn:NevA/2SNS4yMQPoRhw3+a3AKyOr Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk.vb28C (Dropped File)
MIME Type application/octet-stream
File Size 1.46 KB
MD5 9977d12b2a2e320321f15500d17b87b8 Copy to Clipboard
SHA1 415f4aa4e6879699444e5797f2909de7c4781b63 Copy to Clipboard
SHA256 6745f99e32ecf3500663d0263d806d948dd6a8bf30c2cca27a4605133866a684 Copy to Clipboard
SSDeep 24:FmAJeU/A/jxN5CQljVZw4tQ/GdikhtpdLaLz+auWWC4SVxhNwhL6VBcv:Fm19N4QljHQ/oi6xI63SVtOmkv Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk Modified File Stream
malicious
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk.kiwPKeJ (Dropped File)
MIME Type application/octet-stream
File Size 1.64 KB
MD5 db617aba4e6c5f8561df8df000d9adc0 Copy to Clipboard
SHA1 fbfdfaa3df6a6fd7bce4a89617304ea560b1601d Copy to Clipboard
SHA256 a1a3887c510d71fe409a7e33093113f40eff0c6b87496a6257c44ed5f06bc807 Copy to Clipboard
SSDeep 24:qJ2Q9EEoQwPj1Gk9uFjM1lR8Gdrx22D20LDyHE3xajnf5/bI/WbMx:M2IwPBGk9uxM138Gxbb3cjR/6mu Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Recovery\d327d5c2-7147-11eb-9862-d731c5aaa7a9\Winre.wim Modified File Stream
clean
...
»
Also Known As C:\Recovery\d327d5c2-7147-11eb-9862-d731c5aaa7a9\Winre.wim.Z40cRh (Dropped File)
MIME Type application/octet-stream
File Size 10.00 MB
MD5 0172cb902e97e6d77f12face9f4dfbaa Copy to Clipboard
SHA1 179af6f22c430df2451e59246d37fc403d35892c Copy to Clipboard
SHA256 4b1a3c3a3b5308af1c865f2e08eec33713195e2f0d25002d514260cf9606e608 Copy to Clipboard
SSDeep 196608:TAEsUofTkxTRB6qnb3UQa0mPj4fnqoJXHBCbHIDJrGUn1GFCQG/qps43pVMCy:TA4cYxVwq07wnqoRhgIDJKo1GsQmqmXR Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db.vXzEfE (Dropped File)
MIME Type application/octet-stream
File Size 288 Bytes
MD5 102c13260ea3f32f6b481605eb47cf33 Copy to Clipboard
SHA1 6963816af5027ef76af1ed2b878aae6bfdfd7d97 Copy to Clipboard
SHA256 b8fa4e77fefbfac96a49df26a39f0f1aa6dc5fce39a6fbe5949e9b024dbb9c44 Copy to Clipboard
SSDeep 6:NagplnlIOcSkA8nFHVSDjPaVQp23Zsn/ZPlUWjkWGLywvO65tV71CEDC/rn:NaCnx8F1oyQMZsZ2W1wtH1CEDU Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.U7l9k (Dropped File)
MIME Type application/octet-stream
File Size 288 Bytes
MD5 a148a59448db8e4f6812cab285d7a4c9 Copy to Clipboard
SHA1 8f2f894ca6e5f89c921306c85b553c1b3bbd87bf Copy to Clipboard
SHA256 8cc155f186444227cd17ee657c3f452c7667bce23cc311908718e4c09cc8c9d5 Copy to Clipboard
SSDeep 6:ECzjfWLpTXwfxj5X02TpakSvcfd49GS/xyzEM1KDdMiuPUSoFEBYTVn:ECXOLprwRd0GSkGbiEbDOiusSCmsV Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.PhtuPDv (Dropped File)
MIME Type application/octet-stream
File Size 288 Bytes
MD5 37c6f23a7131d900dccbc93889e6ad3d Copy to Clipboard
SHA1 72ac4e15e980b38253bba9c3c47d5dd1f39d88ea Copy to Clipboard
SHA256 40225296f2202a8f5b1ba66959978407357508ca382bcf9a0183d4a47f665e36 Copy to Clipboard
SSDeep 6:Wm6KpSDwetGkEa+y2x5Ei6nzMEs+vduebGcRCaBp3RFYGbn:WHKSDtAlty2MZnzlHjbeCVjYGb Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.QRQv (Dropped File)
MIME Type application/octet-stream
File Size 288 Bytes
MD5 a25dbf5b5002cd7c84f9b4c7f20b56cc Copy to Clipboard
SHA1 6808805da1b8a0e4a6b2a1ce6a644f07b46d833a Copy to Clipboard
SHA256 ce079259933c88172e40ca571a8ad60f220d32af16950e472d7014a9d30392e9 Copy to Clipboard
SSDeep 6:/V7Hyozf6L9dxjsFtimnUQIbdDxGngM1VXhHAAIuIPw16n:tSozShdCn7CYgyXhbIuIh Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.NcGhQ9 (Dropped File)
MIME Type application/octet-stream
File Size 1.73 KB
MD5 f3de20d625b6254085f6d77ad7971d93 Copy to Clipboard
SHA1 0d5c279973a926abf23be0485f623299a4d4d941 Copy to Clipboard
SHA256 87ae850ae061c4f1fbc1b6bbbfe2bc647da3e2bf1c4bb3ba3e651a522d49fc0b Copy to Clipboard
SSDeep 48:qrWTFXskGtLGWEet427juabUWXlH94og9RRe0ySAllnCF9:0WTZXGtLG/V27jxbUCrgReDllCF9 Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Settings.ini Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Settings.ini.L0SlF (Dropped File)
MIME Type application/octet-stream
File Size 348 Bytes
MD5 4d7d83604a503f43d698d6477ee80729 Copy to Clipboard
SHA1 0c93976ca408f6529c16a23774c039baaae70d7f Copy to Clipboard
SHA256 9eaeeb7fce04fe31b22bc2f02a2269eeead84ee1183707d25161d34bd3748ae4 Copy to Clipboard
SSDeep 6:k93SjNXkw8BcNH4Ct+iwAmq2Z1boLdqB3gfR7Et2hLj5Bvk0/Lhn:kV+Ute4Ct+zbq2BB3u7EiLj5B86h Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Roaming\Microsoft\Protect\CREDHIST Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Protect\CREDHIST.l88ji (Dropped File)
MIME Type application/octet-stream
File Size 288 Bytes
MD5 9a2e66ae334488c70e4486551799a88f Copy to Clipboard
SHA1 b0ea1058fced91ffb694117423298e690fee03d4 Copy to Clipboard
SHA256 a9234facd98b1851a54ff99ca5164087f88d9a1f86fa6fbefc56eb5254996d53 Copy to Clipboard
SSDeep 6:2pxciRXmmljNgbr6i5VbIwwL+4vg+E06Q0qn:K3pTgy++1Nh Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\Preferred Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\Preferred.hHHaz (Dropped File)
MIME Type application/octet-stream
File Size 288 Bytes
MD5 0c4d50ca529bf9c7ee70764aae8a680a Copy to Clipboard
SHA1 79090b0d97602876442ef74416671014097806aa Copy to Clipboard
SHA256 36634978a43442a9a9056e248e0ccb48fcb5f8c4201bccc2a3c8d8be1c37d896 Copy to Clipboard
SSDeep 6:RbYuJbJtcoKCNoCp2XymNyex+Qai8qWjF1cpIrXDYUDYwn:R8EfuQ2Xy/cwjFrXJ Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1b4dd67f29cb1962.customDestinations-ms Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1b4dd67f29cb1962.customDestinations-ms.4scwLK (Dropped File)
MIME Type application/octet-stream
File Size 288 Bytes
MD5 2dc3f402070f21b3951b5f9536773489 Copy to Clipboard
SHA1 5f772bb7b0ae2c36c37685ca1e7a968b7723ebcf Copy to Clipboard
SHA256 7c915df4e40c3bcec789a085c33a3089cbcb4aed46d6f1c60dd570a385b54b5f Copy to Clipboard
SSDeep 6:OQsHMEvOdEMrMcIepp2/mB8bbHMNclKY4+C6/miqkDFn:OQerOPJhH2/3bWKk2mJkDF Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7e4dca80246863e3.customDestinations-ms Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7e4dca80246863e3.customDestinations-ms.HViwp (Dropped File)
MIME Type application/octet-stream
File Size 288 Bytes
MD5 61c91256e703aed1b665e0d184be2171 Copy to Clipboard
SHA1 7132ae24a320d8308063e36c1a7d846381f215ad Copy to Clipboard
SHA256 74a8892e970a34475ba710d91ce1152d079395948f8eec917326c505b1b18eaf Copy to Clipboard
SSDeep 6:GOXunmfMBPUVbNT5fSyNUMn0gjrfISQdsJAXlN8+sk6zm3Pqn:lYmpT592FkgrGJIvsk4cS Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget.Lu5pEQ (Dropped File)
MIME Type application/octet-stream
File Size 267 Bytes
MD5 f0a240e62fe8eb14d1980d3fc902108b Copy to Clipboard
SHA1 c6ff2f93b920d273b30b455add9a6fbb4fbef1a8 Copy to Clipboard
SHA256 52326a13843533056ff361af90adac077806e60df8a52e4438e00ea015dec630 Copy to Clipboard
SSDeep 6:rCxHLFGxZRTpIcVDIppqSCsPCCXBp/LNwXpHcvtYhn:+xHxGXRTpIcVDIHqxsPvNLulcvtYh Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink.p1SC (Dropped File)
MIME Type application/octet-stream
File Size 271 Bytes
MD5 f7089f1fb7b7302967537360162188aa Copy to Clipboard
SHA1 74979bdec2300c2e6ff6df49630a3bffd85afa51 Copy to Clipboard
SHA256 c60575c918ede1d123b7251c08b5e3d2393ff17f8c5551a9e881fe3edc04a1e5 Copy to Clipboard
SSDeep 6:+ymf5GcjVo9KDLF/VetoNkobNxSbYc4QALmoIWfWBTmEYun:m5GvwFAtoSMxSbNALmVlmEYu Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail.ZtKx9tM (Dropped File)
MIME Type application/octet-stream
File Size 268 Bytes
MD5 3d5197e09aa934731ceb26b45208a533 Copy to Clipboard
SHA1 df4d8173c397b593a5317bb4d8997aa142bd0ecc Copy to Clipboard
SHA256 b1caebd84f7dc6b3bbbc98ed25a5dfd028f8cf6fc36db105ce99a39ad68300b8 Copy to Clipboard
SSDeep 6:W6QKlmjswex0rqChIytYYCGN9wtLhNgmjy4E2tB1X9n:ZflpD0rqCWXtLkM39 Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk Modified File Binary
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk.OnI3 (Dropped File)
MIME Type application/x-dosexec
File Size 1.49 KB
MD5 bd947fe5a6a8e084d48b22ca19938122 Copy to Clipboard
SHA1 ead31c6e967d4c7d07e981939801bde8ed955359 Copy to Clipboard
SHA256 e83524bcb206d0379a636b9c11a2bf3a9cbc668739bf4454d65641f0210f3996 Copy to Clipboard
SSDeep 24:vM3xCgLFNwaZ9pEyvCdZvv4d+/ocDXmOtf+VDSJm9fJw2QVEtpZ72SodNhqBCKWH:kcAldvEgw/BD2aGRQE1iwaiQ Copy to Clipboard
ImpHash -
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk.q4w7x (Dropped File)
MIME Type application/octet-stream
File Size 1.67 KB
MD5 2be7b9ee4c672b51ecefd60fa79c6877 Copy to Clipboard
SHA1 85f69541e11678278bd5dc87ed0590fee5562242 Copy to Clipboard
SHA256 4fc616485617452f926a63280d222ea1733d1e2aaf2cbc5b77e5fb13c85545e5 Copy to Clipboard
SSDeep 48:f9F/rZIVh/dpT/Oe7I6BCwfQj2v63jXa5:f9trcFH6EB3Iqv6ja5 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk.uUALWCY (Dropped File)
MIME Type application/octet-stream
File Size 526 Bytes
MD5 745dc28da8b67d2b10b71b27c7703670 Copy to Clipboard
SHA1 3cb2a65abda2b36e0bbd9caa4ce131641a40795b Copy to Clipboard
SHA256 0817f17ad64137398dfb461d0f04b1a7e4d8d09a48e826199eb3182ccba57c9a Copy to Clipboard
SSDeep 12:mmlmrgQRAI/kFNhGOSyeNCO2aZcH4X6c2yTCcosAuAK4Q:pXQRAIMFNhGpNCO2GXf2W5+Q Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk.NPcw9B (Dropped File)
MIME Type application/octet-stream
File Size 2.32 KB
MD5 ca42bcc580bbb729f6f290dc45933fec Copy to Clipboard
SHA1 ea42343680c66199726428bb1dda3304b2be5e3a Copy to Clipboard
SHA256 d4fe66b70af1fc45006785cdcd3335c23721f4eb0ce2cd4d5cc393d9fb92a7c0 Copy to Clipboard
SSDeep 48:JbiA0Fkm/zrlhb6HjyC6D1NqzZl9reyYzvEIzrU5PU:Mdun6RNqtP6EIT Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg Modified File Stream
clean
...
»
Also Known As C:\Users\Default\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg.YTrS (Dropped File)
MIME Type application/octet-stream
File Size 622.57 KB
MD5 3a3c133ec6cb34fade72993b04e02926 Copy to Clipboard
SHA1 46119c69733d4b5b65ede63f8b2ceec011be2f8e Copy to Clipboard
SHA256 0b73e0120eb1d9035acbbac011502f0ed5f4f17111913534b6ebb45d1c09becd Copy to Clipboard
SSDeep 12288:PpMRkf/OCc6vkFpnCceRvZ5Qm+FgDfANN6GJ/zZbUK7oOX4k5:Pi6mCxvk3CNRBp+FoQNh1zZbUK7oOXX5 Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\Contacts\Administrator.contact Modified File Stream
clean
...
»
Also Known As C:\Users\Default\Contacts\Administrator.contact.ELCT (Dropped File)
MIME Type application/octet-stream
File Size 67.04 KB
MD5 046c3d5b591aefc6651c38cd86d0f4ab Copy to Clipboard
SHA1 236ce60caa6600089aa455baa8a45a5e340e5a1f Copy to Clipboard
SHA256 dbf84af259734e57aa05f6352429222fa8690da86773ba655dc5ffc0d430714c Copy to Clipboard
SSDeep 1536:dioZ8d6e5IRSh/BALtC73vHN6DwneMXdt7zAhsMrlTEBOr3s6xq:Mg8d6etIC73vHN6w8hsMr5xr3Zk Copy to Clipboard
ImpHash -
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
MazeEncryptedFile File encrypted by Maze Ransomware Ransomware
5/5
...
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\\olvrr9ld.dat Dropped File Unknown
clean
...
  • Actions
»
MIME Type -
File Size 0 Bytes
MD5 d41d8cd98f00b204e9800998ecf8427e Copy to Clipboard
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 Copy to Clipboard
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
ImpHash -
C:\\DECRYPT-FILES.html Dropped File HTML
clean
...
»
Also Known As C:\$Recycle.Bin\\DECRYPT-FILES.html (Dropped File)
C:\$Recycle.Bin\S-1-5-21-4219442223-4223814209-3835049652-1000\\DECRYPT-FILES.html (Dropped File)
C:\Boot\\DECRYPT-FILES.html (Dropped File)
C:\Boot\cs-CZ\\DECRYPT-FILES.html (Dropped File)
C:\Boot\da-DK\\DECRYPT-FILES.html (Dropped File)
C:\Boot\de-DE\\DECRYPT-FILES.html (Dropped File)
C:\Boot\el-GR\\DECRYPT-FILES.html (Dropped File)
C:\Boot\en-US\\DECRYPT-FILES.html (Dropped File)
C:\Boot\es-ES\\DECRYPT-FILES.html (Dropped File)
C:\Boot\fi-FI\\DECRYPT-FILES.html (Dropped File)
C:\Boot\Fonts\\DECRYPT-FILES.html (Dropped File)
C:\Boot\fr-FR\\DECRYPT-FILES.html (Dropped File)
C:\Boot\hu-HU\\DECRYPT-FILES.html (Dropped File)
C:\Boot\it-IT\\DECRYPT-FILES.html (Dropped File)
C:\Boot\ja-JP\\DECRYPT-FILES.html (Dropped File)
C:\Boot\ko-KR\\DECRYPT-FILES.html (Dropped File)
C:\Boot\nb-NO\\DECRYPT-FILES.html (Dropped File)
C:\Boot\nl-NL\\DECRYPT-FILES.html (Dropped File)
C:\Boot\pl-PL\\DECRYPT-FILES.html (Dropped File)
C:\Boot\pt-BR\\DECRYPT-FILES.html (Dropped File)
C:\Boot\pt-PT\\DECRYPT-FILES.html (Dropped File)
C:\Boot\ru-RU\\DECRYPT-FILES.html (Dropped File)
C:\Boot\sv-SE\\DECRYPT-FILES.html (Dropped File)
C:\Boot\tr-TR\\DECRYPT-FILES.html (Dropped File)
C:\Boot\zh-CN\\DECRYPT-FILES.html (Dropped File)
C:\Boot\zh-HK\\DECRYPT-FILES.html (Dropped File)
C:\Boot\zh-TW\\DECRYPT-FILES.html (Dropped File)
C:\Users\\DECRYPT-FILES.html (Dropped File)
C:\PerfLogs\\DECRYPT-FILES.html (Dropped File)
C:\PerfLogs\Admin\\DECRYPT-FILES.html (Dropped File)
C:\Recovery\\DECRYPT-FILES.html (Dropped File)
C:\Recovery\d327d5c2-7147-11eb-9862-d731c5aaa7a9\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\History\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Credentials\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Feeds\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Media Player\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Burn\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Burn\Burn\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Caches\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\History\History.IE5\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\History\Low\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Ringtones\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MM5O9XQS\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PMMR5K9K\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RIJUQL1C\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X9OHK109\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\WER\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\WER\ERC\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows\WER\ReportArchive\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows Media\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Local\Temp\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\LocalLow\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\LocalLow\Microsoft\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Identities\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Credentials\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Crypto\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Crypto\RSA\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Protect\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\IECompatCache\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\IECompatCache\Low\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\IETldCache\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\IETldCache\Low\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\PrivacIE\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\PrivacIE\Low\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Themes\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\Contacts\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\Desktop\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\Documents\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\Music\\DECRYPT-FILES.html (Dropped File)
C:\Users\Default\Pictures\\DECRYPT-FILES.html (Dropped File)
MIME Type text/html
File Size 6.41 KB
MD5 d64dde46765a66fca016050b899c2384 Copy to Clipboard
SHA1 3f5a528e63e33861a526983f3a4946626682452e Copy to Clipboard
SHA256 2cd0c3207ade26fbd3245ade2886f4a6cd104f98252d0c0b7de752a3d8d4a352 Copy to Clipboard
SSDeep 96:z2dMHJdgvOYEHdwlH+6iI+3HXu0aVzKLqw7vZ4hTpR8+o4W:sGwuHdwlH+5tHe0YswVrm9 Copy to Clipboard
ImpHash -
Extracted JavaScripts (1)
»
JavaScript #1
» 
function CopyToClipboard(containerid) {
  if (document.selection) {
    var range = document.body.createTextRange();
    range.moveToElementText(document.getElementById(containerid));
    range.select().createTextRange();
    document.execCommand("copy");

  } else if (window.getSelection) {
    var range = document.createRange();
    range.selectNode(document.getElementById(containerid));
    window.getSelection().addRange(range);
    document.execCommand("copy");
    alert("Base64 copied into the clipboard!")
  }
}
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image