File name:

d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe

Full analysis: https://app.any.run/tasks/b6a98f1f-d775-4dcc-bdca-da44fe5f06b5
Verdict: Malicious activity
Threats:

Maze is ransomware — a malware type that encrypts the victim’s files and restores the data in exchange for a ransom payment. One of the most distinguishable features of Maze is that it is one of the first malware of the kind to publicly release stolen data.

Malware Trends Tracker     >>>
Analysis date: May 31, 2025, 21:19:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
maze
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

C0EA689122E919500F4228EDEAF3830E

SHA1:

5700E166ABDD234EAE4B5D024EC46E8D53B34AEF

SHA256:

D7B792C012FD86F2D47ECB2F6BD6FA1D7FDE294471D412C077D22A6AF8B7C4A8

SSDEEP:

12288:9Mcu4Uw8t+Rby54DB3NaXFLlFqrA1I+dD89Wrx5ln:wzw8N54DB3EFLlQ4I+dDqWrxzn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MAZE mutex has been found

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

    • Maze is detected

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

    • RANSOMWARE has been detected

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

    • Modifies files in the Chrome extension folder

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

  • INFO

    • Checks supported languages

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

    • Reads the computer name

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

    • Creates files in the program directory

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

    • Reads the machine GUID from the registry

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

    • Creates files or folders in the user directory

      • d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe (PID: 5772)

    • Reads the software policy settings

      • slui.exe (PID: 6240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:05:14 08:13:34+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 70144
InitializedDataSize: 396288
UninitializedDataSize: -
EntryPoint: 0x703d
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #MAZE d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe no specs sppextcomobj.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
5772"C:\Users\admin\AppData\Local\Temp\d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe" C:\Users\admin\AppData\Local\Temp\d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6240"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7588C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
616
Read events
616
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
866
Text files
255
Unknown types
0

Dropped files

PID
Process
Filename
Type
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\Users\admin\AppData\DECRYPT-FILES.htmlhtml
MD5:84FD90846643BCC81E631B190DA5A9C1
SHA256:65CBCCE7A64FE4D2B5B5A80720ED237E48D95925734A874949497F302E30BA34
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\BOOTNXT.2qxk42binary
MD5:A13BF49A0BBA17EC27D375F375C27120
SHA256:99B15F0E7A6F0EB7220EF15B81B0BFD59F6A8184E982C51B8BA2EE0245D17C26
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\DECRYPT-FILES.htmlhtml
MD5:84FD90846643BCC81E631B190DA5A9C1
SHA256:65CBCCE7A64FE4D2B5B5A80720ED237E48D95925734A874949497F302E30BA34
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\BOOTNXTbinary
MD5:A13BF49A0BBA17EC27D375F375C27120
SHA256:99B15F0E7A6F0EB7220EF15B81B0BFD59F6A8184E982C51B8BA2EE0245D17C26
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\Users\admin\3D Objects\DECRYPT-FILES.htmlhtml
MD5:84FD90846643BCC81E631B190DA5A9C1
SHA256:65CBCCE7A64FE4D2B5B5A80720ED237E48D95925734A874949497F302E30BA34
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\DECRYPT-FILES.htmlhtml
MD5:84FD90846643BCC81E631B190DA5A9C1
SHA256:65CBCCE7A64FE4D2B5B5A80720ED237E48D95925734A874949497F302E30BA34
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DECRYPT-FILES.htmlhtml
MD5:84FD90846643BCC81E631B190DA5A9C1
SHA256:65CBCCE7A64FE4D2B5B5A80720ED237E48D95925734A874949497F302E30BA34
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.uVzGYgFbinary
MD5:657DE76300B70BC2E165B38806AB631E
SHA256:AE6C54E21C7CE0BCC373309D92EAF649B4D14AEB79FB1C257B887003489E88B2
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\bootTel.datbinary
MD5:9311B1CD9040828BB4E69FEB9A5C5D04
SHA256:4275A777005703E5D8DB868ECD3FD7903C6FABF3BFE4712E872904BD74BC0A33
5772d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exeC:\Users\admin\AppData\Local\Adobe\DECRYPT-FILES.htmlhtml
MD5:84FD90846643BCC81E631B190DA5A9C1
SHA256:65CBCCE7A64FE4D2B5B5A80720ED237E48D95925734A874949497F302E30BA34
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
19
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7784
svchost.exe
GET
304
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5568
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5568
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
8008
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
7784
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7784
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.31.3
  • 20.190.159.130
  • 40.126.31.0
  • 40.126.31.73
  • 40.126.31.2
  • 20.190.159.4
  • 20.190.159.75
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
d7b792c012fd86f2d47ecb2f6bd6fa1d7fde294471d412c077d22a6af8b7c4a8.exe