value:  Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company presumably so Maze can encrypt files on the shared drives as well as the local machine. 
name: Hide Artifacts: Run Virtual Instance