1.dll

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA April 2, 2021, 4:49 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA April 2, 2021, 4:49 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 2, 2021, 4:48 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 2, 2021, 4:49 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 2, 2021, 4:48 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d00000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 2, 2021, 4:48 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 2, 2021, 4:48 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 2, 2021, 4:48 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 2, 2021, 4:48 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 2, 2021, 4:48 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d91000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 2, 2021, 4:48 p.m.	process_identifier: 872 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 2, 2021, 4:48 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1	0	0

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

Elastic	malicious (high confidence)
McAfee	Artemis!5512180F20E8
CrowdStrike	win/malicious_confidence_80% (D)
APEX	Malicious
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.5512180f20e8279a
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Cylance	Unsafe
BitDefenderTheta	Gen:NN.ZedlaF.34662.eq4@aqnXp8d