Toward Detecting Malware Based on Process-Aware Behaviors

Table 2

The feature matrix of LoadLibraryExW for two samples. For clarity, S1 is abbreviated to Sample1, and S2 to Sample2.

	user32.dll	gdi32.dll	ws2_32.dll	Label
S1	2	1	0	1
S2	0	0	1	0