AmdPowerXpressRequestHighPerformance
GetHandleVerifier
GetMainTargetServices
IsSandboxedProcess
NvOptimusEnablement
Static task
static1
Behavioral task
behavioral1
Sample
xlabs.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
xlabs.exe
Resource
win10v2004-20221111-en
Target
xlabs.exe
Size
1.8MB
MD5
c9026c974d82dde2498ec83c66169913
SHA1
b9323a6f55268789f7b192f524d232af654ab123
SHA256
ff9c5fbf4bf438c5ea426a342adf8863f46c94a07cabc9c3515954258d50aeb3
SHA512
411cdf4f2e0720331dd89959a643a4d31b32b06421348781128078f48e16074bc55fe781e63627714ab3fd58d632f6e0637b3e16fa86e927efe95dda71fbac05
SSDEEP
24576:my8Dm6SERj8KvF82LCJE01DKvL/XQQQBc0ah0lhSMXlTY//YYJRutQpxA+aUzL4q:u64rCO01uj4QucaskJELn
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymSetSearchPathW
SymGetSearchPathW
SymSetOptions
SymInitialize
timeGetTime
OpenProcess
TerminateProcess
WaitForMultipleObjects
GetModuleHandleA
HeapSetInformation
CreateEventW
ExpandEnvironmentStringsW
GetUserDefaultLangID
TlsAlloc
TlsFree
TlsSetValue
SetFilePointerEx
ReadFile
GetFileSizeEx
SetEndOfFile
GetFileInformationByHandle
SetFileInformationByHandle
FlushFileBuffers
GetModuleHandleExW
ResetEvent
SetEvent
GetUserDefaultLCID
GetUserDefaultLocaleName
EnumSystemLocalesEx
HeapDestroy
GetSystemInfo
WideCharToMultiByte
MultiByteToWideChar
VirtualQuery
MoveFileW
CreateDirectoryW
GetFinalPathNameByHandleW
GetFileAttributesExW
GetFileType
SetHandleInformation
GetCurrentProcessorNumber
SetThreadAffinityMask
GetProcessHeaps
FindClose
FindNextFileW
FindFirstFileExW
GetProcessHandleCount
InitializeConditionVariable
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
RtlLookupFunctionEntry
RtlVirtualUnwind
CreateFileA
PeekNamedPipe
MoveFileExA
FormatMessageW
GetEnvironmentVariableA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
GetSystemDirectoryA
WriteConsoleW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapSize
GetDriveTypeW
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapReAlloc
HeapFree
HeapAlloc
GetStdHandle
SetStdHandle
ExitProcess
GetConsoleMode
GetConsoleOutputCP
FreeLibraryAndExitThread
ExitThread
RtlUnwind
RtlUnwindEx
LoadLibraryExA
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
UnhandledExceptionFilter
RtlCaptureContext
AcquireSRWLockExclusive
VirtualFree
TlsGetValue
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
IsWow64Process
GetNativeSystemInfo
GetProductInfo
GetVersionExW
QueryPerformanceCounter
QueryPerformanceFrequency
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
CreateToolhelp32Snapshot
GetCurrentProcessId
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
DuplicateHandle
GetCurrentProcess
WaitForSingleObject
CreateThread
GetModuleHandleW
RaiseException
IsDebuggerPresent
Sleep
GetCurrentThread
GetCurrentThreadId
SetLastError
FreeLibrary
LocalFree
LoadLibraryExW
GetCommandLineW
FormatMessageA
WriteFile
OutputDebugStringA
GetTickCount
GetLocalTime
GetCurrentDirectoryW
CreateFileW
GetModuleFileNameW
DeleteFileW
CloseHandle
SetEnvironmentVariableW
GetCommandLineA
DecodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
GetProcAddress
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStringTypeW
LCMapStringEx
LeaveCriticalSection
EnterCriticalSection
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
IsProcessorFeaturePresent
RtlPcToFileHeader
Process32First
VirtualProtect
LoadLibraryA
Process32Next
CreateProcessW
SetDllDirectoryW
GetDllDirectoryW
CreateMutexA
ReleaseMutex
FindFirstFileW
GetFullPathNameW
AreFileApisANSI
GetFileInformationByHandleEx
GetLocaleInfoEx
WaitForSingleObjectEx
GetExitCodeThread
InitializeSRWLock
GetSystemMetrics
EnumChildWindows
GetPropA
SetParent
PostMessageA
LoadIconA
GetWindowLongPtrA
SetWindowLongPtrW
MessageBoxA
SetForegroundWindow
ShowWindow
SetProcessDPIAware
SetWindowRgn
SetWindowPos
GetWindowRect
ReleaseCapture
DefWindowProcW
SetPropA
GetWindowLongPtrW
CreateRoundRectRgn
PtInRegion
CombineRgn
SetRectRgn
DeleteObject
CreateRectRgn
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
OpenProcessToken
GetSidSubAuthority
GetKernelObjectSecurity
SetKernelObjectSecurity
GetAce
GetSecurityDescriptorSacl
SetTokenInformation
RegDisablePredefinedCache
RevertToSelf
GetLengthSid
IsValidSid
InitializeSid
SHGetKnownFolderPath
CommandLineToArgvW
SHCreateItemFromParsingName
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
__WSAFDIsSet
WSASetLastError
WSASocketW
ioctlsocket
recvfrom
WSAGetLastError
closesocket
select
bind
listen
accept
htonl
freeaddrinfo
sendto
getaddrinfo
gethostname
WSAIoctl
getpeername
WSAStartup
WSACleanup
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
send
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
recv
setsockopt
htons
getsockopt
connect
ntohs
socket
getsockname
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGenRandom
BCryptCreateHash
VariantInit
SysAllocString
VariantClear
CertFreeCertificateContext
CryptStringToBinaryA
CertEnumCertificatesInStore
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CryptDecodeObjectEx
PFXImportCertStore
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CertGetCertificateChain
AmdPowerXpressRequestHighPerformance
GetHandleVerifier
GetMainTargetServices
IsSandboxedProcess
NvOptimusEnablement
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ