Loads The following DLL(s)[Dynamic Link Library] when this malware is executed :-
%windir%\system32\ntdll.dll
%windir%\system32\kernel32.dll
%windir%\system32\user32.dll
%windir%\system32\gdi32.dll
%windir%\system32\advapi32.dll
%windir%\system32\rpcrt4.dll
%windir%\system32\ole32.dll
%windir%\system32\msvcrt.dll
%windir%\system32\vsmvhk.dll
%windir%\system32\oleaut32.dll
%windir%\system32\wsock32.dll
%windir%\system32\ws2_32.dll
%windir%\system32\ws2help.dll
%windir%\system32\comctl32.dll
%windir%\system32\wship6.dll
%windir%\system32\pstorec.dll
%windir%\system32\atl.dll
%windir%\system32\secur32.dll
%programfiles%\mywebsearch\srchastt\1.bin\mwssrcas.dll
Creates the Following MUTEX(s) on user's System:-
mywebsearch:srchas:shared05042949646950
mywebsearch:srchas:shared07042949646951
mywebsearch:srchas:shared07042949646952