Loads The following DLL(s)[Dynamic Link Library] when this malware is executed :-
%windir%\system32\ntdll.dll
%windir%\system32\kernel32.dll
%windir%\system32\user32.dll
%windir%\system32\gdi32.dll
%windir%\system32\advapi32.dll
%windir%\system32\rpcrt4.dll
%windir%\system32\ole32.dll
%windir%\system32\msvcrt.dll
%windir%\system32\oleaut32.dll
%windir%\system32\wsock32.dll
%windir%\system32\ws2_32.dll
%windir%\system32\ws2help.dll
%windir%\system32\comctl32.dll
%windir%\system32\pstorec.dll
%windir%\system32\atl.dll
%windir%\system32\wship6.dll
%windir%\system32\secur32.dll
advapi32.dll
%workingdir%\gcontroller.dll
Creates the Following MUTEX(s) on user's System:-