Technical Information
To ensure autorun and distribution:
Changes the following executable system files:
- <SYSTEM32>\gdiplus.dll
Modifies file system:
Creates the following files:
- %TEMP%\nsf2.tmp
- <SYSTEM32>\eRepComaddin.dll
- <SYSTEM32>\OAComAddin.dll
- <SYSTEM32>\eMagComaddin.dll
- <SYSTEM32>\oadocument.dot
- %APPDATA%\Microsoft\Templates\oadocument.dot
- <SYSTEM32>\erepinfodocument.dot
- %APPDATA%\Microsoft\Templates\erepinfodocument.dot
- <SYSTEM32>\egovinfodocument.dot
- %APPDATA%\Microsoft\Templates\egovinfodocument.dot
- <SYSTEM32>\documentTemplate.xml
- %APPDATA%\Microsoft\Templates\documentTemplate.xml
- <SYSTEM32>\Comdlg32.ocx
- %ProgramFiles%\E_Gov\IFLYTEK\StampPubCom.dll
- %ProgramFiles%\E_Gov\IFLYTEK\StampClientCom.dll
- %ProgramFiles%\E_Gov\IFLYTEK\StampCEBAux.dll
- %ProgramFiles%\E_Gov\IFLYTEK\LocalSealStamp.dll
- %ProgramFiles%\E_Gov\IFLYTEK\GdiPlus.dll
- %ProgramFiles%\E_Gov\IFLYTEK\Filter.dll
- %ProgramFiles%\E_Gov\IFLYTEK\DFECoreExt.dll
- %ProgramFiles%\E_Gov\IFLYTEK\DFECore.dll
- %ProgramFiles%\E_Gov\IFLYTEK\DESSeal.dll
- %ProgramFiles%\E_Gov\IFLYTEK\eRepComaddin.dll
- %ProgramFiles%\E_Gov\IFLYTEK\OAComAddin.dll
- <SYSTEM32>\OAControl.dll
- %HOMEPATH%\My Documents\Hermes\emotions.dat
- %WINDIR%\OfficeSeal.ini
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\MSVCP60D.DLL
- <SYSTEM32>\DownloadCoCoDefaultFile.ocx
- <SYSTEM32>\StampPubCom.dll
- <SYSTEM32>\StampClientCom.dll
- <SYSTEM32>\StampCEBAux.dll
- <SYSTEM32>\LocalSealStamp.dll
- <SYSTEM32>\Filter.dll
- <SYSTEM32>\DFECoreExt.dll
- <SYSTEM32>\DFECore.dll
- <SYSTEM32>\DESSeal.dll
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\version.tag
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\OANotify.wav
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\MsgNotify.wav
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\MYDEFAULTDISPPIC.bmp
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\CAKeyUtils.dll
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\CAKeyUtilsC.dll
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\iflytekCA.exe
- %HOMEPATH%\My Documents\Hermes\ChatHistory\MessageLog.xsl
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\HermesUpdater.exe
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\HermesMain.exe
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\help.chm
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\xvidcore.dll
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\UnbrainIMMedia.dll
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\MSVCRTD.DLL
- %ProgramFiles%\E_Gov\IFLYTEK\eMagComaddin.dll
- <SYSTEM32>\OACtrl.dll
- %ProgramFiles%\E_Gov\IFLYTEK\WebBridge.ocx
- %ProgramFiles%\E_Gov\IFLYTEK\UnbrainIMMedia.dll
- %ProgramFiles%\E_Gov\IFLYTEK\MSVCP60D.DLL
- %ProgramFiles%\E_Gov\IFLYTEK\HermesMain.exe
- %ProgramFiles%\E_Gov\IFLYTEK\help.chm
- %ProgramFiles%\E_Gov\IFLYTEK\emotions.dat
- %TEMP%\nsv6.tmp\System.dll
- %TEMP%\nsk5.tmp
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\uninst.exe
- %HOMEPATH%\Start Menu\Programs\ХюС¶НЁ\ХюС¶НЁР¶ФШ.lnk
- %HOMEPATH%\Start Menu\Programs\ХюС¶НЁ\ХюС¶НЁ.lnk
- %HOMEPATH%\Desktop\ОЯєюКРрЇЅЗшНіТ»°м№«ЖЅМЁ.url
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\OAWeb.bmp
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\Login.jpg
- %ProgramFiles%\E_Gov\IFLYTEK\COCO\HermesClientConfig.xml
- %APPDATA%\Hermes\hermes_config.xml
- %TEMP%\nsy3.tmp\System.dll
- %ProgramFiles%\E_Gov\IFLYTEK\ОЯєюКРрЇЅЗшНіТ»°м№«ЖЅМЁ.url
- %ProgramFiles%\E_Gov\IFLYTEK\Wuhu.ico
- %ProgramFiles%\E_Gov\IFLYTEK\mainiconBlue.ico
- %ProgramFiles%\E_Gov\IFLYTEK\Login.jpg
- %ProgramFiles%\E_Gov\IFLYTEK\OAWeb.bmp
- %ProgramFiles%\E_Gov\IFLYTEK\hermes_config.xml
- %ProgramFiles%\E_Gov\IFLYTEK\HermesClientConfig.xml
- %ProgramFiles%\E_Gov\IFLYTEK\ХюС¶НЁЙэј¶°ьОЯєю20131219_2016.exe
- %ProgramFiles%\E_Gov\IFLYTEK\MSVCRTD.DLL
- %ProgramFiles%\E_Gov\IFLYTEK\xvidcore.dll
- %ProgramFiles%\E_Gov\IFLYTEK\RegFont2.vbs
- %ProgramFiles%\E_Gov\IFLYTEK\HermesUpdater.exe
- %ProgramFiles%\E_Gov\IFLYTEK\RegFont1.vbs
- %ProgramFiles%\E_Gov\IFLYTEK\·ЅХэРЎ±кЛОјтМе.ttf
- %ProgramFiles%\E_Gov\IFLYTEK\·ВЛОЈGB2312.ttf
- %ProgramFiles%\E_Gov\IFLYTEK\oadocument.dot
- %ProgramFiles%\E_Gov\IFLYTEK\OACtrl.dll
- %ProgramFiles%\E_Gov\IFLYTEK\OAControl.dll
- %ProgramFiles%\E_Gov\IFLYTEK\erepinfodocument.dot
- %ProgramFiles%\E_Gov\IFLYTEK\egovinfodocument.dot
- %ProgramFiles%\E_Gov\IFLYTEK\documentTemplate.xml
- %ProgramFiles%\E_Gov\IFLYTEK\UnibrainRSTProj.ocx
- %ProgramFiles%\E_Gov\IFLYTEK\TreeSelectProj.ocx
- %ProgramFiles%\E_Gov\IFLYTEK\ssleay32.dll
- %ProgramFiles%\E_Gov\IFLYTEK\libeay32.dll
- %ProgramFiles%\E_Gov\IFLYTEK\IflytekOAMUD.ocx
- %ProgramFiles%\E_Gov\IFLYTEK\Comdlg32.ocx
- %ProgramFiles%\E_Gov\IFLYTEK\version.tag
- %ProgramFiles%\E_Gov\IFLYTEK\OANotify.wav
- %ProgramFiles%\E_Gov\IFLYTEK\MsgNotify.wav
- %ProgramFiles%\E_Gov\IFLYTEK\MYDEFAULTDISPPIC.bmp
- %ProgramFiles%\E_Gov\IFLYTEK\CAKeyUtils.dll
- %ProgramFiles%\E_Gov\IFLYTEK\CAKeyUtilsC.dll
- %ProgramFiles%\E_Gov\IFLYTEK\iflytekCA.exe
- %ProgramFiles%\E_Gov\IFLYTEK\MessageLog.xsl
- %ProgramFiles%\E_Gov\IFLYTEK\DownloadCoCoDefaultFile.ocx
- C:\desdbg.txt
Deletes the following files:
- %ProgramFiles%\E_Gov\IFLYTEK\hermes_config.xml
- %ProgramFiles%\E_Gov\IFLYTEK\OANotify.wav
- %ProgramFiles%\E_Gov\IFLYTEK\MsgNotify.wav
- %ProgramFiles%\E_Gov\IFLYTEK\MYDEFAULTDISPPIC.bmp
- %ProgramFiles%\E_Gov\IFLYTEK\CAKeyUtils.dll
- %ProgramFiles%\E_Gov\IFLYTEK\CAKeyUtilsC.dll
- %ProgramFiles%\E_Gov\IFLYTEK\iflytekCA.exe
- %ProgramFiles%\E_Gov\IFLYTEK\MessageLog.xsl
- %ProgramFiles%\E_Gov\IFLYTEK\HermesUpdater.exe
- %ProgramFiles%\E_Gov\IFLYTEK\HermesMain.exe
- %ProgramFiles%\E_Gov\IFLYTEK\help.chm
- %ProgramFiles%\E_Gov\IFLYTEK\xvidcore.dll
- %ProgramFiles%\E_Gov\IFLYTEK\UnbrainIMMedia.dll
- %ProgramFiles%\E_Gov\IFLYTEK\MSVCRTD.DLL
- %ProgramFiles%\E_Gov\IFLYTEK\MSVCP60D.DLL
- %ProgramFiles%\E_Gov\IFLYTEK\emotions.dat
- %ProgramFiles%\E_Gov\IFLYTEK\oadocument.dot
- %ProgramFiles%\E_Gov\IFLYTEK\OACtrl.dll
- %ProgramFiles%\E_Gov\IFLYTEK\OAControl.dll
- %ProgramFiles%\E_Gov\IFLYTEK\eRepComaddin.dll
- %ProgramFiles%\E_Gov\IFLYTEK\OAComAddin.dll
- %ProgramFiles%\E_Gov\IFLYTEK\eMagComaddin.dll
- %ProgramFiles%\E_Gov\IFLYTEK\erepinfodocument.dot
- %ProgramFiles%\E_Gov\IFLYTEK\egovinfodocument.dot
- %ProgramFiles%\E_Gov\IFLYTEK\documentTemplate.xml
- %ProgramFiles%\E_Gov\IFLYTEK\DownloadCoCoDefaultFile.ocx
- <SYSTEM32>\DownloadCoCoDefaultFile.ocx
- %ProgramFiles%\E_Gov\IFLYTEK\OAWeb.bmp
- %ProgramFiles%\E_Gov\IFLYTEK\Login.jpg
- %ProgramFiles%\E_Gov\IFLYTEK\HermesClientConfig.xml
- %ProgramFiles%\E_Gov\IFLYTEK\version.tag
- %ProgramFiles%\E_Gov\IFLYTEK\DESSeal.dll
Substitutes the following files:
- <SYSTEM32>\DownloadCoCoDefaultFile.ocx
Miscellaneous:
Searches for the following windows:
- ClassName: 'TCocoMainForm' WindowName: ''
- ClassName: 'OpusApp' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following:
- '%ProgramFiles%\E_Gov\IFLYTEK\ХюС¶НЁЙэј¶°ьОЯєю20131219_2016.exe'
