Technical Information
Modifies file system:
Creates the following files:
- %ProgramFiles%\Detong\Office Tab\is-B1ER6.tmp
- %ProgramFiles%\Detong\Office Tab\Language\is-05R2U.tmp
- %ProgramFiles%\Detong\Office Tab\Language\is-AGVTR.tmp
- <SYSTEM32>\is-CNQUA.tmp
- %ProgramFiles%\Detong\Office Tab\is-EGO3M.tmp
- %ProgramFiles%\Detong\Office Tab\is-L7RNT.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Office Tab\Uninstall Office Tab Professional.lnk
- %ALLUSERSPROFILE%\Desktop\Office Tab Center.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Office Tab\Office Tab Center(Admin).lnk
- %ProgramFiles%\Detong\Office Tab\Language\is-1F69J.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Office Tab\Office Tab Center.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Office Tab\Office Tab Professional on the Web.url
- %TEMP%\is-1919I.tmp\OfficeTab7.tmp
- %TEMP%\is-FVNDR.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-FVNDR.tmp\_isetup\_shfoldr.dll
- %TEMP%\7ZipSfx.000\install.cmd
- %TEMP%\7ZipSfx.000\crack.exe
- %TEMP%\7ZipSfx.000\OfficeTab7.exe
- <SYSTEM32>\is-IR68U.tmp
- <SYSTEM32>\is-M9RJ5.tmp
- <SYSTEM32>\is-JHB8F.tmp
- %ProgramFiles%\Detong\Office Tab\is-GAESK.tmp
- %ProgramFiles%\Detong\Office Tab\is-TMVCO.tmp
- %ProgramFiles%\Detong\Office Tab\is-0M1SO.tmp
Moves the following files:
- from %ProgramFiles%\Detong\Office Tab\is-B1ER6.tmp to %ProgramFiles%\Detong\Office Tab\PowerPointTab.dll
- from %ProgramFiles%\Detong\Office Tab\is-L7RNT.tmp to %ProgramFiles%\Detong\Office Tab\WordTab.dll
- from %ProgramFiles%\Detong\Office Tab\is-EGO3M.tmp to %ProgramFiles%\Detong\Office Tab\ExcelTab.dll
- from %ProgramFiles%\Detong\Office Tab\Language\is-1F69J.tmp to %ProgramFiles%\Detong\Office Tab\Language\language_WTB.xml
- from %ProgramFiles%\Detong\Office Tab\Language\is-AGVTR.tmp to %ProgramFiles%\Detong\Office Tab\Language\language_PTB.xml
- from %ProgramFiles%\Detong\Office Tab\Language\is-05R2U.tmp to %ProgramFiles%\Detong\Office Tab\Language\language_ETB.xml
- from <SYSTEM32>\is-CNQUA.tmp to <SYSTEM32>\ArmAccess.dll
- from %ProgramFiles%\Detong\Office Tab\is-0M1SO.tmp to %ProgramFiles%\Detong\Office Tab\OfficeTabCenter(Admin).exe
- from %ProgramFiles%\Detong\Office Tab\is-TMVCO.tmp to %ProgramFiles%\Detong\Office Tab\OfficeTabCenter.exe
- from %ProgramFiles%\Detong\Office Tab\is-GAESK.tmp to %ProgramFiles%\Detong\Office Tab\unins000.exe
- from <SYSTEM32>\is-JHB8F.tmp to <SYSTEM32>\OTB_Loader.dll
- from <SYSTEM32>\is-M9RJ5.tmp to <SYSTEM32>\OfficeTabFunction.dll
- from <SYSTEM32>\is-IR68U.tmp to <SYSTEM32>\Officetab_Detong.ocx
Miscellaneous:
Searches for the following windows:
- ClassName: 'PP12FrameClass' WindowName: ''
- ClassName: 'PPTFrameClass' WindowName: ''
- ClassName: 'JWinproj-WhimperMainClass' WindowName: ''
- ClassName: 'XLMAIN' WindowName: ''
- ClassName: 'OpusApp' WindowName: ''
- ClassName: 'PP11FrameClass' WindowName: ''
Creates and executes the following:
- '%TEMP%\is-1919I.tmp\OfficeTab7.tmp' /SL5="$300DE,2331985,299520,%TEMP%\7ZipSfx.000\OfficeTab7.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\7ZipSfx.000\OfficeTab7.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\OTB_Loader.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Officetab_Detong.ocx"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "
