Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Classes\TurboMeeting\shell\open\command] '' = '"%APPDATA%\TurboMeeting\PCStarter.exe" %1'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\tmsetup.txt
- %APPDATA%\turbomeeting\turbomeeting\sss.exe
- %APPDATA%\turbomeeting\turbomeeting\rsp1024hcmd.txt
- %APPDATA%\turbomeeting\turbomeeting\pcstarterxp.exe
- %APPDATA%\turbomeeting\turbomeeting\pcstarter.exe
- %APPDATA%\turbomeeting\turbomeeting\jsproxy.dll
- %APPDATA%\turbomeeting\turbomeeting\installservice.exe
- %APPDATA%\turbomeeting\turbomeeting\image\ymeetee.ico
- %APPDATA%\turbomeeting\turbomeeting\image\turbomeetingwatermark.png
- %APPDATA%\turbomeeting\turbomeeting\image\seperatorline.png
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_ger.tmd
- %APPDATA%\turbomeeting\turbomeeting\image\separator1.png
- %APPDATA%\turbomeeting\turbomeeting\image\mxmeeting.ico
- %APPDATA%\turbomeeting\turbomeeting\image\imdefault.png
- %APPDATA%\turbomeeting\turbomeeting\image\dummywebcam.png
- %APPDATA%\turbomeeting\turbomeeting\image\ctmeeting.ico
- %APPDATA%\turbomeeting\turbomeeting\image\applicationicon.ico
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_tur.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_spa.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_prt.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_jpn.tmd
- %APPDATA%\turbomeeting\turbomeeting\image\profileinfodialogbackground.bmp
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_ita.tmd
- %APPDATA%\turbomeeting\turbomeeting\tmdownloader.exe
- %APPDATA%\turbomeeting\pcstarter.exe
- %HOMEPATH%\desktop\turbomeeting.lnk
- %APPDATA%\turbomeeting\turbomeeting\setup_status.txt
- %APPDATA%\turbomeeting\turbomeeting\hookdll\tm1591818808.dll
- %TEMP%\svedetector.txt
- %APPDATA%\turbomeeting\turbomeeting\hookdll\tm1591818807.dll
- %APPDATA%\turbomeeting\turbomeeting\configure.xml
- %TEMP%\rsp1024h.txt
- %APPDATA%\turbomeeting\tmlauncher.exe
- %APPDATA%\turbomeeting\tminstaller.exe
- %APPDATA%\turbomeeting\turbomeeting\tmlauncher.exe
- %APPDATA%\turbomeeting\turbomeeting\tminstaller.exe
- %APPDATA%\turbomeeting\turbomeeting\cache.xml
- %APPDATA%\turbomeeting\turbomeeting\accessory_status.txt
- %APPDATA%\turbomeeting\turbomeeting\vistafunc.dll
- %APPDATA%\turbomeeting\turbomeeting\version.txt
- %APPDATA%\turbomeeting\turbomeeting\turbomeeting.exe
- %APPDATA%\turbomeeting\turbomeeting\turbomeeting.dll
- %APPDATA%\turbomeeting\turbomeeting\tmservice.exe
- %APPDATA%\turbomeeting\turbomeeting\tmresource.dll
- %APPDATA%\turbomeeting\turbomeeting\tmremover.exe
- %APPDATA%\turbomeeting\tmremover.exe
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_fre.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_eng.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_dth.tmd
- %TEMP%\tm_starter_dir\image\mxmeeting.ico
- %TEMP%\tm_starter_dir\image\imdefault.png
- %TEMP%\tm_starter_dir\image\dummywebcam.png
- %TEMP%\tm_starter_dir\image\ctmeeting.ico
- %TEMP%\tm_starter_dir\image\applicationicon.ico
- %TEMP%\tm_starter_dir\dictionary_client_tur.tmd
- %TEMP%\tm_starter_dir\dictionary_client_spa.tmd
- %TEMP%\tm_starter_dir\dictionary_client_prt.tmd
- %TEMP%\tm_starter_dir\image\separator1.png
- %TEMP%\tm_starter_dir\dictionary_client_jpn.tmd
- %TEMP%\tm_starter_dir\dictionary_client_ger.tmd
- %TEMP%\tm_starter_dir\dictionary_client_fre.tmd
- %TEMP%\tm_starter_dir\dictionary_client_eng.tmd
- %TEMP%\tm_starter_dir\dictionary_client_dth.tmd
- %TEMP%\tm_starter_dir\dictionary_client_chit.tmd
- %TEMP%\tm_starter_dir\dictionary_client_chi.tmd
- %TEMP%\tm_starter_dir\dbghelp.dll
- %TEMP%\tm_starter_dir\clientdatabase
- %TEMP%\pcclient.zip
- %TEMP%\tm_starter_dir\dictionary_client_ita.tmd
- %TEMP%\tm_starter_dir\image\seperatorline.png
- %TEMP%\tm_starter_dir\image\profileinfodialogbackground.bmp
- %TEMP%\tm_starter_dir\image\turbomeetingwatermark.png
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_chit.tmd
- %TEMP%\tm_starter_dir\turbomeeting.dll
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_chi.tmd
- %APPDATA%\turbomeeting\turbomeeting\dbghelp.dll
- %APPDATA%\turbomeeting\turbomeeting\clientdatabase
- %TEMP%\tminstaller.txt
- %TEMP%\tm_starter_dir\rsp1024hcmd.txt
- %TEMP%\tm_starter_dir\tmlauncher.exe
- %TEMP%\tm_starter_dir\vistafunc.dll
- %TEMP%\tm_starter_dir\version.txt
- %TEMP%\tm_starter_dir\turbomeeting.exe
- %TEMP%\tm_starter_dir\tmservice.exe
- %TEMP%\tm_starter_dir\image\ymeetee.ico
- %TEMP%\tm_starter_dir\tmresource.dll
- %TEMP%\tm_starter_dir\tmremover.exe
- %TEMP%\tm_starter_dir\tminstaller.exe
- %TEMP%\tm_starter_dir\tmdownloader.exe
- %TEMP%\tm_starter_dir\sss.exe
- %TEMP%\tm_starter_dir\pcstarterxp.exe
- %TEMP%\tm_starter_dir\pcstarter.exe
- %TEMP%\tm_starter_dir\jsproxy.dll
- %TEMP%\tm_starter_dir\installservice.exe
- %APPDATA%\microsoft\windows\start menu\programs\turbomeeting\turbomeeting start meeting.lnk
- %APPDATA%\microsoft\windows\start menu\programs\turbomeeting\turbomeeting uninstall.lnk
Удаляет следующие файлы
- %TEMP%\pcclient.zip
- %TEMP%\tm_starter_dir\installservice.exe
- %TEMP%\tm_starter_dir\jsproxy.dll
- %TEMP%\tm_starter_dir\pcstarter.exe
- %TEMP%\tm_starter_dir\pcstarterxp.exe
- %TEMP%\tm_starter_dir\rsp1024hcmd.txt
- %TEMP%\tm_starter_dir\sss.exe
- %TEMP%\tm_starter_dir\tmdownloader.exe
- %TEMP%\tm_starter_dir\dictionary_client_jpn.tmd
- %TEMP%\tm_starter_dir\tminstaller.exe
- %TEMP%\tm_starter_dir\tmremover.exe
- %TEMP%\tm_starter_dir\tmresource.dll
- %TEMP%\tm_starter_dir\tmservice.exe
- %TEMP%\tm_starter_dir\turbomeeting.dll
- %TEMP%\tm_starter_dir\turbomeeting.exe
- %TEMP%\tm_starter_dir\version.txt
- %TEMP%\tm_starter_dir\vistafunc.dll
- %TEMP%\tm_starter_dir\image\turbomeetingwatermark.png
- %TEMP%\tm_starter_dir\image\ymeetee.ico
- %TEMP%\tm_starter_dir\image\seperatorline.png
- %TEMP%\tm_starter_dir\image\separator1.png
- %TEMP%\tm_starter_dir\image\profileinfodialogbackground.bmp
- %TEMP%\tm_starter_dir\dbghelp.dll
- %TEMP%\tm_starter_dir\dictionary_client_chi.tmd
- %TEMP%\tm_starter_dir\dictionary_client_chit.tmd
- %TEMP%\tm_starter_dir\dictionary_client_dth.tmd
- %TEMP%\tm_starter_dir\dictionary_client_eng.tmd
- %TEMP%\tm_starter_dir\dictionary_client_fre.tmd
- %TEMP%\tm_starter_dir\dictionary_client_ger.tmd
- %APPDATA%\turbomeeting\turbomeeting\hookdll\tm1591818807.dll
- %TEMP%\tm_starter_dir\tmlauncher.exe
- %TEMP%\tm_starter_dir\dictionary_client_ita.tmd
- %TEMP%\tm_starter_dir\dictionary_client_spa.tmd
- %TEMP%\tm_starter_dir\dictionary_client_tur.tmd
- %TEMP%\tm_starter_dir\image\applicationicon.ico
- %TEMP%\tm_starter_dir\image\ctmeeting.ico
- %TEMP%\tm_starter_dir\image\dummywebcam.png
- %TEMP%\tm_starter_dir\image\imdefault.png
- %TEMP%\tm_starter_dir\image\mxmeeting.ico
- %TEMP%\tm_starter_dir\clientdatabase
- %TEMP%\tm_starter_dir\dictionary_client_prt.tmd
- %APPDATA%\turbomeeting\turbomeeting\rsp1024hcmd.txt
Самоудаляется.
Сетевая активность
TCP
Запросы HTTP GET
- http://rs.##ic.com:443/as/wapi/get_client_size?cl################################################################################# via rs.#wic.com
- http://rs.##ic.com:80/as/wapi/get_client_size?cl################################################################################# via rs.#wic.com
- http://rs.#wic.com/as/wapi/get_client?cl####################################################################################
UDP
- DNS ASK rs.#wic.com
Другое
Ищет следующие окна
- ClassName: 'TurboMeetingMainWindowClass' WindowName: ''
- ClassName: 'TMSetupWindow' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\tm_starter_dir\tmlauncher.exe'
- '%APPDATA%\turbomeeting\turbomeeting\turbomeeting.exe' --program %APPDATA%\TurboMeeting\TurboMeeting\rsp1024hcmd.txt
- '%APPDATA%\turbomeeting\turbomeeting\turbomeeting.exe' --VSEDetect
- '%TEMP%\tm_starter_dir\tmlauncher.exe' ' (со скрытым окном)
