Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\MeetingManager\shell\open\command] '' = '"%APPDATA%\MeetingManager\PCStarter.exe" %1'
Modifies file system
Creates the following files
- %TEMP%\tmsetup.txt
- %APPDATA%\meetingmanager\turbomeeting\jsproxy.dll
- %APPDATA%\meetingmanager\turbomeeting\installservice.exe
- %APPDATA%\meetingmanager\turbomeeting\image\ymeetee.ico
- %APPDATA%\meetingmanager\turbomeeting\image\turbomeetingwatermark.png
- %APPDATA%\meetingmanager\turbomeeting\image\seperatorline.png
- %APPDATA%\meetingmanager\turbomeeting\image\separator1.png
- %APPDATA%\meetingmanager\turbomeeting\image\profileinfodialogbackground.bmp
- %APPDATA%\meetingmanager\turbomeeting\image\mxmeeting.ico
- %APPDATA%\meetingmanager\turbomeeting\image\imdefault.png
- %APPDATA%\meetingmanager\turbomeeting\image\dummywebcam.png
- %APPDATA%\meetingmanager\turbomeeting\image\ctmeeting.ico
- %APPDATA%\meetingmanager\turbomeeting\image\applicationicon.ico
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_tur.tmd
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_spa.tmd
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_prt.tmd
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_jpn.tmd
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_ita.tmd
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_ger.tmd
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_fre.tmd
- %APPDATA%\meetingmanager\turbomeeting\pcstarter.exe
- %APPDATA%\meetingmanager\turbomeeting\pcstarterxp.exe
- %APPDATA%\meetingmanager\turbomeeting\rsp1024hcmd.txt
- %APPDATA%\meetingmanager\turbomeeting\sss.exe
- %TEMP%\svedetector.txt
- %APPDATA%\meetingmanager\turbomeeting\hookdll\tm1604378603.dll
- %APPDATA%\meetingmanager\turbomeeting\configure.xml
- %TEMP%\rsp1024h.txt
- %APPDATA%\meetingmanager\tmlauncher.exe
- %APPDATA%\meetingmanager\tminstaller.exe
- %APPDATA%\meetingmanager\tmremover.exe
- %APPDATA%\meetingmanager\pcstarter.exe
- %APPDATA%\meetingmanager\turbomeeting\cache.xml
- %APPDATA%\meetingmanager\turbomeeting\vistafunc.dll
- %APPDATA%\meetingmanager\turbomeeting\accessory_status.txt
- %APPDATA%\meetingmanager\turbomeeting\version.txt
- %APPDATA%\meetingmanager\turbomeeting\turbomeeting.exe
- %APPDATA%\meetingmanager\turbomeeting\turbomeeting.dll
- %APPDATA%\meetingmanager\turbomeeting\tmservice.exe
- %APPDATA%\meetingmanager\turbomeeting\tmresource.dll
- %APPDATA%\meetingmanager\turbomeeting\tmremover.exe
- %APPDATA%\meetingmanager\turbomeeting\tmlauncher.exe
- %APPDATA%\meetingmanager\turbomeeting\tminstaller.exe
- %APPDATA%\meetingmanager\turbomeeting\tmdownloader.exe
- %APPDATA%\meetingmanager\turbomeeting\hookdll\tm1604378604.dll
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_eng.tmd
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_dth.tmd
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_chit.tmd
- %TEMP%\tm_starter_dir\image\mxmeeting.ico
- %TEMP%\tm_starter_dir\image\imdefault.png
- %TEMP%\tm_starter_dir\image\dummywebcam.png
- %TEMP%\tm_starter_dir\image\ctmeeting.ico
- %TEMP%\tm_starter_dir\image\applicationicon.ico
- %TEMP%\tm_starter_dir\dictionary_client_tur.tmd
- %TEMP%\tm_starter_dir\dictionary_client_spa.tmd
- %TEMP%\tm_starter_dir\dictionary_client_prt.tmd
- %TEMP%\tm_starter_dir\dictionary_client_jpn.tmd
- %TEMP%\tm_starter_dir\dictionary_client_ita.tmd
- %TEMP%\tm_starter_dir\dictionary_client_ger.tmd
- %TEMP%\tm_starter_dir\dictionary_client_fre.tmd
- %TEMP%\tm_starter_dir\dictionary_client_eng.tmd
- %TEMP%\tm_starter_dir\dictionary_client_dth.tmd
- %TEMP%\tm_starter_dir\dictionary_client_chit.tmd
- %TEMP%\tm_starter_dir\dictionary_client_chi.tmd
- %TEMP%\tm_starter_dir\dbghelp.dll
- %TEMP%\tm_starter_dir\clientdatabase
- %TEMP%\pcclient.zip
- %TEMP%\tm_starter_dir\image\profileinfodialogbackground.bmp
- %TEMP%\tm_starter_dir\image\separator1.png
- %TEMP%\tm_starter_dir\image\seperatorline.png
- %TEMP%\tm_starter_dir\image\turbomeetingwatermark.png
- %APPDATA%\meetingmanager\turbomeeting\dbghelp.dll
- %APPDATA%\meetingmanager\turbomeeting\clientdatabase
- %TEMP%\tminstaller.txt
- %TEMP%\tm_starter_dir\rsp1024hcmd.txt
- %TEMP%\tm_starter_dir\tmlauncher.exe
- %TEMP%\tm_starter_dir\vistafunc.dll
- %TEMP%\tm_starter_dir\version.txt
- %TEMP%\tm_starter_dir\turbomeeting.exe
- %TEMP%\tm_starter_dir\turbomeeting.dll
- %TEMP%\tm_starter_dir\tmresource.dll
- %TEMP%\tm_starter_dir\tmservice.exe
- %TEMP%\tm_starter_dir\tmremover.exe
- %TEMP%\tm_starter_dir\tminstaller.exe
- %TEMP%\tm_starter_dir\tmdownloader.exe
- %TEMP%\tm_starter_dir\sss.exe
- %TEMP%\tm_starter_dir\pcstarterxp.exe
- %TEMP%\tm_starter_dir\pcstarter.exe
- %TEMP%\tm_starter_dir\jsproxy.dll
- %TEMP%\tm_starter_dir\installservice.exe
- %TEMP%\tm_starter_dir\image\ymeetee.ico
- %APPDATA%\meetingmanager\turbomeeting\dictionary_client_chi.tmd
- %APPDATA%\meetingmanager\turbomeeting\setup_status.txt
Deletes the following files
- %TEMP%\pcclient.zip
- %TEMP%\tm_starter_dir\installservice.exe
- %TEMP%\tm_starter_dir\jsproxy.dll
- %TEMP%\tm_starter_dir\pcstarter.exe
- %TEMP%\tm_starter_dir\pcstarterxp.exe
- %TEMP%\tm_starter_dir\rsp1024hcmd.txt
- %TEMP%\tm_starter_dir\sss.exe
- %TEMP%\tm_starter_dir\tmdownloader.exe
- %TEMP%\tm_starter_dir\dictionary_client_jpn.tmd
- %TEMP%\tm_starter_dir\tminstaller.exe
- %TEMP%\tm_starter_dir\tmremover.exe
- %TEMP%\tm_starter_dir\tmresource.dll
- %TEMP%\tm_starter_dir\tmservice.exe
- %TEMP%\tm_starter_dir\turbomeeting.dll
- %TEMP%\tm_starter_dir\turbomeeting.exe
- %TEMP%\tm_starter_dir\version.txt
- %TEMP%\tm_starter_dir\vistafunc.dll
- %TEMP%\tm_starter_dir\image\turbomeetingwatermark.png
- %TEMP%\tm_starter_dir\image\ymeetee.ico
- %TEMP%\tm_starter_dir\image\seperatorline.png
- %TEMP%\tm_starter_dir\image\separator1.png
- %TEMP%\tm_starter_dir\image\profileinfodialogbackground.bmp
- %TEMP%\tm_starter_dir\dbghelp.dll
- %TEMP%\tm_starter_dir\dictionary_client_chi.tmd
- %TEMP%\tm_starter_dir\dictionary_client_chit.tmd
- %TEMP%\tm_starter_dir\dictionary_client_dth.tmd
- %TEMP%\tm_starter_dir\dictionary_client_eng.tmd
- %TEMP%\tm_starter_dir\dictionary_client_fre.tmd
- %TEMP%\tm_starter_dir\dictionary_client_ger.tmd
- %APPDATA%\meetingmanager\turbomeeting\hookdll\tm1604378603.dll
- %TEMP%\tm_starter_dir\tmlauncher.exe
- %TEMP%\tm_starter_dir\dictionary_client_ita.tmd
- %TEMP%\tm_starter_dir\dictionary_client_spa.tmd
- %TEMP%\tm_starter_dir\dictionary_client_tur.tmd
- %TEMP%\tm_starter_dir\image\applicationicon.ico
- %TEMP%\tm_starter_dir\image\ctmeeting.ico
- %TEMP%\tm_starter_dir\image\dummywebcam.png
- %TEMP%\tm_starter_dir\image\imdefault.png
- %TEMP%\tm_starter_dir\image\mxmeeting.ico
- %TEMP%\tm_starter_dir\clientdatabase
- %TEMP%\tm_starter_dir\dictionary_client_prt.tmd
- %APPDATA%\meetingmanager\turbomeeting\rsp1024hcmd.txt
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://re####.desktop.services/as/wapi/get_client_size?cl##################################################################################################
- http://re####.desktop.services/as/wapi/get_client?cl###################################################################################
- http://re####.desktop.services/as/wapi/ssi?si######################################################################
UDP
- DNS ASK re####.desktop.services
Miscellaneous
Searches for the following windows
- ClassName: 'TurboMeetingMainWindowClass' WindowName: ''
- ClassName: 'TMSetupWindow' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%TEMP%\tm_starter_dir\tmlauncher.exe'
- '%APPDATA%\meetingmanager\turbomeeting\turbomeeting.exe' --program %APPDATA%\MeetingManager\TurboMeeting\rsp1024hcmd.txt
- '%APPDATA%\meetingmanager\turbomeeting\turbomeeting.exe' --VSEDetect
- '%TEMP%\tm_starter_dir\tmlauncher.exe' ' (with hidden window)
