Trojan.KeyLogger.19132

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ServerOceanCtrl' = '%PROGRAM_FILES%\Sh_online\Beike_backup\OceanCtrl.exe'
[<HKLM>\SOFTWARE\Classes\dfl.file\shell\open\command] '' = '%PROGRAM_FILES%\Sh_online\Beike_backup\OceanServer.exe %1'
[<HKLM>\SOFTWARE\Classes\dfd.file\shell\open\command] '' = '%PROGRAM_FILES%\Sh_online\Beike_backup\OceanServer.exe %1'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\OceanUpService] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Sh_online\Beike_backup\OceanCtrl.exe'
'%PROGRAM_FILES%\Sh_online\Beike_backup\OBUpService.exe'
'%PROGRAM_FILES%\Sh_online\Beike_backup\SetupStuff.exe' -am
'%PROGRAM_FILES%\Sh_online\Beike_backup\installcd.exe' sss
'%TEMP%\is-FGAC2.tmp\setup.tmp' /SL5="$60036,1943031,178176,%TEMP%\Beike_Server\setup.exe" /sp- /VERYSILENT /TASKS="desktopicon,startupicon,associate,sysmenu" /norestart /LANG=chinese
'%TEMP%\Beike_Server\setup.exe' /sp- /VERYSILENT /TASKS="desktopicon,startupicon,associate,sysmenu" /norestart /LANG=chinese
'%PROGRAM_FILES%\Sh_online\Beike_backup\OBUpService.exe' -install
'%PROGRAM_FILES%\Sh_online\Beike_backup\SetupStuff.exe' "%TEMP%\Beike_Server"

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s/c <SYSTEM32>\OceanMenu.dll
'<SYSTEM32>\net1.exe' start OceanUpService

Устанавливает процедуры перхвата сообщений

о нажатии клавиш клавиатуры:

Библиотека-обработчик для всех процессов: %PROGRAM_FILES%\Sh_online\Beike_backup\IdleUI.dll

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-8DE9B.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-1LHI9.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-FPRSR.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-GI6KB.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-J8TVN.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-IGGHH.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-QCVE0.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-LV2FA.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-GAGLN.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-7DED1.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-FCH3I.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-LCDK1.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-A4KB9.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-OS7N3.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-5IBI3.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-9MSQN.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-489LV.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-UR6MJ.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-74GQM.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-QOAFD.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-9PCGB.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-OPLDM.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-GSI4K.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-4N8UT.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-KQVA5.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-3QN00.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-0C2D9.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-OQQ3L.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-6FP4E.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-N6FK7.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-EH4NN.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-FA223.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-T1DOO.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-MVI3L.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-CPGRO.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-UFJQ5.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-THTG0.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-HAQGU.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-B2DIE.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-BADG3.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-P0BC6.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-2LFHI.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-IF1BL.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-067VB.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-BKDC7.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-LNN15.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_sybase\backup\FullBackup.sql
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_sybase\backup\FullBackup.bat
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_sybase\backup\LoadBackup.sql
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_sybase\backup\SybaseRestore.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_sybase\backup\Sybase++-и¦¤-¦¬т¦=-¬¬¦T¦+ў+-¦¦.doc
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_sybase\backup\Create_DB.sql
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_oracle\Rman_Backup_Level0.rcv
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_oracle\Rman_Backup_Level0.bat
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_oracle\Rman_Backup_Level1.bat
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_sybase\backup\Create_DB.bat
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_oracle\Rman_Backup_Level1.rcv
%PROGRAM_FILES%\Sh_online\Beike_backup\version.dat
%PROGRAM_FILES%\Sh_online\Beike_backup\ServerInfo.ini
%APPDATA%\Sh_online\Beike_backup\LocalInfo.ini
%APPDATA%\Sh_online\Beike_backup\ServerInfo.ini
%APPDATA%\Sh_online\Beike_backup\FileType.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\OBVSet.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\FileType.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_sybase\SybaseRestore.rar
%PROGRAM_FILES%\Sh_online\Beike_backup\lcs.dat
%PROGRAM_FILES%\Sh_online\Beike_backup\logo.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\LocalInfo.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_oracle\incremental_del.bat
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-M49AM.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-F7TVJ.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-D9BTB.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-HNN7P.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-1QI2S.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-FIP7E.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-G3J8K.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-V11FM.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-4C7MK.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-QVNER.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-4RVIP.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\ЙПєЈИИПЯ\±ґїЗґжґўїН»§¶Л\Р¶ФШ ±ґїЗґжґўїН»§¶Л.lnk
%ALLUSERSPROFILE%\Desktop\±ґїЗґжґўїН»§¶Л.lnk
<SYSTEM32>\OceanBackupServer.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\bat_oracle\full_del.bat
%PROGRAM_FILES%\Sh_online\Beike_backup\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\ЙПєЈИИПЯ\±ґїЗґжґўїН»§¶Л\±ґїЗґжґўїН»§¶Л.lnk
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-B2BNT.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-IUOEJ.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-65MAM.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-D6189.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-CP5TT.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-438OQ.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-S14FU.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-SLJIF.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-DLHCN.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-VCSKV.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-U0R70.tmp
%TEMP%\is-NIGMA.tmp\_isetup\_shfoldr.dll
%TEMP%\is-NIGMA.tmp\_isetup\_RegDLL.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-PF2LE.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-90GUL.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-7DTHE.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-LOIKA.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-G2V3M.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-1DKNN.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-RPFRU.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-SS9Q2.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-DLJ7D.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-E5K0E.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-UP5RQ.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-H89LU.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-AI9Q6.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-0I8OJ.tmp
%TEMP%\is-FGAC2.tmp\setup.tmp
%TEMP%\Beike_Server\Bin\bat_sybase\backup\Create_DB.sql
%TEMP%\Beike_Server\Bin\bat_sybase\backup\Create_DB.bat
%TEMP%\Beike_Server\Bin\bat_sybase\backup\FullBackup.bat
%TEMP%\Beike_Server\Bin\bat_sybase\backup\LoadBackup.sql
%TEMP%\Beike_Server\Bin\bat_sybase\backup\FullBackup.sql
%TEMP%\Beike_Server\Bin\bat_oracle\Rman_Backup_Level1.rcv
%TEMP%\Beike_Server\Bin\bat_oracle\incremental_del.bat
%TEMP%\Beike_Server\Bin\bat_oracle\full_del.bat
%TEMP%\Beike_Server\Bin\bat_oracle\Rman_Backup_Level0.bat
%TEMP%\Beike_Server\Bin\bat_oracle\Rman_Backup_Level1.bat
%TEMP%\Beike_Server\Bin\bat_oracle\Rman_Backup_Level0.rcv
%TEMP%\Beike_Server\Bin\OBVSet.ini
%TEMP%\Beike_Server\Bin\logo.bmp
%TEMP%\Beike_Server\Bin\ServerInfo.ini
%TEMP%\Beike_Server\setup.exe
%TEMP%\Beike_Server\Bin\version.dat
%TEMP%\Beike_Server\Bin\LocalInfo.ini
%TEMP%\Beike_Server\Bin\bat_sybase\backup\Sybase++-и¦¤-¦¬т¦=-¬¬¦T¦+ў+-¦¦.doc
%TEMP%\Beike_Server\Bin\bat_sybase\backup\SybaseRestore.exe
%TEMP%\Beike_Server\Bin\bat_sybase\SybaseRestore.rar
%TEMP%\Beike_Server\Bin\lcs.dat
%TEMP%\Beike_Server\Bin\FileType.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\is-PD5KJ.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-JQ2II.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-RQI6I.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-4METM.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-VTHIA.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-JLP1I.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-GDSF1.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-6NIHC.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-756OE.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-D8SJ9.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-T1CDP.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-1O2N5.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-JRII4.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-344OB.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-KKMT9.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-V5K02.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-7OH8C.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-B8M47.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-K1MGT.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-R1HO6.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-R29KO.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-JG2DR.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-NKPH7.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-ME24A.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\License\is-CPEPT.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\License\is-B9HN0.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\License\is-JMTCL.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-2BL99.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-ORVVN.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\Language\is-EQPHF.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-DETV5.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-NFFS5.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-5KJ0F.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\Language\is-4JBJ7.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\Language\is-MLD27.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-FQ4S6.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-FBVF3.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-32Q8U.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-GV5HN.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-IAH0R.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-BF6PN.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-FDTS8.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-MRHCD.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-914CM.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-VK1UG.tmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-VUL54.tmp

Удаляет следующие файлы:

%APPDATA%\Sh_online\Beike_backup\ServerInfo.ini
%TEMP%\is-FGAC2.tmp\setup.tmp
%TEMP%\is-NIGMA.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-NIGMA.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-B2DIE.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\lotus_mouse on.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-THTG0.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\local file_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-GSI4K.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\mirror_mouse on.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-HAQGU.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\lotus_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-BADG3.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\left_tensile_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-067VB.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\left_tensile.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-CPGRO.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\local file_mouse on.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-UFJQ5.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\line.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-IGGHH.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM2_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-7DED1.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM1_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-8DE9B.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM3_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-1LHI9.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM2_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-QCVE0.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\normal_backup_left.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-LV2FA.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\mirror_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-FCH3I.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM1_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-GAGLN.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\normal_backup_right.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-T1DOO.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\Easy Mode-but.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-MVI3L.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\cursor_hand.cur
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-KQVA5.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\email_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-6FP4E.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\email_mouse on.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-EH4NN.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_RESTORE_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-V5K02.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_RESTORE_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-FA223.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_TASK_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-N6FK7.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_TASK_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-P0BC6.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\left_bottom.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-2LFHI.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\left tensile_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-BKDC7.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\left_ten.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-IF1BL.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\left_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-3QN00.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\exchange_mouse on.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-4N8UT.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\event_title.BMP
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-0C2D9.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\file_filter.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-OQQ3L.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\exchange_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-F7TVJ.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\tab_press.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-FIP7E.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\tab_nornmal1.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-D9BTB.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\text_pic.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-M49AM.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\task_title.BMP
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-4C7MK.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\system_mouse on.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-G3J8K.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\sql_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-QVNER.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\tab_nornmal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-4RVIP.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\system_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-CP5TT.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\sounds\finishbackup1.wav
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-65MAM.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\sounds\finishbackup.wav
%PROGRAM_FILES%\Sh_online\Beike_backup\OceanMenu.dll в <SYSTEM32>\OceanMenu.dll
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-D6189.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\sounds\finishtest.wav
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-HNN7P.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\sounds\changedisk.wav
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-1QI2S.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\Title1.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-B2BNT.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\sounds\Error.WAV
%PROGRAM_FILES%\Sh_online\Beike_backup\sounds\is-IUOEJ.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\sounds\confirm.wav
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-QOAFD.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM6_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-UR6MJ.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM5_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-9PCGB.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\radio_normal.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-OPLDM.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM6_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-J8TVN.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM4_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-FPRSR.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM3_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-74GQM.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM5_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-GI6KB.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\NUM4_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-5IBI3.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\right_log.bmp1
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-9MSQN.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\right_log.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-V11FM.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\sql_mouse on.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-LNN15.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\right_tensile.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-A4KB9.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\restore_title.BMP
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-489LV.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\radio_press.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-OS7N3.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\right_lo1g.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-LCDK1.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\right_bottom.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-7OH8C.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\but_prev1.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\is-NFFS5.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\uninstall.ico
%PROGRAM_FILES%\Sh_online\Beike_backup\is-PD5KJ.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\SetupStuff.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\is-5KJ0F.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\version.dat
%PROGRAM_FILES%\Sh_online\Beike_backup\is-DETV5.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\Unsetup.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\is-1DKNN.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\OceanSN.dll
%PROGRAM_FILES%\Sh_online\Beike_backup\is-LOIKA.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\OceanServer.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\is-RPFRU.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\RunPro.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\is-SS9Q2.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\program.ico
%PROGRAM_FILES%\Sh_online\Beike_backup\License\is-JMTCL.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\License\TAILICENSE.txt
%PROGRAM_FILES%\Sh_online\Beike_backup\License\is-CPEPT.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\License\ENGLICENSE.txt
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-2BL99.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_ACCOUNT_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-ORVVN.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_ACCOUNT_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\Language\is-4JBJ7.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\Language\obcht.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\Language\is-MLD27.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\Language\obchs.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\License\is-B9HN0.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\License\CHILICENSE.txt
%PROGRAM_FILES%\Sh_online\Beike_backup\Language\is-EQPHF.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\Language\obeng.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\is-438OQ.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\icon.ico
%PROGRAM_FILES%\Sh_online\Beike_backup\is-S14FU.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\FT_ND_API.dll
%PROGRAM_FILES%\Sh_online\Beike_backup\is-VCSKV.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\installcd.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\is-SLJIF.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\IdleUI.dll
%PROGRAM_FILES%\Sh_online\Beike_backup\is-7DTHE.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\clienticon.ico
%PROGRAM_FILES%\Sh_online\Beike_backup\is-PF2LE.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\unins000.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\is-U0R70.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\DfZip.dll
%PROGRAM_FILES%\Sh_online\Beike_backup\is-90GUL.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\DfUnzip.dll
%PROGRAM_FILES%\Sh_online\Beike_backup\is-AI9Q6.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\OceanCtrl.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\is-0I8OJ.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\OBVSet.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\is-G2V3M.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\OceanMenu.dll
%PROGRAM_FILES%\Sh_online\Beike_backup\is-DLJ7D.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\OceanEngine.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\is-UP5RQ.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\lcs.dat
%PROGRAM_FILES%\Sh_online\Beike_backup\is-DLHCN.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\klprocess.dll
%PROGRAM_FILES%\Sh_online\Beike_backup\is-H89LU.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\OBUpService.exe
%PROGRAM_FILES%\Sh_online\Beike_backup\is-E5K0E.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\LocalInfo.ini
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-JLP1I.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\bottomАЙм.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-4METM.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\advance_backup_right.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-R1HO6.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\but-next1.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-VTHIA.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT-DISABLE.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-GDSF1.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_TASK_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-T1CDP.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_TASK_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-JQ2II.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\advance_backup_left.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-RQI6I.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\about_ok.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-344OB.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_BACKUP_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-B8M47.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_BACKUP_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-KKMT9.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_EVENT_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-JRII4.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_EVENT_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-R29KO.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT-PASS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-K1MGT.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT-NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-JG2DR.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_ACCOUNT_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\is-NKPH7.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\en\BUT_ACCOUNT_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-BF6PN.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_RESTORE_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-VK1UG.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_RESTORE_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-FQ4S6.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_TASK_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-FBVF3.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_TASK_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-FDTS8.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_BACKUP_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-MRHCD.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_BACKUP_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-VUL54.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_EVENT_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\is-914CM.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\ch\BUT_EVENT_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-6NIHC.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_EVENT_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-756OE.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_EVENT_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-1O2N5.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_RESTORE_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-D8SJ9.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_RESTORE_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-IAH0R.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_ACCOUNT_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-32Q8U.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_ACCOUNT_NORMAL.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-ME24A.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_BACKUP_PRESS.bmp
%PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\is-GV5HN.tmp в %PROGRAM_FILES%\Sh_online\Beike_backup\skin\cht\BUT_BACKUP_NORMAL.bmp

Другое:

Ищет следующие окна:

ClassName: '' WindowName: '????????'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней