Technical Information
- [<HKLM>\Software\Classes\Heinote.txt\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.sql\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.diff\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.iss\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.nsi\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.nsh\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.json\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.makefile\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.yaml\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.md\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.lua\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.py\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.pl\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.xml\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.log\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.markdown\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- [<HKLM>\Software\Classes\Heinote.rc\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
- <SYSTEM32>\tasks\hn_repair
- <SYSTEM32>\tasks\hn_update
- [<HKLM>\System\CurrentControlSet\Services\HEINOTEUPDATE] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\HEINOTEUPDATE] 'ImagePath' = '<SYSTEM32>\svchost.exe -k HEINOTEUPDATE'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\HEINOTEUPDATE\Parameters] 'ServiceDll' = '%APPDATA%\Heinote\HNChecker.dll'
- 'HEINOTEUPDATE' <SYSTEM32>\svchost.exe -k HEINOTEUPDATE
- %TEMP%\peblokbuzheinote85000910alin001.exe
- %TEMP%\funinstaller_ps_0107004.exe
- %TEMP%\{5bf388b9-cc98-4512-9131-8e2e4509b62b}.tf
- %TEMP%\{4207bf9b-376c-4315-aa44-33c1f0a5eeb5}.tmp
- %TEMP%\{4c45d1a2-75d0-4848-9f4b-f34c87fbf62e}.tmp\7z.dll
- %TEMP%\{13878d7f-3cb9-428b-a0c3-b791f73b11e5}.tmp
- %TEMP%\{10e74c84-a0c5-4214-a831-99492b81a41e}.tmp\360base.dll
- %TEMP%\{10e74c84-a0c5-4214-a831-99492b81a41e}.tmp\360netul.dll
- %TEMP%\{10e74c84-a0c5-4214-a831-99492b81a41e}.tmp\netbridge.dll
- %TEMP%\{10e74c84-a0c5-4214-a831-99492b81a41e}.tmp\utils\ldsbasic.dll
- %TEMP%\fmpskin\configuration.7z
- %TEMP%\fmpskin\configuration\installerdefault.skin
- %TEMP%\funaccesetupfiles\setupfiles.7z
- %TEMP%\{389f4e51-a1db-4ad9-97c0-1de675a4b9fb}.tf
- %TEMP%\ldsgamemaster.exe
- %TEMP%\funaccesetupfiles\funacce\seedicon.ico
- %TEMP%\funaccesetupfiles\funacce\风行视频加速器.exe
- %TEMP%\funaccesetupfiles\funacce\aptnail.dll
- %TEMP%\funaccesetupfiles\funacce\dicengjiasu.dll
- %TEMP%\funaccesetupfiles\funacce\dicengjiasu64.dll
- %TEMP%\funaccesetupfiles\funacce\fireman.dll
- %TEMP%\funaccesetupfiles\funacce\funaccelerator.dll
- %TEMP%\funaccesetupfiles\funacce\funaccelerator64.dll
- %TEMP%\funaccesetupfiles\funacce\fundodge.dll
- %TEMP%\funaccesetupfiles\funacce\funworks.dll
- %TEMP%\funaccesetupfiles\funacce\funworks64.dll
- %TEMP%\funaccesetupfiles\funacce\gma.dll
- %TEMP%\funaccesetupfiles\funacce\aenvclear.daw
- %TEMP%\funaccesetupfiles\funacce\acceclient.exe
- %TEMP%\funaccesetupfiles\funacce\uninst.exe
- %TEMP%\360net.dll
- %TEMP%\lud75eb.tmp
- %TEMP%\{2c52f67b-a040-4fa2-8ed0-1e3a77eae6b1}.tf
- %APPDATA%\heinote\feedback.tmp
- %APPDATA%\heinote\filerelated.tmp
- %APPDATA%\heinote\readmode.tmp
- %APPDATA%\heinote\service.tmp
- %APPDATA%\heinote\skinbox.tmp
- %APPDATA%\heinote\hnote.tmp
- %APPDATA%\heinote\notepaper.tmp
- %APPDATA%\heinote\report.tmp
- %APPDATA%\heinote\update.tmp
- %APPDATA%\heinote\upgrade.tmp
- %APPDATA%\heinote\duilib.tmp
- %APPDATA%\heinote\hnchecker.tmp
- %APPDATA%\heinote\hnshell.tmp
- %APPDATA%\heinote\autosave.tmp
- %APPDATA%\heinote\hnshell64.tmp
- %APPDATA%\heinote\hnpreview64.tmp
- %APPDATA%\heinote\heinote.tmp
- %APPDATA%\heinote\unuserchoise.tmp
- %APPDATA%\heinote\userchoise.tmp
- %APPDATA%\heinote\updatechecker.tmp
- %APPDATA%\heinote\uninst.tmp
- %TEMP%\ldsgamemasterinstroad_214001.exe
- %HOMEPATH%\desktop\小黑记事本.lnk
- %APPDATA%\microsoft\windows\start menu\小黑记事本\启动小黑记事本.lnk
- %APPDATA%\microsoft\windows\start menu\小黑记事本\卸载小黑记事本.lnk
- %TEMP%\{b7fd13c8-acc8-4b4c-a100-834a32c4eeda}.tf
- %TEMP%\lud4fb5.tmp
- %TEMP%\360base.dll
- %APPDATA%\heinote\hnpreview.tmp
- %TEMP%\funaccesetupfiles\funacce\sfunworks.daw
- %TEMP%\funaccesetupfiles\funacce\ssdodge.daw
- %TEMP%\{b7fd13c8-acc8-4b4c-a100-834a32c4eeda}.tf
- %TEMP%\lud4fb5.tmp
- %TEMP%\360base.dll
- %TEMP%\{2c52f67b-a040-4fa2-8ed0-1e3a77eae6b1}.tf
- %TEMP%\lud75eb.tmp
- %TEMP%\360net.dll
- %TEMP%\{389f4e51-a1db-4ad9-97c0-1de675a4b9fb}.tf
- %TEMP%\{5bf388b9-cc98-4512-9131-8e2e4509b62b}.tf
- %TEMP%\{4207bf9b-376c-4315-aa44-33c1f0a5eeb5}.tmp
- %TEMP%\{13878d7f-3cb9-428b-a0c3-b791f73b11e5}.tmp
- from %APPDATA%\heinote\autosave.tmp to %APPDATA%\heinote\autosave.exe
- from %APPDATA%\heinote\updatechecker.tmp to %APPDATA%\heinote\updatechecker.dll
- from %APPDATA%\heinote\update.tmp to %APPDATA%\heinote\update.dll
- from %APPDATA%\heinote\userchoise.tmp to %APPDATA%\heinote\userchoise.reg
- from %APPDATA%\heinote\unuserchoise.tmp to %APPDATA%\heinote\unuserchoise.reg
- from %APPDATA%\heinote\heinote.tmp to %APPDATA%\heinote\heinote.ini
- from %APPDATA%\heinote\hnpreview64.tmp to %APPDATA%\heinote\hnpreview64.dll
- from %APPDATA%\heinote\hnpreview.tmp to %APPDATA%\heinote\hnpreview.dll
- from %APPDATA%\heinote\hnshell64.tmp to %APPDATA%\heinote\hnshell64.dll
- from %APPDATA%\heinote\hnshell.tmp to %APPDATA%\heinote\hnshell.dll
- from %APPDATA%\heinote\hnchecker.tmp to %APPDATA%\heinote\hnchecker.dll
- from %APPDATA%\heinote\duilib.tmp to %APPDATA%\heinote\duilib.dll
- from %APPDATA%\heinote\upgrade.tmp to %APPDATA%\heinote\upgrade.exe
- from %APPDATA%\heinote\update.tmp to %APPDATA%\heinote\update.exe
- from %APPDATA%\heinote\report.tmp to %APPDATA%\heinote\report.exe
- from %APPDATA%\heinote\notepaper.tmp to %APPDATA%\heinote\notepaper.exe
- from %APPDATA%\heinote\hnote.tmp to %APPDATA%\heinote\hnote.exe
- from %APPDATA%\heinote\skinbox.tmp to %APPDATA%\heinote\skinbox.exe
- from %APPDATA%\heinote\service.tmp to %APPDATA%\heinote\service.exe
- from %APPDATA%\heinote\readmode.tmp to %APPDATA%\heinote\readmode.exe
- from %APPDATA%\heinote\filerelated.tmp to %APPDATA%\heinote\filerelated.exe
- from %APPDATA%\heinote\feedback.tmp to %APPDATA%\heinote\feedback.exe
- from %APPDATA%\heinote\report.tmp to %APPDATA%\heinote\report.dll
- from %APPDATA%\heinote\uninst.tmp to %APPDATA%\heinote\uninst.exe
- %APPDATA%\heinote\update.tmp
- %APPDATA%\heinote\report.tmp
- http://d.###note.com/downloads/alin_1/pEbLokbuZheinote85000910alin001.exe
- http://dl.##dashi.com/gamemaster/LDSGameMasterInstRoad_214001.exe
- http://do#####ds.funshion.net/tools/cloudinstall_signature/7004/FunInstaller_PS_0107004.exe
- http://dl.##dashi.com/gamemaster/buychannelFull.exe
- http://s.###ashi.com/mgame?ty#################################################################################################################################
- http://s.###ashi.com/mgame?ty##########################################################################################################################
- http://ky######on.dftoutiao.com/position/get02
- http://tj#.#654.com/heinote/common_action?co#####################################################################################################################################################...
- http://s.###ashi.com/mgame?ty###################################################################################################################################
- http://s.###ashi.com/mgame?ty################################################################################################################################
- http://do####f.eastday.com/wnkt/qdb/setup_wnktwkb011.exe
- http://ne#####.funshion.com/tools/acceconfig.ini
- http://do###.7654.com/n/heinote2.json
- http://do###.7654.com/n/report/queryinfo.xml
- http://st##.#unshion.net/tools/FsPlatformAction?rp###############################################################################################################################################...
- http://ap#.#58pan.com/upgrape.php
- http://tj#.#654.com/heinote/common_action?co#####################################################################################################################################################...
- http://tj#.#654.com/heinote/install?co###########################################################################################################################################################...
- http://tj#.#654.com/heinote/online?co############################################################################################################################################################...
- DNS ASK ap#.#58pan.com
- DNS ASK d.###note.com
- DNS ASK dl.##dashi.com
- DNS ASK tj#.#654.com
- DNS ASK do#####ds.funshion.net
- DNS ASK s.###ashi.com
- DNS ASK ky######on.dftoutiao.com
- DNS ASK do###.7654.com
- DNS ASK ne#####.funshion.com
- DNS ASK do####f.eastday.com
- DNS ASK st##.#unshion.net
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- '%TEMP%\peblokbuzheinote85000910alin001.exe'
- '%TEMP%\ldsgamemasterinstroad_214001.exe'
- '%APPDATA%\heinote\hnote.exe' -install
- '%APPDATA%\heinote\hnote.exe' -schedule
- '%APPDATA%\heinote\notepaper.exe' -install
- '%TEMP%\ldsgamemaster.exe' /PID="214001" /S /FROM=inst
- '%APPDATA%\heinote\report.exe'
- '%TEMP%\funinstaller_ps_0107004.exe'
- '%WINDIR%\syswow64\regedit.exe' /s "%APPDATA%\Heinote\UserChoise.reg"' (with hidden window)
- '%APPDATA%\heinote\notepaper.exe' -install' (with hidden window)
- '%APPDATA%\heinote\report.exe' ' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s /u %APPDATA%\Heinote\HNShell64.dll
- '%WINDIR%\syswow64\regsvr32.exe' /s /u %APPDATA%\Heinote\HNPreview64.dll
- '%WINDIR%\syswow64\regsvr32.exe' /s /u %APPDATA%\Heinote\hnchecker.dll
- '%WINDIR%\syswow64\regsvr32.exe' /s %APPDATA%\Heinote\UserChoise.reg
- '%WINDIR%\syswow64\regsvr32.exe' /s %APPDATA%\Heinote\HNShell64.dll
- '<SYSTEM32>\regsvr32.exe' /s %APPDATA%\Heinote\HNShell64.dll
- '%WINDIR%\syswow64\regsvr32.exe' /s %APPDATA%\Heinote\HNPreview64.dll
- '%WINDIR%\syswow64\regedit.exe' /s "%APPDATA%\Heinote\UserChoise.reg"
- '<SYSTEM32>\regsvr32.exe' /s %APPDATA%\Heinote\HNPreview64.dll
- '%WINDIR%\syswow64\svchost.exe' -k HEINOTEUPDATE
- '%WINDIR%\syswow64\rundll32.exe'