Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) up####.sdk.jig####.cn:80
- TCP(HTTP/1.1) v1.iqia####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) oth.up####.mdt.####.com:8080
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) 1####.29.29.29:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) ap####.iqia####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(TLS/1.0) v1.iqia####.com:443
- TCP(TLS/1.0) v2.iqia####.com.####.com:443
- TCP(TLS/1.0) s####.j####.cn:443
- TCP c####.g####.ig####.com:5225
- TCP 1####.198.120.80:7007
- TCP sdk.o####.t####.####.com:5224
- TCP oth.str.mdt.####.com:8081
- UDP s.j####.cn:19000
- TCP oth.eve.mdt.####.com:8081
- 254.60.168.####.arpa
- 7j####.c####.z0.####.com
- a####.u####.com
- and####.b####.qq.com
- ap####.iqia####.com
- c####.g####.ig####.com
- c-h####.g####.com
- l####.tbs.qq.com
- m.iqia####.com
- n####.iqia####.com
- oth.eve.mdt.####.com
- oth.str.mdt.####.com
- oth.up####.mdt.####.com
- s####.j####.cn
- s.j####.cn
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- up####.sdk.jig####.cn
- v1.iqia####.com
- v2.iqia####.com
- www.iqia####.com
- sni.c####.q####.####.net/config/hz-hzv3.conf
- sni.c####.q####.####.net/tdata_YYn966
- sni.c####.q####.####.net/tdata_eOt091
- v1.iqia####.com/aop/public/images/upload/act_99/2377c209731ec5fc080b8274...
- v1.iqia####.com/aop/public/images/upload/act_99/2943cdae22281acacf4bcaad...
- v1.iqia####.com/aop/public/images/upload/act_99/2ff91ab19d5e2a8684f00ed2...
- v1.iqia####.com/aop/public/images/upload/act_99/5149d0a803c5a05cd31d1d8e...
- v1.iqia####.com/aop/public/images/upload/act_99/767b2660cfab0a2c9f23768e...
- v1.iqia####.com/aop/public/images/upload/act_99/b7b979b24de2ed3a10b574d2...
- v1.iqia####.com/aop/public/images/upload/act_99/c352d150d7e27c20d2d874fb...
- v1.iqia####.com/aop/public/images/upload/act_99/e738bc25930aba344355b7b4...
- v1.iqia####.com/aop/public/images/upload/act_99/ec77040e4ff464cab07996ac...
- v1.iqia####.com/news/u/cms/www/201801/04212704uwjx.jpg
- v1.iqia####.com/news/u/cms/www/201801/042128109oq5.jpg
- v1.iqia####.com/news/u/cms/www/201801/091505078au2.png
- v1.iqia####.com/news/u/cms/www/201801/09161208zt80.jpg
- v1.iqia####.com/news/u/cms/www/201801/11175808thyh.jpg
- v1.iqia####.com/news/u/cms/www/201807/13210822tg5d.png
- v1.iqia####.com/news/u/cms/www/201807/16171142timx.png
- v1.iqia####.com/news/u/cms/www/201807/17111508kygb.jpg
- v1.iqia####.com/news/u/cms/www/201807/18172536ujr4.jpg
- v1.iqia####.com/news/u/cms/www/201807/20110835zetv.png
- v1.iqia####.com/news/u/cms/www/201807/201812516ivk.png
- v1.iqia####.com/news/u/cms/www/201807/23165830au9p.jpg
- a####.u####.com/app_logs
- and####.b####.qq.com/rqd/async?aid=####
- ap####.iqia####.com/appStatistics/clickAction
- c-h####.g####.com/api.php?format=####&t=####
- l####.tbs.qq.com/ajax?c=####&k=####
- oth.up####.mdt.####.com:8080/beacon/vercheck
- sdk.o####.p####.####.com/api.php?format=####&t=####
- up####.sdk.jig####.cn/v1/push/sdk/postlist
- /data/data/####/-1iqianjin_7.0.3.txt
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/1.jar
- /data/data/####/1004
- /data/data/####/2LSV5g-DPIh5-8l5hxrQPLwMOUE.-705463584.tmp
- /data/data/####/8L70wbvOHCrehs5b6D1CRbW8XS8.-1590667002.tmp
- /data/data/####/8vkaKiuhrFAoogmSkXiU0zSBFvY.838394417.tmp
- /data/data/####/9.jar
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/DENGTA_META.xml
- /data/data/####/JPushSA_Config.xml
- /data/data/####/JPushSA_Config.xml.bak
- /data/data/####/SP_AROUTER_CACHE.xml
- /data/data/####/YDsbnfXmX915D0lfCp9-z5QoZs0.-626644338.tmp
- /data/data/####/appPackageNames
- /data/data/####/beacon_cover.xml
- /data/data/####/beacon_cover_check.lock
- /data/data/####/beacon_cover_load.lock
- /data/data/####/beacon_db
- /data/data/####/beacon_db-journal
- /data/data/####/beacon_sig_1.lock
- /data/data/####/bugly_db_-journal
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.rid.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/cn.jpush.preferences.v2.xml.bak
- /data/data/####/core_info
- /data/data/####/crashrecord.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/debug.conf
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/fxrO3vaW5fIS2xwhk7LEt257XFw.-929532446.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui.xml
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/https_m.iqianjin.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/iqianjin.xml
- /data/data/####/iqianjinNewDB.db-journal
- /data/data/####/iqianjindb-journal
- /data/data/####/jpush_device_info.xml
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_local_notification.db-wal
- /data/data/####/jpush_stat_cache.json
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/jpush_statistics.db
- /data/data/####/jpush_statistics.db-journal
- /data/data/####/jpush_statistics.db-shm (deleted)
- /data/data/####/jpush_statistics.db-wal
- /data/data/####/jtEAus4MmGBalHAGPmeOH_ggHec.-1311593388.tmp
- /data/data/####/k2K3np_ttjlZ7UC-AZCVX429nRY.1605000498.tmp
- /data/data/####/knUa019m3BzZ1iclMRU_rl0TZMI.-511992496.tmp
- /data/data/####/libjiagu-239223147.so
- /data/data/####/local_crash_lock
- /data/data/####/msg_queue
- /data/data/####/multidex.version.xml
- /data/data/####/puhuiStatis_.db-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qohRT7hKY4v5LsscCvbcPlvtq0c.134211128.tmp
- /data/data/####/rg7J_m5fEWgWPzZOaXDi06qGRW4.-1814785416.tmp
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_YYn966
- /data/data/####/tdata_YYn966.jar
- /data/data/####/tdata_eOt091
- /data/data/####/tdata_eOt091.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/ui0N0p71byiH8-uGWZf1J84HVYg.617892873.tmp
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/v1LEGfJw2d_SAGnRqckT6OlrT94.432765103.tmp
- /data/data/####/vc0KUpE9Q_bJrI7bL_XnCU-88qo.9852649.tmp
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/xQRCpOFpPcqRbg-DFPsBYvccQxo.-1986473939.tmp
- /data/data/####/y3kdQfJ2f0WyoLjxTKQ2tWaPT1E.1865330473.tmp
- /data/media/####/.push_deviceid
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.iqianjin.client.db
- /data/media/####/meta.dat
- /data/media/####/tdata_YYn966
- /data/media/####/tdata_eOt091
- /data/media/####/test.log
- /system/bin/sh -c getprop
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24901 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-239223147.so
- getprop
- getprop ro.product.cpu.abi
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24901 300 0
- Bugly
- getuiext2
- jcore117
- libgifimage
- libimagepipeline
- libjiagu-239223147
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES-ECB-PKCS5Padding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- AES-GCM-NoPadding
- DES-ECB-PKCS5Padding