Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sdk.o####.amp.####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) d####.opensp####.cn:80
- TCP(HTTP/1.1) api.ycf####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) h####.opensp####.cn:80
- TCP(HTTP/1.1) img.ycf####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(TLS/1.0) res####.a####.com:443
- TCP 42.62.1####.16:5227
- TCP t####.nz.ig####.com:5224
- TCP sdk.o####.t####.####.com:5224
- 7j####.c####.z0.####.com
- a####.exc.mob.com
- a####.u####.com
- and####.b####.qq.com
- api.s####.mob.com
- api.ycf####.com
- c-h####.g####.com
- d####.opensp####.cn
- h####.opensp####.cn
- img.ycf####.com
- l####.tbs.qq.com
- res####.a####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.amp.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- t####.nz.g####.net
- t####.nz.ge####.com
- t####.nz.ig####.com
- u####.ycf####.com
- api.ycf####.com/ask/detail?id=22840&userid=80934&client_ver=5.0.6&visit_...
- api.ycf####.com/ask/list?userid=80934&client_ver=5.0.6&visit_start_time=...
- api.ycf####.com/comments/hotcomments?count=3&articleid=22840_ask_22840&u...
- api.ycf####.com/content/getcontentlist?categoryid=3&categorytype=normal&...
- api.ycf####.com/content/getcontentlist?categoryid=56&categorytype=normal...
- api.ycf####.com/content/getplaylist?userid=80934&client_ver=5.0.6&visit_...
- api.ycf####.com/views/focusimg?userid=&client_ver=5.0.6&visit_start_time...
- h####.opensp####.cn/launchconfig?t=####&p=dml0e####
- img.ycf####.com/thumbs/135/100/data/ycrb//userfiles/32/images/cms/articl...
- img.ycf####.com/thumbs/135/100/data/ycrb//userfiles/32/images/cms/subjec...
- img.ycf####.com/thumbs/160/114/data/ycrb//userfiles/32/images/cms/ask/20...
- img.ycf####.com/thumbs/480/270/data/ycrb//userfiles/32/images/cms/articl...
- sdk.o####.amp.####.com/api.htm?format=####&t=####
- sni.c####.q####.####.net/config/bj-bjv4.conf
- sni.c####.q####.####.net/config/hz-bjv4.conf
- sni.c####.q####.####.net/tdata_SzD730
- sni.c####.q####.####.net/tdata_ZCi456
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- and####.b####.qq.com/rqd/async
- api.s####.mob.com/conf4
- api.s####.mob.com/conn
- api.s####.mob.com/data2
- api.s####.mob.com/log4
- api.s####.mob.com/snsconf
- api.ycf####.com/ask/related
- api.ycf####.com/menu/gettaglist
- api.ycf####.com/paper/prepaper
- api.ycf####.com/search/hotword
- api.ycf####.com/total/total.php
- api.ycf####.com/usercenter/sso/fakeReg?securitykey=53b5eb7356d1a3c5703b3...
- api.ycf####.com/userinfo/api/v2/favor/sync?userid=80934&client_ver=5.0.6...
- api.ycf####.com/userinfo/api/v2/reddot?userid=80934&client_ver=5.0.6&vis...
- api.ycf####.com/userinfo/api/v2/sub/sync?userid=80934&client_ver=5.0.6&v...
- api.ycf####.com/userinfo/api/v3/ask/concern/list
- api.ycf####.com/views/counts
- api.ycf####.com/views/coverpages
- api.ycf####.com/views/overall
- api.ycf####.com/views/version
- c-h####.g####.com/api.php?format=####&t=####
- d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
- l####.tbs.qq.com/ajax?c=####&k=####
- sdk-ope####.g####.com/api.php?format=####&t=####
- /data/data/####/.imprint
- /data/data/####/.lock
- /data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
- /data/data/####/504709dfd3251974a827ae7a356ba7fc.0
- /data/data/####/9548505880428.0
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/bugly_db_legu-journal
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/ccccc11a5690e3f1a8bf30f2230dfc2d.0
- /data/data/####/com.iflytek.id.xml
- /data/data/####/com.iflytek.msc.xml
- /data/data/####/config.xml
- /data/data/####/config_noclear.xml
- /data/data/####/core_info
- /data/data/####/debug.conf
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/gdaemon_20161017
- /data/data/####/gx_sp.xml
- /data/data/####/hmdb
- /data/data/####/hmdb-journal
- /data/data/####/ifly_launch_lib.xml
- /data/data/####/iflytek_state_com.ycen.www.activity.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal
- /data/data/####/journal.tmp
- /data/data/####/libshella-2.8.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/logdb.db
- /data/data/####/logdb.db-journal
- /data/data/####/mix.dex
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/pref.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/statistics.db-journal
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbs_load_stat_flag.xml
- /data/data/####/tbs_report_lock.txt
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_SzD730
- /data/data/####/tdata_SzD730.jar
- /data/data/####/tdata_ZCi456
- /data/data/####/tdata_ZCi456.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/media/####/.ba
- /data/media/####/.dk
- /data/media/####/.lock
- /data/media/####/.nomedia
- /data/media/####/11hXqMne978Qs8j1KvhVxMe4zpQ.-758047677.tmp
- /data/media/####/1526454255730.db
- /data/media/####/22840.dat
- /data/media/####/9-aDRbiMK3BE-Fw4BmhSte0He64.98418078.tmp
- /data/media/####/AhsJsTmfxI5atMaNlTRIrglk8sA.1883000273.tmp
- /data/media/####/Alvin2.xml
- /data/media/####/CLVvC_kMrXqQDCAF05wsMJTsX3g.-844059976.tmp
- /data/media/####/ContextData.xml
- /data/media/####/DY0o3yAIdt8nnKmtO6lGmBoakbk.1990319126.tmp
- /data/media/####/GrBkhwK4kta-foeDs6WFzJFRCnA.-579184917.tmp
- /data/media/####/Jljutk4Zre8Huh5fAwBTU42hehQ.1995251487.tmp
- /data/media/####/MPUNhIJ2K_bZ24u--tx75Mox_XM.1107647845.tmp
- /data/media/####/MrGNJl-1fJjlflHWb3Ws9qgXwGI.-1916606307.tmp
- /data/media/####/SXJHOdtUaoPGEP4gQvGWPHbGC4A.-506875631.tmp
- /data/media/####/TZrLEhhaul9fB8Fu2MHzDZcNIlA.-752696131.tmp
- /data/media/####/VNPxcMgcYRsUaUtCFYWF_uLt4tU.-1611792890.tmp
- /data/media/####/WQtKmnpONbBD37rWpnWproi9RWM.-1121497727.tmp
- /data/media/####/WuYZG997rA9vm9t8DKAnm523rJk.-1104017833.tmp
- /data/media/####/_vR4WZpe0fxJhuFWYN5n_NpdPQw.1089907231.tmp
- /data/media/####/alsn20170807.db
- /data/media/####/alsn20170807.db-journal
- /data/media/####/app.db
- /data/media/####/ask_attention.dat
- /data/media/####/ask_comment22840.dat
- /data/media/####/ask_detail22840.dat
- /data/media/####/ask_follow.dat
- /data/media/####/ask_praise.dat
- /data/media/####/ask_question.dat
- /data/media/####/ask_related22840.dat
- /data/media/####/ask_subject_praise.dat
- /data/media/####/c716539653fae46cc4ef413c4a43bc90.mp4
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.ycen.www.activity.db
- /data/media/####/comment_logo.png
- /data/media/####/cover_key2.dat
- /data/media/####/dwuvdOF9BEbdHXLpHHiDpSDCc6w.-504554149.tmp
- /data/media/####/ea85b2c99776531627b7d939e113e9af.mp4
- /data/media/####/gov_logo.png
- /data/media/####/ic_launcher.png
- /data/media/####/iflyworkdir_test
- /data/media/####/izRazyqOT8LO8fWsM7coOuXsnLM.-1375202296.tmp
- /data/media/####/local_collect.dat
- /data/media/####/mediadata.dat
- /data/media/####/pvbX5JUgNsZnbPQg2tlt0ZXAJwA.918861195.tmp
- /data/media/####/subscribe.dat
- /data/media/####/tagId3.dat
- /data/media/####/tagId4.dat
- /data/media/####/tagId56.dat
- /data/media/####/tagId6.dat
- /data/media/####/tdata_SzD730
- /data/media/####/tdata_ZCi456
- /data/media/####/test.log
- /data/media/####/yc9lbousOE74WdwVPNJAGZOOd4I.316311992.tmp
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25122 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25122 300 0
- Bugly
- getuiext2
- imagepipeline
- libnfix
- libshella-2.8
- libufix
- msc
- neh
- nfix
- ufix
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- AES-GCM-NoPadding