Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) and####.cl####.hon####.####.com:80
- TCP(HTTP/1.1) a####.b####.qq.com:8011
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP c####.g####.ig####.com:5226
- TCP sdk.o####.t####.####.net:5224
- 7j####.c####.z0.####.com
- a####.b####.qq.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- and####.cl####.hon####.com
- c####.g####.ig####.com
- c-h####.g####.com
- i####.hon####.com
- l####.tbs.qq.com
- log.u####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- and####.cl####.hon####.####.com/Public/Client/android/1.4.6/css/style.cs...
- and####.cl####.hon####.####.com/Public/Client/android/1.4.6/js/conf/do_c...
- and####.cl####.hon####.####.com/Public/Client/android/1.4.6/js/mod/funct...
- and####.cl####.hon####.####.com/Public/Client/common/js/conf/do_config.j...
- and####.cl####.hon####.####.com/Public/Client/common/js/lib/do.js?ver=####
- and####.cl####.hon####.####.com/Public/Client/common/js/lib/fastclick.js...
- and####.cl####.hon####.####.com/Public/Client/common/js/lib/zepto.min.js...
- and####.cl####.hon####.####.com/Public/Client/common/js/mod/common.js?ve...
- and####.cl####.hon####.####.com/Public/Client/common/js/mod/functions.js...
- and####.cl####.hon####.####.com/bookface/5/69/56983_middle.jpg
- and####.cl####.hon####.####.com/bookface/8/56/85663_middle.jpg
- and####.cl####.hon####.####.com/bookface/8/65/86548_middle.jpg
- and####.cl####.hon####.####.com/bookface/8/71/87157_middle.jpg
- and####.cl####.hon####.####.com/bookface/8/90/89030_middle.jpg
- and####.cl####.hon####.####.com/bookface/8/90/89044_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/16/91669_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/19/91975_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/19/91977_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/31/93129_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/31/93136_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/31/93152_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/33/93349_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/34/93416_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/36/93650_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/37/93754_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/38/93846_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/40/94079_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/8/90854_middle.jpg
- and####.cl####.hon####.####.com/bookface/9/8/90897_middle.jpg
- and####.cl####.hon####.####.com/img/bangdan/201808011.jpg
- and####.cl####.hon####.####.com/img/bangdan/hs20180704_59288new.jpg
- and####.cl####.hon####.####.com/notlogin.png
- and####.cl####.hon####.####.com/userlogin.html?version=####&P27=####&P30...
- sh.wagbr####.alibaba####.com/bar/get/52d637a756240b840c019238/?ud_get=####
- sni.c####.q####.####.net/config/hz-hzv3.conf
- sni.c####.q####.####.net/tdata_MkX219
- sni.c####.q####.####.net/tdata_iGj879
- a####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- and####.cl####.hon####.####.com//ajax/getpopup.do?&version=####&P27=####...
- and####.cl####.hon####.####.com//ajax/getpopupconfig.do?&version=####&P2...
- and####.cl####.hon####.####.com//listmodules?pageconfig=####&version=###...
- and####.cl####.hon####.####.com/Bookajax/getversion.do?&P27=####&P30=###...
- and####.cl####.hon####.####.com/Pushajax/addUserBehavior?&version=####&P...
- and####.cl####.hon####.####.com/Pushajax/bindDevice?sex_flag=####&versio...
- and####.cl####.hon####.####.com/clientbanner?version=####&P27=####&P30=#...
- c-h####.g####.com/api.php?format=####&t=####
- l####.tbs.qq.com/ajax?c=####&k=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- /data/data/####/14ffc8d930b6fe7f20da9d116e1acefb8a7dd6c526a2637....0.tmp
- /data/data/####/1f8a1d5a8dd3ab695b9f8d638e955da1a1d4ff0e0627b47....0.tmp
- /data/data/####/26dde87bcf246bc7f626a65fd065cab716c280fdc491aba....0.tmp
- /data/data/####/528d468ba326c98c943477b0f5cc68e5e3d66f4aa2d576e....0.tmp
- /data/data/####/7716732c50cbff2a443865400613269729dbc37f219b5a9....0.tmp
- /data/data/####/8247326ac465d249e6115af6dcba168a75eb3029b42ec17....0.tmp
- /data/data/####/9a934be6943444e94a97d05caf9beb19d987768008e966a....0.tmp
- /data/data/####/FavDATA.xml
- /data/data/####/MiscDATA.xml
- /data/data/####/ReadSetting.xml
- /data/data/####/adeb46e938003b5a4b13fe4870f5bf9fb555673d0d62f84....0.tmp
- /data/data/####/bc91f13d748477f9d0aa52fcf18ae2fa37000b410965b8c....0.tmp
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c3f177eb6359992488d4104cd27a50b5eb6b7e25bca6768....0.tmp
- /data/data/####/core_info
- /data/data/####/d3db5f26cc5e700ab1b7ba6750aec33d31e79d7d70bf916....0.tmp
- /data/data/####/da8f6f67b9ac57d325d08f2c570ef6cb1e91cbdca501725....0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/db31ab269589ef726af64eb7855dcecc39400a56a228d92....0.tmp
- /data/data/####/debug.conf
- /data/data/####/e5227751f4166b5537b6b365961867906b156f6e78e32d3....0.tmp
- /data/data/####/e60415d15d63499d4d502aa2805fb1df384b8fef5a9ced3....0.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/fistInstall.xml
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/hong.db
- /data/data/####/hong.db-journal
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libshella-2.8.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/sex_flag_name.xml
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_config.xml.bak
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_MkX219
- /data/data/####/tdata_MkX219.jar
- /data/data/####/tdata_iGj879
- /data/data/####/tdata_iGj879.jar
- /data/data/####/umeng_socialize.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/12077808.sht
- /data/media/####/12077809.sht
- /data/media/####/12077812.sht
- /data/media/####/12262196.sht
- /data/media/####/12262238.sht
- /data/media/####/12264381.sht
- /data/media/####/12264401.sht
- /data/media/####/12266384.sht
- /data/media/####/12266394.sht
- /data/media/####/12269640.sht
- /data/media/####/12570151.sht
- /data/media/####/12675624.sht
- /data/media/####/12675632.sht
- /data/media/####/12678159.sht
- /data/media/####/12678160.sht
- /data/media/####/12680173.sht
- /data/media/####/12680180.sht
- /data/media/####/12681845.sht
- /data/media/####/12681854.sht
- /data/media/####/12684067.sht
- /data/media/####/13039837.sht
- /data/media/####/13039838.sht
- /data/media/####/13301524.sht
- /data/media/####/13301525.sht
- /data/media/####/13301526.sht
- /data/media/####/13304992.sht
- /data/media/####/13304994.sht
- /data/media/####/13304995.sht
- /data/media/####/13307769.sht
- /data/media/####/13307771.sht
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.hongshu.bin
- /data/media/####/com.hongshu.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/crash-2018-08-09-02-39-24-1533782364612.log
- /data/media/####/store_cacheboy
- /data/media/####/store_categoryboy
- /data/media/####/store_free_boy
- /data/media/####/store_rankboy
- /data/media/####/tbslog.txt
- /data/media/####/tdata_MkX219
- /data/media/####/tdata_iGj879
- /data/media/####/test.log
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.PushService 24129 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.PushService 24129 300 0
- Bugly
- getuiext2
- libnfix
- libshella-2.8
- libufix
- nfix
- ufix
- AES-CBC-NoPadding
- AES-GCM-NoPadding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-NoPadding
- AES-GCM-NoPadding