Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) a####.b####.qq.com:8011
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(TLS/1.0) 2####.58.212.174:443
- TCP(TLS/1.0) dxp.b####.com:443
- TCP(TLS/1.0) h####.b####.com:443
- TCP(TLS/1.0) api.jiangch####.com:443
- TCP(TLS/1.0) ti####.c####.l####.####.com:443
- TCP(TLS/1.0) hotfix####.aliy####.com:443
- TCP(TLS/1.0) qy-swa####.qi####.com:443
- TCP c####.g####.ig####.com:5225
- TCP sdk.o####.t####.####.com:5224
- 7j####.c####.z0.####.com
- a####.b####.qq.com
- a####.man.aliy####.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- api.jiangch####.com
- c####.g####.ig####.com
- c-h####.g####.com
- dxp.b####.com
- h####.b####.com
- hotfix####.aliy####.com
- log.u####.com
- mt####.go####.com
- oss.jiangch####.com
- qy-swa####.qi####.com
- s####.u####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sh.wagbr####.alibaba####.com/bar/get/59c32dd3c895767df500001c/?ud_get=####
- sni.c####.q####.####.net/config/hz-hzv3.conf
- sni.c####.q####.####.net/tdata_MkX219
- sni.c####.q####.####.net/tdata_iGj879
- ti####.c####.l####.####.com/lib_img_3791391814060032
- ti####.c####.l####.####.com/lib_img_3796963082553344
- ti####.c####.l####.####.com/lib_img_3824977291200512
- ti####.c####.l####.####.com/lib_img_3924312786552832
- ti####.c####.l####.####.com/lib_img_3924313374836736
- ti####.c####.l####.####.com/lib_img_3924313745246208
- ti####.c####.l####.####.com/lib_img_3924314080397312
- ti####.c####.l####.####.com/lib_img_3924314369198080
- ti####.c####.l####.####.com/lib_img_3933958202017792
- ti####.c####.l####.####.com/lib_img_3980707903621120
- ti####.c####.l####.####.com/lib_img_3995205280794624
- ti####.c####.l####.####.com/lib_img_3999454450337792
- ti####.c####.l####.####.com/lib_img_4003331662972928
- ti####.c####.l####.####.com/lib_img_4014892182456320
- ti####.c####.l####.####.com/lib_img_4015086095697920
- ti####.c####.l####.####.com/lib_img_4021716816267264
- ti####.c####.l####.####.com/lib_img_4021716819003392
- ti####.c####.l####.####.com/smartcolleage-11609-bd4ae08764e248b4a4c113ea...
- ti####.c####.l####.####.com/smartcolleage-11613-5ba2b696bf1c44ecaafd6b38...
- ti####.c####.l####.####.com/smartcolleage-11613-66a517e23db445fbb36afb5f...
- ti####.c####.l####.####.com/smartcolleage-11640-c36f7a9dd65246b2a00f645a...
- ti####.c####.l####.####.com/微信图片_20180226163401.jpg
- ti####.c####.l####.####.com/登陆头像1 copy.png
- a####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- c-h####.g####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
- /data/data/####/023c16bcbc825882f7f746ded7541f0be239b6a802fabb2....0.tmp
- /data/data/####/02acb4e0661161353a22e42b8461bc8c47b91f661a0dd6e....0.tmp
- /data/data/####/0411599a0452a87320ef1d7bf0db6c1e741c6411bd04da5....0.tmp
- /data/data/####/0cfc1d1502d46e9b5b6953cdc4e333111e7839910971504....0.tmp
- /data/data/####/0fdd5815e6b71ec5b5fde42e477a5ffd0560fd73b39d9ca....0.tmp
- /data/data/####/1534422564650.log
- /data/data/####/1534422564650.log.bak
- /data/data/####/16bfb954be4bf15294315046af6e97bb3e46d12cf783840....0.tmp
- /data/data/####/1a1808d5ea6d22eaeb6ed32ce6005ccc4368dbe159ba78d....0.tmp
- /data/data/####/1d639e2ed97f856e8050ea5d72146fc3d5cc52024fba0e9....0.tmp
- /data/data/####/1d871ef8cf187efea38ad54c3832a3cfc6d09e513becc14....0.tmp
- /data/data/####/28e6e4d6b9ce8330e3004e215562bfd7e79cfcb5dba12dd....0.tmp
- /data/data/####/4714477ca352687af5100a9d1ae262d96dae5a4d97963a2....0.tmp
- /data/data/####/4f43f8643211814c392088ef61d06720a100436bcd07ab2....0.tmp
- /data/data/####/58d2618f3fe9c095e72c1b350400e1822cbabf44caa4751....0.tmp
- /data/data/####/60d5aca360ca6a2d92bdae16fbb0cee99373a7ff1fc9522....0.tmp
- /data/data/####/6644129f28239b4159b7f3a36fe0679aa17ad0584b4e8a7....0.tmp
- /data/data/####/666ee5edbd6a7634b646cb826275ea37fb2379a07e6436b....0.tmp
- /data/data/####/6b236049ac8eeea54020e3bcfea8658b787be6c2bbd7bbc....0.tmp
- /data/data/####/6c673aefd4e8c3682abe74eaa65bd7b06c174a01844e57e....0.tmp
- /data/data/####/7cfac9b609f9dc04fa4e9b9215b01512f71a2ba2860cbea....0.tmp
- /data/data/####/839d6f7bd696b3c2d36df4fd15c041269282e734db8aa0f....0.tmp
- /data/data/####/8eaa8116eed42c5f223177894a69b838a097b516b4699fb....0.tmp
- /data/data/####/96f83dd42ed92556e97a53864e66a56e0895f172564f080....0.tmp
- /data/data/####/982ceee736544a629f676c433a27a928d6e11dcf4cdb888....0.tmp
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/MultiDex.lock
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/__local_stat_full_cache.json
- /data/data/####/__send_data_1534422566341
- /data/data/####/__send_data_1534422566476
- /data/data/####/__send_data_1534422582302
- /data/data/####/a2ed1e1e46840c29280f64dc2bb9736a8938a6c6ed938fb....0.tmp
- /data/data/####/b84689ef385396736c2415171048165f998afa97e48b585....0.tmp
- /data/data/####/baidu_mtj_sdk_record.xml
- /data/data/####/bf133025897f01fdc306713dc64d09c7294353f2265fcdd....0.tmp
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c4d02d3fb035315308bbdf7757e988c10566805b64fbbf2....0.tmp
- /data/data/####/com.qiyukf.analytics.xml
- /data/data/####/core__local_last_session.json
- /data/data/####/core__local_stat_cache.json
- /data/data/####/df038e6c3e8217e60fbc2a0254e9455911a3670b96300c7....0.tmp
- /data/data/####/e1769a5d05e2f1dbce2aaa2d46ac4de3ed329137800a4b8....0.tmp
- /data/data/####/e3dc2c56ea04eee52123298b29c2dce3d6a94afbe246a16....0.tmp
- /data/data/####/e9c74ce16b39376ba604fda5fb67fbbea912c0d3afc77ce....0.tmp
- /data/data/####/f11074e7d9be98d33a49bca6c7d30ad6cbdaccbba465351....0.tmp
- /data/data/####/fcc66a3b5cc4f795b0d90c1fead0695f77c9cbd7f6b4deb....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/icampus.db-journal
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libcuid.so
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.0.2.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/mtj_auto.config
- /data/data/####/mtj_autoTracker.js
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/pushservice__local_last_session.json
- /data/data/####/pushservice__local_stat_cache.json
- /data/data/####/qiyu_save_eab5965935aee92b3007e8a200ca1441.xml
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/smart_app_sp.xml
- /data/data/####/smart_colleage_sp.xml
- /data/data/####/sp_sophix.xml
- /data/data/####/tdata_MkX219
- /data/data/####/tdata_MkX219.jar
- /data/data/####/tdata_iGj879
- /data/data/####/tdata_iGj879.jar
- /data/data/####/trace_circle.data
- /data/data/####/umeng_socialize.xml
- /data/data/####/unicorn#cheese#
- /data/media/####/.confd
- /data/media/####/.confd-journal
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.nomedia
- /data/media/####/.timestamp
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.hengchuang.icampus.bin
- /data/media/####/com.hengchuang.icampus.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/tdata_MkX219
- /data/media/####/tdata_iGj879
- /data/media/####/test.log
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.DemoPushService 25213 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.display.id
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.smartisan.version
- getprop ro.vivo.os.build.display.id
- getprop ro.vivo.os.version
- getprop ro.yunos.version
- logcat -d -v threadtime
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.DemoPushService 25213 300 0
- Bugly
- avcodec
- avformat
- avutil
- crash_analysis
- fdk-aac
- getuiext2
- libnfix
- libshella-2.9.0.2
- libufix
- nfix
- swscale
- ufix
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding