Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pub-####.qin####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) st####.re####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) img.re####.com:80
- TCP(HTTP/1.1) nav.cn.ron####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) app.re####.com:80
- TCP(TLS/1.0) s####.cn.ron####.com:443
- TCP 1####.92.122.155:8609
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5227
- 7j####.c####.z0.####.com
- a####.u####.com
- and####.b####.qq.com
- app.re####.com
- c####.g####.ig####.com
- c-h####.g####.com
- img.re####.com
- log.u####.com
- nav.cn.ron####.com
- pub-####.qin####.com
- s####.cn.ron####.com
- s####.u####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st####.re####.com
- app.re####.com/Case/gallery/id/621/order/1
- app.re####.com/Case/gallery/id/847/order/1
- app.re####.com/Case/gallery/id/847/order/2
- app.re####.com/Case/index/id/621
- app.re####.com/Case/index/id/847
- et2-na6####.wagbr####.ali####.####.com/bar/get/5917fa74e88bad72b90020d5/...
- img.re####.com/201706/20170623/20170623_0fadab95b05d8059f3b2kxNnPV6btfrA...
- img.re####.com/201706/20170623/20170623_19daf6ca7533f7d99d87rfhFXShOnWt4...
- img.re####.com/201706/20170623/20170623_1c23039b78eac74bd1d0YEVhjAhprOZu...
- img.re####.com/201706/20170623/20170623_397bea3291b6e384f4919KZSw5uk0kSV...
- img.re####.com/201706/20170623/20170623_3c95b0f12cfa415ea655ccC6GJVfI25M...
- img.re####.com/201706/20170623/20170623_5b3b7db858baae3ed57f561agzczUGD7...
- img.re####.com/201706/20170623/20170623_8259d2b9428ab8111512qPdxZPDH8GVI...
- img.re####.com/201706/20170623/20170623_9c635328665aadfeef5dLzrWVuf4KNgG...
- img.re####.com/201706/20170623/20170623_ace6541f30591320b444eNqFKkT3eO4B...
- img.re####.com/201706/20170623/20170623_bad583122e16039d73efnXUp51s3xmcR...
- img.re####.com/201706/20170623/20170623_d2a60f93140f1e2b3e558NCrxTMZ8Lmj...
- img.re####.com/201706/20170626/20170626_2b746572fc49819f5849mBmqPgBbV2Px...
- img.re####.com/201706/20170626/20170626_8a8bd00fed7b20e87faaDFOBVxk3WzCH...
- img.re####.com/201706/20170626/20170626_9ebcccb7af6ede0e628anDxkkAnIyGH2...
- img.re####.com/201707/20170712/20170712_4f0c5cf063d6be74d6f0sawEVhGY8WyH...
- img.re####.com/201710/20171031/20171031_b6433789a3e7693bc156FMKakxfj6SB9...
- img.re####.com/201711/20171124/20171124_265af7ceee043f59986aC06ZjQSwchqy...
- img.re####.com/201712/20171205/20171205_3c554fe33dd4343f606b9AUlgQLA4lPk...
- img.re####.com/201803/20180309/20180309_04fd376eb1484e677104u50M2lFNl1K0...
- img.re####.com/201803/20180309/20180309_8c1994640f2ef09fee6b1pN2BUo7Pk2D...
- img.re####.com/201803/20180309/20180309_90c676b956111f9ccab55NRIwz8gpStf...
- img.re####.com/201803/20180309/20180309_ea3f87db28a3c71306afS8FgewlK70Mo...
- img.re####.com/201804/20180412/20180412_95968b132f2c5229ff77OfBwGh5J6F1R...
- img.re####.com/201804/20180415/20180415_99ca7026286a8def4ff1OTF0jFEJDFw5...
- img.re####.com/201805/20180514/20180514_08bf38eeac7aa1ad4586lLVKbdy6cy6c...
- img.re####.com/201805/20180514/20180514_092f5be173bf8aba12e0mfxGdYIXQYar...
- img.re####.com/201805/20180514/20180514_315dd195636a97475f04XtyJafDbOCiC...
- img.re####.com/201805/20180521/20180521_138e45c052a2eebdef91oZCC4m2hSiog...
- img.re####.com/201806/20180605/20180605_6bd410b49468433c6407KAnyxea1noEW...
- img.re####.com/201808/20180820/20180820_545e4c57aee37c0e68c53ue1vHT36Zwl...
- img.re####.com/201810/20181018/20181018_543d3be1d37fa12ac0d5Rho01UpWOBOh...
- img.re####.com/201810/20181019/20181019_7af5e33d66acc66d6d42xkw0Y5qUGPOH...
- img.re####.com/201810/20181023/20181023_5ac544d9b38aa696b598ELl10BUEIOh6...
- img.re####.com/201810/20181028/20181028_01daf99c54283f4e3660CbPUZyIb65MM...
- img.re####.com/201810/20181028/20181028_285119ded812c2047819WnP81D8KqjuD...
- img.re####.com/avatar/001/36/59/149803366835_avatar_big.jpg
- img.re####.com/avatar/001/36/59/150606001037_avatar_big.jpg
- img.re####.com/avatar/001/36/59/150606722338_avatar_big.jpg
- img.re####.com/avatar/001/72/70/150606009359_avatar_big.jpg
- img.re####.com/avatar/001/74/87/150606717921_avatar_big.jpg
- img.re####.com/avatar/002/83/99/149803374966_avatar_big.jpg
- img.re####.com/avatar/002/83/99/150606033672_avatar_big.jpg
- img.re####.com/avatar/005/20/14/150606006226_avatar_big.jpg
- img.re####.com/avatar/005/20/14/152566396530_avatar_big.jpg
- pub-####.qin####.com/tdata_EDT356
- st####.re####.com/app/css/app.min.css?t=####
- st####.re####.com/app/images/icon-back.png
- st####.re####.com/public/css/reset.min.css?t=####
- st####.re####.com/usercenter/css/swiper.min.css
- st####.re####.com/usercenter/js/jquery1.8.min.js?t=####
- st####.re####.com/usercenter/js/swiper.min.js
- t####.c####.q####.####.com/config/hz-hzv3.conf
- t####.c####.q####.####.com/tdata_MkX219
- t####.c####.q####.####.com/tdata_iGj879
- a####.u####.com/app_logs
- and####.b####.qq.com/rqd/async?aid=####
- app.re####.com/Case/case_list
- app.re####.com/Index/index
- app.re####.com/Index/update_version
- c-h####.g####.com/api.php?format=####&t=####
- nav.cn.ron####.com/navipush.json
- sdk.o####.p####.####.com/api.php?format=####&t=####
- /data/data/####/-kOBE1mX6AKBKB-4PMC8CPDjAmE.-1501350655.tmp
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/1004
- /data/data/####/1541642163393.log
- /data/data/####/1541642163393.log.bak
- /data/data/####/1541642163393.log.bak (deleted)
- /data/data/####/1YqAJD10J5P79kJK_uwZMIoGYok.-1424431042.tmp
- /data/data/####/1oqlOyG4HuHOyPlaHf4q9fbH9nI.-1241656916.tmp
- /data/data/####/2007355852
- /data/data/####/3CzdL7oqncGi95DTVZP_Z0mbDKk.1294452587.tmp
- /data/data/####/8T_xnlS0mi6X5jJ3J50nup8Pkzk.-857401236.tmp
- /data/data/####/9ebc2e722633
- /data/data/####/Alvin2.xml
- /data/data/####/B79TKBDvQY5UXEspRSe5DHbMcBM.1607388747.tmp
- /data/data/####/BZjWU2vwa11PGEFRJVLyZTWKkvM.1246533007.tmp
- /data/data/####/COUNTLY_STORE.xml
- /data/data/####/ContextData.xml
- /data/data/####/JvTlhVzPqn4uR42llWTYXRDe8NM.543779989.tmp
- /data/data/####/KOvLJSsZcv_c_zN8EL5AJ2n2cVg.-620747294.tmp
- /data/data/####/MNKJyGfZ5CUEy5Yl3ltAMdZKTEE.1257842901.tmp
- /data/data/####/M_YdpEMzeHm1Km4uNFrZTew1nqg.-1665773817.tmp
- /data/data/####/MultiDex.lock
- /data/data/####/NFxAZqN5MhRCt7ifPjpEA8gpWhw.1341144415.tmp
- /data/data/####/NeT4z2HqwRDI6-SKRjpSvYbdfV0.-1929262897.tmp
- /data/data/####/RedocnConfig.xml
- /data/data/####/RongPush.xml
- /data/data/####/Statistics.xml
- /data/data/####/U6BmV2YlH931Q6uZUtmxNoCPRVk.-573393201.tmp
- /data/data/####/YdEPWjpUBrc85ojAs5y4V88OWt4.-510627385.tmp
- /data/data/####/ZQ_aEonFND7OM54E40Tsw7e3fvw.1940290713.tmp
- /data/data/####/ZX8ZxGhw6ywGnusapWYBiHhzMVk.1032422153.tmp
- /data/data/####/bmpIbgqOjtLananbBaqnt0i2Gl0.-149945255.tmp
- /data/data/####/bugly_db_-journal
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/crashrecord.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/etQ9nkgZEieczROblzlkn4gK3q0.-1609603467.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/h4iMWqKUjFN4opZzdnE-Ezg4yYI.340056212.tmp
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-2085473921.so
- /data/data/####/local_crash_lock
- /data/data/####/msp.db
- /data/data/####/msp.db-journal
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/push.pid
- /data/data/####/push_daemon
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qMdpk4-9hgvaQsnhOqgmeR2AH48.-227555726.tmp
- /data/data/####/rfb53Xtlh578sVX78ruGZh7VYSs.312362058.tmp
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/tdata_MkX219
- /data/data/####/tdata_MkX219.jar
- /data/data/####/tdata_iGj879
- /data/data/####/tdata_iGj879.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/wTTYHg3ottIoN1U8DTQNJGE2Jtk.1397651333.tmp
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/yZqoI_8Am7QjBDMjlxCQ4lzOUv8.-1371072785.tmp
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/RongLog_2_8_17.log
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.redocn.redocn.db
- /data/media/####/tdata_MkX219
- /data/media/####/tdata_iGj879
- /data/media/####/test.log
- /system/bin/chmod 777 <Package Folder>/app_lib/x86/push_daemon
- /system/bin/sh -c getprop
- /system/bin/sh -c type su
- <Package Folder>/app_lib/x86/push_daemon <Package> io.rong.push.PushService /storage/emulated/0/.rongLock
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24681 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-2085473921.so
- getprop
- mount
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24681 300 0
- Bugly
- RongIMLib
- getuiext2
- imagepipeline
- libjiagu-2085473921
- push
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding