Adware.Gexin.20460

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) i.t####.com:80
TCP(HTTP/1.1) rp-na####.ron####.com:80
TCP(HTTP/1.1) tinychi####.q####.com.####.com:80
TCP(HTTP/1.1) rq####.sp####.mig.####.net:80
TCP(HTTP/1.1) a####.b####.qq.com:8011
TCP(HTTP/1.1) a####.b####.qq.com:8012
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) j####.d####.com.####.cn:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) loc.map.b####.com:443
TCP(TLS/1.0) s####.cn.ron####.com:443
TCP sdk.o####.t####.####.com:5224
TCP 1####.92.22.167:8000
TCP cm-1####.g####.com:5224

DNS requests:

a####.b####.qq.com
aexcep####.b####.qq.com
and####.b####.qq.com
api.map.b####.com
av1.x####.com
c####.x####.com
c####.x####.com
c-h####.g####.com
cdn-sdk####.g####.com
cm-1####.g####.com
i.t####.com
j####.d####.com
loc.map.b####.com
nav.cn.ron####.com
s####.cn.ron####.com
sdk-ope####.g####.com
sdk.c####.g####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

HTTP GET requests:

i.t####.com/a/3f565628a54ead6c51c0987c43b0fff91
tinychi####.q####.com.####.com/config/hzv9.conf

HTTP POST requests:

a####.b####.qq.com:8011/rqd/async
a####.b####.qq.com:8012/rqd/async
c-h####.g####.com/api.php?format=####&t=####
rp-na####.ron####.com/navipush.json
rq####.sp####.mig.####.net/rqd/async
sdk-ope####.g####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/-1706829246
/data/data/####/.jg.ic
/data/data/####/000001.dbtmp
/data/data/####/000002.dbtmp
/data/data/####/000003.log
/data/data/####/1591799554152_2218
/data/data/####/1591799554854_2218
/data/data/####/1591799558195_2218
/data/data/####/1591799559691_2218
/data/data/####/1591799561304_2394
/data/data/####/1591799561713_2413
/data/data/####/1591799561949_2218
/data/data/####/1591799562398_2394
/data/data/####/1591799563333_2218
/data/data/####/1591799564489_2394
/data/data/####/1591799564506_2218
/data/data/####/1591799566660_2218
/data/data/####/1591799568861_2833
/data/data/####/1591799571153_2874
/data/data/####/1591799571925_2218
/data/data/####/1591799572376_2874
/data/data/####/1591799575274_2218
/data/data/####/1591799575800_2218
/data/data/####/1591799584705_2833
/data/data/####/1591799589180_2413
/data/data/####/1591799594954_2218
/data/data/####/1591799619434_2218
/data/data/####/1591799624973_2394
/data/data/####/1667485511
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/COUNTLY_STORE.xml
/data/data/####/INSTALLATION
/data/data/####/LOCK
/data/data/####/MANIFEST-000001
/data/data/####/MANIFEST-000002
/data/data/####/Pythagoras_phase.xml
/data/data/####/RongPush.xml
/data/data/####/Statistics.xml
/data/data/####/TDCloudSettingsConfig228C0E7A18E496B9E84D5A2DF4028134.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_cloudcontrol1.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime0.xml
/data/data/####/TalingDataConfig228C0E7A18E496B9E84D5A2DF4028134.xml
/data/data/####/account.0ba46c06f595477edfc7170ce390dec5.css
/data/data/####/account.bedd4d610a8e980e92d2.js
/data/data/####/account.html
/data/data/####/agreement.58e63239102e51e38e8237ca19111a1f.css
/data/data/####/agreement.bedd4d610a8e980e92d2.js
/data/data/####/agreement.html
/data/data/####/appSetting.xml
/data/data/####/apply-cash.beb8fc1f70c4a34493c1f23a7c18ef2d.css
/data/data/####/apply-cash.bedd4d610a8e980e92d2.js
/data/data/####/apply-cash.html
/data/data/####/apply-list.0190fdd0d7e9e6200d1a538e84186882.css
/data/data/####/apply-list.bedd4d610a8e980e92d2.js
/data/data/####/apply-list.html
/data/data/####/apply-success.bedd4d610a8e980e92d2.js
/data/data/####/apply-success.f6f813518241e0430cefc1b0f0d7c261.css
/data/data/####/apply-success.html
/data/data/####/authStatus_com.doumi.jianzhi.xml
/data/data/####/authStatus_com.doumi.jianzhi;ipc.xml
/data/data/####/authStatus_com.doumi.jianzhi;pushservice.xml
/data/data/####/authStatus_com.doumi.jianzhi;remote.xml
/data/data/####/authStatus_io.rong.push.xml
/data/data/####/banner_integral.jpg
/data/data/####/banner_share.png
/data/data/####/banner_submit.png
/data/data/####/bg_blacklist.png
/data/data/####/bg_personal.png
/data/data/####/bg_popup.png
/data/data/####/bg_rise.png
/data/data/####/bg_status.png
/data/data/####/bg_tab.png
/data/data/####/bind-alipay.af7354a8ccf771137ad40e15fec08ba6.css
/data/data/####/bind-alipay.bedd4d610a8e980e92d2.js
/data/data/####/bind-alipay.html
/data/data/####/bind-unionpay.af7354a8ccf771137ad40e15fec08ba6.css
/data/data/####/bind-unionpay.bedd4d610a8e980e92d2.js
/data/data/####/bind-unionpay.html
/data/data/####/bind-weixinwallet.af7354a8ccf771137ad40e15fec08ba6.css
/data/data/####/bind-weixinwallet.bedd4d610a8e980e92d2.js
/data/data/####/bind-weixinwallet.html
/data/data/####/bugly_db_-journal
/data/data/####/bundle.js
/data/data/####/cache.manifest
/data/data/####/china.zip
/data/data/####/city.171b44607f7f811e2de07e338d325df2.css
/data/data/####/city.bedd4d610a8e980e92d2.js
/data/data/####/city.html
/data/data/####/city_1.json
/data/data/####/city_10.json
/data/data/####/city_100.json
/data/data/####/city_101.json
/data/data/####/city_102.json
/data/data/####/city_103.json
/data/data/####/city_104.json
/data/data/####/city_105.json
/data/data/####/city_106.json
/data/data/####/city_107.json
/data/data/####/city_108.json
/data/data/####/city_109.json
/data/data/####/city_11.json
/data/data/####/city_110.json
/data/data/####/city_111.json
/data/data/####/city_112.json
/data/data/####/city_113.json
/data/data/####/city_114.json
/data/data/####/city_115.json
/data/data/####/city_116.json
/data/data/####/city_117.json
/data/data/####/city_118.json
/data/data/####/city_119.json
/data/data/####/city_12.json
/data/data/####/city_120.json
/data/data/####/city_121.json
/data/data/####/city_122.json
/data/data/####/city_123.json
/data/data/####/city_124.json
/data/data/####/city_125.json
/data/data/####/city_126.json
/data/data/####/city_127.json
/data/data/####/city_128.json
/data/data/####/city_129.json
/data/data/####/city_13.json
/data/data/####/city_130.json
/data/data/####/city_131.json
/data/data/####/city_132.json
/data/data/####/city_133.json
/data/data/####/city_134.json
/data/data/####/city_135.json
/data/data/####/city_136.json
/data/data/####/city_137.json
/data/data/####/city_138.json
/data/data/####/city_139.json
/data/data/####/city_14.json
/data/data/####/city_140.json
/data/data/####/city_141.json
/data/data/####/city_142.json
/data/data/####/city_143.json
/data/data/####/city_144.json
/data/data/####/city_145.json
/data/data/####/city_146.json
/data/data/####/city_147.json
/data/data/####/city_148.json
/data/data/####/city_149.json
/data/data/####/city_15.json
/data/data/####/city_150.json
/data/data/####/city_151.json
/data/data/####/city_152.json
/data/data/####/city_153.json
/data/data/####/city_154.json
/data/data/####/city_155.json
/data/data/####/city_156.json
/data/data/####/city_157.json
/data/data/####/city_158.json
/data/data/####/city_159.json
/data/data/####/city_16.json
/data/data/####/city_160.json
/data/data/####/city_161.json
/data/data/####/city_162.json
/data/data/####/city_163.json
/data/data/####/city_164.json
/data/data/####/city_165.json
/data/data/####/city_166.json
/data/data/####/city_167.json
/data/data/####/city_168.json
/data/data/####/city_169.json
/data/data/####/city_17.json
/data/data/####/city_170.json
/data/data/####/city_171.json
/data/data/####/city_172.json
/data/data/####/city_173.json
/data/data/####/city_174.json
/data/data/####/city_175.json
/data/data/####/city_176.json
/data/data/####/city_177.json
/data/data/####/city_178.json
/data/data/####/city_179.json
/data/data/####/city_18.json
/data/data/####/city_180.json
/data/data/####/city_181.json
/data/data/####/city_182.json
/data/data/####/city_183.json
/data/data/####/city_184.json
/data/data/####/city_185.json
/data/data/####/city_186.json
/data/data/####/city_187.json
/data/data/####/city_188.json
/data/data/####/city_189.json
/data/data/####/city_19.json
/data/data/####/city_190.json
/data/data/####/city_191.json
/data/data/####/city_192.json
/data/data/####/city_193.json
/data/data/####/city_194.json
/data/data/####/city_195.json
/data/data/####/city_196.json
/data/data/####/city_197.json
/data/data/####/city_198.json
/data/data/####/city_199.json
/data/data/####/city_2.json
/data/data/####/city_20.json
/data/data/####/city_200.json
/data/data/####/city_201.json
/data/data/####/city_202.json
/data/data/####/city_203.json
/data/data/####/city_204.json
/data/data/####/city_205.json
/data/data/####/city_206.json
/data/data/####/city_207.json
/data/data/####/city_208.json
/data/data/####/city_209.json
/data/data/####/city_21.json
/data/data/####/city_210.json
/data/data/####/city_211.json
/data/data/####/city_212.json
/data/data/####/city_213.json
/data/data/####/city_214.json
/data/data/####/city_215.json
/data/data/####/city_216.json
/data/data/####/city_217.json
/data/data/####/city_218.json
/data/data/####/city_219.json
/data/data/####/city_22.json
/data/data/####/city_220.json
/data/data/####/city_221.json
/data/data/####/city_222.json
/data/data/####/city_223.json
/data/data/####/city_224.json
/data/data/####/city_225.json
/data/data/####/city_226.json
/data/data/####/city_227.json
/data/data/####/city_228.json
/data/data/####/city_229.json
/data/data/####/city_23.json
/data/data/####/city_230.json
/data/data/####/city_231.json
/data/data/####/city_232.json
/data/data/####/city_233.json
/data/data/####/city_234.json
/data/data/####/city_235.json
/data/data/####/city_236.json
/data/data/####/city_237.json
/data/data/####/city_238.json
/data/data/####/city_239.json
/data/data/####/city_24.json
/data/data/####/city_240.json
/data/data/####/city_241.json
/data/data/####/city_242.json
/data/data/####/city_243.json
/data/data/####/city_244.json
/data/data/####/city_245.json
/data/data/####/city_246.json
/data/data/####/city_247.json
/data/data/####/city_248.json
/data/data/####/city_249.json
/data/data/####/city_25.json
/data/data/####/city_250.json
/data/data/####/city_251.json
/data/data/####/city_252.json
/data/data/####/city_253.json
/data/data/####/city_254.json
/data/data/####/city_255.json
/data/data/####/city_256.json
/data/data/####/city_257.json
/data/data/####/city_258.json
/data/data/####/city_259.json
/data/data/####/city_26.json
/data/data/####/city_260.json
/data/data/####/city_261.json
/data/data/####/city_262.json
/data/data/####/city_263.json
/data/data/####/city_264.json
/data/data/####/city_265.json
/data/data/####/city_266.json
/data/data/####/city_267.json
/data/data/####/city_268.json
/data/data/####/city_269.json
/data/data/####/city_27.json
/data/data/####/city_270.json
/data/data/####/city_271.json
/data/data/####/city_272.json
/data/data/####/city_273.json
/data/data/####/city_274.json
/data/data/####/city_275.json
/data/data/####/city_276.json
/data/data/####/city_277.json
/data/data/####/city_278.json
/data/data/####/city_279.json
/data/data/####/city_28.json
/data/data/####/city_280.json
/data/data/####/city_281.json
/data/data/####/city_282.json
/data/data/####/city_283.json
/data/data/####/city_284.json
/data/data/####/city_285.json
/data/data/####/city_286.json
/data/data/####/city_287.json
/data/data/####/city_288.json
/data/data/####/city_289.json
/data/data/####/city_29.json
/data/data/####/city_290.json
/data/data/####/city_291.json
/data/data/####/city_292.json
/data/data/####/city_293.json
/data/data/####/city_294.json
/data/data/####/city_295.json
/data/data/####/city_296.json
/data/data/####/city_297.json
/data/data/####/city_298.json
/data/data/####/city_299.json
/data/data/####/city_3.json
/data/data/####/city_30.json
/data/data/####/city_300.json
/data/data/####/city_301.json
/data/data/####/city_302.json
/data/data/####/city_303.json
/data/data/####/city_304.json
/data/data/####/city_305.json
/data/data/####/city_306.json
/data/data/####/city_307.json
/data/data/####/city_308.json
/data/data/####/city_309.json
/data/data/####/city_31.json
/data/data/####/city_310.json
/data/data/####/city_311.json
/data/data/####/city_312.json
/data/data/####/city_313.json
/data/data/####/city_314.json
/data/data/####/city_315.json
/data/data/####/city_316.json
/data/data/####/city_317.json
/data/data/####/city_318.json
/data/data/####/city_319.json
/data/data/####/city_32.json
/data/data/####/city_320.json
/data/data/####/city_321.json
/data/data/####/city_322.json
/data/data/####/city_323.json
/data/data/####/city_324.json
/data/data/####/city_325.json
/data/data/####/city_326.json
/data/data/####/city_327.json
/data/data/####/city_328.json
/data/data/####/city_329.json
/data/data/####/city_33.json
/data/data/####/city_330.json
/data/data/####/city_331.json
/data/data/####/city_332.json
/data/data/####/city_333.json
/data/data/####/city_334.json
/data/data/####/city_335.json
/data/data/####/city_336.json
/data/data/####/city_337.json
/data/data/####/city_338.json
/data/data/####/city_339.json
/data/data/####/city_34.json
/data/data/####/city_340.json
/data/data/####/city_341.json
/data/data/####/city_342.json
/data/data/####/city_343.json
/data/data/####/city_344.json
/data/data/####/city_345.json
/data/data/####/city_35.json
/data/data/####/city_353.json
/data/data/####/city_36.json
/data/data/####/city_37.json
/data/data/####/city_373.json
/data/data/####/city_374.json
/data/data/####/city_375.json
/data/data/####/city_376.json
/data/data/####/city_377.json
/data/data/####/city_378.json
/data/data/####/city_379.json
/data/data/####/city_38.json
/data/data/####/city_380.json
/data/data/####/city_381.json
/data/data/####/city_382.json
/data/data/####/city_383.json
/data/data/####/city_384.json
/data/data/####/city_385.json
/data/data/####/city_386.json
/data/data/####/city_39.json
/data/data/####/city_4.json
/data/data/####/city_40.json
/data/data/####/city_41.json
/data/data/####/city_42.json
/data/data/####/city_43.json
/data/data/####/city_44.json
/data/data/####/city_45.json
/data/data/####/city_46.json
/data/data/####/city_47.json
/data/data/####/city_48.json
/data/data/####/city_49.json
/data/data/####/city_5.json
/data/data/####/city_50.json
/data/data/####/city_51.json
/data/data/####/city_52.json
/data/data/####/city_53.json
/data/data/####/city_54.json
/data/data/####/city_55.json
/data/data/####/city_56.json
/data/data/####/city_57.json
/data/data/####/city_58.json
/data/data/####/city_59.json
/data/data/####/city_6.json
/data/data/####/city_60.json
/data/data/####/city_61.json
/data/data/####/city_62.json
/data/data/####/city_63.json
/data/data/####/city_64.json
/data/data/####/city_65.json
/data/data/####/city_66.json
/data/data/####/city_67.json
/data/data/####/city_68.json
/data/data/####/city_69.json
/data/data/####/city_7.json
/data/data/####/city_70.json
/data/data/####/city_71.json
/data/data/####/city_72.json
/data/data/####/city_73.json
/data/data/####/city_74.json
/data/data/####/city_75.json
/data/data/####/city_76.json
/data/data/####/city_77.json
/data/data/####/city_78.json
/data/data/####/city_79.json
/data/data/####/city_8.json
/data/data/####/city_80.json
/data/data/####/city_81.json
/data/data/####/city_82.json
/data/data/####/city_83.json
/data/data/####/city_84.json
/data/data/####/city_85.json
/data/data/####/city_86.json
/data/data/####/city_87.json
/data/data/####/city_88.json
/data/data/####/city_89.json
/data/data/####/city_9.json
/data/data/####/city_90.json
/data/data/####/city_91.json
/data/data/####/city_92.json
/data/data/####/city_93.json
/data/data/####/city_94.json
/data/data/####/city_95.json
/data/data/####/city_96.json
/data/data/####/city_97.json
/data/data/####/city_98.json
/data/data/####/city_99.json
/data/data/####/com.doumi.jianzhi_preferences.xml
/data/data/####/complain-and-feedback.aaae25db890f708432616cd9c94ef066.css
/data/data/####/complain-and-feedback.bedd4d610a8e980e92d2.js
/data/data/####/complain-and-feedback.html
/data/data/####/complain.5387ffa8c4f3b18ec55b16c2eda53ca5.css
/data/data/####/complain.bedd4d610a8e980e92d2.js
/data/data/####/complain.html
/data/data/####/daemon
/data/data/####/default.png
/data/data/####/detail-address.bedd4d610a8e980e92d2.js
/data/data/####/detail-address.d451ce4c2d34e0c7431c4d2f9ce77688.css
/data/data/####/detail-address.html
/data/data/####/detail.0c3503f857d1c1e2e640fd238079b734.css
/data/data/####/detail.bedd4d610a8e980e92d2.js
/data/data/####/detail.html
/data/data/####/dmdid
/data/data/####/domSetting
/data/data/####/doumi-db-journal
/data/data/####/duiba.393ced2b797779c43289c5eb14d314ed.css
/data/data/####/duiba.bedd4d610a8e980e92d2.js
/data/data/####/duiba.html
/data/data/####/earn-score.508a8e7b4b9a302878b7e3f579bd1fbd.css
/data/data/####/earn-score.bedd4d610a8e980e92d2.js
/data/data/####/earn-score.html
/data/data/####/f1e5994e2a5f4dbe680c.worker.js
/data/data/####/favorite.a47348f2f32771d6d786f978de0056b9.css
/data/data/####/favorite.bedd4d610a8e980e92d2.js
/data/data/####/favorite.html
/data/data/####/fe5312fdbe923e425eb3.worker.js
/data/data/####/feedback.01a78666ae8a0f118ce3ee0d7a6c73a4.css
/data/data/####/feedback.bedd4d610a8e980e92d2.js
/data/data/####/feedback.html
/data/data/####/file__0.localstorage-journal
/data/data/####/firll.dat
/data/data/####/getui_sp.xml
/data/data/####/hotjob-list.bedd4d610a8e980e92d2.js
/data/data/####/hotjob-list.c9cf426508765ec26d87cbfe3243eaef.css
/data/data/####/hotjob-list.html
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/huiyan-index.bedd4d610a8e980e92d2.js
/data/data/####/huiyan-index.e65bf01fc4df23db0800797526aebc5d.css
/data/data/####/huiyan-index.html
/data/data/####/huiyan-result.bedd4d610a8e980e92d2.js
/data/data/####/huiyan-result.d5620b670d63ff5ffeb96aa19c6ffdc7.css
/data/data/####/huiyan-result.html
/data/data/####/icon.png
/data/data/####/icon_account.png
/data/data/####/icon_blacklist.png
/data/data/####/icon_cate_check.png
/data/data/####/icon_cate_other.png
/data/data/####/icon_cate_promotion.png
/data/data/####/icon_cate_reg.png
/data/data/####/icon_cate_share.png
/data/data/####/icon_cate_survey.png
/data/data/####/icon_deliver.png
/data/data/####/icon_detail.png
/data/data/####/icon_form.png
/data/data/####/icon_index.png
/data/data/####/icon_online.png
/data/data/####/icon_taobaoke.png
/data/data/####/icon_toplist.png
/data/data/####/imkit.db-journal
/data/data/####/index.bedd4d610a8e980e92d2.js
/data/data/####/index.df859638d2d4b366b5369dd44937fc54.css
/data/data/####/index.html
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/integral-detail.bedd4d610a8e980e92d2.js
/data/data/####/integral-detail.ee7bc00e52cfdc6536b86edf1631f94f.css
/data/data/####/integral-detail.html
/data/data/####/jianZhi.xml
/data/data/####/ker.db-journal
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/login-captcha.7049d980df4016e2e27bfecee9e151bc.css
/data/data/####/login-captcha.bedd4d610a8e980e92d2.js
/data/data/####/login-captcha.html
/data/data/####/login-check-phone.7049d980df4016e2e27bfecee9e151bc.css
/data/data/####/login-check-phone.bedd4d610a8e980e92d2.js
/data/data/####/login-check-phone.html
/data/data/####/login-password.7049d980df4016e2e27bfecee9e151bc.css
/data/data/####/login-password.bedd4d610a8e980e92d2.js
/data/data/####/login-password.html
/data/data/####/mPBE.xml
/data/data/####/main.dek
/data/data/####/msg-invite-list.87d79483377fad90a55643a8004487cd.css
/data/data/####/msg-invite-list.bedd4d610a8e980e92d2.js
/data/data/####/msg-invite-list.html
/data/data/####/msg-news-list.1a96c56bd766ed48f554615cc6daa15a.css
/data/data/####/msg-news-list.bedd4d610a8e980e92d2.js
/data/data/####/msg-news-list.html
/data/data/####/msg-online-list.4310fe27cd99918984fd3692a8171314.css
/data/data/####/msg-online-list.bedd4d610a8e980e92d2.js
/data/data/####/msg-online-list.html
/data/data/####/multidex.version.xml
/data/data/####/nearby-list.bedd4d610a8e980e92d2.js
/data/data/####/nearby-list.df961b3ac8120ad7899390f9fe74f04f.css
/data/data/####/nearby-list.html
/data/data/####/no-idencode.6a8d094d6ea53f5ab861ccf3ffcfd2ca.css
/data/data/####/no-idencode.bedd4d610a8e980e92d2.js
/data/data/####/no-idencode.html
/data/data/####/offline-invite-bonus.301ec482bce79ffc0fa09e037b12d520.css
/data/data/####/offline-invite-bonus.bedd4d610a8e980e92d2.js
/data/data/####/offline-invite-bonus.html
/data/data/####/offline-invite-list.301ec482bce79ffc0fa09e037b12d520.css
/data/data/####/offline-invite-list.bedd4d610a8e980e92d2.js
/data/data/####/offline-invite-list.html
/data/data/####/offline-share.301ec482bce79ffc0fa09e037b12d520.css
/data/data/####/offline-share.bedd4d610a8e980e92d2.js
/data/data/####/offline-share.html
/data/data/####/online-complain-select.925030d21d4f4cfb64fe5111...ca.css
/data/data/####/online-complain-select.bedd4d610a8e980e92d2.js
/data/data/####/online-complain-select.html
/data/data/####/online-complain.5387ffa8c4f3b18ec55b16c2eda53ca5.css
/data/data/####/online-complain.bedd4d610a8e980e92d2.js
/data/data/####/online-complain.html
/data/data/####/online-detail.054e09312a85782aedc5d9e4cc136b10.css
/data/data/####/online-detail.bedd4d610a8e980e92d2.js
/data/data/####/online-detail.html
/data/data/####/online-income.bedd4d610a8e980e92d2.js
/data/data/####/online-income.ed0094e5b940aec6fc2e4fbff00102f4.css
/data/data/####/online-income.html
/data/data/####/online-index.0f94b7f684e8c2feaceecd3b8cf34272.css
/data/data/####/online-index.bedd4d610a8e980e92d2.js
/data/data/####/online-index.html
/data/data/####/online-personal.925030d21d4f4cfb64fe51114c8de7ca.css
/data/data/####/online-personal.bedd4d610a8e980e92d2.js
/data/data/####/online-personal.html
/data/data/####/online-prefecture.bedd4d610a8e980e92d2.js
/data/data/####/online-prefecture.c6f35c7de93aac5d2022c10059cae26c.css
/data/data/####/online-prefecture.html
/data/data/####/online-retrial.bedd4d610a8e980e92d2.js
/data/data/####/online-retrial.fbe03ce0b6eb3738a1e59f1a4be67beb.css
/data/data/####/online-retrial.html
/data/data/####/online-submit-detail.44ad0977a812b02e9bfcd46cef822398.css
/data/data/####/online-submit-detail.bedd4d610a8e980e92d2.js
/data/data/####/online-submit-detail.html
/data/data/####/online-submit-success.bedd4d610a8e980e92d2.js
/data/data/####/online-submit-success.fbe03ce0b6eb3738a1e59f1a4be67beb.css
/data/data/####/online-submit-success.html
/data/data/####/online-submit.bedd4d610a8e980e92d2.js
/data/data/####/online-submit.f8c90afe52320f379ef1aba8363f331a.css
/data/data/####/online-submit.html
/data/data/####/pay.png
/data/data/####/perfect-resume.82d4347dd9ef500d596ddb0fa99d7d27.css
/data/data/####/perfect-resume.bedd4d610a8e980e92d2.js
/data/data/####/perfect-resume.html
/data/data/####/prefecture.ae7d69ba5953a93f840b239cad836270.css
/data/data/####/prefecture.bedd4d610a8e980e92d2.js
/data/data/####/prefecture.html
/data/data/####/preferences-job-type-select.bedd4d610a8e980e92d2.js
/data/data/####/preferences-job-type-select.d3c20cc0d3ced711295...34.css
/data/data/####/preferences-job-type-select.html
/data/data/####/preferences.bedd4d610a8e980e92d2.js
/data/data/####/preferences.d3c20cc0d3ced71129566cc53f615934.css
/data/data/####/preferences.html
/data/data/####/provinces.json
/data/data/####/ptj_icons.png
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/rapidly-apply.5dcb804f044ef7f17da7c760124edbde.css
/data/data/####/rapidly-apply.bedd4d610a8e980e92d2.js
/data/data/####/rapidly-apply.html
/data/data/####/recommend-list.bedd4d610a8e980e92d2.js
/data/data/####/recommend-list.c9cf426508765ec26d87cbfe3243eaef.css
/data/data/####/recommend-list.html
/data/data/####/register.7049d980df4016e2e27bfecee9e151bc.css
/data/data/####/register.bedd4d610a8e980e92d2.js
/data/data/####/register.html
/data/data/####/reset.bedd4d610a8e980e92d2.js
/data/data/####/reset.ce510425deb96a701c0250e84728b6d4.css
/data/data/####/reset.html
/data/data/####/resume.0f986fa70aac8eeada3f40c0184a9dce.css
/data/data/####/resume.bedd4d610a8e980e92d2.js
/data/data/####/resume.html
/data/data/####/run.pid
/data/data/####/search.b443772d398417eea1289ed62209b522.css
/data/data/####/search.bedd4d610a8e980e92d2.js
/data/data/####/search.html
/data/data/####/security_info
/data/data/####/selectiveperfect-list.5553bcce6bb2d21911c0c6b5daa5f414.css
/data/data/####/selectiveperfect-list.bedd4d610a8e980e92d2.js
/data/data/####/selectiveperfect-list.html
/data/data/####/set-resume-success.bedd4d610a8e980e92d2.js
/data/data/####/set-resume-success.c366caeb1248ad5aad03c3b29809de46.css
/data/data/####/set-resume-success.html
/data/data/####/settings.41877e36d10a364939b02f7973280a60.css
/data/data/####/settings.bedd4d610a8e980e92d2.js
/data/data/####/settings.html
/data/data/####/sign-in.bedd4d610a8e980e92d2.js
/data/data/####/sign-in.e14e6c34599275687806fee67c014291.css
/data/data/####/sign-in.html
/data/data/####/ssoconfigs.xml
/data/data/####/taobaoke-detail.32ac4fafb784df8c292eaee90d65b97e.css
/data/data/####/taobaoke-detail.bedd4d610a8e980e92d2.js
/data/data/####/taobaoke-detail.html
/data/data/####/taobaoke-income.bedd4d610a8e980e92d2.js
/data/data/####/taobaoke-income.c448f29f20325e9b219f6b5d60ab0717.css
/data/data/####/taobaoke-income.html
/data/data/####/taobaoke-index.3beb1ecaed44b3e2d79a2022dc906e59.css
/data/data/####/taobaoke-index.bedd4d610a8e980e92d2.js
/data/data/####/taobaoke-index.html
/data/data/####/taobaoke-order.bedd4d610a8e980e92d2.js
/data/data/####/taobaoke-order.f71bad3326b055a2b2419ce98b2a4d19.css
/data/data/####/taobaoke-order.html
/data/data/####/taobaoke-search-hot-key.a37e2ad969e04ca0fc71a8d...9f.css
/data/data/####/taobaoke-search-hot-key.bedd4d610a8e980e92d2.js
/data/data/####/taobaoke-search-hot-key.html
/data/data/####/taobaoke-search.bedd4d610a8e980e92d2.js
/data/data/####/taobaoke-search.fe1e7e8b06ad9755013997b62b4cc479.css
/data/data/####/taobaoke-search.html
/data/data/####/taobaoke-share.bedd4d610a8e980e92d2.js
/data/data/####/taobaoke-share.dcc5f148858a74d5f8468a121c6ea919.css
/data/data/####/taobaoke-share.html
/data/data/####/tdid.xml
/data/data/####/tmp.zip
/data/data/####/vendor.dll.js
/data/data/####/wallet.4cb9c55b4b22f464fa6ed9fbcd533205.css
/data/data/####/wallet.bedd4d610a8e980e92d2.js
/data/data/####/wallet.html
/data/data/####/webview.db-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/BeLog_1591799565563.log
/data/media/####/BeLog_1591799570100.log
/data/media/####/app.db
/data/media/####/com.doumi.jianzhi.bin
/data/media/####/com.doumi.jianzhi.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/dmdid
/data/media/####/domSetting
/data/media/####/journal.tmp
/data/media/####/yoh.dat
/data/media/####/yol.dat
/data/media/####/yom.dat

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/app_bin/daemon -p <Package> -s <Package>.daemon.DaemonService -t 120
chmod 0755 <Package Folder>/app_bin/daemon
chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
logcat -d -v threadtime

Loads the following dynamic libraries:

BaiduMapSDK_base_v4_5_2
RongIMLib
dek
getuiext2
kerdb
kerkee_util
libjiagu
locSDK7a

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial