Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) norma-e####.m####.com:80
- TCP(HTTP/1.1) peopl####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) 1####.70.14.60:8004
- TCP(HTTP/1.1) v####.pe####.cn:80
- TCP(HTTP/1.1) m.d####.mob.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) fanews-####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) v####.c####.com.cn:80
- TCP(TLS/1.0) s####.ml####.cc:443
- TCP(TLS/1.0) redi####.network####.com:443
- TCP(TLS/1.0) dc1.network####.com:443
- TCP(TLS/1.0) 1####.217.17.78:443
- TCP(TLS/1.0) l####.tbs.qq.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP 43.2####.145.8:5227
- TCP t####.nz4.ig####.com:5224
- 7j####.c####.z0.####.com
- a####.exc.mob.com
- a####.u####.com
- and####.b####.qq.com
- api.s####.mob.com
- c-h####.g####.com
- dc1.network####.com
- fanews-####.oss-cn-####.aliy####.com
- l####.tbs.qq.com
- m.d####.mob.com
- norma-e####.m####.com
- peopl####.oss-cn-####.aliy####.com
- pub-####.qin####.com
- redi####.network####.com
- s####.ml####.cc
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- t####.nz4.g####.net
- t####.nz4.ge####.com
- t####.nz4.ig####.com
- v####.c####.com.cn
- v####.pe####.cn
- v####.pe####.cn
- fanews-####.oss-cn-####.aliy####.com/null_56015.gif?action=####&app_vers...
- fanews-####.oss-cn-####.aliy####.com/null_56015.gif?action=####&page=###...
- fanews-####.oss-cn-####.aliy####.com/null_56015.gif?action=####&utdid=##...
- m.d####.mob.com/v2/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
- norma-e####.m####.com/android/exchange/getpublickey.do
- peopl####.oss-cn-####.aliy####.com/people/cdrb_2_201503/20190216/cdrb_2_...
- peopl####.oss-cn-####.aliy####.com/people/cdrb_2_201503/20190225/cdrb_2_...
- peopl####.oss-cn-####.aliy####.com/people/cdrb_2_201503/20190311/cdrb_2_...
- peopl####.oss-cn-####.aliy####.com/people/cdrb_2_201503/20190326/cdrb_2_...
- peopl####.oss-cn-####.aliy####.com/people/cdrb_2_201503/20190327/cdrb_2_...
- t####.c####.q####.####.com/tdata_Jga153
- t####.c####.q####.####.com/tdata_Wqf010
- t####.c####.q####.####.com/tdata_bca864
- t####.c####.q####.####.com/tdata_duV457
- ti####.c####.l####.####.com/config/bj-bjv6.conf
- ti####.c####.l####.####.com/config/hz-bjv6.conf
- ti####.c####.l####.####.com/tdata_EDT369
- v####.c####.com.cn/comment/commentlist?articleId=####&count=####&maxId=#...
- v####.c####.com.cn/content/detail?categoryId=####&articleId=####&sysCode...
- v####.c####.com.cn/content/getcontentlist?categoryId=####&count=####&pla...
- v####.c####.com.cn/menu/menulist?devicetype=####&parentid=####&version=#...
- v####.c####.com.cn/views/counts?articleIds=####&platform=####&pjCode=###...
- v####.c####.com.cn/views/coverpages?platform=####&pjCode=####&device_siz...
- v####.c####.com.cn/views/version?appversion=####&platform=####&pjCode=##...
- v####.pe####.cn/prod/common/api/paper/paperlist.php?date=####&pagesSize=...
- v####.pe####.cn/prod/common/api/paper/prepaper.php?paperName=####&platfo...
- v####.pe####.cn/prod/common/img/data/paper/cdrb//paper/data/user/demo/ho...
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- and####.b####.qq.com/rqd/async
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/snsconf
- c-h####.g####.com/api.php?format=####&t=####
- norma-e####.m####.com/push/android/external/add.do
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
- /data/data/####/.imprint
- /data/data/####/.lock
- /data/data/####/.mrecord
- /data/data/####/.mrlock
- /data/data/####/.statistics
- /data/data/####/03a42d082e57a666a7932149ed047f98.0.tmp
- /data/data/####/03a42d082e57a666a7932149ed047f98.1.tmp
- /data/data/####/08233b25932d082bb28018c792ad0124.0.tmp
- /data/data/####/08233b25932d082bb28018c792ad0124.1.tmp
- /data/data/####/1338681ec5ef3f5bfbf9802c9cf97e83.0.tmp
- /data/data/####/1338681ec5ef3f5bfbf9802c9cf97e83.1.tmp
- /data/data/####/39783fe895dad1e889bf01640ce77e12.0.tmp
- /data/data/####/39783fe895dad1e889bf01640ce77e12.1.tmp
- /data/data/####/5fa05da9515b7a628906cd4312465033.0.tmp
- /data/data/####/5fa05da9515b7a628906cd4312465033.1.tmp
- /data/data/####/6faee040fef7aceb2a708f413a58f3ed.0.tmp
- /data/data/####/6faee040fef7aceb2a708f413a58f3ed.1.tmp
- /data/data/####/97c34acb5b60872432a2c37924ecfb51.0.tmp
- /data/data/####/97c34acb5b60872432a2c37924ecfb51.1.tmp
- /data/data/####/INSTALLATION-744d9fc3-5dbd-3edd-a589-56d77bdb0e5d
- /data/data/####/NBSUserAction
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c3b9c5d5ddb00f8dd30c428349af3483.0.tmp
- /data/data/####/c3b9c5d5ddb00f8dd30c428349af3483.1.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.networkbench.agent.impl.v2_com.chengdudaily...ty.xml
- /data/data/####/com.x.y.1.xml
- /data/data/####/com.x.y.2.xml
- /data/data/####/config.xml
- /data/data/####/config_noclear.xml
- /data/data/####/core_info
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/debug.conf
- /data/data/####/download_upload
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f2d76a93a2c8857bbd49e15ef6489ef6.0.tmp
- /data/data/####/f2d76a93a2c8857bbd49e15ef6489ef6.1.tmp
- /data/data/####/f3d216a79227d6b42c403d5f10d0ae54.0.tmp
- /data/data/####/f3d216a79227d6b42c403d5f10d0ae54.1.tmp
- /data/data/####/f8f020fffd762e86cb8940e5fa71cc11.0.tmp
- /data/data/####/f8f020fffd762e86cb8940e5fa71cc11.1.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.1.2.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/mob_commons_1.xml
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/multidex.version.xml
- /data/data/####/mwsdk_analytics.db-journal
- /data/data/####/mz_push_preference.xml
- /data/data/####/native_record_lock
- /data/data/####/persistent_data.xml
- /data/data/####/primary.db-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbs_pv_config
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_Jga153
- /data/data/####/tdata_Jga153.jar
- /data/data/####/tdata_Wqf010
- /data/data/####/tdata_Wqf010.jar
- /data/data/####/tdata_bca864
- /data/data/####/tdata_bca864.jar
- /data/data/####/tdata_duV457
- /data/data/####/tdata_duV457.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/-tKsNKIJTFizcvGIsT0bAzeAxLI.1014618342.tmp
- /data/media/####/.dic_lock
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.nomedia
- /data/media/####/.nulplt
- /data/media/####/.pkg_lock
- /data/media/####/.rcTag
- /data/media/####/.rc_lock
- /data/media/####/10ba98afff217ccefe4e841da44b5332
- /data/media/####/2019-03-27.log.txt
- /data/media/####/3c43a41a6d7de132ac7c4c0829a8986a
- /data/media/####/5Q4zEiyWqrClWUN9JHEpKSvYsWw.-2054362516.tmp
- /data/media/####/5abfa90303250dabe67530f44c5b1c14
- /data/media/####/BQPOKAqVKcn-w6H_7SL6oBjYCng.-537028304.tmp
- /data/media/####/E7y88qPFOBGUZVjMJyES7mMIvZ8.-1390628188.tmp
- /data/media/####/GEMT-oD88avJSPY5p01Bz16U8Zk.866046285.tmp
- /data/media/####/Gf1IpyO-s7cq3AlheFiPMar6FmU.1965207452.tmp
- /data/media/####/T-9-q_bm2a4OFY0j9oYW8CBO35E.-476194131.tmp
- /data/media/####/U4pfuZFgE_GR8K7XTAFeemGjuF8.825265004.tmp
- /data/media/####/app.db
- /data/media/####/com.chengdudaily.activity.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/comment_logo.png
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/gov_logo.png
- /data/media/####/ic_launcher.png
- /data/media/####/jywqgulE_UBdnDLrZ1uLiuwPb_4.-35234465.tmp
- /data/media/####/k5_K_sQ4bIEhsl6EuiPrAjl2zVU.-1418222153.tmp
- /data/media/####/kQapsfb5AvVkWsfBijRXeMRHOmY.831611140.tmp
- /data/media/####/nYiVX2_ewc7MogyK4sCRxjJ_xzg.-1907005420.tmp
- /data/media/####/paper_cache_data
- /data/media/####/paper_history_cache_data
- /data/media/####/praise.dat
- /data/media/####/rkxYvbNivbGPW3IfWlq75xYjs7Q.1594847008.tmp
- /data/media/####/splash_ad
- /data/media/####/tdata_Jga153
- /data/media/####/tdata_Wqf010
- /data/media/####/tdata_bca864
- /data/media/####/tdata_duV457
- /data/media/####/test.log
- /data/media/####/u2OTUC-3Q7aDqctB7yjHtNmzJz0.-114762129.tmp
- /data/media/####/vsLnacL4Vbf6zPzP4j3O2btfd8A.-1461922441.tmp
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25553 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.1.2.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25553 300 0
- Bugly
- getuiext3
- imagepipeline
- libnfix
- libshella-2.9.1.2
- libufix
- neh
- nfix
- ufix
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- AES-GCM-NoPadding