Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) norma-e####.m####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(TLS/1.0) api.map.b####.com:443
- TCP(TLS/1.0) msg.umengc####.com:443
- TCP(TLS/1.0) api.growi####.com:443
- TCP(TLS/1.0) 1####.217.168.238:443
- TCP(TLS/1.0) t####.growi####.com:443
- TCP(TLS/1.0) t.growi####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP 2####.119.216.51:443
- TCP c####.g####.ig####.com:5225
- TCP zb-cent####.m.ta####.com:80
- 7j####.c####.z0.####.com
- a####.exc.mob.com
- a####.u####.com
- ag####.m.ta####.com
- amdc####.m.ta####.com
- and####.b####.qq.com
- api.growi####.com
- api.map.b####.com
- c####.g####.ig####.com
- c####.g####.ig####.com
- c-h####.g####.com
- msg.umengc####.com
- norma-e####.m####.com
- pub-####.qin####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- t####.growi####.com
- t.growi####.com
- umen####.m.ta####.com
- umengj####.m.ta####.com
- norma-e####.m####.com/android/exchange/getpublickey.do
- qin####.com.www.####.com/tdata_EDT369
- t####.c####.q####.####.com/config/hz-hzv6.conf
- t####.c####.q####.####.com/tdata_Jga153
- t####.c####.q####.####.com/tdata_WOW230
- t####.c####.q####.####.com/tdata_bca864
- t####.c####.q####.####.com/tdata_mSr887
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- and####.b####.qq.com/rqd/async?aid=####
- c-h####.g####.com/api.php?format=####&t=####
- norma-e####.m####.com/push/android/external/add.do
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
- /data/data/####/.duid
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.lock
- /data/data/####/.vpl_lock
- /data/data/####/1004
- /data/data/####/3528157823d1
- /data/data/####/ACCS_BINDumeng;552c919ffd98c5940b000e64.xml
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/AGOO_BIND.xml
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alvin2.xml
- /data/data/####/AppPrefs_base.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/MultiDex.lock
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/accs.db-journal
- /data/data/####/agoo.pid
- /data/data/####/authStatus_com.nt.ptc.enterprise.xml
- /data/data/####/authStatus_com.nt.ptc.enterprise;channel.xml
- /data/data/####/authStatus_com.nt.ptc.enterprise;pushservice.xml
- /data/data/####/authStatus_com.nt.ptc.enterprise;remote.xml
- /data/data/####/bugly_db_-journal
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.x.y.1.xml
- /data/data/####/com.x.y.2.xml
- /data/data/####/crashrecord.xml
- /data/data/####/device_id.xml.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/growing.db-journal
- /data/data/####/growing_ecsid
- /data/data/####/growing_persist_data.xml
- /data/data/####/growing_profile.xml
- /data/data/####/growing_server_pref.xml
- /data/data/####/growingio.lock-journal
- /data/data/####/gx_sp.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/libcuid.so
- /data/data/####/libjiagu-2088426795.so
- /data/data/####/local_crash_lock
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/mob_commons_1
- /data/data/####/multidex.version.xml
- /data/data/####/mz_push_preference.xml
- /data/data/####/native_record_lock
- /data/data/####/parttimejobcatenterprise-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/tdata_Jga153
- /data/data/####/tdata_Jga153.jar
- /data/data/####/tdata_WOW230
- /data/data/####/tdata_WOW230.jar
- /data/data/####/tdata_bca864
- /data/data/####/tdata_bca864.jar
- /data/data/####/tdata_mSr887
- /data/data/####/tdata_mSr887.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/media/####/.artc_lock
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.di
- /data/media/####/.dic_lock
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.im_lock
- /data/media/####/.lecd
- /data/media/####/.lesd_lock
- /data/media/####/.mn_-1464060969
- /data/media/####/.nomedia
- /data/media/####/.pkg_lock
- /data/media/####/.pkgs_lock
- /data/media/####/.rc_lock
- /data/media/####/.slw
- /data/media/####/.ss_lock
- /data/media/####/1f405c56928646bf9bd933c7949e02f9
- /data/media/####/2019-05-28.log.txt
- /data/media/####/3170bf466be64920baeb2b51a6bc65fb
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.nt.ptc.enterprise.db
- /data/media/####/d5c0924d4c85417aa1bee3589068bc94
- /data/media/####/deviceToken
- /data/media/####/f445a13ca7fb4577a8897c6105f16859
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/tdata_Jga153
- /data/media/####/tdata_WOW230
- /data/media/####/tdata_bca864
- /data/media/####/tdata_mSr887
- /data/media/####/test.0 (deleted)
- /data/media/####/test.log
- /data/media/####/yoh.dat
- /data/media/####/yol.dat
- /data/media/####/yom.dat
- /system/bin/cat /proc/cpuinfo
- /system/bin/sh -c getprop
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:552c919ffd98c5940b000e64","utdid":"XO0fO8UABgUDAGdzx1FlpCgc","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25099 300 0
- cat /sys/class/net/wlan0/address
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 700 <Package Folder>/files/gdaemon_20161017
- getprop
- mount
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25099 300 0
- BaiduMapSDK_base_v4_0_0
- Bugly
- audioeffect_jni
- getuiext3
- hyphenate
- hyphenate_av
- hyphenate_av_recorder
- libjiagu-2088426795
- sqlite
- tnet-3.1
- xsignal_client
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- 1
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding