Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) prs####.i####.com:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) sto####.i####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5225
- 7j####.c####.z0.####.com
- a####.u####.com
- c####.g####.ig####.com
- c-h####.g####.com
- l####.tbs.qq.com
- log.u####.com
- prs####.i####.com
- pub-####.qin####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sto####.i####.com
- et2-na6####.wagbr####.ali####.####.com/bar/get/58d9c3dd04e2056ef4001e76/...
- prs####.i####.com/banner/dav-banner19022110113580758.jpg@!banner
- prs####.i####.com/banner/dav-banner19022509570346807.jpg@!banner
- prs####.i####.com/banner/dav-banner19031109530779224.jpg@!banner
- prs####.i####.com/resource/224dYiDxD5.jpg@!resource_face
- prs####.i####.com/resource/T8PNidzb6y.jpg@!resource_face
- prs####.i####.com/resource/T8bm3jJcaE.png@!resource_face
- prs####.i####.com/resource/bmSxRjnsBr.jpg@!resource_face
- prs####.i####.com/resource/dav-resource19010814393769123.jpg@!resource
- prs####.i####.com/resource/dav-resource19010816324405503.jpg@!resource
- prs####.i####.com/resource/dav-resource19011012285176754.jpg@!resource
- prs####.i####.com/resource/dav-resource19012417114419985.jpg@!resource
- prs####.i####.com/resource/dav-resource19021111171285867.jpg@!resource
- prs####.i####.com/resource/dav-resource1903041114073437.jpg@!resource
- prs####.i####.com/resource/dav-resource19030411245433778.jpg@!resource
- prs####.i####.com/resource/dav-resource19031217262279061.jpg@!resource
- prs####.i####.com/resource/ehk3xzw2w6.jpg@!resource_face
- prs####.i####.com/resource/hTScpT7k3M.jpg@!resource_face
- prs####.i####.com/resource/y3s2YCEAp7.png@!resource_face
- qin####.com.www.####.com/tdata_EDT369
- sto####.i####.com/index.php?s=####
- t####.c####.q####.####.com/tdata_Jga153
- t####.c####.q####.####.com/tdata_Wqf010
- t####.c####.q####.####.com/tdata_bca864
- t####.c####.q####.####.com/tdata_ynp969
- a####.u####.com/app_logs
- c-h####.g####.com/api.php?format=####&t=####
- l####.tbs.qq.com/ajax?c=####&k=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sto####.i####.com/index.php?s=####
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/1a0c21be4b52eaaeea8e55ac6ab5ad16.0.tmp
- /data/data/####/1a0c21be4b52eaaeea8e55ac6ab5ad16.1.tmp
- /data/data/####/25848a5e7e4717bcf2e74dc362527bc4.0.tmp
- /data/data/####/25848a5e7e4717bcf2e74dc362527bc4.1.tmp
- /data/data/####/3a715a2ddb44e0f7b3446a77ca893438.0.tmp
- /data/data/####/3a715a2ddb44e0f7b3446a77ca893438.1.tmp
- /data/data/####/478e3faea1c248de3a550580db556d6b.0.tmp
- /data/data/####/478e3faea1c248de3a550580db556d6b.1.tmp
- /data/data/####/4b709cf69f2c2f095a7e9b11e712e1a8.0.tmp
- /data/data/####/4b709cf69f2c2f095a7e9b11e712e1a8.1.tmp
- /data/data/####/6803f38ca7aafc4786d9a262ba7318cd.0.tmp
- /data/data/####/6803f38ca7aafc4786d9a262ba7318cd.1.tmp
- /data/data/####/681dfe0c53b1e907a21f036d1b4e8534.0.tmp
- /data/data/####/681dfe0c53b1e907a21f036d1b4e8534.1.tmp
- /data/data/####/755ef15aad82e578530eb720125ad33a.0.tmp
- /data/data/####/755ef15aad82e578530eb720125ad33a.1.tmp
- /data/data/####/9102c1bb9833c79e827a3fe9be4566f3.0.tmp
- /data/data/####/9102c1bb9833c79e827a3fe9be4566f3.1.tmp
- /data/data/####/9201281025cee2c0d1d8b026e96a2b16.0.tmp
- /data/data/####/9201281025cee2c0d1d8b026e96a2b16.1.tmp
- /data/data/####/94f5b4df231dd962e14a98b2fb3fc4ba.0.tmp
- /data/data/####/94f5b4df231dd962e14a98b2fb3fc4ba.1.tmp
- /data/data/####/9b804993f71936e7c3f62e1c8c5bda98.0.tmp
- /data/data/####/9b804993f71936e7c3f62e1c8c5bda98.1.tmp
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/MultiDex.lock
- /data/data/####/PRStoreDB-journal
- /data/data/####/a269a2c4ae86a139d1468fb3bcc24779.0.tmp
- /data/data/####/a269a2c4ae86a139d1468fb3bcc24779.1.tmp
- /data/data/####/b2c72c10b3e88ed0a96527694340ea47.0.tmp
- /data/data/####/b2c72c10b3e88ed0a96527694340ea47.1.tmp
- /data/data/####/b62e30dbbd83172521d2558dee72d0b9.0.tmp
- /data/data/####/b62e30dbbd83172521d2558dee72d0b9.1.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/core_info
- /data/data/####/d5133f1a37a7af6297fdb96854dfa888.0.tmp
- /data/data/####/d5133f1a37a7af6297fdb96854dfa888.1.tmp
- /data/data/####/e795d264f79b38e3d9dad17122eed2e9.0.tmp
- /data/data/####/e795d264f79b38e3d9dad17122eed2e9.1.tmp
- /data/data/####/ec24d33270ed9a0858c426edb709c372.0.tmp
- /data/data/####/ec24d33270ed9a0858c426edb709c372.1.tmp
- /data/data/####/eecea85e90d19afe4360bedd9372ec23.0.tmp
- /data/data/####/eecea85e90d19afe4360bedd9372ec23.1.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f5ae58cd1907a242b770bcaadbf487de.0.tmp
- /data/data/####/f5ae58cd1907a242b770bcaadbf487de.1.tmp
- /data/data/####/fc8d291e75e9
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/hmall.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal
- /data/data/####/libjiagu-1825764045.so
- /data/data/####/multidex.version.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_Jga153
- /data/data/####/tdata_Jga153.jar
- /data/data/####/tdata_Wqf010
- /data/data/####/tdata_Wqf010.jar
- /data/data/####/tdata_bca864
- /data/data/####/tdata_bca864.jar
- /data/data/####/tdata_ynp969
- /data/data/####/tdata_ynp969.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/media/####/.nomedia
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/org.gbmedia.hmall.bin
- /data/media/####/org.gbmedia.hmall.db
- /data/media/####/tdata_Jga153
- /data/media/####/tdata_Wqf010
- /data/media/####/tdata_bca864
- /data/media/####/tdata_ynp969
- /data/media/####/test.log
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.MyPushService 24659 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- getprop ro.product.cpu.abi
- mount
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.MyPushService 24659 300 0
- getuiext3
- libjiagu-1825764045
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- RSA-ECB-NoPadding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding