Adware.Gexin.22462

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) adash####.man.aliy####.com:80
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) plb####.u####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) app-####.d####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) 1####.217.168.195:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

a####.man.aliy####.com
and####.cli####.go####.com
and####.google####.com
android####.go####.com
api.map.b####.com
app-####.d####.com
instant####.google####.com
m####.go####.com
md####.google####.com
plb####.u####.com
u####.u####.com
www.gst####.com

HTTP GET requests:

app-####.d####.com:443/api/v2/client/getappsetting?platform=####
app-####.d####.com:443/api/v3/client/detail/getvideo?platform=####
app-####.d####.com:443/api/v3/client/message/index?userId=####&deviceTok...
app-####.d####.com:443/api/v3/client/operation/supernatant?citydomain=##...
app-####.d####.com:443/api/v3/client/operation?type=####&citydomain=####...
app-####.d####.com:443/api/v3/client/search/filter?platform=####
app-####.d####.com:443/api/v3/client/search/words?citydomain=####&platfo...
app-####.d####.com:443/api/v3/client/standapp/search/recommend?citydomai...
app-####.d####.com:443/api/v3/client/subscribetags/list?hidden_operation...

HTTP POST requests:

adash####.man.aliy####.com/man/api?ak=####&s=####
al####.u####.com:443/unify_logs
app-####.d####.com:443/api/v2/client/dek/manifest?platform=####
plb####.u####.com:443/umpx_internal

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/0.chunk.js
/data/data/####/000001.dbtmp
/data/data/####/000002.dbtmp
/data/data/####/000004.dbtmp
/data/data/####/1.chunk.js
/data/data/####/2.chunk.js
/data/data/####/3.chunk.js
/data/data/####/4.chunk.js
/data/data/####/5.chunk.js
/data/data/####/6.chunk.js
/data/data/####/A3AEECD8.dex
/data/data/####/A3AEECD8.dex.flock (deleted)
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/MANIFEST-000001
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/_umeng_common_config.xml
/data/data/####/a==8.0.0&&1.0.0_1643543546114_envelope.log
/data/data/####/account-bind-list.38fcf5c56d45f776dd91e577f505645e-two.css
/data/data/####/account-bind-list.ef547636e0120209ff74.js
/data/data/####/account-bind-list.html
/data/data/####/account.ef547636e0120209ff74.js
/data/data/####/account.f58a834282b178480b77d311ad339a8e-two.css
/data/data/####/account.html
/data/data/####/agoo.pid
/data/data/####/agreement.ef547636e0120209ff74.js
/data/data/####/agreement.fab09c4e44e9ec08a32f769faa750100-one.css
/data/data/####/agreement.html
/data/data/####/apply-cash-record.7687708074d8e3bccd98b8a45fa9f254-two.css
/data/data/####/apply-cash-record.d41d8cd98f00b204e9800998ecf8427e-one.css
/data/data/####/apply-cash-record.ef547636e0120209ff74.js
/data/data/####/apply-cash-record.html
/data/data/####/apply-cash-success.1d241aa48ce4a997d5ef677319f0...wo.css
/data/data/####/apply-cash-success.ef547636e0120209ff74.js
/data/data/####/apply-cash-success.html
/data/data/####/apply-cash.6a9c33862b73799b32b6a84b87b031c0-two.css
/data/data/####/apply-cash.ef547636e0120209ff74.js
/data/data/####/apply-cash.html
/data/data/####/apply-detail.5776070d6c81c39b1bda624f1ef8bf24-two.css
/data/data/####/apply-detail.c7eda6f039c3ef9bfd97f987bdf15e51-one.css
/data/data/####/apply-detail.ef547636e0120209ff74.js
/data/data/####/apply-detail.html
/data/data/####/apply-list.d41d8cd98f00b204e9800998ecf8427e-one.css
/data/data/####/apply-list.ef547636e0120209ff74.js
/data/data/####/apply-list.f64444e2dfc6c0598faffe8ddb4b9fba-two.css
/data/data/####/apply-list.html
/data/data/####/apply-success.10f6f117c5ffedb4fbb21a374876d2ae-two.css
/data/data/####/apply-success.c7eda6f039c3ef9bfd97f987bdf15e51-one.css
/data/data/####/apply-success.ef547636e0120209ff74.js
/data/data/####/apply-success.html
/data/data/####/authStatus_com.ybjz.app;remote.xml
/data/data/####/avatar_female.png
/data/data/####/avatar_male.png
/data/data/####/bg_blacklist.png
/data/data/####/bg_detail_banner.png
/data/data/####/bg_detail_quanzhi.png
/data/data/####/bg_index_column.png
/data/data/####/bg_map.png
/data/data/####/bg_mingqi_info.png
/data/data/####/bg_popup.png
/data/data/####/bg_renzheng.png
/data/data/####/bg_resume.png
/data/data/####/bg_status.png
/data/data/####/bg_status_new.png
/data/data/####/bg_tab.png
/data/data/####/bg_toptips.png
/data/data/####/bind-alipay.30dafbd020a8c6204e480314e96b22f7-one.css
/data/data/####/bind-alipay.54ce9475f22b888c301a067a1838e0c0-two.css
/data/data/####/bind-alipay.ef547636e0120209ff74.js
/data/data/####/bind-alipay.html
/data/data/####/bind-unionpay.09738d1e59b218565fa2c60f27816982-two.css
/data/data/####/bind-unionpay.30dafbd020a8c6204e480314e96b22f7-one.css
/data/data/####/bind-unionpay.ef547636e0120209ff74.js
/data/data/####/bind-unionpay.html
/data/data/####/bind-weixinwallet.30dafbd020a8c6204e480314e96b22f7-one.css
/data/data/####/bind-weixinwallet.edc1be2feaed0d77d2148705f9495f73-two.css
/data/data/####/bind-weixinwallet.ef547636e0120209ff74.js
/data/data/####/bind-weixinwallet.html
/data/data/####/bundle.js
/data/data/####/cache.manifest
/data/data/####/change-mobile-number.a2b0ea6da5181352d174086428...wo.css
/data/data/####/change-mobile-number.ef547636e0120209ff74.js
/data/data/####/change-mobile-number.html
/data/data/####/channel_umeng_common_config.xml
/data/data/####/china.zip
/data/data/####/city.95e09476214ef7a72a4fdcbd8f47934c-one.css
/data/data/####/city.ef547636e0120209ff74.js
/data/data/####/city.html
/data/data/####/city_1.json
/data/data/####/city_10.json
/data/data/####/city_100.json
/data/data/####/city_101.json
/data/data/####/city_102.json
/data/data/####/city_103.json
/data/data/####/city_104.json
/data/data/####/city_105.json
/data/data/####/city_106.json
/data/data/####/city_107.json
/data/data/####/city_108.json
/data/data/####/city_109.json
/data/data/####/city_11.json
/data/data/####/city_110.json
/data/data/####/city_111.json
/data/data/####/city_112.json
/data/data/####/city_113.json
/data/data/####/city_114.json
/data/data/####/city_115.json
/data/data/####/city_116.json
/data/data/####/city_117.json
/data/data/####/city_118.json
/data/data/####/city_119.json
/data/data/####/city_12.json
/data/data/####/city_120.json
/data/data/####/city_121.json
/data/data/####/city_122.json
/data/data/####/city_123.json
/data/data/####/city_124.json
/data/data/####/city_125.json
/data/data/####/city_126.json
/data/data/####/city_127.json
/data/data/####/city_128.json
/data/data/####/city_129.json
/data/data/####/city_13.json
/data/data/####/city_130.json
/data/data/####/city_131.json
/data/data/####/city_132.json
/data/data/####/city_133.json
/data/data/####/city_134.json
/data/data/####/city_135.json
/data/data/####/city_136.json
/data/data/####/city_137.json
/data/data/####/city_138.json
/data/data/####/city_139.json
/data/data/####/city_14.json
/data/data/####/city_140.json
/data/data/####/city_141.json
/data/data/####/city_142.json
/data/data/####/city_143.json
/data/data/####/city_144.json
/data/data/####/city_145.json
/data/data/####/city_146.json
/data/data/####/city_147.json
/data/data/####/city_148.json
/data/data/####/city_149.json
/data/data/####/city_15.json
/data/data/####/city_150.json
/data/data/####/city_151.json
/data/data/####/city_152.json
/data/data/####/city_153.json
/data/data/####/city_154.json
/data/data/####/city_155.json
/data/data/####/city_156.json
/data/data/####/city_157.json
/data/data/####/city_158.json
/data/data/####/city_159.json
/data/data/####/city_16.json
/data/data/####/city_160.json
/data/data/####/city_161.json
/data/data/####/city_162.json
/data/data/####/city_163.json
/data/data/####/city_164.json
/data/data/####/city_165.json
/data/data/####/city_166.json
/data/data/####/city_167.json
/data/data/####/city_168.json
/data/data/####/city_169.json
/data/data/####/city_17.json
/data/data/####/city_170.json
/data/data/####/city_171.json
/data/data/####/city_172.json
/data/data/####/city_173.json
/data/data/####/city_174.json
/data/data/####/city_175.json
/data/data/####/city_176.json
/data/data/####/city_177.json
/data/data/####/city_178.json
/data/data/####/city_179.json
/data/data/####/city_18.json
/data/data/####/city_180.json
/data/data/####/city_181.json
/data/data/####/city_182.json
/data/data/####/city_183.json
/data/data/####/city_184.json
/data/data/####/city_185.json
/data/data/####/city_186.json
/data/data/####/city_187.json
/data/data/####/city_188.json
/data/data/####/city_189.json
/data/data/####/city_19.json
/data/data/####/city_190.json
/data/data/####/city_191.json
/data/data/####/city_192.json
/data/data/####/city_193.json
/data/data/####/city_194.json
/data/data/####/city_195.json
/data/data/####/city_196.json
/data/data/####/city_197.json
/data/data/####/city_198.json
/data/data/####/city_199.json
/data/data/####/city_2.json
/data/data/####/city_20.json
/data/data/####/city_200.json
/data/data/####/city_201.json
/data/data/####/city_202.json
/data/data/####/city_203.json
/data/data/####/city_204.json
/data/data/####/city_205.json
/data/data/####/city_206.json
/data/data/####/city_207.json
/data/data/####/city_208.json
/data/data/####/city_209.json
/data/data/####/city_21.json
/data/data/####/city_210.json
/data/data/####/city_211.json
/data/data/####/city_212.json
/data/data/####/city_213.json
/data/data/####/city_214.json
/data/data/####/city_215.json
/data/data/####/city_216.json
/data/data/####/city_217.json
/data/data/####/city_218.json
/data/data/####/city_219.json
/data/data/####/city_22.json
/data/data/####/city_220.json
/data/data/####/city_221.json
/data/data/####/city_222.json
/data/data/####/city_223.json
/data/data/####/city_224.json
/data/data/####/city_225.json
/data/data/####/city_226.json
/data/data/####/city_227.json
/data/data/####/city_228.json
/data/data/####/city_229.json
/data/data/####/city_23.json
/data/data/####/city_230.json
/data/data/####/city_231.json
/data/data/####/city_232.json
/data/data/####/city_233.json
/data/data/####/city_234.json
/data/data/####/city_235.json
/data/data/####/city_236.json
/data/data/####/city_237.json
/data/data/####/city_238.json
/data/data/####/city_239.json
/data/data/####/city_24.json
/data/data/####/city_240.json
/data/data/####/city_241.json
/data/data/####/city_242.json
/data/data/####/city_243.json
/data/data/####/city_244.json
/data/data/####/city_245.json
/data/data/####/city_246.json
/data/data/####/city_247.json
/data/data/####/city_248.json
/data/data/####/city_249.json
/data/data/####/city_25.json
/data/data/####/city_250.json
/data/data/####/city_251.json
/data/data/####/city_252.json
/data/data/####/city_253.json
/data/data/####/city_254.json
/data/data/####/city_255.json
/data/data/####/city_256.json
/data/data/####/city_257.json
/data/data/####/city_258.json
/data/data/####/city_259.json
/data/data/####/city_26.json
/data/data/####/city_260.json
/data/data/####/city_261.json
/data/data/####/city_262.json
/data/data/####/city_263.json
/data/data/####/city_264.json
/data/data/####/city_265.json
/data/data/####/city_266.json
/data/data/####/city_267.json
/data/data/####/city_268.json
/data/data/####/city_269.json
/data/data/####/city_27.json
/data/data/####/city_270.json
/data/data/####/city_271.json
/data/data/####/city_272.json
/data/data/####/city_273.json
/data/data/####/city_274.json
/data/data/####/city_275.json
/data/data/####/city_276.json
/data/data/####/city_277.json
/data/data/####/city_278.json
/data/data/####/city_279.json
/data/data/####/city_28.json
/data/data/####/city_280.json
/data/data/####/city_281.json
/data/data/####/city_282.json
/data/data/####/city_283.json
/data/data/####/city_284.json
/data/data/####/city_285.json
/data/data/####/city_286.json
/data/data/####/city_287.json
/data/data/####/city_288.json
/data/data/####/city_289.json
/data/data/####/city_29.json
/data/data/####/city_290.json
/data/data/####/city_291.json
/data/data/####/city_292.json
/data/data/####/city_293.json
/data/data/####/city_294.json
/data/data/####/city_295.json
/data/data/####/city_296.json
/data/data/####/city_297.json
/data/data/####/city_298.json
/data/data/####/city_299.json
/data/data/####/city_3.json
/data/data/####/city_30.json
/data/data/####/city_300.json
/data/data/####/city_301.json
/data/data/####/city_302.json
/data/data/####/city_303.json
/data/data/####/city_304.json
/data/data/####/city_305.json
/data/data/####/city_306.json
/data/data/####/city_307.json
/data/data/####/city_308.json
/data/data/####/city_309.json
/data/data/####/city_31.json
/data/data/####/city_310.json
/data/data/####/city_311.json
/data/data/####/city_312.json
/data/data/####/city_313.json
/data/data/####/city_314.json
/data/data/####/city_315.json
/data/data/####/city_316.json
/data/data/####/city_317.json
/data/data/####/city_318.json
/data/data/####/city_319.json
/data/data/####/city_32.json
/data/data/####/city_320.json
/data/data/####/city_321.json
/data/data/####/city_322.json
/data/data/####/city_323.json
/data/data/####/city_324.json
/data/data/####/city_325.json
/data/data/####/city_326.json
/data/data/####/city_327.json
/data/data/####/city_328.json
/data/data/####/city_329.json
/data/data/####/city_33.json
/data/data/####/city_330.json
/data/data/####/city_331.json
/data/data/####/city_332.json
/data/data/####/city_333.json
/data/data/####/city_334.json
/data/data/####/city_335.json
/data/data/####/city_336.json
/data/data/####/city_337.json
/data/data/####/city_338.json
/data/data/####/city_339.json
/data/data/####/city_34.json
/data/data/####/city_340.json
/data/data/####/city_341.json
/data/data/####/city_342.json
/data/data/####/city_343.json
/data/data/####/city_344.json
/data/data/####/city_345.json
/data/data/####/city_35.json
/data/data/####/city_353.json
/data/data/####/city_36.json
/data/data/####/city_37.json
/data/data/####/city_373.json
/data/data/####/city_374.json
/data/data/####/city_375.json
/data/data/####/city_376.json
/data/data/####/city_377.json
/data/data/####/city_378.json
/data/data/####/city_379.json
/data/data/####/city_38.json
/data/data/####/city_380.json
/data/data/####/city_381.json
/data/data/####/city_382.json
/data/data/####/city_383.json
/data/data/####/city_384.json
/data/data/####/city_385.json
/data/data/####/city_386.json
/data/data/####/city_39.json
/data/data/####/city_4.json
/data/data/####/city_40.json
/data/data/####/city_41.json
/data/data/####/city_42.json
/data/data/####/city_43.json
/data/data/####/city_44.json
/data/data/####/city_45.json
/data/data/####/city_46.json
/data/data/####/city_47.json
/data/data/####/city_48.json
/data/data/####/city_49.json
/data/data/####/city_5.json
/data/data/####/city_50.json
/data/data/####/city_51.json
/data/data/####/city_52.json
/data/data/####/city_53.json
/data/data/####/city_54.json
/data/data/####/city_55.json
/data/data/####/city_56.json
/data/data/####/city_57.json
/data/data/####/city_58.json
/data/data/####/city_59.json
/data/data/####/city_6.json
/data/data/####/city_60.json
/data/data/####/city_61.json
/data/data/####/city_62.json
/data/data/####/city_63.json
/data/data/####/city_64.json
/data/data/####/city_65.json
/data/data/####/city_66.json
/data/data/####/city_67.json
/data/data/####/city_68.json
/data/data/####/city_69.json
/data/data/####/city_7.json
/data/data/####/city_70.json
/data/data/####/city_71.json
/data/data/####/city_72.json
/data/data/####/city_73.json
/data/data/####/city_74.json
/data/data/####/city_75.json
/data/data/####/city_76.json
/data/data/####/city_77.json
/data/data/####/city_78.json
/data/data/####/city_79.json
/data/data/####/city_8.json
/data/data/####/city_80.json
/data/data/####/city_81.json
/data/data/####/city_82.json
/data/data/####/city_83.json
/data/data/####/city_84.json
/data/data/####/city_85.json
/data/data/####/city_86.json
/data/data/####/city_87.json
/data/data/####/city_88.json
/data/data/####/city_89.json
/data/data/####/city_9.json
/data/data/####/city_90.json
/data/data/####/city_91.json
/data/data/####/city_92.json
/data/data/####/city_93.json
/data/data/####/city_94.json
/data/data/####/city_95.json
/data/data/####/city_96.json
/data/data/####/city_97.json
/data/data/####/city_98.json
/data/data/####/city_99.json
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/com.ybjz.app_preferences.xml
/data/data/####/company-detail.19916e748e943cc4631b8fbbf9f8d259-one.css
/data/data/####/company-detail.7137c36bba3c3fd04ba40bf85e95fff9-two.css
/data/data/####/company-detail.ef547636e0120209ff74.js
/data/data/####/company-detail.html
/data/data/####/complain.26c2b68d3bfbfbbacec7281134f1908c-two.css
/data/data/####/complain.ef547636e0120209ff74.js
/data/data/####/complain.html
/data/data/####/complaint-forms-business-lose.a033132638ac153e6...wo.css
/data/data/####/complaint-forms-business-lose.ef547636e0120209ff74.js
/data/data/####/complaint-forms-business-lose.html
/data/data/####/complaint-forms-false-information.a29374361b8f6...wo.css
/data/data/####/complaint-forms-false-information.ef547636e0120209ff74.js
/data/data/####/complaint-forms-false-information.html
/data/data/####/complaint-forms-fee-charge.a29374361b8f611d8633...wo.css
/data/data/####/complaint-forms-fee-charge.ef547636e0120209ff74.js
/data/data/####/complaint-forms-fee-charge.html
/data/data/####/complaint-forms-salary-arrears.a29374361b8f611d...wo.css
/data/data/####/complaint-forms-salary-arrears.ef547636e0120209ff74.js
/data/data/####/complaint-forms-salary-arrears.html
/data/data/####/complaint-success.9aa437f8efb09723eee9cc00914472df-two.css
/data/data/####/complaint-success.ef547636e0120209ff74.js
/data/data/####/complaint-success.html
/data/data/####/count-down-bg.png
/data/data/####/cyan_face.png
/data/data/####/cyan_face_gray.png
/data/data/####/dW1weF9pbnRlcm5hbF8xNjQzNTQzNTM3MTMy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNjQzNTQzNTQ1MDU0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNjQzNTQzNTU3Njg1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNjQzNTQzNTkyNzU4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNjQzNTQzNjMwMjMw;
/data/data/####/detail-address.5e5aa64a0565a74d544b5e9b54e017c9-two.css
/data/data/####/detail-address.ef547636e0120209ff74.js
/data/data/####/detail-address.html
/data/data/####/detail-mix.58831661261301c8eed1cca40159167f-one.css
/data/data/####/detail-mix.7e9698af73d36504e5bffdcd89db33d4-two.css
/data/data/####/detail-mix.ef547636e0120209ff74.js
/data/data/####/detail-mix.html
/data/data/####/detail.08f92ce8c44d27b0781b9bdba4070585-one.css
/data/data/####/detail.95f0a79a78de2db816f28cfc1dfa33d2-two.css
/data/data/####/detail.ef547636e0120209ff74.js
/data/data/####/detail.html
/data/data/####/detail_basic_head.png
/data/data/####/detail_direct_head.png
/data/data/####/detail_online_head.png
/data/data/####/detail_player_big.png
/data/data/####/detail_player_small.png
/data/data/####/dmzp.png
/data/data/####/dmzygw.png
/data/data/####/downloader_umeng_common_config.xml
/data/data/####/duiba.2839f02f6b96f7eaf8852679854b77b7-one.css
/data/data/####/duiba.ef547636e0120209ff74.js
/data/data/####/duiba.html
/data/data/####/empower.png
/data/data/####/entry-details.8eb05b0e52338ec6d06b7ddc47bc085d-two.css
/data/data/####/entry-details.ef547636e0120209ff74.js
/data/data/####/entry-details.html
/data/data/####/evaluate.c06520a83be22d94fe2f3ea7820c185f-one.css
/data/data/####/evaluate.ef547636e0120209ff74.js
/data/data/####/evaluate.f64444e2dfc6c0598faffe8ddb4b9fba-two.css
/data/data/####/evaluate.html
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f1e5994e2a5f4dbe680c.worker.js
/data/data/####/fe5312fdbe923e425eb3.worker.js
/data/data/####/feedback.1992e90c0660c4ad48569367a977df14-one.css
/data/data/####/feedback.ef547636e0120209ff74.js
/data/data/####/feedback.html
/data/data/####/gal.db
/data/data/####/gal.db-journal
/data/data/####/hotjob-list.906a2f71cc7187cce21b44525e1fab9f-one.css
/data/data/####/hotjob-list.ef547636e0120209ff74.js
/data/data/####/hotjob-list.html
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/huiyan-index.ef547636e0120209ff74.js
/data/data/####/huiyan-index.f7f5582f0db955b0fca6acb349d89de8-two.css
/data/data/####/huiyan-index.html
/data/data/####/huiyan-result.9c54de9a08aad8b0de9a0f3716dd74c8-two.css
/data/data/####/huiyan-result.ef547636e0120209ff74.js
/data/data/####/huiyan-result.html
/data/data/####/i==1.2.0&&1.0.0_1643543537308_envelope.log
/data/data/####/i==1.2.0&&1.0.0_1643543557569_envelope.log
/data/data/####/i==1.2.0&&1.0.0_1643543630237_envelope.log
/data/data/####/icon-safe.png
/data/data/####/icon-welfare-01.png
/data/data/####/icon-welfare-02.png
/data/data/####/icon-welfare-03.png
/data/data/####/icon-welfare-04.png
/data/data/####/icon-welfare-05.png
/data/data/####/icon-welfare-06.png
/data/data/####/icon-welfare-07.png
/data/data/####/icon-welfare-new-01.png
/data/data/####/icon-welfare-new-02.png
/data/data/####/icon-welfare-new-03.png
/data/data/####/icon-welfare-new-04.png
/data/data/####/icon-welfare-new-05.png
/data/data/####/icon-welfare-new-06.png
/data/data/####/icon-welfare-new-07.png
/data/data/####/icon.png
/data/data/####/icon_account.png
/data/data/####/icon_arrow.png
/data/data/####/icon_blacklist.png
/data/data/####/icon_cate_check.png
/data/data/####/icon_cate_other.png
/data/data/####/icon_cate_promotion.png
/data/data/####/icon_cate_reg.png
/data/data/####/icon_cate_share.png
/data/data/####/icon_cate_survey.png
/data/data/####/icon_deliver.png
/data/data/####/icon_detail.png
/data/data/####/icon_detail_new.png
/data/data/####/icon_doubt.png
/data/data/####/icon_form.png
/data/data/####/icon_index.png
/data/data/####/icon_online.png
/data/data/####/icon_order.png
/data/data/####/icon_personal.png
/data/data/####/icon_personal1.png
/data/data/####/icon_rate.png
/data/data/####/icon_resume.png
/data/data/####/icon_succeed.png
/data/data/####/icon_taobaoke.png
/data/data/####/icon_wallet.png
/data/data/####/index
/data/data/####/info.xml
/data/data/####/integral-detail.c83a6efc7066963968c7d023024ca754-one.css
/data/data/####/integral-detail.ef547636e0120209ff74.js
/data/data/####/integral-detail.html
/data/data/####/ipc_umeng_common_config.xml
/data/data/####/jianZhi.xml
/data/data/####/ker.db-journal
/data/data/####/lazyload_default.png
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/ljzp.png
/data/data/####/login-captcha.9296354b9f5f9f3fab398e7e17deb1bc-one.css
/data/data/####/login-captcha.ef547636e0120209ff74.js
/data/data/####/login-captcha.html
/data/data/####/login-check-phone.3acdf887f9ecb67aa39ac9b8313cc98e-one.css
/data/data/####/login-check-phone.ef547636e0120209ff74.js
/data/data/####/login-check-phone.html
/data/data/####/login-password.3acdf887f9ecb67aa39ac9b8313cc98e-one.css
/data/data/####/login-password.ef547636e0120209ff74.js
/data/data/####/login-password.html
/data/data/####/mac.xml
/data/data/####/main.dek
/data/data/####/metrics_guid
/data/data/####/mingqi_tag.png
/data/data/####/mingqi_toutu_ placeholder.png
/data/data/####/mingqi_toutu_default.jpg
/data/data/####/mipush_country_code
/data/data/####/mipush_country_code.lock
/data/data/####/mipush_region
/data/data/####/mipush_region.lock
/data/data/####/nearby-list.5c0d4e7954abfb150458f24d22bd93d0-one.css
/data/data/####/nearby-list.ef547636e0120209ff74.js
/data/data/####/nearby-list.html
/data/data/####/no-idencode.ef547636e0120209ff74.js
/data/data/####/no-idencode.f5e5c6efc8d757b97d99e16b290ab4fb-one.css
/data/data/####/no-idencode.html
/data/data/####/online-prefecture.5123a485a5b55423a26b945b4230db2d-one.css
/data/data/####/online-prefecture.ef547636e0120209ff74.js
/data/data/####/online-prefecture.html
/data/data/####/prefecture.ba608718150f704ee23d0a7aaa8f4deb-one.css
/data/data/####/prefecture.ef547636e0120209ff74.js
/data/data/####/prefecture.html
/data/data/####/preferences-job-type-select.8f7175e398c6534e484...ne.css
/data/data/####/preferences-job-type-select.ef547636e0120209ff74.js
/data/data/####/preferences-job-type-select.html
/data/data/####/privacyAgreement.ef547636e0120209ff74.js
/data/data/####/privacyAgreement.fab09c4e44e9ec08a32f769faa750100-one.css
/data/data/####/privacyAgreement.html
/data/data/####/proc_auxv
/data/data/####/progress_left.png
/data/data/####/progress_right.png
/data/data/####/provinces.json
/data/data/####/ptj_icons.png
/data/data/####/pushservice_umeng_common_config.xml
/data/data/####/rapidly-apply.ceec654f14e37ffbafaf288f27dd4d44-one.css
/data/data/####/rapidly-apply.ef547636e0120209ff74.js
/data/data/####/rapidly-apply.html
/data/data/####/recommend-list.906a2f71cc7187cce21b44525e1fab9f-one.css
/data/data/####/recommend-list.ef547636e0120209ff74.js
/data/data/####/recommend-list.html
/data/data/####/register.9845bac4a430482e7dc79a68248a3d36-one.css
/data/data/####/register.ef547636e0120209ff74.js
/data/data/####/register.html
/data/data/####/remote_umeng_common_config.xml
/data/data/####/reset.71ba3195f5a81815708f69db66fe8c40-one.css
/data/data/####/reset.ef547636e0120209ff74.js
/data/data/####/reset.html
/data/data/####/resume-addition.84df9e83c49a750ceb4f3d09143e8847-two.css
/data/data/####/resume-addition.ef547636e0120209ff74.js
/data/data/####/resume-addition.html
/data/data/####/resume-education.925e2a1a56e4513974aa6c0c44401867-two.css
/data/data/####/resume-education.ef547636e0120209ff74.js
/data/data/####/resume-education.html
/data/data/####/resume-index.ccd4e0f117a2b3513c49ba07f876ce2b-two.css
/data/data/####/resume-index.ef547636e0120209ff74.js
/data/data/####/resume-index.html
/data/data/####/resume-info.5add20c801379970620f217d8c0b9cf9-two.css
/data/data/####/resume-info.ef547636e0120209ff74.js
/data/data/####/resume-info.html
/data/data/####/resume-preference.8ed3a8d572362461884522501c256ab7-two.css
/data/data/####/resume-preference.ef547636e0120209ff74.js
/data/data/####/resume-preference.html
/data/data/####/resume-work.cb1e02bee5588e2300b78f5675c70716-two.css
/data/data/####/resume-work.ef547636e0120209ff74.js
/data/data/####/resume-work.html
/data/data/####/search.099a4243e789f51f498cf5fd7bfcaa7a-one.css
/data/data/####/search.57821ffac2251ddbcf0063458c719dcc-two.css
/data/data/####/search.ef547636e0120209ff74.js
/data/data/####/search.html
/data/data/####/selected.6c6c9e182504de9f44d1afe0d223224f-two.css
/data/data/####/selected.d41d8cd98f00b204e9800998ecf8427e-one.css
/data/data/####/selected.ef547636e0120209ff74.js
/data/data/####/selected.html
/data/data/####/selected_big.png
/data/data/####/selected_middle.png
/data/data/####/selected_small.png
/data/data/####/selectiveperfect-list.600dd311eae712f04127072f6...ne.css
/data/data/####/selectiveperfect-list.ef547636e0120209ff74.js
/data/data/####/selectiveperfect-list.html
/data/data/####/set-resume-success.49f6e4820473c25e6e7f181f7806...ne.css
/data/data/####/set-resume-success.ef547636e0120209ff74.js
/data/data/####/set-resume-success.html
/data/data/####/settings.af1d633d1685e9b2373d9f782fa52af5-two.css
/data/data/####/settings.ef547636e0120209ff74.js
/data/data/####/settings.html
/data/data/####/t==8.0.0&&1.0.0_1643543548331_envelope.log
/data/data/####/taobaoke-detail.b2a39010a7273cde7dd228c386619fe5-one.css
/data/data/####/taobaoke-detail.ef547636e0120209ff74.js
/data/data/####/taobaoke-detail.html
/data/data/####/taobaoke-income.431a0bed4168f310cf3d9bf5473c2fc9-one.css
/data/data/####/taobaoke-income.ef547636e0120209ff74.js
/data/data/####/taobaoke-income.html
/data/data/####/taobaoke-index.d5dd94be166cbb44ef39c36aa5f09614-one.css
/data/data/####/taobaoke-index.ef547636e0120209ff74.js
/data/data/####/taobaoke-index.html
/data/data/####/taobaoke-order.d18b222592a9b845ed9722e3f4272351-one.css
/data/data/####/taobaoke-order.ef547636e0120209ff74.js
/data/data/####/taobaoke-order.html
/data/data/####/taobaoke-search-hot-key.9cda77bb31da14cb8999ac4...ne.css
/data/data/####/taobaoke-search-hot-key.ef547636e0120209ff74.js
/data/data/####/taobaoke-search-hot-key.html
/data/data/####/taobaoke-search.b78708aa1c7a04779a0da807626bafdb-one.css
/data/data/####/taobaoke-search.ef547636e0120209ff74.js
/data/data/####/taobaoke-search.html
/data/data/####/taobaoke-share.1fcf83f8f8bca64ce6f350395883ea23-one.css
/data/data/####/taobaoke-share.ef547636e0120209ff74.js
/data/data/####/taobaoke-share.html
/data/data/####/the-real-index
/data/data/####/tmp.zip
/data/data/####/tmpd8.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/update.xml
/data/data/####/vendor.dll.js
/data/data/####/verified.83111ef341fc89eeb48f4a24e18c1b22-two.css
/data/data/####/verified.ef547636e0120209ff74.js
/data/data/####/verified.html
/data/data/####/wallet.8b6967ea349c3b13ed5935855e1491aa-two.css
/data/data/####/wallet.ef547636e0120209ff74.js
/data/data/####/wallet.html
/data/data/####/yellow_face.png
/data/data/####/yellow_face_gray.png

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
ls /
ls /sys/class/thermal

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial