Technical information
- Android.HiddenAds.180.origin
- Android.HiddenAds.181.origin
- Android.Triada.222.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) 3####.tc.qq.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) c.g####.qq.com:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) v.g####.qq.com:80
- TCP(HTTP/1.1) api.snail####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) 1####.199.167.212:80
- TCP(HTTP/1.1) api.xima####.com:80
- TCP(HTTP/1.1) car.moyum####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(TLS/1.0) owe.joy-r####.com:9050
- a####.b####.qq.com
- a####.u####.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- api.snail####.com
- api.xima####.com
- c.g####.qq.com
- car.moyum####.com
- cdn.joy-r####.com
- h####.c####.com
- i####.dd.qq.com
- imgc####.qq.com
- mi.g####.qq.com
- owe.joy-r####.com
- p####.ugd####.com
- pp.m####.com
- qzones####.g####.cn
- s####.e.qq.com
- v.g####.qq.com
- 1####.199.167.212/app/queryModuleState.action?&appversion=####&client_si...
- 1####.199.167.212/music/interface.action?method=####&client_sign=####&co...
- 1####.199.167.212/snaillove_lamp/getChannel.action?&sign=####
- 1####.199.167.212/snaillove_lamp/getEntranceNew.action?&sign=####
- 1####.199.167.212/snaillove_lamp/getSlide.action?&sign=####
- 1####.199.167.212/snaillove_lamp/getSlide.action?&sign=####&flag=####
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451027979327.png
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451027986279.png
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451027993798.png
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451040122340.jpg
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451040132578.jpg
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451040142338.jpg
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451040233300.jpg
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451040464915.jpg
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451041437889.jpg
- 3####.tc.qq.com/16891/992BB93F8D9D73487E8DFE6689B5F621.apk?fsname=####&c...
- api.snail####.com/cloudmusic/api/getHasCoverAd?packagename=####&language...
- c.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=...
- c.g####.qq.com/gdt_trace_a.fcg?actionid=####&targettype=####&tagetid=###...
- car.moyum####.com/nfile/mkres/mudata.zip
- car.moyum####.com/nfile/mkres/mures.zip
- d####.c####.l####.####.com/896e8760-4b4b-44fc-96af-7eae30fe04a4bdco_60048
- mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android02/images/tsa_ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- s####.tc.qq.com/gdt/0/DAAD72KAKAAPAAApBbjS57B44zn5rU.jpg/0?ck=####
- s####.tc.qq.com/ma_icon/0/icon_11789440_1534905411/256
- v.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####&gap=####
- z.c####.com/stat.htm?id=####&cnzz_eid=####
- a####.u####.com/app_logs
- aexcep####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- api.xima####.com/oauth2/access_token
- s####.e.qq.com/activate
- s####.e.qq.com/click
- s####.e.qq.com/msg
- /data/data/####/.imprint
- /data/data/####/2488.yaqcookie
- /data/data/####/5ead7c1916e321af3ee0d7d6aa595238.temp
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/EventDex.dex
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/H4O783l.apk
- /data/data/####/HtCfg.xml
- /data/data/####/bird_plugin.dex
- /data/data/####/bird_plugin.dex (deleted)
- /data/data/####/bird_plugin.jar
- /data/data/####/bird_plugin.jar.sig
- /data/data/####/bird_plugin.tmp
- /data/data/####/bird_plugin.tmp.sig
- /data/data/####/bugly_db_legu-journal
- /data/data/####/config.xml
- /data/data/####/d8e67ec7102dca09281249c880d77711.temp
- /data/data/####/data.tmp
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/dexMethod.28020090.dat
- /data/data/####/downloader.db-journal
- /data/data/####/gdt_config.cfg
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_plugin.tmp.sig
- /data/data/####/gdt_suid
- /data/data/####/libdexwebutil.so
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.0.2.so
- /data/data/####/libufix.so
- /data/data/####/libyaqbasic.28020090.so
- /data/data/####/libyaqpro.28020090.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/mures.dex
- /data/data/####/native_record_lock
- /data/data/####/res.tmp
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/security_info
- /data/data/####/tMS866P3hcq
- /data/data/####/ting_data.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/update_lc
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/yaqsdkcookie
- /data/media/####/-103652353.0.tmp
- /data/media/####/-1999500433.0.tmp
- /data/media/####/-246565419.0.tmp
- /data/media/####/-42823833.0.tmp
- /data/media/####/-479326590.0.tmp
- /data/media/####/.nomedia
- /data/media/####/1483928623.0.tmp
- /data/media/####/1e7750d04529d67aec751b343bb19c48
- /data/media/####/386865091.0.tmp
- /data/media/####/555165034.0.tmp
- /data/media/####/806362188.0.tmp
- /data/media/####/Badinfo.xml
- /data/media/####/BpLink.xml
- /data/media/####/YvscMPs.xml
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/rinsWPVPycqVPSq38.db
- /data/media/####/rinsWPVPycqVPSq38.db-journal
- /data/media/####/webinfo.xml
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/app_aqPVSg3/tMS866P3hcq -p <Package> -s com.birdads.out.BGService -t 600
- cat /sys/class/net/wlan0/address
- chmod 0755 <Package Folder>/app_aqPVSg3/tMS866P3hcq
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- sh <Package Folder>/app_aqPVSg3/tMS866P3hcq -p <Package> -s com.birdads.out.BGService -t 600
- Bugly
- bluetoothlibrary
- libnfix
- libshella-2.9.0.2
- libufix
- libyaqbasic.28020090
- libyaqpro.28020090
- nfix
- ufix
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES-ECB-NoPadding
- RSA-ECB-PKCS1Padding