Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Adware.Gexin.6026

Added to the Dr.Web virus database: 2018-12-06

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Adware.Gexin.2.origin
Network activity:
Connects to:
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.1) pub-####.qin####.com:80
  • TCP(HTTP/1.1) a####.u####.com:80
  • TCP(HTTP/1.1) ti####.c####.l####.####.com:80
  • TCP(HTTP/1.1) c-h####.g####.com:80
  • TCP(HTTP/1.1) tengf####.c####.sensors####.cn:8006
  • TCP(HTTP/1.1) t####.c####.q####.####.com:80
  • TCP(HTTP/1.1) beacon####.aliy####.com:80
  • TCP(HTTP/1.1) sdk.o####.p####.####.com:80
  • TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
  • TCP(TLS/1.0) ada####.m.ta####.com:443
  • TCP(TLS/1.0) waws-pr####.vip.azurewe####.####.net:443
  • TCP(TLS/1.0) schedul####.yo####.com:443
  • TCP(TLS/1.0) cdn-sta####.azure####.net.####.net:443
  • TCP(TLS/1.0) 1####.217.20.110:443
  • TCP(TLS/1.0) sh.wagbr####.ta####.com:443
  • TCP c####.g####.ig####.com:5225
  • TCP sdk.o####.t####.####.com:5224
DNS requests:
  • 7j####.c####.z0.####.com
  • a####.man.aliy####.com
  • a####.u####.com
  • ada####.ut.ta####.com
  • adas####.ut.ta####.com
  • beacon####.aliy####.com
  • c####.g####.ig####.com
  • c-h####.g####.com
  • code####.azurewe####.net
  • codepus####.azure####.net
  • pub-####.qin####.com
  • sdk.c####.ig####.com
  • sdk.o####.p####.####.com
  • sdk.o####.t####.####.com
  • sdk.o####.t####.####.com
  • sdk.o####.t####.####.net
  • tengf####.c####.sensors####.cn
  • tj.youza####.com
HTTP GET requests:
  • pub-####.qin####.com/tdata_EDT356
  • t####.c####.q####.####.com/tdata_BAI450
  • t####.c####.q####.####.com/tdata_YJA893
  • tengf####.c####.sensors####.cn:8006/config/Android.conf?project=####
  • ti####.c####.l####.####.com/config/hz-hzv3.conf
HTTP POST requests:
  • a####.u####.com/app_logs
  • beacon####.aliy####.com/beacon/fetch/config/byappkey
  • c-h####.g####.com/api.php?format=####&t=####
  • sdk.o####.p####.####.com/api.php?format=####&t=####
  • sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
  • tengf####.c####.sensors####.cn:8006/sa?project=####&token=####
File system changes:
Creates the following files:
  • /data/data/####/.imprint
  • /data/data/####/.jg.ic
  • /data/data/####/1004
  • /data/data/####/Alvin2.xml
  • /data/data/####/CodePush.xml
  • /data/data/####/ContextData.xml
  • /data/data/####/MultiDex.lock
  • /data/data/####/PranceCookiePrefsFile.db-journal
  • /data/data/####/Prance_Main_db-journal
  • /data/data/####/Prance_Read_History_db-journal
  • /data/data/####/Prance_User_db-journal
  • /data/data/####/RKStorage-journal
  • /data/data/####/UTCommon.xml
  • /data/data/####/a203c4a8cc8d
  • /data/data/####/allcircle_click_tip@2x.png
  • /data/data/####/allcircle_click_tip@3x.png
  • /data/data/####/allcircle_icon@2x.png
  • /data/data/####/allcircle_icon@3x.png
  • /data/data/####/ap.Lock
  • /data/data/####/app.json
  • /data/data/####/arrow@2x.png
  • /data/data/####/arrow@3x.png
  • /data/data/####/article_state_new_icon@2x.png
  • /data/data/####/article_state_new_icon@3x.png
  • /data/data/####/article_state_top_icon@2x.png
  • /data/data/####/article_state_top_icon@3x.png
  • /data/data/####/article_title_array_icon@2x.png
  • /data/data/####/article_title_array_icon@3x.png
  • /data/data/####/back-icon-mask.png
  • /data/data/####/back-icon.png
  • /data/data/####/back-icon@2x.png
  • /data/data/####/back-icon@3x.png
  • /data/data/####/bbs_attention_add@2x.png
  • /data/data/####/bbs_attention_add@3x.png
  • /data/data/####/bbs_attention_cancle@2x.png
  • /data/data/####/bbs_attention_cancle@3x.png
  • /data/data/####/bbs_attention_cancle_allcircle@2x.png
  • /data/data/####/bbs_attention_cancle_allcircle@3x.png
  • /data/data/####/bbs_btn_blue@2x.png
  • /data/data/####/bbs_btn_blue@3x.png
  • /data/data/####/bbs_circle_look_all@2x.png
  • /data/data/####/bbs_circle_look_all@3x.png
  • /data/data/####/bbs_create_float_btn@2x.png
  • /data/data/####/bbs_create_float_btn@3x.png
  • /data/data/####/bbs_focus_index_all_circle_icon@2x.png
  • /data/data/####/bbs_focus_index_all_circle_icon@3x.png
  • /data/data/####/bbs_focus_index_circle_add_icon@2x.png
  • /data/data/####/bbs_focus_index_circle_add_icon@3x.png
  • /data/data/####/bbs_focus_index_circle_remove_icon@2x.png
  • /data/data/####/bbs_focus_index_circle_remove_icon@3x.png
  • /data/data/####/bbs_look_all@2x.png
  • /data/data/####/bbs_look_all@3x.png
  • /data/data/####/bbs_post_detail_more_icon@2x.png
  • /data/data/####/bbs_post_detail_more_icon@3x.png
  • /data/data/####/bbs_post_index_add_icon@2x.png
  • /data/data/####/bbs_post_index_add_icon@3x.png
  • /data/data/####/bbs_post_index_anonymous_normal_icon@2x.png
  • /data/data/####/bbs_post_index_anonymous_normal_icon@3x.png
  • /data/data/####/bbs_post_index_anonymous_press_icon@2x.png
  • /data/data/####/bbs_post_index_anonymous_press_icon@3x.png
  • /data/data/####/bbs_post_index_delete_circle_icon@2x.png
  • /data/data/####/bbs_post_index_delete_circle_icon@3x.png
  • /data/data/####/bbs_post_index_delete_img_icon@2x.png
  • /data/data/####/bbs_post_index_delete_img_icon@3x.png
  • /data/data/####/bbs_post_index_down_arrow@2x.png
  • /data/data/####/bbs_post_index_down_arrow@3x.png
  • /data/data/####/bbs_post_index_img_icon@2x.png
  • /data/data/####/bbs_post_index_img_icon@3x.png
  • /data/data/####/bbs_post_index_topic_icon@2x.png
  • /data/data/####/bbs_post_index_topic_icon@3x.png
  • /data/data/####/bbs_post_index_topic_press_icon@2x.png
  • /data/data/####/bbs_post_index_topic_press_icon@3x.png
  • /data/data/####/bbs_post_my@2x.png
  • /data/data/####/bbs_post_my@3x.png
  • /data/data/####/bbs_reply_icon@2x.png
  • /data/data/####/bbs_reply_icon@3x.png
  • /data/data/####/bbs_title_hot_icon@2x.png
  • /data/data/####/bbs_title_hot_icon@3x.png
  • /data/data/####/bbs_title_top_icon@2x.png
  • /data/data/####/bbs_title_top_icon@3x.png
  • /data/data/####/big_placehoder@2x.png
  • /data/data/####/big_placehoder@3x.png
  • /data/data/####/bj_vip_icon@2x.png
  • /data/data/####/bj_vip_icon@3x.png
  • /data/data/####/bugly_db_-journal
  • /data/data/####/cache_download_switch_btn_start@2x.png
  • /data/data/####/cache_download_switch_btn_start@3x.png
  • /data/data/####/cache_download_switch_btn_start_disable@2x.png
  • /data/data/####/cache_download_switch_btn_start_disable@3x.png
  • /data/data/####/cache_download_switch_btn_stop@2x.png
  • /data/data/####/cache_download_switch_btn_stop@3x.png
  • /data/data/####/cache_download_switch_btn_stop_disable@2x.png
  • /data/data/####/cache_download_switch_btn_stop_disable@3x.png
  • /data/data/####/cache_downloaded@2x.png
  • /data/data/####/cache_downloaded@3x.png
  • /data/data/####/cache_downloading@2x.png
  • /data/data/####/cache_downloading@3x.png
  • /data/data/####/cache_more_schedule_icon_disable@2x.png
  • /data/data/####/cache_more_schedule_icon_disable@3x.png
  • /data/data/####/cache_more_schedule_icon_normal@2x.png
  • /data/data/####/cache_more_schedule_icon_normal@3x.png
  • /data/data/####/cc.db
  • /data/data/####/cc.db-journal
  • /data/data/####/checkbox_checked@2x.png
  • /data/data/####/checkbox_checked@3x.png
  • /data/data/####/checkbox_normal@2x.png
  • /data/data/####/checkbox_normal@3x.png
  • /data/data/####/checkbox_pressed@2x.png
  • /data/data/####/checkbox_pressed@3x.png
  • /data/data/####/checkbox_unchecked@2x.png
  • /data/data/####/checkbox_unchecked@3x.png
  • /data/data/####/circle_click_tip@2x.png
  • /data/data/####/circle_click_tip@3x.png
  • /data/data/####/circle_icon@2x.png
  • /data/data/####/circle_icon@3x.png
  • /data/data/####/circle_placeholder@2x.png
  • /data/data/####/codepush.json
  • /data/data/####/coin@2x.png
  • /data/data/####/coin@3x.png
  • /data/data/####/com.prance.app-journal
  • /data/data/####/com.prance.app_preferences.xml
  • /data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
  • /data/data/####/com.youzan.mobile.AnalyticsPrefs.xml
  • /data/data/####/community_ishidden@2x.png
  • /data/data/####/community_ishidden@3x.png
  • /data/data/####/community_nohidden@2x.png
  • /data/data/####/community_nohidden@3x.png
  • /data/data/####/community_reply@2x.png
  • /data/data/####/community_reply@3x.png
  • /data/data/####/course_cache_list_icon@2x.png
  • /data/data/####/course_cache_list_icon@3x.png
  • /data/data/####/crashrecord.xml
  • /data/data/####/daydayup_recommendation_icon@2x.png
  • /data/data/####/daydayup_recommendation_icon@3x.png
  • /data/data/####/default_avatar@2x.png
  • /data/data/####/default_avatar@3x.png
  • /data/data/####/download.zip
  • /data/data/####/dso_deps
  • /data/data/####/dso_lock
  • /data/data/####/dso_manifest
  • /data/data/####/dso_state
  • /data/data/####/edit_clear_icon@2x.png
  • /data/data/####/edit_clear_icon@3x.png
  • /data/data/####/empty_evaluate_icon@2x.png
  • /data/data/####/empty_evaluate_icon@3x.png
  • /data/data/####/empty_no_cache_icon@2x.png
  • /data/data/####/empty_no_cache_icon@3x.png
  • /data/data/####/empty_no_ware_icon@2x.png
  • /data/data/####/empty_no_ware_icon@3x.png
  • /data/data/####/empty_start@2x.png
  • /data/data/####/empty_start@3x.png
  • /data/data/####/events
  • /data/data/####/events-journal
  • /data/data/####/exchangeIdentity.json
  • /data/data/####/exchange_icon_1@2x.png
  • /data/data/####/exchange_icon_1@3x.png
  • /data/data/####/exchange_icon_2@2x.png
  • /data/data/####/exchange_icon_2@3x.png
  • /data/data/####/exchange_icon_3@2x.png
  • /data/data/####/exchange_icon_3@3x.png
  • /data/data/####/exchange_icon_4@3x.png
  • /data/data/####/exid.dat
  • /data/data/####/favorite_media_icon@2x.png
  • /data/data/####/favorite_media_icon@3x.png
  • /data/data/####/fetch_empty_icon_new@2x.png
  • /data/data/####/fetch_empty_icon_new@3x.png
  • /data/data/####/fetch_fail_icon@2x.png
  • /data/data/####/fetch_fail_icon@3x.png
  • /data/data/####/fetch_fail_icon_new@2x.png
  • /data/data/####/fetch_fail_icon_new@3x.png
  • /data/data/####/focus_index_circle_item_bg1@2x.png
  • /data/data/####/focus_index_circle_item_bg1@3x.png
  • /data/data/####/focus_index_circle_item_bg2@2x.png
  • /data/data/####/focus_index_circle_item_bg2@3x.png
  • /data/data/####/focus_index_circle_item_bg3@2x.png
  • /data/data/####/focus_index_circle_item_bg3@3x.png
  • /data/data/####/focus_index_circle_item_bg4@2x.png
  • /data/data/####/focus_index_circle_item_bg4@3x.png
  • /data/data/####/gdaemon_20161017
  • /data/data/####/get_coin_icon@2x.png
  • /data/data/####/get_coin_icon@3x.png
  • /data/data/####/get_coin_icon_completed@2x.png
  • /data/data/####/get_coin_icon_completed@3x.png
  • /data/data/####/getui_sp.xml
  • /data/data/####/gx_sp.xml
  • /data/data/####/home_article_cell_icon@2x.png
  • /data/data/####/home_article_cell_icon@3x.png
  • /data/data/####/home_audio_cell_icon@2x.png
  • /data/data/####/home_audio_cell_icon@3x.png
  • /data/data/####/home_bj_vip_bg@2x.png
  • /data/data/####/home_bj_vip_bg@3x.png
  • /data/data/####/home_community_msg_cancle@2x.png
  • /data/data/####/home_community_msg_cancle@3x.png
  • /data/data/####/home_community_msg_icon@2x.png
  • /data/data/####/home_community_msg_icon@3x.png
  • /data/data/####/home_course_hot@2x.png
  • /data/data/####/home_course_hot@3x.png
  • /data/data/####/home_course_rationing_icon@2x.png
  • /data/data/####/home_course_rationing_icon@3x.png
  • /data/data/####/home_course_rationing_icon_1@2x.png
  • /data/data/####/home_course_rationing_icon_1@3x.png
  • /data/data/####/home_course_subcribing@2x.png
  • /data/data/####/home_course_subcribing@3x.png
  • /data/data/####/home_course_tuan@2x.png
  • /data/data/####/home_course_tuan@3x.png
  • /data/data/####/home_everyday_article_icon@2x.png
  • /data/data/####/home_everyday_article_icon@3x.png
  • /data/data/####/home_everyday_audio_icon@2x.png
  • /data/data/####/home_everyday_audio_icon@3x.png
  • /data/data/####/home_everyday_study_item_icon@2x.png
  • /data/data/####/home_everyday_study_item_icon@3x.png
  • /data/data/####/home_group_title_more_icon@2x.png
  • /data/data/####/home_group_title_more_icon@3x.png
  • /data/data/####/home_item_meeting_icon@2x.png
  • /data/data/####/home_item_meeting_icon@3x.png
  • /data/data/####/home_living_bgview@2x.png
  • /data/data/####/home_living_bgview@3x.png
  • /data/data/####/home_living_living_icon@2x.png
  • /data/data/####/home_living_living_icon@3x.png
  • /data/data/####/home_living_waiting_icon@2x.png
  • /data/data/####/home_living_waiting_icon@3x.png
  • /data/data/####/home_media_progress_ion@2x.png
  • /data/data/####/home_media_progress_ion@3x.png
  • /data/data/####/home_meng_icon_bbs@2x.png
  • /data/data/####/home_meng_icon_bbs@3x.png
  • /data/data/####/home_meng_icon_bbs_word@2x.png
  • /data/data/####/home_meng_icon_bbs_word@3x.png
  • /data/data/####/home_nd_vip_bg@2x.png
  • /data/data/####/home_nd_vip_bg@3x.png
  • /data/data/####/home_new_user_task_icon@2x.png
  • /data/data/####/home_new_user_task_icon@3x.png
  • /data/data/####/home_series_course_bg@2x.png
  • /data/data/####/home_series_course_bg@3x.png
  • /data/data/####/home_tab_course_icon_normal@2x.png
  • /data/data/####/home_tab_course_icon_normal@3x.png
  • /data/data/####/home_tab_course_icon_selected@2x.png
  • /data/data/####/home_tab_course_icon_selected@3x.png
  • /data/data/####/home_tab_home_icon_normal@2x.png
  • /data/data/####/home_tab_home_icon_normal@3x.png
  • /data/data/####/home_tab_home_icon_selected@2x.png
  • /data/data/####/home_tab_home_icon_selected@3x.png
  • /data/data/####/home_tab_my_icon_normal@2x.png
  • /data/data/####/home_tab_my_icon_normal@3x.png
  • /data/data/####/home_tab_my_icon_selected@2x.png
  • /data/data/####/home_tab_my_icon_selected@3x.png
  • /data/data/####/home_tab_new_icon@2x.png
  • /data/data/####/home_tab_new_icon@3x.png
  • /data/data/####/home_tab_vip_icon_normal@2x.png
  • /data/data/####/home_tab_vip_icon_normal@3x.png
  • /data/data/####/home_tab_vip_icon_press@2x.png
  • /data/data/####/home_tab_vip_icon_press@3x.png
  • /data/data/####/home_toolbar_message_icon@2x.png
  • /data/data/####/home_toolbar_message_icon@3x.png
  • /data/data/####/home_toolbar_search_icon@2x.png
  • /data/data/####/home_toolbar_search_icon@3x.png
  • /data/data/####/home_toolbar_sign_icon@2x.png
  • /data/data/####/home_toolbar_sign_icon@3x.png
  • /data/data/####/home_topic_list_icon@2x.png
  • /data/data/####/home_topic_list_icon@3x.png
  • /data/data/####/home_video_bg@2x.png
  • /data/data/####/home_video_bg@3x.png
  • /data/data/####/home_zs_vip_bg@2x.png
  • /data/data/####/home_zs_vip_bg@3x.png
  • /data/data/####/hottopic_click_tip@2x.png
  • /data/data/####/hottopic_click_tip@3x.png
  • /data/data/####/hottopic_icon@2x.png
  • /data/data/####/hottopic_icon@3x.png
  • /data/data/####/ic_change_phone_number@2x.png
  • /data/data/####/ic_favorite_bbs@2x.png
  • /data/data/####/ic_favorite_bbs@3x.png
  • /data/data/####/ic_login_qq@2x.png
  • /data/data/####/ic_login_qq@3x.png
  • /data/data/####/ic_login_wechat@2x.png
  • /data/data/####/ic_login_wechat@3x.png
  • /data/data/####/ic_third_party_bind_qq@2x.png
  • /data/data/####/ic_third_party_bind_qq@3x.png
  • /data/data/####/ic_third_party_bind_wechat@2x.png
  • /data/data/####/ic_third_party_bind_wechat@3x.png
  • /data/data/####/index.android.bundle
  • /data/data/####/index.android.bundle.meta
  • /data/data/####/init.pid
  • /data/data/####/init_c1.pid
  • /data/data/####/libjiagu-1267286255.so
  • /data/data/####/light_start@2x.png
  • /data/data/####/light_start@3x.png
  • /data/data/####/list_content_price@2x.png
  • /data/data/####/list_content_price@3x.png
  • /data/data/####/main.jsbundle
  • /data/data/####/main.jsbundle.meta
  • /data/data/####/meng_i_know_btn@2x.png
  • /data/data/####/meng_i_know_btn@3x.png
  • /data/data/####/menu_search_icon_dark@2x.png
  • /data/data/####/menu_search_icon_dark@3x.png
  • /data/data/####/multidex.version.xml
  • /data/data/####/my_cache_icon@2x.png
  • /data/data/####/my_cache_icon@3x.png
  • /data/data/####/my_coin@2x.png
  • /data/data/####/my_coin@3x.png
  • /data/data/####/my_community_icon@2x.png
  • /data/data/####/my_daysign_icon@2x.png
  • /data/data/####/my_daysign_icon@3x.png
  • /data/data/####/my_exchangecode_icon@2x.png
  • /data/data/####/my_exchangecode_icon@3x.png
  • /data/data/####/my_first_register_dialog_bg@2x.png
  • /data/data/####/my_first_register_dialog_bg@3x.png
  • /data/data/####/my_first_register_dialog_btn@2x.png
  • /data/data/####/my_first_register_dialog_btn@3x.png
  • /data/data/####/my_first_register_dialog_close@2x.png
  • /data/data/####/my_first_register_dialog_close@3x.png
  • /data/data/####/my_group_icon@2x.png
  • /data/data/####/my_group_icon@3x.png
  • /data/data/####/my_help_icon@2x.png
  • /data/data/####/my_help_icon@3x.png
  • /data/data/####/my_important_bg@2x.png
  • /data/data/####/my_important_bg@3x.png
  • /data/data/####/my_message_icon@2x.png
  • /data/data/####/my_message_icon@3x.png
  • /data/data/####/my_metting_icon@2x.png
  • /data/data/####/my_metting_icon@3x.png
  • /data/data/####/my_money_icon@2x.png
  • /data/data/####/my_money_icon@3x.png
  • /data/data/####/my_question_icon@2x.png
  • /data/data/####/my_question_icon@3x.png
  • /data/data/####/my_setting_icon@2x.png
  • /data/data/####/my_setting_icon@3x.png
  • /data/data/####/my_task_icon@2x.png
  • /data/data/####/my_task_icon@3x.png
  • /data/data/####/my_vip_icon@2x.png
  • /data/data/####/my_vip_icon@3x.png
  • /data/data/####/native_record_lock
  • /data/data/####/nav_back@2x.png
  • /data/data/####/nav_back@3x.png
  • /data/data/####/nav_back_dark@2x.png
  • /data/data/####/nav_back_dark@3x.png
  • /data/data/####/nav_close_dark@2x.png
  • /data/data/####/nav_close_dark@3x.png
  • /data/data/####/nd_vip_icon@2x.png
  • /data/data/####/nd_vip_icon@3x.png
  • /data/data/####/new_user_task_list_header_bg@2x.png
  • /data/data/####/new_user_task_list_header_bg@3x.png
  • /data/data/####/new_user_task_list_progress_dot_selected@2x.png
  • /data/data/####/new_user_task_list_progress_dot_selected@3x.png
  • /data/data/####/new_user_task_list_progress_gift_icon@2x.png
  • /data/data/####/new_user_task_list_progress_gift_icon@3x.png
  • /data/data/####/new_user_task_list_progress_gift_icon_selected@2x.png
  • /data/data/####/new_user_task_list_progress_gift_icon_selected@3x.png
  • /data/data/####/new_user_task_rules_close_icon@2x.png
  • /data/data/####/new_user_task_rules_close_icon@3x.png
  • /data/data/####/new_user_task_rules_title_left_icon@2x.png
  • /data/data/####/new_user_task_rules_title_left_icon@3x.png
  • /data/data/####/new_user_task_rules_title_right_icon@2x.png
  • /data/data/####/new_user_task_rules_title_right_icon@3x.png
  • /data/data/####/node_modules_reactnavigation_src_views_assets_b...sk.png
  • /data/data/####/node_modules_reactnavigation_src_views_assets_backicon.png
  • /data/data/####/pay_address_location_icon@2x.png
  • /data/data/####/pay_address_location_icon@3x.png
  • /data/data/####/pay_address_top_line@2x.png
  • /data/data/####/pay_address_top_line@3x.png
  • /data/data/####/pay_recommend_icon@2x.png
  • /data/data/####/pay_recommend_icon@3x.png
  • /data/data/####/pay_time_icon@2x.png
  • /data/data/####/pay_time_icon@3x.png
  • /data/data/####/pay_way_alipay_icon@2x.png
  • /data/data/####/pay_way_alipay_icon@3x.png
  • /data/data/####/pay_way_switch_icon_normal@2x.png
  • /data/data/####/pay_way_switch_icon_normal@3x.png
  • /data/data/####/pay_way_switch_icon_selected@2x.png
  • /data/data/####/pay_way_switch_icon_selected@3x.png
  • /data/data/####/pay_way_wechat_icon@2x.png
  • /data/data/####/pay_way_wechat_icon@3x.png
  • /data/data/####/post_detail_choose_normal@2x.png
  • /data/data/####/post_detail_choose_normal@3x.png
  • /data/data/####/post_detail_choose_normal_disable@2x.png
  • /data/data/####/post_detail_choose_normal_disable@3x.png
  • /data/data/####/post_detail_choose_selected@2x.png
  • /data/data/####/post_detail_choose_selected@3x.png
  • /data/data/####/post_detail_choose_selected_disable@2x.png
  • /data/data/####/post_detail_choose_selected_disable@3x.png
  • /data/data/####/post_detail_empty_view@2x.png
  • /data/data/####/post_detail_empty_view@3x.png
  • /data/data/####/post_detail_like_icon@2x.png
  • /data/data/####/post_detail_like_icon@3x.png
  • /data/data/####/post_detail_like_normal_icon@2x.png
  • /data/data/####/post_detail_like_normal_icon@3x.png
  • /data/data/####/post_detail_reply_icon@2x.png
  • /data/data/####/post_detail_reply_icon@3x.png
  • /data/data/####/post_detail_reply_like_icon@2x.png
  • /data/data/####/post_detail_reply_like_icon@3x.png
  • /data/data/####/post_detail_reply_like_normal_icon@2x.png
  • /data/data/####/post_detail_reply_like_normal_icon@3x.png
  • /data/data/####/post_detail_reply_reply_icon@2x.png
  • /data/data/####/post_detail_reply_reply_icon@3x.png
  • /data/data/####/post_detail_share_circle_icon@2x.png
  • /data/data/####/post_detail_share_circle_icon@3x.png
  • /data/data/####/post_detail_share_collect_normal_icon@2x.png
  • /data/data/####/post_detail_share_collect_normal_icon@3x.png
  • /data/data/####/post_detail_share_collect_press_icon@3x.png
  • /data/data/####/post_detail_share_delete_press_icon@2x.png
  • /data/data/####/post_detail_share_delete_press_icon@3x.png
  • /data/data/####/post_detail_share_qq_icon@2x.png
  • /data/data/####/post_detail_share_qq_icon@3x.png
  • /data/data/####/post_detail_share_qzone_icon@2x.png
  • /data/data/####/post_detail_share_qzone_icon@3x.png
  • /data/data/####/post_detail_share_report_icon@2x.png
  • /data/data/####/post_detail_share_report_icon@3x.png
  • /data/data/####/post_detail_share_wx_icon@2x.png
  • /data/data/####/post_detail_share_wx_icon@3x.png
  • /data/data/####/post_detail_view_all_reply_arrow@2x.png
  • /data/data/####/post_detail_view_all_reply_arrow@3x.png
  • /data/data/####/post_item_overhead_icon@2x.png
  • /data/data/####/post_item_overhead_icon@3x.png
  • /data/data/####/post_item_share_icon@2x.png
  • /data/data/####/post_item_share_icon@3x.png
  • /data/data/####/post_item_vip_icon@2x.png
  • /data/data/####/post_item_vip_icon@3x.png
  • /data/data/####/push.pid
  • /data/data/####/pushext.db-journal
  • /data/data/####/pushg.db-journal
  • /data/data/####/pushsdk.db-journal
  • /data/data/####/react_components_form_images_edit_clear_icon.png
  • /data/data/####/react_components_header_images_nav_back.png
  • /data/data/####/react_components_header_images_nav_back_dark.png
  • /data/data/####/react_components_header_images_nav_close_dark.png
  • /data/data/####/react_components_listview_images_turn_top_btn.png
  • /data/data/####/react_pages_articleitem_images_article_state_new_icon.png
  • /data/data/####/react_pages_articleitem_images_article_state_top_icon.png
  • /data/data/####/react_pages_articleitem_images_article_title_ar...on.png
  • /data/data/####/react_pages_articleitem_images_daydayup_recomme...on.png
  • /data/data/####/react_pages_articleitem_images_exchange_icon_1.png
  • /data/data/####/react_pages_articleitem_images_exchange_icon_2.png
  • /data/data/####/react_pages_articleitem_images_exchange_icon_3.png
  • /data/data/####/react_pages_articleitem_images_exchange_icon_4.png
  • /data/data/####/react_pages_articleitem_images_home_video_bg.png
  • /data/data/####/react_pages_articleitem_images_list_content_price.png
  • /data/data/####/react_pages_articlelist_image_menu_search_icon_dark.png
  • /data/data/####/react_pages_bbs_guide_images_allcircle_click_tip.png
  • /data/data/####/react_pages_bbs_guide_images_allcircle_icon.png
  • /data/data/####/react_pages_bbs_guide_images_circle_click_tip.png
  • /data/data/####/react_pages_bbs_guide_images_circle_icon.png
  • /data/data/####/react_pages_bbs_guide_images_hottopic_click_tip.png
  • /data/data/####/react_pages_bbs_guide_images_hottopic_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_attention_add.png
  • /data/data/####/react_pages_bbs_images_bbs_attention_cancle.png
  • /data/data/####/react_pages_bbs_images_bbs_attention_cancle_allcircle.png
  • /data/data/####/react_pages_bbs_images_bbs_btn_blue.png
  • /data/data/####/react_pages_bbs_images_bbs_circle_look_all.png
  • /data/data/####/react_pages_bbs_images_bbs_create_float_btn.png
  • /data/data/####/react_pages_bbs_images_bbs_focus_index_all_circle_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_focus_index_circle_add_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_focus_index_circle_r...on.png
  • /data/data/####/react_pages_bbs_images_bbs_look_all.png
  • /data/data/####/react_pages_bbs_images_bbs_post_detail_more_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_post_index_add_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_post_index_anonymous...on.png
  • /data/data/####/react_pages_bbs_images_bbs_post_index_delete_ci...on.png
  • /data/data/####/react_pages_bbs_images_bbs_post_index_delete_img_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_post_index_down_arrow.png
  • /data/data/####/react_pages_bbs_images_bbs_post_index_img_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_post_index_topic_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_post_index_topic_press_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_post_my.png
  • /data/data/####/react_pages_bbs_images_bbs_reply_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_title_hot_icon.png
  • /data/data/####/react_pages_bbs_images_bbs_title_top_icon.png
  • /data/data/####/react_pages_bbs_images_focus_index_circle_item_bg1.png
  • /data/data/####/react_pages_bbs_images_focus_index_circle_item_bg2.png
  • /data/data/####/react_pages_bbs_images_focus_index_circle_item_bg3.png
  • /data/data/####/react_pages_bbs_images_focus_index_circle_item_bg4.png
  • /data/data/####/react_pages_bbs_images_post_detail_choose_norma...le.png
  • /data/data/####/react_pages_bbs_images_post_detail_choose_normal.png
  • /data/data/####/react_pages_bbs_images_post_detail_choose_selec...le.png
  • /data/data/####/react_pages_bbs_images_post_detail_choose_selected.png
  • /data/data/####/react_pages_bbs_images_post_detail_empty_view.png
  • /data/data/####/react_pages_bbs_images_post_detail_like_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_like_normal_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_reply_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_reply_like_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_reply_like_n...on.png
  • /data/data/####/react_pages_bbs_images_post_detail_reply_reply_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_share_circle_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_share_collec...on.png
  • /data/data/####/react_pages_bbs_images_post_detail_share_delete...on.png
  • /data/data/####/react_pages_bbs_images_post_detail_share_qq_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_share_qzone_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_share_report_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_share_wx_icon.png
  • /data/data/####/react_pages_bbs_images_post_detail_view_all_rep...ow.png
  • /data/data/####/react_pages_bbs_images_post_item_overhead_icon.png
  • /data/data/####/react_pages_bbs_images_post_item_share_icon.png
  • /data/data/####/react_pages_bbs_images_post_item_vip_icon.png
  • /data/data/####/react_pages_course_cache_images_cache_download_...le.png
  • /data/data/####/react_pages_course_cache_images_cache_download_...op.png
  • /data/data/####/react_pages_course_cache_images_cache_download_...rt.png
  • /data/data/####/react_pages_course_cache_images_cache_downloaded.png
  • /data/data/####/react_pages_course_cache_images_cache_downloading.png
  • /data/data/####/react_pages_course_cache_images_cache_more_sche...al.png
  • /data/data/####/react_pages_course_cache_images_cache_more_sche...le.png
  • /data/data/####/react_pages_course_cache_images_course_cache_list_icon.png
  • /data/data/####/react_pages_course_images_empty_no_cache_icon.png
  • /data/data/####/react_pages_course_images_empty_no_ware_icon.png
  • /data/data/####/react_pages_evaluate_images_empty_start.png
  • /data/data/####/react_pages_evaluate_images_selected_start.png
  • /data/data/####/react_pages_evaluatelist_images_empty_evaluate_icon.png
  • /data/data/####/react_pages_evaluatelist_images_empty_start.png
  • /data/data/####/react_pages_evaluatelist_images_light_start.png
  • /data/data/####/react_pages_favorite_images_favorite_media_icon.png
  • /data/data/####/react_pages_favorite_images_ic_favorite_bbs.png
  • /data/data/####/react_pages_home_images_bj_vip_icon.png
  • /data/data/####/react_pages_home_images_home_article_cell_icon.png
  • /data/data/####/react_pages_home_images_home_audio_cell_icon.png
  • /data/data/####/react_pages_home_images_home_bj_vip_bg.png
  • /data/data/####/react_pages_home_images_home_community_msg_cancle.png
  • /data/data/####/react_pages_home_images_home_community_msg_icon.png
  • /data/data/####/react_pages_home_images_home_course_hot.png
  • /data/data/####/react_pages_home_images_home_course_rationing_icon.png
  • /data/data/####/react_pages_home_images_home_course_rationing_icon_1.png
  • /data/data/####/react_pages_home_images_home_course_subcribing.png
  • /data/data/####/react_pages_home_images_home_course_tuan.png
  • /data/data/####/react_pages_home_images_home_everyday_article_icon.png
  • /data/data/####/react_pages_home_images_home_everyday_audio_icon.png
  • /data/data/####/react_pages_home_images_home_everyday_study_item_icon.png
  • /data/data/####/react_pages_home_images_home_group_title_more_icon.png
  • /data/data/####/react_pages_home_images_home_item_meeting_icon.png
  • /data/data/####/react_pages_home_images_home_living_bgview.png
  • /data/data/####/react_pages_home_images_home_living_living_icon.png
  • /data/data/####/react_pages_home_images_home_living_waiting_icon.png
  • /data/data/####/react_pages_home_images_home_media_progress_ion.png
  • /data/data/####/react_pages_home_images_home_nd_vip_bg.png
  • /data/data/####/react_pages_home_images_home_new_user_task_icon.png
  • /data/data/####/react_pages_home_images_home_series_course_bg.png
  • /data/data/####/react_pages_home_images_home_tab_course_icon_normal.png
  • /data/data/####/react_pages_home_images_home_tab_course_icon_selected.png
  • /data/data/####/react_pages_home_images_home_tab_home_icon_normal.png
  • /data/data/####/react_pages_home_images_home_tab_home_icon_selected.png
  • /data/data/####/react_pages_home_images_home_tab_my_icon_normal.png
  • /data/data/####/react_pages_home_images_home_tab_my_icon_selected.png
  • /data/data/####/react_pages_home_images_home_tab_new_icon.png
  • /data/data/####/react_pages_home_images_home_tab_vip_icon_normal.png
  • /data/data/####/react_pages_home_images_home_tab_vip_icon_press.png
  • /data/data/####/react_pages_home_images_home_toolbar_message_icon.png
  • /data/data/####/react_pages_home_images_home_toolbar_search_icon.png
  • /data/data/####/react_pages_home_images_home_toolbar_sign_icon.png
  • /data/data/####/react_pages_home_images_home_topic_list_icon.png
  • /data/data/####/react_pages_home_images_home_zs_vip_bg.png
  • /data/data/####/react_pages_home_images_my_daysign_icon.png
  • /data/data/####/react_pages_home_images_my_message_icon.png
  • /data/data/####/react_pages_home_images_my_setting_icon.png
  • /data/data/####/react_pages_home_images_nd_vip_icon.png
  • /data/data/####/react_pages_home_images_time_interval.png
  • /data/data/####/react_pages_home_images_vip_free_icon.png
  • /data/data/####/react_pages_home_images_zs_vip_icon.png
  • /data/data/####/react_pages_home_meng_images_home_meng_icon_bbs.png
  • /data/data/####/react_pages_home_meng_images_home_meng_icon_bbs_word.png
  • /data/data/####/react_pages_home_meng_images_meng_i_know_btn.png
  • /data/data/####/react_pages_home_mycomponent_images_my_cache_icon.png
  • /data/data/####/react_pages_home_mycomponent_images_my_coin.png
  • /data/data/####/react_pages_home_mycomponent_images_my_community_icon.png
  • /data/data/####/react_pages_home_mycomponent_images_my_exchange...on.png
  • /data/data/####/react_pages_home_mycomponent_images_my_first_re...bg.png
  • /data/data/####/react_pages_home_mycomponent_images_my_first_re...se.png
  • /data/data/####/react_pages_home_mycomponent_images_my_first_re...tn.png
  • /data/data/####/react_pages_home_mycomponent_images_my_group_icon.png
  • /data/data/####/react_pages_home_mycomponent_images_my_help_icon.png
  • /data/data/####/react_pages_home_mycomponent_images_my_important_bg.png
  • /data/data/####/react_pages_home_mycomponent_images_my_metting_icon.png
  • /data/data/####/react_pages_home_mycomponent_images_my_money_icon.png
  • /data/data/####/react_pages_home_mycomponent_images_my_question_icon.png
  • /data/data/####/react_pages_home_mycomponent_images_my_task_icon.png
  • /data/data/####/react_pages_home_mycomponent_images_my_vip_icon.png
  • /data/data/####/react_pages_my_images_community_ishidden.png
  • /data/data/####/react_pages_my_images_community_nohidden.png
  • /data/data/####/react_pages_my_images_community_reply.png
  • /data/data/####/react_pages_my_images_series_course_jiantou.png
  • /data/data/####/react_pages_my_images_series_detail_bj_bg.png
  • /data/data/####/react_pages_my_images_series_detail_nd_bg.png
  • /data/data/####/react_pages_my_images_series_detail_suo.png
  • /data/data/####/react_pages_my_images_series_detail_zs_bg.png
  • /data/data/####/react_pages_pay_images_pay_address_location_icon.png
  • /data/data/####/react_pages_pay_images_pay_address_top_line.png
  • /data/data/####/react_pages_pay_images_pay_recommend_icon.png
  • /data/data/####/react_pages_pay_images_pay_time_icon.png
  • /data/data/####/react_pages_pay_images_pay_way_alipay_icon.png
  • /data/data/####/react_pages_pay_images_pay_way_switch_icon_normal.png
  • /data/data/####/react_pages_pay_images_pay_way_switch_icon_selected.png
  • /data/data/####/react_pages_pay_images_pay_way_wechat_icon.png
  • /data/data/####/react_pages_tasklist_images_coin.png
  • /data/data/####/react_pages_tasklist_images_get_coin_icon.png
  • /data/data/####/react_pages_tasklist_images_get_coin_icon_completed.png
  • /data/data/####/react_pages_tasklist_images_new_user_task_list_...bg.png
  • /data/data/####/react_pages_tasklist_images_new_user_task_list_...ed.png
  • /data/data/####/react_pages_tasklist_images_new_user_task_list_...on.png
  • /data/data/####/react_pages_tasklist_images_new_user_task_rules...on.png
  • /data/data/####/react_pages_tasklist_images_task_list_top_bg.png
  • /data/data/####/react_pages_tasklist_images_task_pull_down.png
  • /data/data/####/react_pages_tasklist_images_task_pull_up.png
  • /data/data/####/react_pages_tasklist_images_task_receive_score.png
  • /data/data/####/react_pages_user_images_checkbox_checked.png
  • /data/data/####/react_pages_user_images_checkbox_unchecked.png
  • /data/data/####/react_pages_user_images_ic_change_phone_number.png
  • /data/data/####/react_pages_user_images_ic_login_qq.png
  • /data/data/####/react_pages_user_images_ic_login_wechat.png
  • /data/data/####/react_pages_user_images_ic_third_party_bind_qq.png
  • /data/data/####/react_pages_user_images_ic_third_party_bind_wechat.png
  • /data/data/####/react_pages_user_images_register_gift.png
  • /data/data/####/react_res_image_arrow.png
  • /data/data/####/react_res_image_big_placehoder.png
  • /data/data/####/react_res_image_checkbox_normal.png
  • /data/data/####/react_res_image_checkbox_pressed.png
  • /data/data/####/react_res_image_circle_placeholder.png
  • /data/data/####/react_res_image_default_avatar.png
  • /data/data/####/react_res_image_fetch_empty_icon_new.png
  • /data/data/####/react_res_image_fetch_fail_icon.png
  • /data/data/####/react_res_image_fetch_fail_icon_new.png
  • /data/data/####/react_res_image_reload_data_again_bg.png
  • /data/data/####/react_res_image_slogan.png
  • /data/data/####/react_res_image_small_placeholder.png
  • /data/data/####/register_gift@2x.png
  • /data/data/####/register_gift@3x.png
  • /data/data/####/reload_data_again_bg@2x.png
  • /data/data/####/reload_data_again_bg@3x.png
  • /data/data/####/run.pid
  • /data/data/####/selected_start@2x.png
  • /data/data/####/selected_start@3x.png
  • /data/data/####/sensorsdata.xml
  • /data/data/####/series_course_jiantou@2x.png
  • /data/data/####/series_course_jiantou@3x.png
  • /data/data/####/series_detail_bj_bg@2x.png
  • /data/data/####/series_detail_bj_bg@3x.png
  • /data/data/####/series_detail_nd_bg@2x.png
  • /data/data/####/series_detail_suo@2x.png
  • /data/data/####/series_detail_suo@3x.png
  • /data/data/####/series_detail_zs_bg@2x.png
  • /data/data/####/series_detail_zs_bg@3x.png
  • /data/data/####/shared.db-journal
  • /data/data/####/slogan@2x.png
  • /data/data/####/slogan@3x.png
  • /data/data/####/small_placeholder@2x.png
  • /data/data/####/small_placeholder@3x.png
  • /data/data/####/task_list_top_bg@2x.png
  • /data/data/####/task_list_top_bg@3x.png
  • /data/data/####/task_pull_down@2x.png
  • /data/data/####/task_pull_down@3x.png
  • /data/data/####/task_pull_up@2x.png
  • /data/data/####/task_pull_up@3x.png
  • /data/data/####/task_receive_score@2x.png
  • /data/data/####/task_receive_score@3x.png
  • /data/data/####/tdata_BAI450
  • /data/data/####/tdata_BAI450.jar
  • /data/data/####/tdata_YJA893
  • /data/data/####/tdata_YJA893.jar
  • /data/data/####/time_interval@2x.png
  • /data/data/####/time_interval@3x.png
  • /data/data/####/turn_top_btn@2x.png
  • /data/data/####/turn_top_btn@3x.png
  • /data/data/####/ua.db
  • /data/data/####/ua.db-journal
  • /data/data/####/umeng_general_config.xml
  • /data/data/####/umeng_it.cache
  • /data/data/####/ut.db
  • /data/data/####/ut.db-journal
  • /data/data/####/vip_free_icon@2x.png
  • /data/data/####/vip_free_icon@3x.png
  • /data/data/####/webview.db-journal
  • /data/data/####/webviewCookiesChromium.db-journal
  • /data/data/####/webviewCookiesChromium.db-journal (deleted)
  • /data/data/####/webviewCookiesChromiumPrivate.db-journal
  • /data/data/####/zs_vip_icon@2x.png
  • /data/data/####/zs_vip_icon@3x.png
  • /data/media/####/.nomedia
  • /data/media/####/Alvin2.xml
  • /data/media/####/ContextData.xml
  • /data/media/####/app.db
  • /data/media/####/com.getui.sdk.deviceId.db
  • /data/media/####/com.igexin.sdk.deviceId.db
  • /data/media/####/com.prance.app.bin
  • /data/media/####/com.prance.app.db
  • /data/media/####/tdata_BAI450
  • /data/media/####/tdata_YJA893
  • /data/media/####/test.log
Miscellaneous:
Executes the following shell scripts:
  • <Package Folder>/files/gdaemon_20161017 0 <Package>/com.prance.third.impl.GeTuiPushService 24365 300 0
  • cat /sys/class/net/wlan0/address
  • chmod 700 <Package Folder>/files/gdaemon_20161017
  • mount
  • sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.prance.third.impl.GeTuiPushService 24365 300 0
Loads the following dynamic libraries:
  • Bugly
  • getuiext2
  • libfb
  • libjiagu-1267286255
  • libreactnativejni
  • libyoga
  • ut_c_api
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
  • AES-CBC-PKCS7Padding
  • RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2020

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124