Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) andy####.shijiw####.com.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) a####.shijiw####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(TLS/1.0) lbs.net####.im:443
- TCP(TLS/1.0) nim.qi####.com:443
- TCP(TLS/1.0) dt.net####.im:443
- TCP(TLS/1.0) qy-swa####.qi####.com:443
- TCP c####.g####.ig####.com:5225
- TCP sdk.o####.t####.####.com:5224
- TCP l####.net####.im:8080
- 7j####.c####.z0.####.com
- a####.shijiw####.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- andy####.shijiw####.com
- c####.g####.ig####.com
- c-h####.g####.com
- dt.net####.im
- l####.net####.im
- lbs.net####.im
- nim.qi####.com
- qy-swa####.qi####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- a####.shijiw####.com/html/detail.html
- a####.shijiw####.com/html/static/css/app.d0c12dafc000910d196dfcc5a7da317...
- a####.shijiw####.com/html/static/js/app.2534e8f8e2785abfb9c2.15431131421...
- a####.shijiw####.com/html/static/js/manifest.3a98c981890ae406b112.154311...
- a####.shijiw####.com/html/static/js/vendor.cfd9dc68086661286954.15431131...
- andy####.shijiw####.com.####.com/1535099779_3969161102.jpg?imageVi####
- andy####.shijiw####.com.####.com/1535100251_4117856970.jpg?imageVi####
- andy####.shijiw####.com.####.com/1535597281_626613831.png
- andy####.shijiw####.com.####.com/1535597324_3758787103.jpg
- andy####.shijiw####.com.####.com/1536044085_4190385037.jpg?imageVi####
- andy####.shijiw####.com.####.com/1536044134_3000843074.jpg?imageVi####
- andy####.shijiw####.com.####.com/1538794017_1049727766.png?imageVi####
- andy####.shijiw####.com.####.com/1539308130_1978608478.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539308355_942632612.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539308882_3231586428.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539309115_749090615.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539309306_694648477.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539335011_622900731.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539825879_625838976.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539825921_3432043055.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539825948_1873656235.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539825972_1164954721.jpg?imageVi####
- andy####.shijiw####.com.####.com/1539826389_3995286566.jpg?imageVi####
- andy####.shijiw####.com.####.com/1543540800_392993508.jpg?imageVi####
- andy####.shijiw####.com.####.com/1543541002_2117049266.jpg?imageVi####
- andy####.shijiw####.com.####.com/1543541116_1395202148.jpg?imageVi####
- andy####.shijiw####.com.####.com/1543541180_2409288672.jpg?imageVi####
- andy####.shijiw####.com.####.com/1543541306_419600437.jpg?imageVi####
- andy####.shijiw####.com.####.com/1543626590_760668992.jpg?imageVi####
- andy####.shijiw####.com.####.com/1544149509_3385145121.png?imageVi####
- andy####.shijiw####.com.####.com/1544150103_3056893505.png?imageVi####
- andy####.shijiw####.com.####.com/1544251054_2586806641.png?imageVi####
- andy####.shijiw####.com.####.com/1544409125_3755922505.png?imageVi####
- andy####.shijiw####.com.####.com/1544410838_77103275.png?imageVi####
- t####.c####.q####.####.com/tdata_vHH584
- t####.c####.q####.####.com/tdata_wmL809
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- a####.shijiw####.com/api/v1/mobile/token_login
- a####.shijiw####.com/manage/activity/find-all.json
- a####.shijiw####.com/manage/broadcast/find-all.json
- a####.shijiw####.com/manage/catalog/find-all.json
- a####.shijiw####.com/manage/goods/find-all-by-type.json
- a####.shijiw####.com/manage/goods/find-one.json
- a####.shijiw####.com/manage/recommend/find-all.json
- a####.shijiw####.com/res/get_res
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- c-h####.g####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- /data/data/####/08556e3ec9336625995169a2add5b1b4783f3bbfe836df2....0.tmp
- /data/data/####/24e689444851df9069e18437c95e169d594c34edd900720....0.tmp
- /data/data/####/2615a4341f541930ae5461123a77b556890a840f9e3bbc3....0.tmp
- /data/data/####/33b758e71f8afa2a7dd8b01c2e9d37deda758f5e0d04b8f....0.tmp
- /data/data/####/3cd8fe2edb3d8836b8218f301a75e9397f0e08cfafbf6e4....0.tmp
- /data/data/####/3f3e336745be723509c2f62747dcfbb593bd8a429ba8a02....0.tmp
- /data/data/####/457b07d028c4169e48d0902af6e4719571c6c70ae89643b....0.tmp
- /data/data/####/50e9773facad86c16ad39b138327bcb8442bb945f683462....0.tmp
- /data/data/####/5218ef4112bdbb4973b1e29e5187df45caed66accb1b494....0.tmp
- /data/data/####/5a9c7cb195e681dfbbf5265c9a262280eb42e69ebdc29ee....0.tmp
- /data/data/####/5ae188eab1f9f0f1696179f5cd70ee3991277b7d07d0107....0.tmp
- /data/data/####/6c41ac8c01020c4dd3aebc959cc35e4ec295d1082709778....0.tmp
- /data/data/####/785ea0ded7c67d7dda3460464cf0a0a3bc2599c5f1874c4....0.tmp
- /data/data/####/7d754106575dac462a3110dc823343804e3d309679e8a9b....0.tmp
- /data/data/####/8be41c436e79ec06f651007485a651fcd974b031fda304f....0.tmp
- /data/data/####/8d36246873e6ddad277a5e22aedf9c2f21675651f8524cb....0.tmp
- /data/data/####/949bb7c661de79b111ab8fd16d95b84365f831662834cd8....0.tmp
- /data/data/####/9c635a55504cc79702497869500dbbd13b3895a8f0a2ed4....0.tmp
- /data/data/####/9f2626d9a7a5dc3dac055ad109d6670d217125438d3552e....0.tmp
- /data/data/####/NIMSDK_Config_49284469fd8aeaf34d0cdc77eb0c9d5f.xml
- /data/data/####/NIMSDK_Config_49284469fd8aeaf34d0cdc77eb0c9d5f_...3d.xml
- /data/data/####/Unicorn.49284469fd8aeaf34d0cdc77eb0c9d5f.xml
- /data/data/####/b5f985ccc3d667f8b8579da64ed302668cd6a8f79481e47....0.tmp
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c577bf5abfa9b80bb58c237d8cc6dc71a399517845284a2....0.tmp
- /data/data/####/c995a64318f5881c0352c834b0828f16780e97bfd8825be....0.tmp
- /data/data/####/com.qiyukf.analytics.xml
- /data/data/####/d00e451d971bbbed37bcfe4ff043a46caf7ed7090cf919e....0.tmp
- /data/data/####/d18892b68e251e296ac1a266db31337b0da1bfbd5e2cb3f....0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/e4452ffdcb509fb0158f0b3b252116d95fe4302b3043503....0.tmp
- /data/data/####/f484ff798cfde1cb6c963dd15a58bb6785a1c19c9a8e319....0.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal
- /data/data/####/journal.tmp
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.0.2.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/msg.db-journal
- /data/data/####/native_record_lock
- /data/data/####/okgo.db-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qiyu_save_49284469fd8aeaf34d0cdc77eb0c9d5f.xml
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/share_data.xml
- /data/data/####/tdata_vHH584
- /data/data/####/tdata_vHH584.jar
- /data/data/####/tdata_wmL809
- /data/data/####/tdata_wmL809.jar
- /data/data/####/unicorn#cheese#
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.shijiweika.andy.bin
- /data/media/####/com.shijiweika.andy.db
- /data/media/####/tdata_vHH584
- /data/media/####/tdata_wmL809
- /data/media/####/test.log
- /data/media/####/tmp_u_20181210
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.http.MyPushService 24903 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- Bugly
- getuiext2
- libnfix
- libshella-2.9.0.2
- libufix
- nfix
- ufix
- AES-ECB-NoPadding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-ECB-NoPadding
- AES-GCM-NoPadding