Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) n####.163.com:80
- TCP(HTTP/1.1) q####.c####.l####.####.com:80
- TCP(HTTP/1.1) m.analy####.126.####.com:80
- TCP(HTTP/1.1) up####.sdk.jig####.cn:80
- TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
- TCP(HTTP/1.1) f####.bn.net####.####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) o####.e.189.cn:80
- TCP(HTTP/1.1) ip.ws.1####.net:80
- TCP(HTTP/1.1) norma-e####.m####.com:80
- TCP(HTTP/1.1) p.3g.1####.com:80
- TCP(HTTP/1.1) ip.ch####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) n####.ws.126.####.com:80
- TCP(HTTP/1.1) mam.net####.com:80
- TCP(SSL/3.0) hu####.net####.com:443
- TCP(TLS/1.0) s####.reg.163.com:443
- TCP(TLS/1.0) b####.163.com:443
- TCP(TLS/1.0) ratcrac####.cos.ap-guan####.####.com:443
- TCP(TLS/1.0) lbs.net####.im:443
- TCP(TLS/1.0) n####.ws.126.####.com:443
- TCP(TLS/1.0) dt.net####.im:443
- TCP(TLS/1.0) qy-swa####.qi####.com:443
- TCP(TLS/1.0) m.analy####.126.####.com:443
- TCP(TLS/1.0) 1####.177.119.139:443
- TCP(TLS/1.0) g1.1####.com:443
- TCP(TLS/1.0) hu####.net####.com:443
- TCP(TLS/1.0) s####.j####.cn:443
- TCP(TLS/1.0) vip.o####.163.####.com:443
- TCP(TLS/1.0) nim.qi####.com:443
- TCP(TLS/1.0) yt####.ws.126.####.com:443
- TCP(TLS/1.0) res.wx.qq.####.com:443
- TCP(TLS/1.0) a####.evergr####.com:443
- TCP(TLS/1.0) nc.htt####.c.####.com:443
- TCP(TLS/1.0) o####.163.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) c.o####.163.####.com:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) e.cn.miao####.com:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) n####.163.com:443
- TCP(TLS/1.0) g####.l####.126.net:443
- TCP(TLS/1.0) sdkr####.l####.126.net:443
- TCP cm-1####.ig####.com:5225
- TCP l####.net####.im:8080
- TCP sdk.o####.t####.####.com:5224
- UDP s.j####.cn:19000
- TCP 1####.25.50.215:7002
- 153.25.232.####.arpa
- 166.181.111.####.arpa
- 7j####.c####.z0.####.com
- a####.evergr####.com
- a####.u####.co
- a####.u####.com
- app-mea####.com
- b####.163.com
- c-h####.g####.com
- c.o####.163.com
- cdn-sdk####.g####.com
- cm-1####.ig####.com
- dt.net####.im
- e.cn.miao####.com
- f####.bn.net####.com
- fl.r####.163.com
- g####.l####.126.net
- g1.1####.com
- hu####.net####.com
- ip.ch####.com
- ip.ws.1####.net
- l####.net####.im
- lbs.net####.im
- m.analy####.126.net
- mam.net####.com
- n####.163.com
- n####.ws.126.net
- nc.htt####.c.####.com
- nim.qi####.com
- norma-e####.m####.com
- o####.163.com
- o####.e.189.cn
- open-i####.ws.126.net
- p.3g.1####.com
- qy-swa####.qi####.com
- r####.wx.qq.com
- ratcrac####.cos.ap-guan####.####.com
- s####.j####.cn
- s####.reg.163.com
- s.j####.cn
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sdkr####.l####.126.net
- sett####.crashly####.com
- up####.sdk.jig####.cn
- vip.o####.163.com
- vmon####.ws.net####.com
- w.c####.com
- yt####.ws.126.net
- cdn-sdk####.g####.com.####.com/tdata_EDB102
- cdn-sdk####.g####.com.####.com/tdata_fPG280
- cdn-sdk####.g####.com.####.com/tdata_uED964
- f####.bn.net####.####.com/51e2c823f07b06cedac0c9f2f4ef292f5f6c2053bada75...
- ip.ch####.com/getip.aspx
- ip.ws.1####.net/ipquery
- mam.net####.com/api/config/getClientIp
- mam.net####.com/api/v1/getconfig
- n####.163.com/madcollectid?timestamp=####&uid=####
- n####.163.com/madrs?app=####&platform=####&category=####&location=####&t...
- n####.ws.126.####.com/8a82745dbc1d4157a83ade909d83f334.gif
- n####.ws.126.####.com/image/snapshot_movie/2019/10/3/6/MER5FI836.jpg
- n####.ws.126.####.com/image/snapshot_movie/2019/10/J/S/MERL5OJJS.jpg
- n####.ws.126.####.com/image/snapshot_movie/2019/11/E/N/METG2PDEN.jpg
- n####.ws.126.####.com/image/snapshot_movie/2019/7/A/Q/MEID9P3AQ.jpg
- n####.ws.126.####.com/image/snapshot_movie/2019/8/D/T/MEM3A4NDT.jpg
- n####.ws.126.####.com/image/snapshot_movie/2019/8/O/5/MELPBVEO5.jpg
- norma-e####.m####.com/android/exchange/getpublickey.do
- o####.e.189.cn/openapi/freeflow/auth.do?sign=####¶mStr=####&format=#...
- q####.c####.l####.####.com/config/hz-hzv6.conf
- q####.c####.l####.####.com/tdata_tYM194
- sdk.o####.p####.####.com/api/addr.htm
- a####.u####.com/app_logs
- c-h####.g####.com/api.php?format=####&t=####
- m.analy####.126.####.com/news/c
- mam.net####.com/data
- n####.163.com/madfeedback
- norma-e####.m####.com/push/android/external/add.do
- p.3g.1####.com/media/push/register/android/vopen
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
- up####.sdk.jig####.cn/v1/push/sdk/postlist
- /data/data/####/.jg.ic
- /data/data/####/1cab487a48e0
- /data/data/####/5E4F64210274-0001-0856-22BF9BFA10D2BeginSession.cls_temp
- /data/data/####/5E4F64210274-0001-0856-22BF9BFA10D2BeginSession.json
- /data/data/####/5E4F64210274-0001-0856-22BF9BFA10D2SessionApp.cls_temp
- /data/data/####/5E4F64210274-0001-0856-22BF9BFA10D2SessionApp.json
- /data/data/####/5E4F64210274-0001-0856-22BF9BFA10D2SessionDevice.cls_temp
- /data/data/####/5E4F64210274-0001-0856-22BF9BFA10D2SessionDevice.json
- /data/data/####/5E4F64210274-0001-0856-22BF9BFA10D2SessionOS.cls_temp
- /data/data/####/5E4F64210274-0001-0856-22BF9BFA10D2SessionOS.json
- /data/data/####/5E4F642300D7-0001-08CA-22BF9BFA10D2BeginSession.cls_temp
- /data/data/####/5E4F642300D7-0001-08CA-22BF9BFA10D2BeginSession.json
- /data/data/####/5E4F642300D7-0001-08CA-22BF9BFA10D2SessionApp.cls_temp
- /data/data/####/5E4F642300D7-0001-08CA-22BF9BFA10D2SessionApp.json
- /data/data/####/5E4F642300D7-0001-08CA-22BF9BFA10D2SessionDevice.cls_temp
- /data/data/####/5E4F642300D7-0001-08CA-22BF9BFA10D2SessionDevice.json
- /data/data/####/5E4F642300D7-0001-08CA-22BF9BFA10D2SessionOS.cls_temp
- /data/data/####/5E4F642300D7-0001-08CA-22BF9BFA10D2SessionOS.json
- /data/data/####/5E4F64260179-0001-0920-22BF9BFA10D2BeginSession.cls_temp
- /data/data/####/5E4F64260179-0001-0920-22BF9BFA10D2BeginSession.json
- /data/data/####/5E4F64260179-0001-0920-22BF9BFA10D2SessionApp.cls_temp
- /data/data/####/5E4F64260179-0001-0920-22BF9BFA10D2SessionApp.json
- /data/data/####/5E4F64260179-0001-0920-22BF9BFA10D2SessionDevice.cls_temp
- /data/data/####/5E4F64260179-0001-0920-22BF9BFA10D2SessionDevice.json
- /data/data/####/5E4F64260179-0001-0920-22BF9BFA10D2SessionOS.cls_temp
- /data/data/####/5E4F64260179-0001-0920-22BF9BFA10D2SessionOS.json
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2BeginSession.cls
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2BeginSession.cls_temp
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2BeginSession.json
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2SessionApp.cls_temp
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2SessionApp.json
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2SessionDevice.cls_temp
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2SessionDevice.json
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2SessionOS.cls_temp
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2SessionOS.json
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2SessionUser.cls
- /data/data/####/5E4F642602DE-0001-0951-22BF9BFA10D2SessionUser.cls_temp
- /data/data/####/5E4F642603B2-0001-0933-22BF9BFA10D2BeginSession.cls_temp
- /data/data/####/5E4F642603B2-0001-0933-22BF9BFA10D2BeginSession.json
- /data/data/####/5E4F642603B2-0001-0933-22BF9BFA10D2SessionApp.cls_temp
- /data/data/####/5E4F642603B2-0001-0933-22BF9BFA10D2SessionApp.json
- /data/data/####/5E4F642603B2-0001-0933-22BF9BFA10D2SessionDevice.cls_temp
- /data/data/####/5E4F642603B2-0001-0933-22BF9BFA10D2SessionDevice.json
- /data/data/####/5E4F642603B2-0001-0933-22BF9BFA10D2SessionOS.cls_temp
- /data/data/####/5E4F642603B2-0001-0933-22BF9BFA10D2SessionOS.json
- /data/data/####/HTHttpDNS.xml
- /data/data/####/JPushSA_Config.xml
- /data/data/####/MultiDex.lock
- /data/data/####/NAPM-SDK.xml
- /data/data/####/NELoginConfig.xml
- /data/data/####/NIMSDK_Config_767f44301c2b3f71134afe903dac4b38.xml
- /data/data/####/NIMSDK_Config_767f44301c2b3f71134afe903dac4b38_...dc.xml
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/Unicorn.767f44301c2b3f71134afe903dac4b38.xml
- /data/data/####/ad_log.txt
- /data/data/####/appPackageNames
- /data/data/####/classify.xml
- /data/data/####/cn.com.mma.mobile.tracking.other.xml
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android;answers;settings.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.google.InstanceId.properties
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml (deleted)
- /data/data/####/com.netease.vopen_preferences.xml
- /data/data/####/com.qiyukf.analytics.xml
- /data/data/####/com.x.y.1.xml
- /data/data/####/com.x.y.2.xml
- /data/data/####/conf
- /data/data/####/config.db-journal
- /data/data/####/config_map.xml
- /data/data/####/constants_file.xml
- /data/data/####/crashlytics-userlog-5E4F642300D7-0001-08CA-22BF...mp.tmp
- /data/data/####/da_pref_config.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/exchangeIdentity.json
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/galaxy_galaxy_ps_body
- /data/data/####/galaxy_galaxy_ps_tmp_body
- /data/data/####/galaxy_pref.xml
- /data/data/####/galaxy_session
- /data/data/####/gdaemon_20161017
- /data/data/####/geofencing.db
- /data/data/####/geofencing.db-journal
- /data/data/####/getui_sp.xml
- /data/data/####/google_app_measurement.db-journal
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/gx_sp.xml
- /data/data/####/home_file.xml
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/initialization_marker
- /data/data/####/io.fabric.sdk.android;fabric;c.a.a.a.m.xml
- /data/data/####/jpush_device_info.xml
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_stat_cache.json
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/jpush_statistics.db
- /data/data/####/jpush_statistics.db-journal
- /data/data/####/key_white_list.xml
- /data/data/####/libMMANDKSignature.so
- /data/data/####/libjiagu924202256.so
- /data/data/####/mipush_extra.xml
- /data/data/####/mipush_region
- /data/data/####/mipush_region.lock
- /data/data/####/mobclick_agent_cached_com.netease.vopen20190514
- /data/data/####/mobidroid.sqlite-journal
- /data/data/####/msg.db-journal
- /data/data/####/msg_queue
- /data/data/####/multidex.version.xml
- /data/data/####/napm.xml
- /data/data/####/netease_apm.db-journal
- /data/data/####/netease_vopen.db-journal
- /data/data/####/ntesaddata.xml
- /data/data/####/ntesaddata.xml (deleted)
- /data/data/####/ntesepaddata.xml
- /data/data/####/pay_course.xml
- /data/data/####/push.pid
- /data/data/####/push_setting.xml
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qiyu_save_767f44301c2b3f71134afe903dac4b38.xml
- /data/data/####/run.pid
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap (deleted)
- /data/data/####/session_analytics.tap.tmp
- /data/data/####/sp_client_report_status.xml
- /data/data/####/sp_push.xml
- /data/data/####/square_file.xml
- /data/data/####/statistics.db-journal
- /data/data/####/store_feedback_update_file.xml
- /data/data/####/tdata_fPG280
- /data/data/####/tdata_fPG280.jar
- /data/data/####/tdata_uED964
- /data/data/####/tdata_uED964.jar
- /data/data/####/um_cache_1582261299139.env
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/unicorn#cheese#
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/.push_deviceid
- /data/media/####/1582261310211
- /data/media/####/1582261310214
- /data/media/####/1582261310254
- /data/media/####/1582261310270
- /data/media/####/1582261310305
- /data/media/####/1582261310306
- /data/media/####/2020-02-21-08-01-23-745.log
- /data/media/####/2020-02-21-08-01-27-258.log
- /data/media/####/2020-02-21-08-01-27-470.log
- /data/media/####/2020-02-21-08-01-28-463.log
- /data/media/####/2020-02-21.log.txt
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.netease.vopen.bin
- /data/media/####/com.netease.vopen.db
- /data/media/####/player_log_mapped.log
- /data/media/####/tdata_fPG280
- /data/media/####/tdata_uED964
- /data/media/####/test.log
- /system/bin/cat /proc/cpuinfo
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.netease.push.newpush.service.PushNewGTCoreService 24704 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- getprop net.dns1
- getprop net.dns2
- mount
- ping -c 10 hubble.netease.com
- ping -c 10 stats.jpush.cn
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.netease.push.newpush.service.PushNewGTCoreService 24704 300 0
- getuiext2
- jcore111
- libgifimage
- libimagepipeline
- libjiagu924202256
- napmcore
- neliveplayer
- nelpengine
- nelprender
- tracepath
- ursandroidcore
- AES
- AES-CBC-PKCS5Padding
- AES-CFB-NoPadding
- AES-ECB-NoPadding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-None-PKCS1Padding
- AES-CBC-PKCS5Padding
- AES-ECB-NoPadding
- AES-ECB-PKCS5Padding
- RSA-None-PKCS1Padding