Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Adware.Gexin.22328

Added to the Dr.Web virus database: 2022-01-13

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Adware.Gexin.2.origin
Network activity:
Connects to:
  • UDP(DNS) 8####.8.4.4:53
  • TCP(HTTP/1.1) nav.cn.ron####.com:80
  • TCP(HTTP/1.1) d####.c####.l####.####.com:80
  • TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
  • TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
  • TCP(HTTP/1.1) and####.b####.qq.com:80
  • TCP(HTTP/1.1) c-h####.g####.com:80
  • TCP(HTTP/1.1) sdk-ope####.g####.com:80
  • TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
  • TCP(TLS/1.0) plb####.u####.com:443
  • TCP(TLS/1.0) j####.d####.com.####.cn:443
  • TCP(TLS/1.0) api.map.b####.com:443
  • TCP(TLS/1.0) s####.cn.ron####.com:443
  • TCP(TLS/1.0) al####.u####.com:443
  • TCP(TLS/1.0) instant####.google####.com:443
  • TCP(TLS/1.0) android####.go####.com:443
  • TCP(TLS/1.0) 1####.217.168.202:443
  • TCP(TLS/1.0) o####.map.b####.com:443
  • TCP(TLS/1.0) loc.map.b####.com:443
  • TCP(TLS/1.0) api.s####.com:443
  • TCP(TLS/1.0) wap.cmpass####.com:8443
  • TCP(TLS/1.0) cdn####.appa####.com:443
  • TCP(TLS/1.0) and####.google####.com:443
  • TCP(TLS/1.0) and####.cli####.go####.com:443
  • TCP(TLS/1.2) 2####.58.208.99:443
  • TCP(TLS/1.2) 1####.217.168.202:443
  • TCP cm-10####.g####.com:5225
  • TCP 1####.50.94.204:8000
  • TCP sdk.o####.t####.####.com:5224
DNS requests:
  • a####.b####.qq.com
  • aexcep####.b####.qq.com
  • and####.b####.qq.com
  • and####.cli####.go####.com
  • and####.google####.com
  • android####.go####.com
  • api.map.b####.com
  • api.s####.com
  • c-h####.g####.com
  • cdn####.appa####.com
  • cdn-sdk####.g####.com
  • cm-10####.g####.com
  • experi####.appa####.com
  • instant####.google####.com
  • j####.d####.com
  • loc.map.b####.com
  • nav.cn.ron####.com
  • o####.map.b####.com
  • plb####.u####.com
  • s####.cn.ron####.com
  • sdk-ope####.g####.com
  • sdk.c####.g####.com
  • sdk.o####.p####.####.com
  • sdk.o####.t####.####.com
  • sdk.o####.t####.####.com
  • sdk.o####.t####.####.com
  • sdk.o####.t####.####.net
  • u####.u####.com
  • wap.cmpass####.com
HTTP GET requests:
  • cdn####.appa####.com:443/apps/ADHOC_d57cad84-f540-4e6f-8395-e4dd90e95f79...
  • cdn-sdk####.g####.com.####.com/tdata_XYq933
  • cdn-sdk####.g####.com.####.com/tdata_pKN446
  • cdn-sdk####.g####.com.####.com/tdata_trp703
  • cdn-sdk####.g####.com.####.com/tdata_xEA084
  • d####.c####.l####.####.com/config/hzv9.conf
  • j####.d####.com.####.cn:443/api/v2/client/getabtestbytoken?platform=####
  • j####.d####.com.####.cn:443/api/v2/client/getappsetting?platform=####
  • j####.d####.com.####.cn:443/api/v2/client/im/filterword?platform=####
  • j####.d####.com.####.cn:443/api/v2/client/loading?city=####&size=####&no...
  • j####.d####.com.####.cn:443/api/v3/client/message/invitepoststatus?userI...
  • j####.d####.com.####.cn:443/api/v3/client/subscribetags/list?hidden_oper...
  • sdk-ope####.g####.com/api/addr.htm
HTTP POST requests:
  • aexcep####.b####.qq.com:8011/rqd/async
  • aexcep####.b####.qq.com:8012/rqd/async
  • al####.u####.com:443/unify_logs
  • and####.b####.qq.com/rqd/async
  • api.map.b####.com:443/sdkcs/verify
  • api.s####.com:443/chat-sdk/sdk/user/v1/collect.action
  • api.s####.com:443/chat-sdk/sdk/user/v1/config.action
  • c-h####.g####.com/api.php?format=####&t=####
  • cdn####.appa####.com:443/get_flags_async
  • j####.d####.com.####.cn:443/api/v2/client/dek/manifest?platform=####
  • j####.d####.com.####.cn:443/api/v2/client/device/activate?platform=####
  • j####.d####.com.####.cn:443/api/v2/client/devicetoken
  • j####.d####.com.####.cn:443/api/v2/client/stats
  • nav.cn.ron####.com/navipush.json
  • plb####.u####.com:443/umpx_internal
  • s####.cn.ron####.com:443/active.json
  • sdk-ope####.g####.com/api.php?format=####&t=####
File system changes:
Creates the following files:
  • /data/data/####/.imprint
  • /data/data/####/.jg.ic
  • /data/data/####/.lock
  • /data/data/####/0.chunk.js
  • /data/data/####/000001.dbtmp
  • /data/data/####/000004.dbtmp
  • /data/data/####/000005.log
  • /data/data/####/000006.dbtmp
  • /data/data/####/000007.log
  • /data/data/####/000008.dbtmp
  • /data/data/####/1.chunk.js
  • /data/data/####/2.chunk.js
  • /data/data/####/ADHOC_SHARED_PREFERENCE.xml
  • /data/data/####/ADHOC_SHARED_PREFERENCE.xml.bak
  • /data/data/####/ADHOC_SHARED_PREFERENCE.xml.bak (deleted)
  • /data/data/####/BeLog_1642093730744.log
  • /data/data/####/BeLog_1642093777552.log
  • /data/data/####/COUNTLY_STORE.xml
  • /data/data/####/CURRENT
  • /data/data/####/FwLog.xml
  • /data/data/####/IM.xml
  • /data/data/####/INSTALLATION
  • /data/data/####/LOCK
  • /data/data/####/MANIFEST-000001
  • /data/data/####/MANIFEST-000004
  • /data/data/####/MANIFEST-000006
  • /data/data/####/RongPush.xml
  • /data/data/####/Statistics.xml
  • /data/data/####/Statistics.xml.bak
  • /data/data/####/WebViewChromiumPrefs.xml
  • /data/data/####/a==7.5.3&&5.6.0_1642093735621_envelope.log
  • /data/data/####/ab_test.xml
  • /data/data/####/ab_test.xml.bak
  • /data/data/####/abtest.xml
  • /data/data/####/account-bind-list.534237e9e4218ca8d08a.js
  • /data/data/####/account-bind-list.a27dea0fba16441ef9634585b7091103-two.css
  • /data/data/####/account-bind-list.html
  • /data/data/####/account.534237e9e4218ca8d08a.js
  • /data/data/####/account.f7a72e7865c6cf0df7cf372b34c0d9da-two.css
  • /data/data/####/account.html
  • /data/data/####/add-work-experience.075afa53dfcaffcf63e9a44a477...wo.css
  • /data/data/####/add-work-experience.534237e9e4218ca8d08a.js
  • /data/data/####/add-work-experience.html
  • /data/data/####/agreement.534237e9e4218ca8d08a.js
  • /data/data/####/agreement.81d341a748c733563293e95b2cd3ef51-one.css
  • /data/data/####/agreement.html
  • /data/data/####/anti-fraud-guide.534237e9e4218ca8d08a.js
  • /data/data/####/anti-fraud-guide.72d679301fd4078933c47956e3219d83-two.css
  • /data/data/####/anti-fraud-guide.html
  • /data/data/####/apply-cash-record.534237e9e4218ca8d08a.js
  • /data/data/####/apply-cash-record.a86c4161011acf20609153ea0d3adf9a-two.css
  • /data/data/####/apply-cash-record.d41d8cd98f00b204e9800998ecf8427e-one.css
  • /data/data/####/apply-cash-record.html
  • /data/data/####/apply-cash-success.17288137e7787c67629f2069ddbc...wo.css
  • /data/data/####/apply-cash-success.534237e9e4218ca8d08a.js
  • /data/data/####/apply-cash-success.html
  • /data/data/####/apply-cash.534237e9e4218ca8d08a.js
  • /data/data/####/apply-cash.f16c132e43e2b216f83036de86fac7e3-two.css
  • /data/data/####/apply-cash.html
  • /data/data/####/apply-detail.534237e9e4218ca8d08a.js
  • /data/data/####/apply-detail.a4ab77a458147a754ee1d250452b2850-one.css
  • /data/data/####/apply-detail.b9f4c8e55f39182db95289c8b43105e5-two.css
  • /data/data/####/apply-detail.html
  • /data/data/####/apply-list.534237e9e4218ca8d08a.js
  • /data/data/####/apply-list.94f78504d56615b15fcc050280f8c139-two.css
  • /data/data/####/apply-list.d41d8cd98f00b204e9800998ecf8427e-one.css
  • /data/data/####/apply-list.html
  • /data/data/####/apply-success.534237e9e4218ca8d08a.js
  • /data/data/####/apply-success.9e6680280182e8fff77ace1a17324b13-two.css
  • /data/data/####/apply-success.a4ab77a458147a754ee1d250452b2850-one.css
  • /data/data/####/apply-success.html
  • /data/data/####/authStatus_com.doumi.jianzhi.xml
  • /data/data/####/authStatus_com.doumi.jianzhi;remote.xml
  • /data/data/####/avatar_female.png
  • /data/data/####/avatar_male.png
  • /data/data/####/banner_integral.jpg
  • /data/data/####/banner_share.png
  • /data/data/####/banner_submit.png
  • /data/data/####/bg_blacklist.png
  • /data/data/####/bg_detail_banner.png
  • /data/data/####/bg_detail_quanzhi.png
  • /data/data/####/bg_index_column.png
  • /data/data/####/bg_invite_list.png
  • /data/data/####/bg_map.png
  • /data/data/####/bg_mingqi_info.png
  • /data/data/####/bg_popup.png
  • /data/data/####/bg_regret.png
  • /data/data/####/bg_renzheng.png
  • /data/data/####/bg_resume.png
  • /data/data/####/bg_rise.png
  • /data/data/####/bg_status.png
  • /data/data/####/bg_status_new.png
  • /data/data/####/bg_tab.png
  • /data/data/####/bg_toptips.png
  • /data/data/####/bind-alipay.30dafbd020a8c6204e480314e96b22f7-one.css
  • /data/data/####/bind-alipay.534237e9e4218ca8d08a.js
  • /data/data/####/bind-alipay.c3f3409c62bd3b1c2fc4adde3cdf1109-two.css
  • /data/data/####/bind-alipay.html
  • /data/data/####/bind-unionpay.30dafbd020a8c6204e480314e96b22f7-one.css
  • /data/data/####/bind-unionpay.534237e9e4218ca8d08a.js
  • /data/data/####/bind-unionpay.9e0b20f532711addaf2726462bd1df43-two.css
  • /data/data/####/bind-unionpay.html
  • /data/data/####/bind-weixinwallet.30dafbd020a8c6204e480314e96b22f7-one.css
  • /data/data/####/bind-weixinwallet.534237e9e4218ca8d08a.js
  • /data/data/####/bind-weixinwallet.b81a73e7393e948cf5d312d93f286a0f-two.css
  • /data/data/####/bind-weixinwallet.html
  • /data/data/####/bugly_db_
  • /data/data/####/bugly_db_-journal
  • /data/data/####/bundle.js
  • /data/data/####/cache.manifest
  • /data/data/####/change-mobile-number.4aee178143ea3ccb0f163074d8...wo.css
  • /data/data/####/change-mobile-number.534237e9e4218ca8d08a.js
  • /data/data/####/change-mobile-number.html
  • /data/data/####/china.zip
  • /data/data/####/city.534237e9e4218ca8d08a.js
  • /data/data/####/city.95e09476214ef7a72a4fdcbd8f47934c-one.css
  • /data/data/####/city.html
  • /data/data/####/city_1.json
  • /data/data/####/city_10.json
  • /data/data/####/city_100.json
  • /data/data/####/city_101.json
  • /data/data/####/city_102.json
  • /data/data/####/city_103.json
  • /data/data/####/city_104.json
  • /data/data/####/city_105.json
  • /data/data/####/city_106.json
  • /data/data/####/city_107.json
  • /data/data/####/city_108.json
  • /data/data/####/city_109.json
  • /data/data/####/city_11.json
  • /data/data/####/city_110.json
  • /data/data/####/city_111.json
  • /data/data/####/city_112.json
  • /data/data/####/city_113.json
  • /data/data/####/city_114.json
  • /data/data/####/city_115.json
  • /data/data/####/city_116.json
  • /data/data/####/city_117.json
  • /data/data/####/city_118.json
  • /data/data/####/city_119.json
  • /data/data/####/city_12.json
  • /data/data/####/city_120.json
  • /data/data/####/city_121.json
  • /data/data/####/city_122.json
  • /data/data/####/city_123.json
  • /data/data/####/city_124.json
  • /data/data/####/city_125.json
  • /data/data/####/city_126.json
  • /data/data/####/city_127.json
  • /data/data/####/city_128.json
  • /data/data/####/city_129.json
  • /data/data/####/city_13.json
  • /data/data/####/city_130.json
  • /data/data/####/city_131.json
  • /data/data/####/city_132.json
  • /data/data/####/city_133.json
  • /data/data/####/city_134.json
  • /data/data/####/city_135.json
  • /data/data/####/city_136.json
  • /data/data/####/city_137.json
  • /data/data/####/city_138.json
  • /data/data/####/city_139.json
  • /data/data/####/city_14.json
  • /data/data/####/city_140.json
  • /data/data/####/city_141.json
  • /data/data/####/city_142.json
  • /data/data/####/city_143.json
  • /data/data/####/city_144.json
  • /data/data/####/city_145.json
  • /data/data/####/city_146.json
  • /data/data/####/city_147.json
  • /data/data/####/city_148.json
  • /data/data/####/city_149.json
  • /data/data/####/city_15.json
  • /data/data/####/city_150.json
  • /data/data/####/city_151.json
  • /data/data/####/city_152.json
  • /data/data/####/city_153.json
  • /data/data/####/city_154.json
  • /data/data/####/city_155.json
  • /data/data/####/city_156.json
  • /data/data/####/city_157.json
  • /data/data/####/city_158.json
  • /data/data/####/city_159.json
  • /data/data/####/city_16.json
  • /data/data/####/city_160.json
  • /data/data/####/city_161.json
  • /data/data/####/city_162.json
  • /data/data/####/city_163.json
  • /data/data/####/city_164.json
  • /data/data/####/city_165.json
  • /data/data/####/city_166.json
  • /data/data/####/city_167.json
  • /data/data/####/city_168.json
  • /data/data/####/city_169.json
  • /data/data/####/city_17.json
  • /data/data/####/city_170.json
  • /data/data/####/city_171.json
  • /data/data/####/city_172.json
  • /data/data/####/city_173.json
  • /data/data/####/city_174.json
  • /data/data/####/city_175.json
  • /data/data/####/city_176.json
  • /data/data/####/city_177.json
  • /data/data/####/city_178.json
  • /data/data/####/city_179.json
  • /data/data/####/city_18.json
  • /data/data/####/city_180.json
  • /data/data/####/city_181.json
  • /data/data/####/city_182.json
  • /data/data/####/city_183.json
  • /data/data/####/city_184.json
  • /data/data/####/city_185.json
  • /data/data/####/city_186.json
  • /data/data/####/city_187.json
  • /data/data/####/city_188.json
  • /data/data/####/city_189.json
  • /data/data/####/city_19.json
  • /data/data/####/city_190.json
  • /data/data/####/city_191.json
  • /data/data/####/city_192.json
  • /data/data/####/city_193.json
  • /data/data/####/city_194.json
  • /data/data/####/city_195.json
  • /data/data/####/city_196.json
  • /data/data/####/city_197.json
  • /data/data/####/city_198.json
  • /data/data/####/city_199.json
  • /data/data/####/city_2.json
  • /data/data/####/city_20.json
  • /data/data/####/city_200.json
  • /data/data/####/city_201.json
  • /data/data/####/city_202.json
  • /data/data/####/city_203.json
  • /data/data/####/city_204.json
  • /data/data/####/city_205.json
  • /data/data/####/city_206.json
  • /data/data/####/city_207.json
  • /data/data/####/city_208.json
  • /data/data/####/city_209.json
  • /data/data/####/city_21.json
  • /data/data/####/city_210.json
  • /data/data/####/city_211.json
  • /data/data/####/city_212.json
  • /data/data/####/city_213.json
  • /data/data/####/city_214.json
  • /data/data/####/city_215.json
  • /data/data/####/city_216.json
  • /data/data/####/city_217.json
  • /data/data/####/city_218.json
  • /data/data/####/city_219.json
  • /data/data/####/city_22.json
  • /data/data/####/city_220.json
  • /data/data/####/city_221.json
  • /data/data/####/city_222.json
  • /data/data/####/city_223.json
  • /data/data/####/city_224.json
  • /data/data/####/city_225.json
  • /data/data/####/city_226.json
  • /data/data/####/city_227.json
  • /data/data/####/city_228.json
  • /data/data/####/city_229.json
  • /data/data/####/city_23.json
  • /data/data/####/city_230.json
  • /data/data/####/city_231.json
  • /data/data/####/city_232.json
  • /data/data/####/city_233.json
  • /data/data/####/city_234.json
  • /data/data/####/city_235.json
  • /data/data/####/city_236.json
  • /data/data/####/city_237.json
  • /data/data/####/city_238.json
  • /data/data/####/city_239.json
  • /data/data/####/city_24.json
  • /data/data/####/city_240.json
  • /data/data/####/city_241.json
  • /data/data/####/city_242.json
  • /data/data/####/city_243.json
  • /data/data/####/city_244.json
  • /data/data/####/city_245.json
  • /data/data/####/city_246.json
  • /data/data/####/city_247.json
  • /data/data/####/city_248.json
  • /data/data/####/city_249.json
  • /data/data/####/city_25.json
  • /data/data/####/city_250.json
  • /data/data/####/city_251.json
  • /data/data/####/city_252.json
  • /data/data/####/city_253.json
  • /data/data/####/city_254.json
  • /data/data/####/city_255.json
  • /data/data/####/city_256.json
  • /data/data/####/city_257.json
  • /data/data/####/city_258.json
  • /data/data/####/city_259.json
  • /data/data/####/city_26.json
  • /data/data/####/city_260.json
  • /data/data/####/city_261.json
  • /data/data/####/city_262.json
  • /data/data/####/city_263.json
  • /data/data/####/city_264.json
  • /data/data/####/city_265.json
  • /data/data/####/city_266.json
  • /data/data/####/city_267.json
  • /data/data/####/city_268.json
  • /data/data/####/city_269.json
  • /data/data/####/city_27.json
  • /data/data/####/city_270.json
  • /data/data/####/city_271.json
  • /data/data/####/city_272.json
  • /data/data/####/city_273.json
  • /data/data/####/city_274.json
  • /data/data/####/city_275.json
  • /data/data/####/city_276.json
  • /data/data/####/city_277.json
  • /data/data/####/city_278.json
  • /data/data/####/city_279.json
  • /data/data/####/city_28.json
  • /data/data/####/city_280.json
  • /data/data/####/city_281.json
  • /data/data/####/city_282.json
  • /data/data/####/city_283.json
  • /data/data/####/city_284.json
  • /data/data/####/city_285.json
  • /data/data/####/city_286.json
  • /data/data/####/city_287.json
  • /data/data/####/city_288.json
  • /data/data/####/city_289.json
  • /data/data/####/city_29.json
  • /data/data/####/city_290.json
  • /data/data/####/city_291.json
  • /data/data/####/city_292.json
  • /data/data/####/city_293.json
  • /data/data/####/city_294.json
  • /data/data/####/city_295.json
  • /data/data/####/city_296.json
  • /data/data/####/city_297.json
  • /data/data/####/city_298.json
  • /data/data/####/city_299.json
  • /data/data/####/city_3.json
  • /data/data/####/city_30.json
  • /data/data/####/city_300.json
  • /data/data/####/city_301.json
  • /data/data/####/city_302.json
  • /data/data/####/city_303.json
  • /data/data/####/city_304.json
  • /data/data/####/city_305.json
  • /data/data/####/city_306.json
  • /data/data/####/city_307.json
  • /data/data/####/city_308.json
  • /data/data/####/city_309.json
  • /data/data/####/city_31.json
  • /data/data/####/city_310.json
  • /data/data/####/city_311.json
  • /data/data/####/city_312.json
  • /data/data/####/city_313.json
  • /data/data/####/city_314.json
  • /data/data/####/city_315.json
  • /data/data/####/city_316.json
  • /data/data/####/city_317.json
  • /data/data/####/city_318.json
  • /data/data/####/city_319.json
  • /data/data/####/city_32.json
  • /data/data/####/city_320.json
  • /data/data/####/city_321.json
  • /data/data/####/city_322.json
  • /data/data/####/city_323.json
  • /data/data/####/city_324.json
  • /data/data/####/city_325.json
  • /data/data/####/city_326.json
  • /data/data/####/city_327.json
  • /data/data/####/city_328.json
  • /data/data/####/city_329.json
  • /data/data/####/city_33.json
  • /data/data/####/city_330.json
  • /data/data/####/city_331.json
  • /data/data/####/city_332.json
  • /data/data/####/city_333.json
  • /data/data/####/city_334.json
  • /data/data/####/city_335.json
  • /data/data/####/city_336.json
  • /data/data/####/city_337.json
  • /data/data/####/city_338.json
  • /data/data/####/city_339.json
  • /data/data/####/city_34.json
  • /data/data/####/city_340.json
  • /data/data/####/city_341.json
  • /data/data/####/city_342.json
  • /data/data/####/city_343.json
  • /data/data/####/city_344.json
  • /data/data/####/city_345.json
  • /data/data/####/city_35.json
  • /data/data/####/city_353.json
  • /data/data/####/city_36.json
  • /data/data/####/city_37.json
  • /data/data/####/city_373.json
  • /data/data/####/city_374.json
  • /data/data/####/city_375.json
  • /data/data/####/city_376.json
  • /data/data/####/city_377.json
  • /data/data/####/city_378.json
  • /data/data/####/city_379.json
  • /data/data/####/city_38.json
  • /data/data/####/city_380.json
  • /data/data/####/city_381.json
  • /data/data/####/city_382.json
  • /data/data/####/city_383.json
  • /data/data/####/city_384.json
  • /data/data/####/city_385.json
  • /data/data/####/city_386.json
  • /data/data/####/city_39.json
  • /data/data/####/city_4.json
  • /data/data/####/city_40.json
  • /data/data/####/city_41.json
  • /data/data/####/city_42.json
  • /data/data/####/city_43.json
  • /data/data/####/city_44.json
  • /data/data/####/city_45.json
  • /data/data/####/city_46.json
  • /data/data/####/city_47.json
  • /data/data/####/city_48.json
  • /data/data/####/city_49.json
  • /data/data/####/city_5.json
  • /data/data/####/city_50.json
  • /data/data/####/city_51.json
  • /data/data/####/city_52.json
  • /data/data/####/city_53.json
  • /data/data/####/city_54.json
  • /data/data/####/city_55.json
  • /data/data/####/city_56.json
  • /data/data/####/city_57.json
  • /data/data/####/city_58.json
  • /data/data/####/city_59.json
  • /data/data/####/city_6.json
  • /data/data/####/city_60.json
  • /data/data/####/city_61.json
  • /data/data/####/city_62.json
  • /data/data/####/city_63.json
  • /data/data/####/city_64.json
  • /data/data/####/city_65.json
  • /data/data/####/city_66.json
  • /data/data/####/city_67.json
  • /data/data/####/city_68.json
  • /data/data/####/city_69.json
  • /data/data/####/city_7.json
  • /data/data/####/city_70.json
  • /data/data/####/city_71.json
  • /data/data/####/city_72.json
  • /data/data/####/city_73.json
  • /data/data/####/city_74.json
  • /data/data/####/city_75.json
  • /data/data/####/city_76.json
  • /data/data/####/city_77.json
  • /data/data/####/city_78.json
  • /data/data/####/city_79.json
  • /data/data/####/city_8.json
  • /data/data/####/city_80.json
  • /data/data/####/city_81.json
  • /data/data/####/city_82.json
  • /data/data/####/city_83.json
  • /data/data/####/city_84.json
  • /data/data/####/city_85.json
  • /data/data/####/city_86.json
  • /data/data/####/city_87.json
  • /data/data/####/city_88.json
  • /data/data/####/city_89.json
  • /data/data/####/city_9.json
  • /data/data/####/city_90.json
  • /data/data/####/city_91.json
  • /data/data/####/city_92.json
  • /data/data/####/city_93.json
  • /data/data/####/city_94.json
  • /data/data/####/city_95.json
  • /data/data/####/city_96.json
  • /data/data/####/city_97.json
  • /data/data/####/city_98.json
  • /data/data/####/city_99.json
  • /data/data/####/classes.dex
  • /data/data/####/classes.dex;classes2.dex
  • /data/data/####/classes.dex;classes3.dex
  • /data/data/####/com.doumi.jianzhi_preferences.xml
  • /data/data/####/company-detail.4f228c0649588e9977acbf4218ec86ac-two.css
  • /data/data/####/company-detail.534237e9e4218ca8d08a.js
  • /data/data/####/company-detail.cca3a9431570090b72d81c9ea229d390-one.css
  • /data/data/####/company-detail.html
  • /data/data/####/complain-and-feedback.534237e9e4218ca8d08a.js
  • /data/data/####/complain-and-feedback.e4549bb4c8984f56df460219a...ne.css
  • /data/data/####/complain-and-feedback.html
  • /data/data/####/complain.534237e9e4218ca8d08a.js
  • /data/data/####/complain.d7b2867990eacbcec7ab7c1f8181f0d8-two.css
  • /data/data/####/complain.html
  • /data/data/####/complaint-forms-business-lose.534237e9e4218ca8d08a.js
  • /data/data/####/complaint-forms-business-lose.58018f5d97d68c35a...wo.css
  • /data/data/####/complaint-forms-business-lose.html
  • /data/data/####/complaint-forms-false-information.534237e9e4218ca8d08a.js
  • /data/data/####/complaint-forms-false-information.9c197a61767fc...wo.css
  • /data/data/####/complaint-forms-false-information.html
  • /data/data/####/complaint-forms-fee-charge.534237e9e4218ca8d08a.js
  • /data/data/####/complaint-forms-fee-charge.9c197a61767fc700785a...wo.css
  • /data/data/####/complaint-forms-fee-charge.html
  • /data/data/####/complaint-forms-salary-arrears.534237e9e4218ca8d08a.js
  • /data/data/####/complaint-forms-salary-arrears.9c197a61767fc700...wo.css
  • /data/data/####/complaint-forms-salary-arrears.html
  • /data/data/####/complaint-success.534237e9e4218ca8d08a.js
  • /data/data/####/complaint-success.590f459a3f48e0e1943a477ce3132c12-two.css
  • /data/data/####/complaint-success.html
  • /data/data/####/conf_n.pid
  • /data/data/####/copy_icon.png
  • /data/data/####/count-down-bg.png
  • /data/data/####/cyan_face.png
  • /data/data/####/cyan_face_gray.png
  • /data/data/####/dW1weF9pbnRlcm5hbF8xNjQyMDkzNzM1OTUz;
  • /data/data/####/dW1weF9pbnRlcm5hbF8xNjQyMDkzNzc4NTcy;
  • /data/data/####/detail-address.534237e9e4218ca8d08a.js
  • /data/data/####/detail-address.65fdb6363b0aac31476a7a00c28019b0-two.css
  • /data/data/####/detail-address.html
  • /data/data/####/detail-mix.534237e9e4218ca8d08a.js
  • /data/data/####/detail-mix.77ea435d348950fa35ae2d0e311e49f4-one.css
  • /data/data/####/detail-mix.a6fe74b97c854b12fd7bedccb91e057a-two.css
  • /data/data/####/detail-mix.html
  • /data/data/####/detail.4bf774182e6854de34fa8c3b90aef0aa-two.css
  • /data/data/####/detail.534237e9e4218ca8d08a.js
  • /data/data/####/detail.e55cdbc80d91a0f389a4b927ca5e917f-one.css
  • /data/data/####/detail.html
  • /data/data/####/detail_basic_head.png
  • /data/data/####/detail_direct_head.png
  • /data/data/####/detail_direct_head_big.png
  • /data/data/####/detail_online_head.png
  • /data/data/####/detail_online_head_big.png
  • /data/data/####/detail_player_big.png
  • /data/data/####/detail_player_small.png
  • /data/data/####/dmdid
  • /data/data/####/dmzp.png
  • /data/data/####/dmzygw.png
  • /data/data/####/domSetting
  • /data/data/####/domSettingTime
  • /data/data/####/doumi-db
  • /data/data/####/doumi-db-journal
  • /data/data/####/duiba.2839f02f6b96f7eaf8852679854b77b7-one.css
  • /data/data/####/duiba.534237e9e4218ca8d08a.js
  • /data/data/####/duiba.html
  • /data/data/####/earn-score.1c1c78dcdb7a95efb321c7010971c508-one.css
  • /data/data/####/earn-score.534237e9e4218ca8d08a.js
  • /data/data/####/earn-score.html
  • /data/data/####/empower.png
  • /data/data/####/entry-details.534237e9e4218ca8d08a.js
  • /data/data/####/entry-details.6066c316cc602a6eed6f2dcb2bf9867d-two.css
  • /data/data/####/entry-details.html
  • /data/data/####/evaluate-list.534237e9e4218ca8d08a.js
  • /data/data/####/evaluate-list.a4ab77a458147a754ee1d250452b2850-one.css
  • /data/data/####/evaluate-list.f6eb968fe548208733eb2830c5797a35-two.css
  • /data/data/####/evaluate-list.html
  • /data/data/####/evaluate.534237e9e4218ca8d08a.js
  • /data/data/####/evaluate.94f78504d56615b15fcc050280f8c139-two.css
  • /data/data/####/evaluate.c06520a83be22d94fe2f3ea7820c185f-one.css
  • /data/data/####/evaluate.html
  • /data/data/####/exchangeIdentity.json
  • /data/data/####/exchange_icon.png
  • /data/data/####/exid.dat
  • /data/data/####/f1e5994e2a5f4dbe680c.worker.js
  • /data/data/####/favorite.534237e9e4218ca8d08a.js
  • /data/data/####/favorite.5878c39fe87723e0f503fced06505907-one.css
  • /data/data/####/favorite.94e262e08c6af41630356161d634991c-two.css
  • /data/data/####/favorite.html
  • /data/data/####/fe5312fdbe923e425eb3.worker.js
  • /data/data/####/feedback.534237e9e4218ca8d08a.js
  • /data/data/####/feedback.a8229ee74a8c1d67288fcb25594a8ff9-one.css
  • /data/data/####/feedback.html
  • /data/data/####/firll.dat
  • /data/data/####/gal.db
  • /data/data/####/gal.db-journal
  • /data/data/####/geofencing.db
  • /data/data/####/geofencing.db-journal
  • /data/data/####/getui_sp.xml
  • /data/data/####/gkt-journal
  • /data/data/####/hotjob-list.534237e9e4218ca8d08a.js
  • /data/data/####/hotjob-list.b6ef5bace95da452d5a9c8ab1c63d6e5-two.css
  • /data/data/####/hotjob-list.c808d59190b93f697aeed8724b861036-one.css
  • /data/data/####/hotjob-list.html
  • /data/data/####/hst.db
  • /data/data/####/hst.db-journal
  • /data/data/####/huiyan-index.339866d118ada781d3ccf486f43e21ad-two.css
  • /data/data/####/huiyan-index.534237e9e4218ca8d08a.js
  • /data/data/####/huiyan-index.html
  • /data/data/####/huiyan-result.534237e9e4218ca8d08a.js
  • /data/data/####/huiyan-result.dcb7deeeea4d835b4a802908ae06f84f-two.css
  • /data/data/####/huiyan-result.html
  • /data/data/####/i==1.2.0&&5.6.0_1642093738537_envelope.log
  • /data/data/####/i==1.2.0&&5.6.0_1642093778542_envelope.log
  • /data/data/####/icon-safe.png
  • /data/data/####/icon-welfare-01.png
  • /data/data/####/icon-welfare-02.png
  • /data/data/####/icon-welfare-03.png
  • /data/data/####/icon-welfare-04.png
  • /data/data/####/icon-welfare-05.png
  • /data/data/####/icon-welfare-06.png
  • /data/data/####/icon-welfare-07.png
  • /data/data/####/icon-welfare-new-01.png
  • /data/data/####/icon-welfare-new-02.png
  • /data/data/####/icon-welfare-new-03.png
  • /data/data/####/icon-welfare-new-04.png
  • /data/data/####/icon-welfare-new-05.png
  • /data/data/####/icon-welfare-new-06.png
  • /data/data/####/icon-welfare-new-07.png
  • /data/data/####/icon.png
  • /data/data/####/icon_account.png
  • /data/data/####/icon_arrow.png
  • /data/data/####/icon_blacklist.png
  • /data/data/####/icon_cate_check.png
  • /data/data/####/icon_cate_other.png
  • /data/data/####/icon_cate_promotion.png
  • /data/data/####/icon_cate_reg.png
  • /data/data/####/icon_cate_share.png
  • /data/data/####/icon_cate_survey.png
  • /data/data/####/icon_deliver.png
  • /data/data/####/icon_detail.png
  • /data/data/####/icon_detail_new.png
  • /data/data/####/icon_doubt.png
  • /data/data/####/icon_form.png
  • /data/data/####/icon_index.png
  • /data/data/####/icon_online.png
  • /data/data/####/icon_order.png
  • /data/data/####/icon_personal1.png
  • /data/data/####/icon_rate.png
  • /data/data/####/icon_regret.png
  • /data/data/####/icon_resume.png
  • /data/data/####/icon_succeed.png
  • /data/data/####/icon_taobaoke.png
  • /data/data/####/icon_toplist.png
  • /data/data/####/icon_wallet.png
  • /data/data/####/icon_warn.png
  • /data/data/####/imkit.db
  • /data/data/####/imkit.db-journal
  • /data/data/####/increment_cache_file
  • /data/data/####/index
  • /data/data/####/index.534237e9e4218ca8d08a.js
  • /data/data/####/index.ac4eaaa536c780e9ce012af3f184aa8a-two.css
  • /data/data/####/index.e90ff1638d0696015399bacb82d02381-one.css
  • /data/data/####/index.html
  • /data/data/####/info.xml
  • /data/data/####/init.pid
  • /data/data/####/init_c1.pid
  • /data/data/####/integral-detail.534237e9e4218ca8d08a.js
  • /data/data/####/integral-detail.d2e5ecb9e6a8186a8938ab931e75a3c9-one.css
  • /data/data/####/integral-detail.html
  • /data/data/####/invite-recommend-list.534237e9e4218ca8d08a.js
  • /data/data/####/invite-recommend-list.6b86811ae121692a0dc923686...wo.css
  • /data/data/####/invite-recommend-list.a4ab77a458147a754ee1d2504...ne.css
  • /data/data/####/invite-recommend-list.html
  • /data/data/####/is_zan.png
  • /data/data/####/jianZhi.xml
  • /data/data/####/job-publisher.534237e9e4218ca8d08a.js
  • /data/data/####/job-publisher.a4ab77a458147a754ee1d250452b2850-one.css
  • /data/data/####/job-publisher.fe8277f25c3fdcdb9b4be58bc0b9a9d2-two.css
  • /data/data/####/job-publisher.html
  • /data/data/####/ker.db-journal
  • /data/data/####/labelSharePre.xml
  • /data/data/####/lazyload_default.png
  • /data/data/####/libcuid.so
  • /data/data/####/libjiagu.so
  • /data/data/####/ljzp.png
  • /data/data/####/local_crash_lock
  • /data/data/####/login-captcha.534237e9e4218ca8d08a.js
  • /data/data/####/login-captcha.5742bdc933655ecb625c7b17b9fd87fc-one.css
  • /data/data/####/login-captcha.html
  • /data/data/####/login-check-phone.534237e9e4218ca8d08a.js
  • /data/data/####/login-check-phone.ea7aa50e46628c34780c01b949a08eee-one.css
  • /data/data/####/login-check-phone.html
  • /data/data/####/login-password.534237e9e4218ca8d08a.js
  • /data/data/####/login-password.ea7aa50e46628c34780c01b949a08eee-one.css
  • /data/data/####/login-password.html
  • /data/data/####/mac.xml
  • /data/data/####/main.dek
  • /data/data/####/make-money-online.534237e9e4218ca8d08a.js
  • /data/data/####/make-money-online.a4ab77a458147a754ee1d250452b2850-one.css
  • /data/data/####/make-money-online.c67924089e49e0838cf18b8f2c4b1087-two.css
  • /data/data/####/make-money-online.html
  • /data/data/####/metrics_guid
  • /data/data/####/mingqi_tag.png
  • /data/data/####/mingqi_toutu_ placeholder.png
  • /data/data/####/mingqi_toutu_default.jpg
  • /data/data/####/mipush_extra.xml
  • /data/data/####/mipush_region
  • /data/data/####/mipush_region.lock
  • /data/data/####/msg-invite-list.534237e9e4218ca8d08a.js
  • /data/data/####/msg-invite-list.ab6745cea1b50e7997f0f9c018d4900b-two.css
  • /data/data/####/msg-invite-list.d41d8cd98f00b204e9800998ecf8427e-one.css
  • /data/data/####/msg-invite-list.html
  • /data/data/####/msg-news-list.534237e9e4218ca8d08a.js
  • /data/data/####/msg-news-list.f4e0eb380f81cdb27020bde72992eb81-one.css
  • /data/data/####/msg-news-list.html
  • /data/data/####/msg-online-list.3f9f1d8f516cfca804ad02f48d6eb67a-one.css
  • /data/data/####/msg-online-list.534237e9e4218ca8d08a.js
  • /data/data/####/msg-online-list.html
  • /data/data/####/nearby-list.534237e9e4218ca8d08a.js
  • /data/data/####/nearby-list.a97eafbed0d9688266e91433175a559e-one.css
  • /data/data/####/nearby-list.adeb8cb58c57c6ff62304080943ebd28-two.css
  • /data/data/####/nearby-list.html
  • /data/data/####/no-idencode.534237e9e4218ca8d08a.js
  • /data/data/####/no-idencode.7418fa430c2c4b3ef49e4852e46dcb52-one.css
  • /data/data/####/no-idencode.html
  • /data/data/####/offline-invite-bonus.4084ef1b596abbcc99e60a7a24...ne.css
  • /data/data/####/offline-invite-bonus.534237e9e4218ca8d08a.js
  • /data/data/####/offline-invite-bonus.html
  • /data/data/####/offline-invite-list.4084ef1b596abbcc99e60a7a24c...ne.css
  • /data/data/####/offline-invite-list.534237e9e4218ca8d08a.js
  • /data/data/####/offline-invite-list.html
  • /data/data/####/offline-share.4084ef1b596abbcc99e60a7a24ce3894-one.css
  • /data/data/####/offline-share.534237e9e4218ca8d08a.js
  • /data/data/####/offline-share.html
  • /data/data/####/ofl.config
  • /data/data/####/ofl_location.db
  • /data/data/####/ofl_location.db-journal
  • /data/data/####/ofl_statistics.db
  • /data/data/####/ofl_statistics.db-journal
  • /data/data/####/online-complain-select.534237e9e4218ca8d08a.js
  • /data/data/####/online-complain-select.7f5183fcc98afcb7b9e6dc17...ne.css
  • /data/data/####/online-complain-select.html
  • /data/data/####/online-complain.534237e9e4218ca8d08a.js
  • /data/data/####/online-complain.8def2e7a28f119daf031d7d3ba258e98-one.css
  • /data/data/####/online-complain.html
  • /data/data/####/online-detail.14ae0f0019b999f7e51ba5fbdffe538c-two.css
  • /data/data/####/online-detail.4c1c5d9a634a44d2db5d7ba88375bf38-one.css
  • /data/data/####/online-detail.534237e9e4218ca8d08a.js
  • /data/data/####/online-detail.html
  • /data/data/####/online-income.534237e9e4218ca8d08a.js
  • /data/data/####/online-income.78a65149714213978f86ea3594247b9e-one.css
  • /data/data/####/online-income.html
  • /data/data/####/online-index.17007d4eb3ec5a52aaa4e0206c6f147e-one.css
  • /data/data/####/online-index.534237e9e4218ca8d08a.js
  • /data/data/####/online-index.html
  • /data/data/####/online-personal.534237e9e4218ca8d08a.js
  • /data/data/####/online-personal.7f5183fcc98afcb7b9e6dc170ebd0a4f-one.css
  • /data/data/####/online-personal.html
  • /data/data/####/online-prefecture.5123a485a5b55423a26b945b4230db2d-one.css
  • /data/data/####/online-prefecture.534237e9e4218ca8d08a.js
  • /data/data/####/online-prefecture.html
  • /data/data/####/online-retrial.534237e9e4218ca8d08a.js
  • /data/data/####/online-retrial.d14658c9f8b3b9f18145d21a562ba87a-one.css
  • /data/data/####/online-retrial.html
  • /data/data/####/online-submit-detail.1e894983c71bb3dc3e3ee2f273...ne.css
  • /data/data/####/online-submit-detail.534237e9e4218ca8d08a.js
  • /data/data/####/online-submit-detail.html
  • /data/data/####/online-submit-success.534237e9e4218ca8d08a.js
  • /data/data/####/online-submit-success.d14658c9f8b3b9f18145d21a5...ne.css
  • /data/data/####/online-submit-success.html
  • /data/data/####/online-submit.534237e9e4218ca8d08a.js
  • /data/data/####/online-submit.d97659ffb74602dd16ddafff37d560f3-one.css
  • /data/data/####/online-submit.html
  • /data/data/####/post-list.534237e9e4218ca8d08a.js
  • /data/data/####/post-list.a4ab77a458147a754ee1d250452b2850-one.css
  • /data/data/####/post-list.b6ef5bace95da452d5a9c8ab1c63d6e5-two.css
  • /data/data/####/post-list.html
  • /data/data/####/prefecture.0ea5ba16d0d5bc848f9aa97fd98f6023-one.css
  • /data/data/####/prefecture.534237e9e4218ca8d08a.js
  • /data/data/####/prefecture.71968be89ee14783b43a24272c035c06-two.css
  • /data/data/####/prefecture.html
  • /data/data/####/preferences-job-type-select.36cff8c856e434d2241...wo.css
  • /data/data/####/preferences-job-type-select.534237e9e4218ca8d08a.js
  • /data/data/####/preferences-job-type-select.687ad0898f62cf4ca2c...ne.css
  • /data/data/####/preferences-job-type-select.html
  • /data/data/####/privacy.534237e9e4218ca8d08a.js
  • /data/data/####/privacy.da37ab9c528807c7e65343ff3f960ce9-two.css
  • /data/data/####/privacy.html
  • /data/data/####/proc_auxv
  • /data/data/####/progress_left.png
  • /data/data/####/progress_right.png
  • /data/data/####/prominent-tags.534237e9e4218ca8d08a.js
  • /data/data/####/prominent-tags.ab14fba0656a44af9f8cc1c062ccfe75-two.css
  • /data/data/####/prominent-tags.html
  • /data/data/####/provinces.json
  • /data/data/####/ptj_icons.png
  • /data/data/####/push.pid
  • /data/data/####/pushext.db-journal
  • /data/data/####/pushg.db-journal
  • /data/data/####/pushgdc.db-journal
  • /data/data/####/pushsdk.db-journal
  • /data/data/####/rapidly-apply.36ef0deb411548494b81c2437d1b938c-two.css
  • /data/data/####/rapidly-apply.534237e9e4218ca8d08a.js
  • /data/data/####/rapidly-apply.57c4202db051a46e61e80f17b171a477-one.css
  • /data/data/####/rapidly-apply.html
  • /data/data/####/recommend-list.534237e9e4218ca8d08a.js
  • /data/data/####/recommend-list.b6ef5bace95da452d5a9c8ab1c63d6e5-two.css
  • /data/data/####/recommend-list.c808d59190b93f697aeed8724b861036-one.css
  • /data/data/####/recommend-list.html
  • /data/data/####/register.534237e9e4218ca8d08a.js
  • /data/data/####/register.b5bba3abd015f375c4e2bd6d5eacb1b7-one.css
  • /data/data/####/register.html
  • /data/data/####/reset.534237e9e4218ca8d08a.js
  • /data/data/####/reset.d9d8604340a6ed793fbdccf399d45e8f-one.css
  • /data/data/####/reset.html
  • /data/data/####/resume-addition.092c846fa90494869bf78c876cbc0896-two.css
  • /data/data/####/resume-addition.534237e9e4218ca8d08a.js
  • /data/data/####/resume-addition.html
  • /data/data/####/resume-education.18bc07b0b27557f50d2a0ef972c72a34-two.css
  • /data/data/####/resume-education.534237e9e4218ca8d08a.js
  • /data/data/####/resume-education.html
  • /data/data/####/resume-index.534237e9e4218ca8d08a.js
  • /data/data/####/resume-index.a4d0d4c2d5158f002b47bfab29b41b9e-two.css
  • /data/data/####/resume-index.html
  • /data/data/####/resume-info.534237e9e4218ca8d08a.js
  • /data/data/####/resume-info.7b29f9129abbea6f15379995549f480a-two.css
  • /data/data/####/resume-info.html
  • /data/data/####/resume-preference.4152666473795d7eb80d57c0a0b348e6-two.css
  • /data/data/####/resume-preference.534237e9e4218ca8d08a.js
  • /data/data/####/resume-preference.html
  • /data/data/####/resume-work.534237e9e4218ca8d08a.js
  • /data/data/####/resume-work.6ae3e50eda3c7c4874e52d4cc3c6c0ba-two.css
  • /data/data/####/resume-work.html
  • /data/data/####/run.pid
  • /data/data/####/search.1143178646703a5aae6d2e87cffb9460-two.css
  • /data/data/####/search.534237e9e4218ca8d08a.js
  • /data/data/####/search.html
  • /data/data/####/security_info
  • /data/data/####/selected.34c45c6a077f961523c9ba09b8e910e5-one.css
  • /data/data/####/selected.534237e9e4218ca8d08a.js
  • /data/data/####/selected.be433e0fe936403c574aedcd9804344d-two.css
  • /data/data/####/selected.html
  • /data/data/####/selected_big.png
  • /data/data/####/selected_middle.png
  • /data/data/####/selected_small.png
  • /data/data/####/selectiveperfect-list.534237e9e4218ca8d08a.js
  • /data/data/####/selectiveperfect-list.78537c381d5650743f2b37056...ne.css
  • /data/data/####/selectiveperfect-list.html
  • /data/data/####/set-resume-success.3870f8f1434d9211db9b1f682a1d...ne.css
  • /data/data/####/set-resume-success.534237e9e4218ca8d08a.js
  • /data/data/####/set-resume-success.html
  • /data/data/####/settings.0380b5ad07fe46b7a97b155af3bf81e2-two.css
  • /data/data/####/settings.534237e9e4218ca8d08a.js
  • /data/data/####/settings.html
  • /data/data/####/sign-in.534237e9e4218ca8d08a.js
  • /data/data/####/sign-in.7ea6495923ff03d8fee10512e536bafa-one.css
  • /data/data/####/sign-in.html
  • /data/data/####/sobot_chat_20220113_log.txt
  • /data/data/####/sobot_config.xml
  • /data/data/####/sobot_config.xml.bak
  • /data/data/####/start_act.xml
  • /data/data/####/taobaoke-detail.358071e44592d180b1e79940927d4191-one.css
  • /data/data/####/taobaoke-detail.534237e9e4218ca8d08a.js
  • /data/data/####/taobaoke-detail.html
  • /data/data/####/taobaoke-income.534237e9e4218ca8d08a.js
  • /data/data/####/taobaoke-income.c09ceadc2e3455c79fd67f0a59f160ac-one.css
  • /data/data/####/taobaoke-income.html
  • /data/data/####/taobaoke-index.534237e9e4218ca8d08a.js
  • /data/data/####/taobaoke-index.d5dd94be166cbb44ef39c36aa5f09614-one.css
  • /data/data/####/taobaoke-index.html
  • /data/data/####/taobaoke-order.534237e9e4218ca8d08a.js
  • /data/data/####/taobaoke-order.d18b222592a9b845ed9722e3f4272351-one.css
  • /data/data/####/taobaoke-order.html
  • /data/data/####/taobaoke-search-hot-key.534237e9e4218ca8d08a.js
  • /data/data/####/taobaoke-search-hot-key.9cda77bb31da14cb8999ac4...ne.css
  • /data/data/####/taobaoke-search-hot-key.html
  • /data/data/####/taobaoke-search.534237e9e4218ca8d08a.js
  • /data/data/####/taobaoke-search.b78708aa1c7a04779a0da807626bafdb-one.css
  • /data/data/####/taobaoke-search.html
  • /data/data/####/taobaoke-share.534237e9e4218ca8d08a.js
  • /data/data/####/taobaoke-share.ff00047a1ed770721cb9fa56d81ab6d4-one.css
  • /data/data/####/taobaoke-share.html
  • /data/data/####/tdata_XYq933
  • /data/data/####/tdata_XYq933.dex
  • /data/data/####/tdata_XYq933.dex.flock (deleted)
  • /data/data/####/tdata_XYq933.jar
  • /data/data/####/tdata_pKN446
  • /data/data/####/tdata_pKN446.dex
  • /data/data/####/tdata_pKN446.dex.flock (deleted)
  • /data/data/####/tdata_pKN446.jar
  • /data/data/####/tdata_trp703
  • /data/data/####/tdata_trp703.dex
  • /data/data/####/tdata_trp703.dex.flock (deleted)
  • /data/data/####/tdata_trp703.jar
  • /data/data/####/tdata_xEA084
  • /data/data/####/tdata_xEA084.dex
  • /data/data/####/tdata_xEA084.dex.flock (deleted)
  • /data/data/####/tdata_xEA084.jar
  • /data/data/####/the-real-index
  • /data/data/####/tmp.zip
  • /data/data/####/ua.db
  • /data/data/####/ua.db-journal
  • /data/data/####/um_pri.xml
  • /data/data/####/umdat.xml
  • /data/data/####/umeng_common_config.xml
  • /data/data/####/umeng_general_config.xml
  • /data/data/####/umeng_it.cache
  • /data/data/####/vendor.dll.js
  • /data/data/####/verified.41f71fcfc698cda5c051a7b701ac5efd-two.css
  • /data/data/####/verified.534237e9e4218ca8d08a.js
  • /data/data/####/verified.html
  • /data/data/####/wallet.534237e9e4218ca8d08a.js
  • /data/data/####/wallet.b7b0de3da09405b3d58fa6743ea48934-two.css
  • /data/data/####/wallet.html
  • /data/data/####/work-desc-exam.534237e9e4218ca8d08a.js
  • /data/data/####/work-desc-exam.7c36f7120f9287650ea5ec282c21feb3-two.css
  • /data/data/####/work-desc-exam.html
  • /data/data/####/yellow_face.png
  • /data/data/####/yellow_face_gray.png
  • /data/media/####/.a.dat
  • /data/media/####/.adfwe.dat
  • /data/media/####/.cca.dat
  • /data/media/####/.cuid
  • /data/media/####/.cuid2
  • /data/media/####/.nomedia
  • /data/media/####/.umm.dat
  • /data/media/####/app.db
  • /data/media/####/com.doumi.jianzhi.bin
  • /data/media/####/com.doumi.jianzhi.db
  • /data/media/####/com.getui.sdk.deviceId.db
  • /data/media/####/com.igexin.sdk.deviceId.db
  • /data/media/####/com.tencent.mobileqq_connectSdk.22.01.13.20.log
  • /data/media/####/conlts.dat
  • /data/media/####/dmdid
  • /data/media/####/domSetting
  • /data/media/####/domSettingTime
  • /data/media/####/gkt-journal
  • /data/media/####/gktper (deleted)
  • /data/media/####/journal
  • /data/media/####/ls.db
  • /data/media/####/ls.db-journal
  • /data/media/####/rong_sdk.log
  • /data/media/####/rong_sdk_debug.log
  • /data/media/####/sysid.dat
  • /data/media/####/tdata_XYq933
  • /data/media/####/tdata_pKN446
  • /data/media/####/tdata_trp703
  • /data/media/####/tdata_xEA084
  • /data/media/####/test.log (deleted)
  • /data/media/####/yoh.dat
  • /data/media/####/yol.dat
  • /data/media/####/yom.dat
  • /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
  • /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
  • /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
  • /system/bin/sh -c type su
  • getprop ro.aa.romver
  • getprop ro.board.platform
  • getprop ro.build.fingerprint
  • getprop ro.build.nubia.rom.name
  • getprop ro.build.rom.id
  • getprop ro.build.tyd.kbstyle_version
  • getprop ro.build.version.emui
  • getprop ro.build.version.opporom
  • getprop ro.gn.gnromvernumber
  • getprop ro.lenovo.series
  • getprop ro.lewa.version
  • getprop ro.meizu.product.model
  • getprop ro.miui.ui.version.name
  • getprop ro.vivo.os.build.display.id
  • logcat -d -v threadtime
  • ls /
  • ls /sys/class/thermal
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
  • AES-CBC-PKCS7Padding
  • AES-ECB-PKCS5Padding
  • AES-GCM-NoPadding
  • RSA-ECB-PKCS1Padding
  • RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
  • AES-CBC-PKCS5Padding
  • AES-CBC-PKCS7Padding
  • AES-ECB-PKCS5Padding
  • AES-GCM-NoPadding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
Requests the system alert window permission.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android