Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.b####.qq.com:8011
- TCP(HTTP/1.1) m.d####.mob.com:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) pin####.qq.com:80
- TCP(HTTP/1.1) m.zero####.cn:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) encrypt####.gst####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5226
- 7j####.c####.z0.####.com
- a####.b####.qq.com
- a####.exc.mob.com
- a####.u####.com
- adser####.go####.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- c####.g####.ig####.com
- c-h####.g####.com
- encrypt####.gst####.com
- f####.zero####.cn
- id.go####.com
- m.d####.mob.com
- m.zero####.cn
- mt####.go####.com
- pi####.qq.com
- pin####.qq.com
- pub-####.qin####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- ssl.gst####.com
- www.go####.com
- www.go####.nl
- www.gst####.com
- m.d####.mob.com/v3/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
- m.zero####.cn/index.htm
- m.zero####.cn/mobile/css/iconfont.css?2####
- m.zero####.cn/mobile/css/mui.css?2####
- m.zero####.cn/mobile/css/mui.icons-extra.css?2####
- m.zero####.cn/mobile/css/mui.picker.min.css?2####
- m.zero####.cn/mobile/css/mui.poppicker.css?2####
- m.zero####.cn/mobile/css/style.css?2####
- m.zero####.cn/mobile/fonts/mui.ttf
- m.zero####.cn/mobile/js/base.min.js?2####
- m.zero####.cn/mobile/js/base.min.js?2####&__t=####
- m.zero####.cn/mobile/js/jquery-1.9.1.min.js?2####
- m.zero####.cn/mobile/js/jquery-1.9.1.min.js?2####&__t=####
- m.zero####.cn/mobile/js/jquery.Toast.js?2####
- m.zero####.cn/mobile/js/jquery.Toast.js?2####&__t=####
- m.zero####.cn/mobile/js/jquery.cookie.js?2####
- m.zero####.cn/mobile/js/jquery.cookie.js?2####&__t=####
- m.zero####.cn/mobile/js/mui.min.js?2####
- m.zero####.cn/mobile/js/mui.min.js?2####&__t=####
- m.zero####.cn/mobile/js/myscript-webview.js?2####
- m.zero####.cn/mobile/js/myscript-webview.js?2####&__t=####
- m.zero####.cn/mobile/js/search/search.js?2####
- m.zero####.cn/mobile/js/search/search.js?2####&__t=####
- m.zero####.cn/mobile/js/wxbUtil.js?2####
- m.zero####.cn/mobile/js/wxbUtil.js?2####&__t=####
- m.zero####.cn/mobileConfig.htm?deviceId=####&clientId=####&deviceType=##...
- m.zero####.cn/mobileConfig.htm?deviceId=####&deviceType=####&__t=####
- m.zero####.cn/msg/getUserMessageNum.htm
- m.zero####.cn/search.htm?__ar=####&__t=####
- m.zero####.cn/upload/course/2018/6/11/55069352_pic.png?t=####
- m.zero####.cn/upload/course/2018/7/17/55072987_pic.png?t=####
- m.zero####.cn/upload/course/2018/7/17/55072992_pic.jpg?t=####
- m.zero####.cn/upload/course/2018/8/2/55073457_pic.jpg?t=####
- m.zero####.cn/upload/index_pic/2018/05/11/96.png?t=####
- m.zero####.cn/upload/index_pic/2018/07/27/85.png?t=####
- m.zero####.cn/upload/index_pic/2018/08/09/101.jpg?t=####
- m.zero####.cn/upload/startup/66_1513561449361.jpg
- m.zero####.cn/upload/startup/67_1513561471854.jpg
- m.zero####.cn/upload/startup/70_1513577872078.jpg
- m.zero####.cn/upload/startup/72_1513580526254.jpg
- m.zero####.cn/upload/teacher/2017/05/25/58_photo.png?t=####
- m.zero####.cn/upload/teacher/2018/07/13/7601_photo.jpg?t=####
- sni.c####.q####.####.net/config/hz-hzv3.conf
- sni.c####.q####.####.net/tdata_Soq141
- sni.c####.q####.####.net/tdata_vxj811
- t####.c####.q####.####.com/tdata_EDT356
- a####.b####.qq.com:8011/rqd/async
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- c-h####.g####.com/api.php?format=####&t=####
- m.zero####.cn/indexItem.htm?type=####&page.currentPage=####
- pi####.qq.com/mstat/report/?index=####
- pin####.qq.com/request
- sdk.o####.p####.####.com/api.php?format=####&t=####
- /data/data/####/.imprint
- /data/data/####/.lock
- /data/data/####/0171657575038ec5849e4741131b84c9.0.tmp
- /data/data/####/0171657575038ec5849e4741131b84c9.1.tmp
- /data/data/####/0c60ee1b4b05b81a1f48b8cb33ce38b9.0.tmp
- /data/data/####/0c60ee1b4b05b81a1f48b8cb33ce38b9.1.tmp
- /data/data/####/1300de2b7c27df173fc1b1f2de314bfe.0.tmp
- /data/data/####/1300de2b7c27df173fc1b1f2de314bfe.1.tmp
- /data/data/####/25591077.1365602
- /data/data/####/25591077.1365602 (deleted)
- /data/data/####/25591077.8969295
- /data/data/####/25591081.5979251
- /data/data/####/25591082.9870231
- /data/data/####/25591082.9870231 (deleted)
- /data/data/####/34015f4328f02adca07e4e7810238ece.0.tmp
- /data/data/####/34015f4328f02adca07e4e7810238ece.1.tmp
- /data/data/####/3506740a34df649202014934b98670cb.0.tmp
- /data/data/####/3506740a34df649202014934b98670cb.1.tmp
- /data/data/####/698f1d8ce91b0ea6f2e27b5c40fb555e.0.tmp
- /data/data/####/698f1d8ce91b0ea6f2e27b5c40fb555e.1.tmp
- /data/data/####/81230639e48fd1f096e6a93325f67cc4.0.tmp
- /data/data/####/81230639e48fd1f096e6a93325f67cc4.1.tmp
- /data/data/####/8aa8c31b78c8993ff27abc81c27bd260.0.tmp
- /data/data/####/8aa8c31b78c8993ff27abc81c27bd260.1.tmp
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/b86c593662264d79b66a9b27dcb89ab5.0.tmp
- /data/data/####/b86c593662264d79b66a9b27dcb89ab5.1.tmp
- /data/data/####/bc6f6a07556b1429b0af6e5d55e70613.0.tmp
- /data/data/####/bc6f6a07556b1429b0af6e5d55e70613.1.tmp
- /data/data/####/bugly_db_legu-journal
- /data/data/####/cbff13b6dbc73497a85a4c25fda99d43.0.tmp
- /data/data/####/cbff13b6dbc73497a85a4c25fda99d43.1.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cd044fff50f7f51f605db276bec9c1d6.0.tmp
- /data/data/####/cd044fff50f7f51f605db276bec9c1d6.1.tmp
- /data/data/####/d8642f2c52ecd514f5514cdff45f47ff.0.tmp
- /data/data/####/d8642f2c52ecd514f5514cdff45f47ff.1.tmp
- /data/data/####/da2e50b4615b87c7f6169bbe748f5abf.0.tmp
- /data/data/####/da2e50b4615b87c7f6169bbe748f5abf.1.tmp
- /data/data/####/daaef6820582c06cc11970afea024b5b.0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/e0988b5c405f
- /data/data/####/e8493fa63492d0106905c78bfb86123a.0.tmp
- /data/data/####/e8493fa63492d0106905c78bfb86123a.1.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/fb63bed7b1ff3d58991281c5af35b3cb.0.tmp
- /data/data/####/fb63bed7b1ff3d58991281c5af35b3cb.1.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/legu_tencent_analysis.db_net.zdsoft.zerobook_an...ournal
- /data/data/####/libshella-2.8.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/mob_commons_1.xml
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/net.zdsoft.zerobook_android.mid.world.ro.xml
- /data/data/####/net.zdsoft.zerobook_android_preferences.xml
- /data/data/####/pri_legu_tencent_analysis.db_net.zdsoft.zeroboo...ournal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/tdata_Soq141
- /data/data/####/tdata_Soq141.jar
- /data/data/####/tdata_vxj811
- /data/data/####/tdata_vxj811.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/user_data.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/xUtils_http_cookie.db
- /data/data/####/xUtils_http_cookie.db-journal
- /data/media/####/.dic_lock
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.mid.txt
- /data/media/####/.mid.txt1000001
- /data/media/####/.nulplt
- /data/media/####/.pkg_lock
- /data/media/####/.rcTag
- /data/media/####/.rc_lock
- /data/media/####/1778ceb0fc9982156be41fcccfca3bdb.js
- /data/media/####/182b689e399f1394d9aadb5fc9c9546c.cookie.js
- /data/media/####/429bc8265ba83b61dab9f9b550dc090c.min.js
- /data/media/####/50997b825799954ea72916dd758ad123.js
- /data/media/####/579b08195840a2cac4df1f132e2cc442.js
- /data/media/####/67_1513561471854.jpg.tmp
- /data/media/####/70_1513577872078.jpg.tmp
- /data/media/####/9e3dfa503f1350a3947c8426d22db746.9.1.min.js
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/a8d3172fd0f8ecf0bafefeae65ff9f92.Toast.js
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/f97f81f8ffcfdc1ef202cd6aba4d323c.min.js
- /data/media/####/net.zdsoft.zerobook_android.bin
- /data/media/####/net.zdsoft.zerobook_android.db
- /data/media/####/tdata_Soq141
- /data/media/####/tdata_vxj811
- /data/media/####/test.log
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/net.zdsoft.zerobook.common.business.service.getui.GeTuiPushService 25792 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- mount
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/net.zdsoft.zerobook.common.business.service.getui.GeTuiPushService 25792 300 0
- Bugly
- MtaNativeCrash
- getuiext2
- libnfix
- libshella-2.8
- libufix
- neh
- nfix
- pl_droidsonroids_gif
- ufix
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-NONE-PKCS1PADDING
- AES-CFB-NoPadding
- AES-ECB-NoPadding
- AES-GCM-NoPadding