Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.b####.qq.com:8011
- TCP(HTTP/1.1) c.d####.mob.com:80
- TCP(HTTP/1.1) oss.newairc####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) m.d####.mob.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) a####.b####.qq.com:8012
- TCP(HTTP/1.1) d####.d####.mob.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) h5.newairc####.com:80
- TCP(TLS/1.0) s####.ml####.cc:443
- TCP(TLS/1.0) oss.newairc####.com:443
- TCP(TLS/1.0) h5.newairc####.com:443
- TCP c####.g####.ig####.com:5226
- TCP sdk.o####.t####.####.com:5224
- 7j####.c####.z0.####.com
- a####.b####.qq.com
- a####.exc.mob.com
- a####.u####.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- api.s####.mob.com
- c####.g####.ig####.com
- c-h####.g####.com
- c.d####.mob.com
- d####.d####.mob.com
- h5.newairc####.com
- img.newairc####.com
- l####.tbs.qq.com
- m.d####.mob.com
- oss.newairc####.com
- pub-####.qin####.com
- s####.ml####.cc
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- h5.newairc####.com/api/getArticleAdv?sid=####&cid=####&v=####
- h5.newairc####.com/api/getComments?sid=####&rootID=####&sourceType=####&...
- m.d####.mob.com/cconf?appkey=####&plat=####&apppkg=####&appver=####&netw...
- oss.newairc####.com/mjxw/pic/201706/07/3b0da16c-6cda-49fb-9999-624aa9425...
- oss.newairc####.com/mjxw/pic/201706/07/3bf69358-1a0f-48ba-b418-6713b0cef...
- oss.newairc####.com/mjxw/pic/201706/07/666c0490-86b7-484f-8d15-495e14b6f...
- oss.newairc####.com/mjxw/pic/201706/07/d379b969-7f70-4070-abb0-7fccae476...
- oss.newairc####.com/xy/att/201706/12/c0802884-7bf6-46fd-9b0e-e19a508cb2a...
- qin####.com.www.####.com/tdata_EDT369
- t####.c####.q####.####.com/tdata_Rnl693
- t####.c####.q####.####.com/tdata_Soq141
- t####.c####.q####.####.com/tdata_fEV688
- t####.c####.q####.####.com/tdata_siA393
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- a####.b####.qq.com:8011/rqd/async
- a####.b####.qq.com:8012/rqd/async
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- and####.b####.qq.com/rqd/async
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/log4
- c-h####.g####.com/api.php?format=####&t=####
- c.d####.mob.com/cdata
- d####.d####.mob.com/dinfo
- d####.d####.mob.com/dsign
- h5.newairc####.com/api/event
- l####.tbs.qq.com/ajax?c=####&k=####
- l####.tbs.qq.com/ajax?c=####&v=####&k=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
- /data/data/####/-1261496487
- /data/data/####/-1292516294
- /data/data/####/-1312716470
- /data/data/####/-1323536101
- /data/data/####/-1354555908
- /data/data/####/-1383854545
- /data/data/####/-1383854546
- /data/data/####/-1383854547
- /data/data/####/-1383854548
- /data/data/####/-1383854549
- /data/data/####/-1383854550
- /data/data/####/-1385575715
- /data/data/####/-1416595522
- /data/data/####/-187490894
- /data/data/####/.imprint
- /data/data/####/.lock
- /data/data/####/.mrecord
- /data/data/####/.mrlock
- /data/data/####/.statistics
- /data/data/####/00da8204473bf47a52837bebe62398fa484f7f96f5aacc4....0.tmp
- /data/data/####/0b2f3a29a31469dd89b2c6bc5dda6114008c719727bed3b....0.tmp
- /data/data/####/104880a4fab8f29748d09a595cd6d3772b84d2fbe366980....0.tmp
- /data/data/####/1389023919
- /data/data/####/1695857311
- /data/data/####/1738763_article.js
- /data/data/####/1738767_article.js
- /data/data/####/2014322588
- /data/data/####/20ac6017aa314f1a39f9ef72fd7e6a871ed367989e71ff6....0.tmp
- /data/data/####/2182900ee75fab300a50a866058a8751f2913c206f0fc84....0.tmp
- /data/data/####/23374d0adfc3a5454ab3cb9c761502f253fcd5656511e01....0.tmp
- /data/data/####/2751cfa32bb7e36854a8ebe9ebf5461bdfad8798dad046d....0.tmp
- /data/data/####/328839982
- /data/data/####/337525857
- /data/data/####/337d70f60e3bea9d4ae70b2c7e51dccea1411f9f247d89d....0.tmp
- /data/data/####/386967948
- /data/data/####/4318c000092f35df0a794d3b16f5c83ec86a48b9973be84....0.tmp
- /data/data/####/49
- /data/data/####/492260850
- /data/data/####/5b33ead1cc312c74df05100a68f6d8b28bcc33d0b9ea847....0.tmp
- /data/data/####/6f4e7f20101b09442eabd09b5fbecc11341d78b5e700543....0.tmp
- /data/data/####/70025384b42b8c0faff25fb735879da08e006438f9186bc....0.tmp
- /data/data/####/71cb5cbe040304184b8e3946098c95e2ca6c45f64fa7e5e....0.tmp
- /data/data/####/722668377
- /data/data/####/7e8115e261ac89502abdbf39b3211954930b1ec9de0005e....0.tmp
- /data/data/####/81fce6ef084737eb7253fe44b2e750978312507ebb15d94....0.tmp
- /data/data/####/843e327e19ae13590f3789e03d157ffd3d2c1ce8d6d117d....0.tmp
- /data/data/####/8a55bd2ee81ce83c82bbdf4f22a89198741faefac2dcec7....0.tmp
- /data/data/####/8bdb91d1c3e9
- /data/data/####/8e09154474c3d39e9030375200cc422e4bc3f9c99e9fe56....0.tmp
- /data/data/####/96e3079b141305825c5cd45f6e1df747d1fb53b048f491b....0.tmp
- /data/data/####/9f5084ebcf20b205d9cf99683a5bfdaf924e3f7bfd38dae....0.tmp
- /data/data/####/FZLTXHK-GBK_YS.ttf
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/a0874279ae807dd172d080053d9e016bd87271c9c09822b....0.tmp
- /data/data/####/a3f6f32345f829f936ea181c62a697fa3fb0624afefc427....0.tmp
- /data/data/####/a4971a9c3cd134548813e4a4f611379820493daffa2e7e2....0.tmp
- /data/data/####/amazeui.min.css
- /data/data/####/amazeui.min.js
- /data/data/####/angular1.4.6.min.js
- /data/data/####/article.js
- /data/data/####/base.css
- /data/data/####/bugly_db_legu-journal
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cf28ed9d77e6f5b10a95d2d7eae12916449a7cd0cecacfd....0.tmp
- /data/data/####/columnId.xml
- /data/data/####/com.founder.minjinzhongyang-1.apk.classes1309007166.zip
- /data/data/####/core_info
- /data/data/####/d2258ff29664c580306448e94565fbc3cefb0b39c3a6e7c....0.tmp
- /data/data/####/d68b46bc652a35a2bb707ed24c8c2aa8046adc109656359....0.tmp
- /data/data/####/d82e4015c2c5935188c865f6d44ad26197e87ef66f4f879....0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/db_founder0-journal
- /data/data/####/de0d8f90d3c73762f19449c06d177a788970035d32109d4....0.tmp
- /data/data/####/de160c84ef02ab8703fa6fc4d05b433a778ef7612a2a6f5....0.tmp
- /data/data/####/debug.conf
- /data/data/####/e2fa42e1c573e711370b77623e9bc237826eab0a15cbfc0....0.tmp
- /data/data/####/ebcb14365c751aa5d458f37e2be3fec3f15525793303ae8....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f1918678bb4685d027a28d01e6b80544b04a1fa4f0ec576....0.tmp
- /data/data/####/file__0.localstorage-journal
- /data/data/####/fontawesome-webfont.ttf
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/great_button.png
- /data/data/####/great_cancel_button.png
- /data/data/####/gx_sp.xml
- /data/data/####/helpMsg.xml
- /data/data/####/icon-images.png
- /data/data/####/icon_audio_play.png
- /data/data/####/icon_file.png
- /data/data/####/icon_file_down.png
- /data/data/####/icon_meta_voice.png
- /data/data/####/icon_selector_normal.png
- /data/data/####/icon_selector_press.png
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/jquery.min2.2.0.js
- /data/data/####/js.combine.min.js
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.10.3.1.so
- /data/data/####/libufix.so
- /data/data/####/loading.png
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/mob_commons_1.xml
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/multidex.version.xml
- /data/data/####/mwsdk_analytics.db-journal
- /data/data/####/native_record_lock
- /data/data/####/news_detail.html
- /data/data/####/persistent_data.xml
- /data/data/####/persistent_data.xml.bak
- /data/data/####/play.png
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/reader.db-journal
- /data/data/####/run.pid
- /data/data/####/sanjiaoxing.png
- /data/data/####/security_info
- /data/data/####/security_info (deleted)
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_Rnl693
- /data/data/####/tdata_Rnl693.jar
- /data/data/####/tdata_Soq141
- /data/data/####/tdata_Soq141.jar
- /data/data/####/tdata_fEV688
- /data/data/####/tdata_fEV688.jar
- /data/data/####/tdata_siA393
- /data/data/####/tdata_siA393.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/video.png
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.al
- /data/media/####/.ccLock
- /data/media/####/.ccc
- /data/media/####/.dh-journal
- /data/media/####/.dhlock
- /data/media/####/.dic_lock
- /data/media/####/.dk
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.nomedia
- /data/media/####/.nulal
- /data/media/####/.nulplt
- /data/media/####/.pkg_lock
- /data/media/####/.plst
- /data/media/####/.rc_lock
- /data/media/####/.usLock
- /data/media/####/app.db
- /data/media/####/com.founder.minjinzhongyang.bin
- /data/media/####/com.founder.minjinzhongyang.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/journal.tmp
- /data/media/####/localTemplate.zip
- /data/media/####/tdata_Rnl693
- /data/media/####/tdata_Soq141
- /data/media/####/tdata_fEV688
- /data/media/####/tdata_siA393
- /data/media/####/test.log
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.GeTuiPushService 25792 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.10.3.1.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- grep -E -v root|shell|system
- logcat -d -v threadtime
- mount
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.GeTuiPushService 25792 300 0
- top -d 0 -n 1
- Bugly
- getuiext2
- libnfix
- libshella-2.10.3.1
- libufix
- neh
- nfix
- ufix
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DESede-ECB-PKCS5Padding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding