Technical information
- Adware.Gexin.2.origin
- UDP(DNS) 2####.5.5.5:53
- UDP(DNS) 1####.114.114.114:53
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) q####.c####.l####.####.com:80
- TCP(HTTP/1.1) d####.opensp####.cn:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) m.qiangt####.com:9000
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) ngc.aliy####.com:80
- TCP(HTTP/1.1) 1####.37.132.16:80
- TCP(HTTP/1.1) thi####.q####.cn:80
- TCP(TLS/1.0) p1.qiangt####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) p1.jietouz####.com:443
- TCP(TLS/1.0) m.qiangt####.com:443
- TCP(TLS/1.0) ti####.b####.com:443
- TCP(TLS/1.0) 2####.58.208.110:443
- TCP(TLS/1.0) res.wx.qq.####.com:443
- TCP(TLS/1.0) api.w####.com:443
- TCP(TLS/1.0) dxp.b####.com:443
- TCP(TLS/1.0) h####.b####.com:443
- TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) log####.ifl####.com:443
- TCP(TLS/1.2) 1####.217.17.42:443
- TCP sdk.o####.t####.####.com:5224
- TCP cm-1####.ig####.com:5226
- 7j####.c####.z0.####.com
- and####.google####.com
- api.w####.com
- c-h####.g####.com
- cm-1####.ig####.com
- d####.opensp####.cn
- dxp.b####.com
- h####.b####.com
- instant####.google####.com
- log####.ifl####.com
- m####.go####.com
- m.qiangt####.com
- ngc.aliy####.com
- p1.jietouz####.com
- p1.qiangt####.com
- r####.wx.qq.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- stc.qiangt####.com
- thi####.q####.cn
- ti####.b####.com
- u####.u####.com
- m.qiangt####.com:9000/v1/ws
- q####.c####.l####.####.com/config/hz-hzv6.conf
- q####.c####.l####.####.com/tdata_LRe817
- q####.c####.l####.####.com/tdata_OxN092
- q####.c####.l####.####.com/tdata_ZPR725
- q####.c####.l####.####.com/tdata_bca864
- sdk.o####.p####.####.com/api/addr.htm
- thi####.q####.cn/mmopen/vi_32/DYAIOgq83eq57mw9haOKrzY5cA8qBF1RWT5uukR8Bg...
- thi####.q####.cn/mmopen/vi_32/JaQ6R1ibCBvOjzBpPrUubJvQRog0YOvcyyjVwBfDKI...
- thi####.q####.cn/mmopen/vi_32/PiajxSqBRaELGjCWHN98UjicPKBjxD7h71zOGUHHL3...
- thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTIz5J5e03mM9szpibQnDeriaY84zX3GeJ...
- thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTLyicMjwcEFobq4wNc43Py6jF2LInI4EL...
- thi####.q####.cn/mmopen/vi_32/UsFFkS32lQvfU4sCRXjSuHvY4YWTFUCRgmS8drq608...
- thi####.q####.cn/mmopen/vi_32/cD5ibJ0WHoJdNgBYbt4hqD5g2cUB2ETibAoVTe5288...
- thi####.q####.cn/mmopen/vi_32/cnSIRtcmBlbNca7JkVEJ8rxKARJU4q7Dic6NTVNs91...
- c-h####.g####.com/api.php?format=####&t=####
- d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
- ngc.aliy####.com/data/r?a=####&m=####&o=####&k=####&p=####&u=####&t=####...
- sdk.o####.p####.####.com/api.php?format=####&t=####
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.jgck
- /data/data/####/0e14f3428e1bde8dff0227042df0b4a48cdff65b68d5e6c....0.tmp
- /data/data/####/25d14a732bef15ce_0
- /data/data/####/290d30ded0a2b89a_0
- /data/data/####/2eb33cd5d6520379_0
- /data/data/####/2eb33cd5d6520379_1
- /data/data/####/2edf07d567451f1f_0
- /data/data/####/2f2720e885fe8840_0
- /data/data/####/2fb5a992f69c9311_0
- /data/data/####/2fcbd3bf962ef076362a8136993274dcfa6de8f3b0287c4....0.tmp
- /data/data/####/2fdf8415a50eca71_0
- /data/data/####/31baf794be24379e_0
- /data/data/####/382dacf685ac6da1_0
- /data/data/####/396145c0e414dc88ac0e3e498e9cafaeed65d0f97ca47f1....0.tmp
- /data/data/####/3a2b8da7be4941e72572d2d9ebb3f7866d6a03d0b7c210f....0.tmp
- /data/data/####/3fa3aa5433a726501966c8c20f73c387bd80f4196b4204a....0.tmp
- /data/data/####/4579b336b26754e66d538dde642bc43a3bda3b138d8ba7c....0.tmp
- /data/data/####/458ff133030b0d7c_0
- /data/data/####/45fb065889422d7f_0
- /data/data/####/48c789cffc047a55_0
- /data/data/####/493c3cc0d7ddecec_0
- /data/data/####/4a01a38be5f1c2ef_0
- /data/data/####/4a085ac649a6effd_0
- /data/data/####/4a085ac649a6effd_1
- /data/data/####/4a3e4bbb8152a781349c5ca8e27cef7fa1fcf1c948c10fa....0.tmp
- /data/data/####/4a656b6e085b4cb8_0
- /data/data/####/4be2dd6eaf9d9ba7bfa6829dc1e24a4f122b2dd431d9427....0.tmp
- /data/data/####/51e42934b753bf09ff3521a4dd3f32c346be90784bd8388....0.tmp
- /data/data/####/531efa8b2f263c3e_0
- /data/data/####/573318446cd6eb83f07c40d6de7bfdb060b6e3728036814....0.tmp
- /data/data/####/5a369f7c750c8a78_0
- /data/data/####/5eca177b72a5020c_0
- /data/data/####/5eca177b72a5020c_1
- /data/data/####/612598d4
- /data/data/####/6434ab82530ed0ad_0
- /data/data/####/655cdb312fcfbe20_0
- /data/data/####/6d5234e47b141d74_0
- /data/data/####/6e17835ec66810fab00044ef253c064d31afabec1ee566c...d4c8.0
- /data/data/####/6e6840184d97a3f62bb0b8f5b9314010ea89d6eddd9ede8....0.tmp
- /data/data/####/6edf448f0745177b_0
- /data/data/####/70ed162613e7db653a9caa4dbbe9bb506395d350d7226fc....0.tmp
- /data/data/####/7257de56e43e2654_0
- /data/data/####/7257de56e43e2654_1
- /data/data/####/72bf855ea513adb3d9c9ab822dd40a116d67bc1138ca171....0.tmp
- /data/data/####/74fab83b3f40a099_0
- /data/data/####/7ac3d2fdf7b41e3c0d7d0576dfbb03843f59c129726ae6c....0.tmp
- /data/data/####/808435b5451c90567b39b45200a32c474e0b96d4f07f789....0.tmp
- /data/data/####/874e04eec96fe88b_0
- /data/data/####/89c0f0746023a2b6_0
- /data/data/####/95d8a0ea4db2b37736023cb6bea751d208ca6038b9c8e3c....0.tmp
- /data/data/####/99be010388737b9701296835f4a5ebb453c68719a01df02....0.tmp
- /data/data/####/9de1e58984a06746_0
- /data/data/####/CookiePersistence.xml
- /data/data/####/Cookies-journal
- /data/data/####/Hawk2.xml
- /data/data/####/Hawk2.xml.bak
- /data/data/####/Hawk2.xml.bak (deleted)
- /data/data/####/SDK_config
- /data/data/####/SDK_config1
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml.bak
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/__local_stat_full_cache.json
- /data/data/####/__send_data_1570011454855
- /data/data/####/a2037d5815166930b69b177954113012d58d91d4441e160...5163.0
- /data/data/####/a2ff78c81d8703f3b01c9f4e94aedb771b377ce8468db8e....0.tmp
- /data/data/####/a33298b519202c36_0
- /data/data/####/a==7.5.3&&4.0.0_1570011447231_envelope.log
- /data/data/####/ab068708431caf31_0
- /data/data/####/af7d3278b10b53de_0
- /data/data/####/b03372cd508b3719_0
- /data/data/####/b18a02c8ac779963_0
- /data/data/####/b56b9c916c230502d61efacc5f8821edc362b7001196589....0.tmp
- /data/data/####/baidu_mtj_sdk_record.xml
- /data/data/####/be3b7206a90ebedb607431175687f3eefeb82b2896296d7...0007.0
- /data/data/####/c6c469f44c5b0bcd_0
- /data/data/####/ca105be8dd434e498f90de30712ae76afcd00a999c080e4....0.tmp
- /data/data/####/ca9c898db87353c0_0
- /data/data/####/ca9c898db87353c0_1
- /data/data/####/caf48b0a938595fb9f7f477407e1773bb6d9c68308c4b6c....0.tmp
- /data/data/####/ce1c83ccd4b28335267a7184eb3ca1bf915262e26595e97....0.tmp
- /data/data/####/ceb8e64d1c232331a1467c2beccb2cdabb55d2be5d25add....0.tmp
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.oat
- /data/data/####/com.iflytek.id.xml
- /data/data/####/com.iflytek.msc.xml
- /data/data/####/com.roadsideclub.news.newsclub_preferences.xml
- /data/data/####/cookie.xml
- /data/data/####/crypto.KEY_256.xml
- /data/data/####/d1cdb3230612a4ca_0
- /data/data/####/d3e474913b6de252017867eedf0359adb49d675503c568a....0.tmp
- /data/data/####/d536b0d63ea0d5b5_0
- /data/data/####/d7bea979b3ec33080ed7b9a1ac1d3e047128c1759618e9b....0.tmp
- /data/data/####/d==7.5.3&&4.0.0_1570011447376_envelope.log
- /data/data/####/d==7.5.3&&4.0.0_1570011453143_envelope.log
- /data/data/####/d==7.5.3&&4.0.0_1570011460022_envelope.log
- /data/data/####/d==7.5.3&&4.0.0_1570011461118_envelope.log
- /data/data/####/d==7.5.3&&4.0.0_1570011465575_envelope.log
- /data/data/####/d==7.5.3&&4.0.0_1570011477330_envelope.log
- /data/data/####/d==7.5.3&&4.0.0_1570011478524_envelope.log
- /data/data/####/device_id.xml.xml
- /data/data/####/e3b703a262c67c3c8fafb8a49ace1006792be43766f3736....0.tmp
- /data/data/####/e4fed9c4927a9030_0
- /data/data/####/e661819e2761535c_0
- /data/data/####/ead244ebb6652af7_0
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f1fac9a552b69546_0
- /data/data/####/f2414db38bba316d_0
- /data/data/####/f31cd95dcaed4ca1_0
- /data/data/####/fe08c830b8b012cf072024e5eb274d74078c2f361b94436....0.tmp
- /data/data/####/fee8796d03ddf949_0
- /data/data/####/getui_sp.xml
- /data/data/####/getui_sp.xml.bak
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/https_m.qiangttapp.com_0.localstorage-journal
- /data/data/####/iflytek_collect_state.xml
- /data/data/####/iflytek_device_info.zip
- /data/data/####/iflytek_state_com.roadsideclub.news.newsclub.xml
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libcuid.so
- /data/data/####/libjiagu.so
- /data/data/####/metrics_guid
- /data/data/####/mtj_autoTracker.js
- /data/data/####/openudid_prefs.xml
- /data/data/####/proc_auxv
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qtt_sp_Data.xml
- /data/data/####/rt_record_file.txt
- /data/data/####/run.pid
- /data/data/####/tdata_LRe817
- /data/data/####/tdata_LRe817.dex
- /data/data/####/tdata_LRe817.dex.flock (deleted)
- /data/data/####/tdata_LRe817.jar
- /data/data/####/tdata_OxN092
- /data/data/####/tdata_OxN092.dex
- /data/data/####/tdata_OxN092.dex.flock (deleted)
- /data/data/####/tdata_OxN092.jar
- /data/data/####/tdata_ZPR725
- /data/data/####/tdata_ZPR725.dex
- /data/data/####/tdata_ZPR725.dex.flock (deleted)
- /data/data/####/tdata_ZPR725.jar
- /data/data/####/tdata_bca864
- /data/data/####/tdata_bca864.dex.flock (deleted)
- /data/data/####/tdata_bca864.jar
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/trace_circle.data
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_common_config.xml.bak
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/weibo_sdk_aid1
- /data/data/####/yunceng.conf
- /data/misc/####/primary.prof
- /system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_LRe817.jar --oat-fd=65 --oat-location=/data/user/0/<Package>/files/tdata_LRe817.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_OxN092.jar --oat-fd=65 --oat-location=/data/user/0/<Package>/files/tdata_OxN092.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_ZPR725.jar --oat-fd=62 --oat-location=/data/user/0/<Package>/files/tdata_ZPR725.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_bca864.jar --oat-fd=60 --oat-location=/data/user/0/<Package>/files/tdata_bca864.dex --compiler-filter=speed
- getprop ro.build.display.id
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.miui.ui.version.name
- getprop ro.smartisan.version
- getprop ro.vivo.os.version
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding