Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.n####.i####.com:80
- TCP(HTTP/1.1) u####.icl####.i####.com:80
- TCP(HTTP/1.1) i####.del####.i####.com:80
- TCP(HTTP/1.1) www.qchann####.cn:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(HTTP/1.1) api.icl####.i####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) 1####.254.116.117:80
- TCP(HTTP/1.1) loc.map.b####.com:80
- TCP(HTTP/1.1) ai####.anal####.cn:8089
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) st####.i####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) mem####.3####.net:80
- TCP(HTTP/1.1) t####.qq.com:80
- TCP(HTTP/1.1) ur####.anal####.cn:8089
- TCP(TLS/1.0) api.shu####.cn:443
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) dai.shu####.cn:443
- TCP(TLS/1.0) u####.icl####.i####.com:443
- TCP(TLS/1.0) fp.fraudme####.cn:443
- TCP(TLS/1.0) st####.shu####.cn:443
- TCP(TLS/1.0) daa.shu####.cn:443
- TCP(TLS/1.0) api.pus####.i####.com:443
- TCP(TLS/1.0) api.icl####.i####.com:443
- TCP 42.62.1####.41:5225
- TCP sdk.o####.t####.####.com:5224
- TCP t####.qq.com:8080
- TCP t####.nz.ge####.com:5224
- TCP t####.qq.com:443
- 7j####.c####.z0.####.com
- ai####.anal####.cn
- and####.b####.qq.com
- api.icl####.i####.com
- api.n####.i####.com
- api.pus####.i####.com
- api.shu####.cn
- c-h####.g####.com
- daa.shu####.cn
- dai.shu####.cn
- fp.fraudme####.cn
- i####.del####.i####.com
- i####.del####.i####.com
- ife####.3g.i####.com
- loc.map.b####.com
- pi####.qq.com
- plb####.u####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st####.i####.com
- st####.shu####.cn
- sta####.i####.com
- t####.nz.g####.net
- t####.nz.ge####.com
- t####.nz.ig####.com
- t####.qq.com
- u####.icl####.i####.com
- u####.u####.com
- ur####.anal####.cn
- www.3####.org
- www.qchann####.cn
- api.icl####.i####.com/client_base_config?configType=####&&gv=####&av=###...
- api.icl####.i####.com/client_base_config?configType=####&gv=####&av=####...
- api.icl####.i####.com/client_base_config?configType=####&newInstall=####...
- api.icl####.i####.com/client_base_config?gv=####&av=####&uid=####&device...
- api.icl####.i####.com/ifengNewsKeepLiveConfig?gv=####&av=####&uid=####&d...
- api.icl####.i####.com/interest_select?gv=####&av=####&uid=####&deviceid=...
- api.n####.i####.com/ClientAdversApi1508?iua=####&adids=####&gv=####&av=#...
- i####.del####.i####.com/getmcode?iua=####&adid=####&gv=####&av=####&uid=...
- mem####.3####.net/dyndns/getip
- sni.c####.q####.####.net/config/bj-bjv4.conf
- sni.c####.q####.####.net/config/hz-bjv4.conf
- sni.c####.q####.####.net/tdata_imh016
- st####.i####.com/appsta.js?datatype=####&datatype2=####&mos=####&softver...
- st####.i####.com/appsta.js?datatype=####&mos=####&softversion=####&publi...
- u####.icl####.i####.com/event_protal/list_api?gv=####&av=####&uid=####&d...
- ai####.anal####.cn:8089/
- and####.b####.qq.com/rqd/async
- c-h####.g####.com/api.php?format=####&t=####
- i####.del####.i####.com/LogReceiver/savelog
- loc.map.b####.com/offline_loc
- loc.map.b####.com/sdk.php
- pi####.qq.com/mstat/report/?index=####
- sdk-ope####.g####.com/api.php?format=####&t=####
- t####.qq.com/203.205.146.122:80/
- u####.icl####.i####.com/appsta.js
- ur####.anal####.cn:8089/
- www.qchann####.cn/center/adj
- www.qchann####.cn/center/adj?appkey=####
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.td-3
- /data/data/####/.tpns.service.xml.xml
- /data/data/####/.tpns.settings.xml.xml
- /data/data/####/.tpush_mta.xml
- /data/data/####/1cdb1292f33954bf4277f61a62229
- /data/data/####/49cef1324178a0f891518558d2f72580
- /data/data/####/54feb131db3b2146c4e35ddc399bbc90
- /data/data/####/61569f186adb1a28f957f2afc8b48c4f
- /data/data/####/73692c384a5a92e84ad3e389dfdc1
- /data/data/####/8a4966925741cd5e4c24f153f81a9
- /data/data/####/8c249dba19b8987e1ae4e85ab047a8dd
- /data/data/####/8ec69d5a71e4ddb2d381f29511aefce7
- /data/data/####/9732985cba77455a16a27d949b35516e
- /data/data/####/Alvin2.xml
- /data/data/####/COMMENTS_DB.db
- /data/data/####/COMMENTS_DB.db-journal
- /data/data/####/ContextData.xml
- /data/data/####/FirstLogin.xml
- /data/data/####/PushSettings.xml.xml
- /data/data/####/QT.xml
- /data/data/####/TeleSign.db-journal
- /data/data/####/a6f2b12d2c2c90367adfab4ca75c8d19
- /data/data/####/a==7.4.0&&6.1.2_1534318711455_envelope.log
- /data/data/####/arch.xml
- /data/data/####/b9eccfc2c8dedfc94fd4dd7301b8ae
- /data/data/####/bugly_db_-journal
- /data/data/####/c2f8c11ea23346a39deaf566e3c8b1
- /data/data/####/com.ifext.news_dna.xml
- /data/data/####/com.ifext.news_preferences.xml
- /data/data/####/com.ifext.news_prefs.xml
- /data/data/####/daemon
- /data/data/####/dayofyear.xml
- /data/data/####/device_id.xml
- /data/data/####/du.lock
- /data/data/####/eguan.db
- /data/data/####/eguan.db-journal
- /data/data/####/eguan_app.db
- /data/data/####/eguan_app.db-journal
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f668369fce3e1fe325ccd6f55d5d2a3
- /data/data/####/firll.dat
- /data/data/####/fm_shared.xml
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/i==1.2.0&&6.1.2_1534318709595_envelope.log
- /data/data/####/i==1.2.0&&6.1.2_1534318720977_envelope.log
- /data/data/####/i==1.2.0&&6.1.2_1534318728982_envelope.log
- /data/data/####/i==1.2.0&&6.1.2_1534318734710_envelope.log
- /data/data/####/ifeng_advert_pre.dat
- /data/data/####/ifeng_advert_task.dat
- /data/data/####/ifeng_log_GT-I8190.txt
- /data/data/####/ifeng_main.db
- /data/data/####/ifeng_main.db-journal
- /data/data/####/ifeng_statitics+6.1.2.dat
- /data/data/####/info.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-1502561448.so
- /data/data/####/local_crash_lock
- /data/data/####/lock_dm
- /data/data/####/lock_gt
- /data/data/####/multidex.version.xml
- /data/data/####/ofl.config
- /data/data/####/ofl_location.db
- /data/data/####/ofl_location.db-journal
- /data/data/####/ofl_statistics.db
- /data/data/####/ofl_statistics.db-journal
- /data/data/####/push.pid
- /data/data/####/push_dialog_opened.xml
- /data/data/####/push_record.db
- /data/data/####/push_record.db-journal
- /data/data/####/push_switch_sp.xml
- /data/data/####/pushext.db-journal
- /data/data/####/pushsdk.db
- /data/data/####/pushsdk.db-journal
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/qtsession.xml
- /data/data/####/reading_history.db
- /data/data/####/reading_history.db-journal
- /data/data/####/red_dot_record.xml
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/sp_replace_flag.sp
- /data/data/####/sp_replace_flag.sp.bak
- /data/data/####/sputil.sp
- /data/data/####/sputil.sp.bak
- /data/data/####/subscriptionTag.xml
- /data/data/####/td_fm.jar
- /data/data/####/tdata_imh016
- /data/data/####/tdata_imh016.jar
- /data/data/####/tmpd8.db-journal
- /data/data/####/tpush.shareprefs.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_common_config.xml.bak
- /data/data/####/umeng_common_config.xml.bak (deleted)
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/xg_message.db
- /data/data/####/xg_message.db-journal
- /data/media/####/._android.dat
- /data/media/####/._driver.dat
- /data/media/####/._system.dat
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.cuid
- /data/media/####/.nomedia
- /data/media/####/.td-3
- /data/media/####/.umm.dat
- /data/media/####/23abac3dcac3d81af85b63f45995ca3b
- /data/media/####/54feb131db3b2146c4e35ddc399bbc90
- /data/media/####/62ac12d43df7379f8db2886fad729535
- /data/media/####/9ba44b48ef720d89ca156d9ce8b4cdc4
- /data/media/####/AN.csv-20180815073835
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/TruthInfo.csv-1534318718088
- /data/media/####/UA.csv-20180815073838
- /data/media/####/_android.dat
- /data/media/####/_driver.dat
- /data/media/####/_system.dat
- /data/media/####/a6f2b12d2c2c90367adfab4ca75c8d19
- /data/media/####/ab27f9f1b93a8ae7c530bd9d5348ced7
- /data/media/####/apge.csv-20180815073838
- /data/media/####/apge.csv-20180815073844
- /data/media/####/apge.csv-20180815073917
- /data/media/####/apge.csv-20180815073927
- /data/media/####/app.db
- /data/media/####/bce9c779aba6926366427a98c7699cba
- /data/media/####/c2f8c11ea23346a39deaf566e3c8b1
- /data/media/####/cfbc1d23cc4b7c3336649382ee049d9c
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.ifext.news.bin
- /data/media/####/com.ifext.news.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/conlts.dat
- /data/media/####/f5dbfe912193bee9
- /data/media/####/ller.dat
- /data/media/####/ls.db
- /data/media/####/ls.db-journal
- /data/media/####/qt.csv.1534318711011.txt
- /data/media/####/sysid.dat
- /data/media/####/tdata_imh016
- /data/media/####/test.0
- /data/media/####/uuid
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.ifeng.news2.getui.GetuiPushService 24400 300 0
- <Package Folder>/lib/libxguardian.so <Package>,2100270300; 55063 203.205.128.130 [{ idx :0, ts :%d, et :2000, si :0, ui : <IMEI> , ky : Axg%lu , mid : 0 , ev :{ ov : 18 , sr : 600*752 , md : <System Property> , lg : en , sv : 3.12 , mf : unknown , apn : %s }}] 0 18
- cat /proc/cpuinfo
- chmod 444/storage/emulated/0/.Android/.td-3
- chmod 444/storage/emulated/0/.DataStorage/.td-3
- chmod 444/storage/emulated/0/.UTSystemConfig/.td-3
- chmod 444/storage/emulated/0/.qmt/.td-3
- chmod 444/storage/emulated/0/.td-3
- chmod 444/storage/emulated/0/Android/.td-3
- chmod 444/storage/emulated/0/DCIM/.td-3
- chmod 444/storage/emulated/0/Download/.td-3
- chmod 444/storage/emulated/0/MQ/.td-3
- chmod 444/storage/emulated/0/Movies/.td-3
- chmod 444/storage/emulated/0/Music/.td-3
- chmod 444/storage/emulated/0/Notifications/.td-3
- chmod 444/storage/emulated/0/Pictures/.td-3
- chmod 444/storage/emulated/0/Podcasts/.td-3
- chmod 444/storage/emulated/0/Ringtones/.td-3
- chmod 444/storage/emulated/0/baidu/.td-3
- chmod 444/storage/emulated/0/qmt/.td-3
- chmod 700 <Package Folder>/app_bin/daemon
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-1502561448.so
- date
- df
- getprop net.dns1
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- id
- logcat -d -v threadtime
- ls -l /system/xbin/su
- ls /dev/socket
- ls /sys/class/thermal
- ls /system/fonts
- mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
- ps
- service call iphonesubinfo 1
- sh -c cat
- sh -c cat /proc/meminfo
- sh -c cat /proc/sys/kernel/osrelease
- sh -c cat /proc/sys/kernel/random/boot_id
- sh -c cat /proc/sys/kernel/random/uuid
- sh -c cat /proc/uptime
- sh -c cat /sys/block/mmcblk0/device/cid
- sh -c cat /sys/class/net/eth0/address
- sh -c cat /sys/class/net/eth1/address
- sh -c cat /sys/class/net/eth2/address
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccvid
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
- sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
- sh -c cd /proc/;cat cpuinfo
- sh -c cd /proc/net/ && cat arp
- sh -c cd /proc/self/;cat status
- sh -c cd /sys/class/net/eth0/ && cat address
- sh -c cd /sys/class/net/wlan0/ && cat address
- sh -c echo OTc0QjA1RDEzRDgwOUE2RUUxMzc3MkIyRUJFNDJDNTExMEQ3RjQ6RTM5QzUxOkZDOTc5Nw== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
- sh -c echo OTc0QjA1RDEzRDgwOUE2RUUxMzc3MkIyRUJFNDJDNTExMEQ3RjQ6RTM5QzUxOkZDOTc5Nw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
- sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
- sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
- sh -c echo RjAxMTE4NzJDQjNDRUVCNTIxMDU1MzJBRkJBMEVFRDdFODE5MEU6Q0E3NzgxOjY3M0YwNg== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
- sh -c echo RjAxMTE4NzJDQjNDRUVCNTIxMDU1MzJBRkJBMEVFRDdFODE5MEU6Q0E3NzgxOjY3M0YwNg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.ifeng.news2.getui.GetuiPushService 24400 300 0
- Bugly
- du
- getuiext2
- ifeng_secure
- libjiagu-1502561448
- locSDK6a
- securityenv
- sign
- tongdun
- tpnsSecurity
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-CFB8-NoPadding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- DESede-CBC-PKCS5Padding
- RSA
- RSA-ECB-PKCS1PADDING
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-CFB8-NoPadding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- DES-ECB-PKCS5Padding