Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) im1.6re####.com:8060
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) im1.6re####.com:8989
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) c####.6re####.cn:80
- TCP(HTTP/1.1) im2.6re####.com:8020
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) m.6re####.com:80
- TCP(HTTP/1.1) im1.6re####.com:3030
- TCP(TLS/1.0) c####.6re####.cn:443
- TCP(TLS/1.0) 1####.217.168.238:443
- TCP(TLS/1.0) 2####.107.1.97:443
- TCP ope####.m.ta####.com:443
- TCP c####.g####.ig####.com:5226
- TCP sdk.o####.t####.####.com:5224
- TCP 2####.119.215.161:80
- 7j####.c####.z0.####.com
- a####.b####.qq.com
- a####.man.aliy####.com
- a####.u####.com
- aexcep####.b####.qq.com
- ag####.m.ta####.com
- amdc####.m.ta####.com
- and####.b####.qq.com
- c####.6re####.cn
- c####.g####.ig####.com
- c-h####.g####.com
- im1.6re####.com
- im2.6re####.com
- m.6re####.com
- pub-####.qin####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- umen####.m.ta####.com
- umengj####.m.ta####.com
- c####.6re####.cn/hotel/2015_12_30_1451479352318180464.jpg
- c####.6re####.cn/hotel/2017_6_30_1498794485768088533.jpg
- c####.6re####.cn/hotel/2017_7_14_1500023044684037990.jpg
- c####.6re####.cn/hotel/2017_7_14_1500023821435224012.jpg
- c####.6re####.cn/hotel/2017_7_14_1500023955484722276.jpg
- c####.6re####.cn/hotel/2017_7_14_1500024403341674702.jpg
- c####.6re####.cn/hotel/2017_7_14_1500025470460070129.jpg
- c####.6re####.cn/hotel/2017_9_12_1505209883729723870.jpg
- c####.6re####.cn/hotel/2017_9_12_1505210532139584169.jpg
- c####.6re####.cn/hotel/2019_1_17_1547694460813717875.jpg
- c####.6re####.cn/sight/2016_11_11_1478860675651062754.jpg
- c####.6re####.cn/sight/2016_3_10_1457579095740910335.jpg
- c####.6re####.cn/sight/2016_5_10_1462892864239196734.jpg
- c####.6re####.cn/sight/2016_8_3_1470220135177688260.jpg
- c####.6re####.cn/sight/2017_6_29_1498727994637437797.jpg
- c####.6re####.cn/sight/2018_10_31_1540959809612144674.jpg
- c####.6re####.cn/sight/2019_1_17_1547713710645517294.jpg
- im1.6re####.com:8060/a2124c9cd516f86ba9609a5aa2c8b829
- im2.6re####.com:8020/app/latest
- m.6re####.com/app_service/get_ios_advs_pic
- m.6re####.com/app_service/get_member_info?token=####
- m.6re####.com/app_service/get_pic_region
- m.6re####.com/app_service/get_show_by_country?dest=####
- m.6re####.com/app_service/get_show_info?id=####
- m.6re####.com/app_service/get_trip_by_country?dest=####&page=####&size=#...
- m.6re####.com/app_service/get_trip_by_show?id=####&page=####&size=####
- m.6re####.com/app_service_ext/get_home_depth_scheme
- m.6re####.com/app_service_ext/get_simple_region
- qin####.com.www.####.com/tdata_EDT369
- t####.c####.q####.####.com/tdata_FhD658
- t####.c####.q####.####.com/tdata_mpY630
- t####.c####.q####.####.com/tdata_ngv385
- t####.c####.q####.####.com/tdata_vHH584
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- a####.u####.com/app_logs
- aexcep####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- and####.b####.qq.com/rqd/async
- c-h####.g####.com/api.php?format=####&t=####
- im1.6re####.com:3030/android/register
- im1.6re####.com:8989/auth
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
- /data/data/####/.imprint
- /data/data/####/0ebc793e84eefbcd6d5fbb7a419158b69d1075c2ba3e074....0.tmp
- /data/data/####/17f95853ad8f
- /data/data/####/1d86edefcd5797211791a5da08d6367ead1c5459cea956e....0.tmp
- /data/data/####/2191c17c24d641ecdaed40e7be87f72164ae61925c8fc9f....0.tmp
- /data/data/####/2e43f740739f7c14e788f08707ad4a30e9f6d91fb941e66....0.tmp
- /data/data/####/3ee027e9938877df9cede1e896ee60cfc33ed08ca0facc7....0.tmp
- /data/data/####/4dd487ad76b9618cf828118d7f320095d14b9dbaad01e33....0.tmp
- /data/data/####/58bddc8dadda88d4fb4321379637b94f518d6ce36760ecc....0.tmp
- /data/data/####/804207303bd0fd40b1f343d25c9573b20694d5b1cb2c47a....0.tmp
- /data/data/####/8f4746e6598cd6a938cf69cdf1fbc72748168ea43cfd6b2....0.tmp
- /data/data/####/ACCS_BINDumeng;5608bbede0f55a42ca000d2b.xml
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/AGOO_BIND.xml
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/LIURENYOU_PREF.xml
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/accs.db-journal
- /data/data/####/agoo.pid
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c05534dcdf9a6104ba6b4ef0ef1d586e914f9f2dce0237b....0.tmp
- /data/data/####/c397d5d6844cf687a440ec6fb5242a87db5eda9fa9f3581....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/d7113af9e1f88c19509442bbb2e06e01dd7f37414ac389f....0.tmp
- /data/data/####/e99da2b05d67235e82af79822721b96f2d4945fc005f7db....0.tmp
- /data/data/####/eca0f399c2de22b0c99d86fc82dda38d98d3b6e62d5bda2....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f054726cb823b270bcfda60bfced970053a72335c27e4d0....0.tmp
- /data/data/####/f898243253141c830cff1d32d994d86730b52ea8f82222e....0.tmp
- /data/data/####/fcfa4b4b952ee7d5eca7dbc7d99db6a6e55ff82e211bc7c....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/httpdns_config_cache.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.1.2.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/mix.dex
- /data/data/####/native_record_lock
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/tdata_FhD658
- /data/data/####/tdata_FhD658.jar
- /data/data/####/tdata_mpY630
- /data/data/####/tdata_mpY630.jar
- /data/data/####/tdata_ngv385
- /data/data/####/tdata_ngv385.jar
- /data/data/####/tdata_vHH584
- /data/data/####/tdata_vHH584.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/media/####/.nomedia
- /data/media/####/2b3f86ad2261405eb4435e3b16d07180
- /data/media/####/584c43adaf0841a3aecb333139df8a04
- /data/media/####/74a1475809bb4679a98ea59bd52edebf
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.liurenyou.im.bin
- /data/media/####/com.liurenyou.im.db
- /data/media/####/d0e9afdea975442c87b4e825078621c3
- /data/media/####/deviceToken
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/tdata_FhD658
- /data/media/####/tdata_mpY630
- /data/media/####/tdata_ngv385
- /data/media/####/tdata_vHH584
- /data/media/####/test.log
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5608bbede0f55a42ca000d2b","utdid":"XJ0iNqO7cSUDAGdzx1EVaK2C","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.GetuiPushService 24629 300 0
- cat /sys/class/net/wlan0/address
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.1.2.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- mount
- sh
- Bugly
- getuiext2
- libnfix
- libshella-2.9.1.2
- libufix
- nfix
- realm-jni
- tnet-3.1
- ufix
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding