Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
- Android.Xiny.1.origin
Сетевая активность:
Подключается к:
- t####.nl
- trac####.####.com
- tmgonli####.nl
- im####.####.com
- con####.####.nl
- w####.####.com
- e####.####.com:8088
- 1####.####.105:8023
- b####.####.com
- s####.####.com
- u####.####.com
- corpo####.####.nl
- 1####.####.105
- i####.####.com
- teleg####.####.nl
- google-####.com
- p####.####.com
- f####.####.net
- f####.####.com
- gl####.####.com
- m####.####.com
- st####.####.com
- d####.####.net
- pag####.####.com
- a0b1a13####.####.net
- c6ba1cd####.####.com
- c####.####.org
- m####.####.nl
- be####.####.net
- ce####.####.org
- imgs####.####.nl
- gst####.com
- h####.com
- a####.####.com
- t####.####.com
- c####.####.net
- cloudfr####.####.com
- c####.####.com
- d####.####.com
- e####.####.com
- freeapp####.com
- a74302b####.####.net
- j####.####.net
Запросы HTTP GET:
- trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_package=...
- h####.com/article/58e5cac366f6003903859a17?view=####
- tmgonli####.nl/nl/
- t####.nl/nl
- tmgonli####.nl/cc1495005869827.js
- tmgonli####.nl/blur/telegraaf.nl.css
- b####.####.com/p2?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12...
- h####.com/js/bundles/partner-article.js?squizard?bust=####
- c####.####.com/index.php?service=####&pub=####&offer_id=####&uc_trans_1=...
- a74302b####.####.net/test.png
- m####.####.nl/static/img/icon-share.png
- a####.####.com/api/s2s/goto?id=####&channel=####&provider=####&iid=####&...
- google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&ut...
- a0b1a13####.####.net/test.png
- 1####.####.105:8023/m/umeng:58f710b66e27a423e8000402/600/AmjH_YklrpHFPA4...
- imgs####.####.nl/v1/scFC9oa4-i2Tt2wakeV6-uDbImA=/80x80/smart/filters:for...
- imgs####.####.nl/v1/RkyPb067KVVeLOkNQ337MvfVCDY=/80x80/smart/filters:for...
- c####.####.org/v2/system/models-105.json
- google-####.com/ga.js
- tmgonli####.nl/consent/consent/?return=####&clienttime=####&version=####...
- tmgonli####.nl/scripts/bootstrap-2.1.1.min.js
- imgs####.####.nl/v1/rbT39EtOBoHEa90m-rS7gbIzIZE=/80x80/smart/filters:for...
- t####.####.com/sync?prtid=####&yahid=####
- imgs####.####.nl/v1/1BArwQH3WtopHPtmV_Qnaz2PZFU=/80x80/smart/filters:for...
- m####.####.nl/zoeken
- c####.####.net/userdata/get?pub=####&technographics=####&callback=####
- be####.####.net/optout_check?callback=####
- ce####.####.org/v3/system/countrys.json
- gst####.com/cv/js/sender/v1/cast_sender.js
- im####.####.com/js/sdkloader/ima3.js
- t####.####.com/site/31435?id=####&redir=####
- h####.com/css/fonts/roboto-v15-latin-regular.ttf
- tmgonli####.nl/nl/website-overzicht
- tmgonli####.nl/sites/all/themes/tmg/images/bollen_footer.png
- imgs####.####.nl/v1/K6AxzsnSIoBZF2kUt7TsRcasuwc=/80x80/smart/filters:for...
- c####.####.org/v2/content/article1-46653586-3534fde76f2f8153c18bb676a448...
- tmgonli####.nl/styles/bootstrap-responsive-2.1.1.min.css
- p####.####.com/aa/y8a2thbi7v8xdodcoa82
- h####.com/content?url=####
- teleg####.####.nl/static/build/site_article_87251f30adaf.min.js
- c####.####.com/files/79e464325fa8c8cbe099fcdd523c9968
- teleg####.####.nl/graphics/videopage/play.7589f1ea03bd084740cdd5cc00f56e...
- t####.####.com/site/31436?dt=####&r=####&sig=####&bkca=####
- ce####.####.org/v2/content/recommend-3534fde76f2f8153c18bb676a448f421-NL...
- teleg####.####.nl/tv/nieuws/buitenland/28249762/__Boze_man_loopt_tegen_d...
- h####.com/js/bundles/cookies.js
- u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=...
- s####.####.com/app/umeng?pid=####&dp=####&af=####&sk=####&cn=####&cv=####
- c####.####.net/pixel?google_nid=####&googl####&id=####
- c####.####.org/v2/system/version-4-105.json
- p####.####.com/ups/19764/sync?uid=####&_origin=####&redir=####&verify=####
- corpo####.####.nl//
- imgs####.####.nl/v1/3kdRyXZbIGUZfRktJApRiU7JoQY=/80x80/smart/filters:for...
- teleg####.####.nl/javascript/analyticsfunctions.7f145f3298ebd5bb16896b24...
- c####.####.com/js/2759701342.js
- u####.####.com/usr?v=####&acc=####&id=####&jds=####&wst=####
- imgs####.####.nl/v1/qo1Bj3lB51usyUULrgBm8GJwHG0=/80x80/smart/filters:for...
- tmgonli####.nl/styles/cookie.css
- u####.####.com/req?v=####&id=####&acc=####&tit=####
- corpo####.####.nl/privacy-verklaring
- t####.####.com/sync?prtid=####&admid=####
- c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
- cloudfr####.####.com/x.png
- tmgonli####.nl/scripts/jquery-1.8.2.min.js
- u####.####.com/req?v=####&upd=####&new=####&id=####&acc=####&tit=####
- h####.com/css/fonts/roboto-v15-latin-500.ttf
- d####.####.com/v.gif?a=####&d=####&u=####&h=####&r=####
- c####.####.net/controltag?confid=####
- tmgonli####.nl/styles/mobile.css
- tmgonli####.nl/styles/bootstrap-2.1.1.min.css
- imgs####.####.nl/v1/tLmRDpBbEAHeSdmMoFd7v0BE5Bw=/80x80/smart/filters:for...
- h####.com/css/partner-article.css?bust=####
- ce####.####.org/v3/commentlist-46653586-3534fde76f2f8153c18bb676a448f421...
- con####.####.nl/player/js/streamone-player-v2.adblock-detect.min.js
- m####.####.nl/static/img/whatsapp-share-button.png
- i####.####.com/s
- teleg####.####.nl/static/build/site_759acf5a9278.min.js
- t####.####.com/sync?prtid=####&aolid=####
- d####.####.com/r/dd/id/L2NzaWQvMS9jaWQvMjYzNTYzMzIvdC8y/dpuid/32212937057/
- u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
- be####.####.net/usermatch.gif?partner=####&partner_uid=####
- teleg####.####.nl/data/files/css/css_d756fdcc4702a1af90653fabc4386324.css
- t####.####.com/sync?prtid=####&id=####&google_gid=####&google_cver=####
- 1####.####.105/m/umeng:58f710b66e27a423e8000402/600/AmjH_YklrpHFPA431yOR...
- tmgonli####.nl/sites/all/themes/tmg/images/icon-footer-rss.png
- p####.####.com/sync/img?redir=####
- ce####.####.org/v2/content/getItemDetails-46653586.json
- imgs####.####.nl/v1/jblBRThxLb6eWRsV02yq-nJMGBA=/80x80/smart/filters:for...
- j####.####.net/G07609/b3/0/3/120814/707900161.js?D=####&C=####
- j####.####.net/gateway/gw.js?csid=####&auto=####
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.1.js?utv=####
- f####.####.net/t/1.css?apiType=####&projectid=####
- imgs####.####.nl/v1/6d5h6n5spPZ-gp1Chb0oiOOUC0w=/80x80/smart/filters:for...
- p####.####.com/ups/19764/sync?uid=####&_origin=####&redir=####
- teleg####.####.nl/css/main.21b2b0ec3365314b5a2e17b97235cc29.css
- a####.####.com/api/ads/record/imp/?_s=####&oc1=####&oc2=####&provider=##...
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.8.js?utv=####
- tmgonli####.nl/styles/tmg.css
- teleg####.####.nl/static/build/sprite.png
- f####.####.net/colophon/fdc-colophon.png
- m####.####.nl/static/img/abonnementen.png
- tmgonli####.nl/sites/all/themes/tmg/images/logo-tmg.png
- u####.####.com/usr?v=####&acc=####&upd=####&new=####&wst=####
- c####.####.org/2017-04-07/06205956992c7c1998f3798b8f329a0e.jpg!240
- c6ba1cd####.####.com/58e7098b66f6003903b7e795_500x333.jpg
- teleg####.####.nl/javascript/jquery-1.11e0a4effa969b585c6a296a6545cf23.8...
- imgs####.####.nl/v1/p6X6ADflhNWpkUZf4jB1GiZWd9c=/80x80/smart/filters:for...
- imgs####.####.nl/v1/EDKC6otRzH98TwPrrF1r678_YOE=/616x410/smart/filters:f...
- p####.####.com/ul_cb/aa/y8a2thbi7v8xdodcoa82
- c####.####.org/2017-04-07/191d1a00e7dd0de1eaab0bdce8773ee9.jpg!240
- c####.####.org/2017-04-07/2829fef9a233d1f82cd9db4a8496dcbc.jpg!240
- a####.####.com/2017/05/23/192530187.zip
- t####.####.com/38645a54-e22a-423a-ac19-3d3ab0c47678?app_id=####&cid=####
- p####.####.com/upi/pid/DuqQKWX7?redir=####
- c####.####.org/v2/content/list-0-0-0-NL-2-0-1.json?1495005####
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.js
- teleg####.####.nl/javascript/jquery/jquery.3291194034b434bb51afaa5aabd23...
- c####.####.org/2017-05-02/a58184d0c91bbef500c711bd1d4ad0b3.jpg
- con####.####.nl/playlist/account=Kx1PKc/item=SRdFqO8B00-l/player=QoRMw6u...
- a####.####.com/api/ads/check?md5=####&secret=####&app_v=####&app=####&ch...
- ce####.####.org/v3/commentlist-46765834-3534fde76f2f8153c18bb676a448f421...
- tmgonli####.nl/consent/img/pressed.png
- d####.####.net/demconf.jpg?et:ibs%7cdata:dpid=####&dpuuid=####&redir=####
- teleg####.####.nl/graphics/videopage/play25.474a26e5402cfd0d640965345065...
- h####.com/js/jquery.js
- teleg####.####.nl/static/gerichtonline/bpreview.13ece81274f2222c471795aa...
- pag####.####.com/pagead/js/r20170522/r20170110/show_ads_impl.js
- con####.####.nl/img/account=Kx1PKc/item=SRdFqO8B00-l/thumbid=2/image.jpg
- ce####.####.org/v2/content/getItemDetails-46765835.json
- f####.####.com/jsapi/4d8dcca4-2df2-47ea-a707-0dc758b9e604.js
- ce####.####.org/v3/system/initcountrytopic.json
- imgs####.####.nl/v1/dBtiHwKnY-6Ptoq6LGlmNdImSSM=/80x80/smart/filters:for...
- teleg####.####.nl//
- t####.####.com/tm42098.js
- c####.####.org/v2/content/list-1-0-0-NL-2-0-1.json?1495005####
- c####.####.com/tracking/adClick?d=####&ru=####&advId=####&clickId=####&s...
- c####.####.org/2017-04-07/4e6c470b403e19e0b41cc8aa09d273e6.jpg!240
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.sync.js
- h####.com/article/58e7098b66f6003903b7e795?view=####
- w####.####.com/6ed84a8b77cf.js?lv=####
- teleg####.####.nl/static/build/app.2fc85aff6ebb99a0ac57c2bc7d8b89e5.js
- ce####.####.org/v2/content/getItemDetails-46765834.json
- c####.####.org/v2/system/startimg-NL.json
- tmgonli####.nl/consent/script/consent.js
- imgs####.####.nl/v1/YDel3kUngWXwk4J67lWNTVFEp2w=/80x80/smart/filters:for...
- tmgonli####.nl/sites/all/themes/tmg/images/icon-footer-nieuwsbrief.png
- freeapp####.com/?appProd=####&appPub=####&prodid=####
- m####.####.nl/telesport/article/27954717/verstappen-bovenaan-in-fluttrai...
- teleg####.####.nl/javascript/new/sticky-widget.486e830c26a47dda60094744a...
- teleg####.####.nl/telesport/27954717/__Verstappen_bovenaan_in_fluttraini...
- a####.####.com/ajax/libs/jquery/1.8.2/jquery.min.js
- teleg####.####.nl/javascript/consentWrapper.473cf9b5cbf5671e57fa7a424723...
- pag####.####.com/pagead/js/adsbygoogle.js
- con####.####.nl/embed/account=Kx1PKc/player=QoRMw6uC0x01/item=SRdFqO8B00...
- d####.####.com/deploy/js_visitor_settings.php?v=####&a=####&url=####&ran...
- con####.####.nl/player/skin/default/streamone.css
- c####.####.org/2017-04-07/753c1913748d9757d9dc0ed576919836.jpg!240
- tmgonli####.nl/consent/img/not_pressed.png
- c####.####.org/2017-04-07/1cb71f9632d61311e32d0e3eadb56699.jpg!240
- teleg####.####.nl/javascript/tg-search.370200d6eb28e931de24c8f22da433a.js
- tmgonli####.nl/blur/telegraaf.nl.js
- tmgonli####.nl/blur/telegraaf.nl.logo.png
- c####.####.com/cms?partner_id=####
- c####.####.org/2017-04-07/e22bf6793c5a89c7185a93ee5d1688b6.jpg!240
- c####.####.org/v2/system/languages.json
- p####.####.com/sync/img?redir=####&mm####&mm####
- teleg####.####.nl/css/siteColors.5c46a3e419ee4eb7ccf8a00dd7aa9652.css
- google-####.com/analytics.js
- teleg####.####.nl/static/img/placeholder.png
- st####.####.com/c/hotjar-27367.js?sv=####
- m####.####.nl/tv/nieuws/buitenland/article/28249762/boze-man-loopt-tegen...
- c####.####.com/dp/navegg.php?pid=####&uid=####
- imgs####.####.nl/v1/dV2J-2Cc6eapfPytEoRNgXbpSoA=/80x80/smart/filters:for...
- teleg####.####.nl/static/build/site_1489061730.min.css
- teleg####.####.nl/data/files/js/js_68deeb279453631cef643d2060c701ae.js
- tmgonli####.nl/sites/all/themes/tmg/images/icon_phone.png
- c####.####.com/index.php?service=####&pub=####&offer_id=####&subpub=####
- t####.####.com/agentapi/click?cid=####&aid=####&postbac####
- teleg####.####.nl/javascript/ads/showads.75977793993735b23353a9c8fa0a76e...
- c####.####.org/v2/content/list-0-0-0-NL-3-0-1.json?1495005####
- tmgonli####.nl/sites/all/themes/tmg/images/icon-footer-twitter.png
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.20.js?utv=####
- teleg####.####.nl/javascript/all-scripts.7c05874763404c80cde78fa37fbc375...
- tmgonli####.nl/sites/all/themes/tmg/images/icon-footer-blog.png
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####
- tmgonli####.nl/sites/all/themes/tmg/images/vergrootglas.png
- t####.####.com/utag/tmggroup/telegraaf-web/prod/utag.sync.js
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.5.js?utv=####
- j####.####.net/G07609/b3/Z/3/120814/707900161.js?D=####&C=####&asidi=####
- imgs####.####.nl/v1/5iC46WZW9zqP8qN5cnPgXwFBwaM=/80x80/smart/filters:for...
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.14.js?utv=####
- d####.####.net/ibs:dpid=822&dpuuid=32212937057&redir=https%3A//sync.navd...
- teleg####.####.nl/javascript/store.522208ff3eab3e86c018e7e9956887bc.min.js
- tmgonli####.nl/blur/telegraaf.nl.jpg
- c6ba1cd####.####.com/58e7098a66f6003903b7e6ac_500x333.jpg
- c####.####.org/2017-04-07/4382b60753a80f6d3fb25f14ab04de59.jpg!240
- c####.####.net/ctjs/controltag.js.7dbac51c9aa7b4135991e8daeb9ced57
- c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1495005####
- c####.####.net/controltag/qxniyymwl.js
- p####.####.com/ct/upi/pid/DuqQKWX7?redir=####&_test=####
- con####.####.nl/player/js/lang/all-languages.js
- im####.####.com/js/core/bridge3.169.1_en.html
- teleg####.####.nl/javascript/new/common.23176cb1df0ca0bc60b460083c9ceb2.js
- c####.####.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
- con####.####.nl/player/plugins/dist/tmg-analytics/tmg-analytics.min.js
- be####.####.net/pixel.gif?source=####&fired=####&confid=####&_kpid=####&...
- j####.####.net/gateway/gw.js?csid=####
- m####.####.nl/static/img/nixel.gif
- imgs####.####.nl/v1/hB7BJIOG7OORx9G3k9uu9qYeWhE=/80x80/smart/filters:for...
- c####.####.org/v2/content/article1-46765835-3534fde76f2f8153c18bb676a448...
- t####.nl/nl/privacy
- c####.####.org/v2/content/article1-46765834-3534fde76f2f8153c18bb676a448...
- h####.com/article/58e7098a66f6003903b7e6ac?view=####
- s####.####.com/genericusersync.ashx?dpid=####
- b####.####.com/p?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12=...
- imgs####.####.nl/v1/0NN3dn1POXb8eGi91aIQk2huzDA=/80x80/smart/filters:for...
- ce####.####.org/v3/commentlist-46765835-3534fde76f2f8153c18bb676a448f421...
- j####.####.net/jslog.gif?commit=####&pubid=####&siteid=####&site_name=##...
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.26.js?utv=####
Запросы HTTP POST:
- a####.####.com/api/ads/fetch?_s=####
- e####.####.com/ping
- tmgonli####.nl/consent/consent/?return=####&clienttime=####&version=####...
- a####.####.com/api/ads/connect
- ce####.####.org/auth/gather
- m####.####.com/v2/register
- e####.####.com/sdk/api/log/record
- e####.####.com:8088/sdk/api/ad/hull_v2
- a####.####.com/app_logs
- e####.####.com/sdk/api/regclient
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/snowfoxprf.xml
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-1359977183.zip
- <Package Folder>/app_tmpdex/reach-sdk.zip
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/updateVer.xml
- <Package Folder>/shared_prefs/coolook.minisite.xml
- <Package Folder>/files/.yflurryreport.1ae6c836e2248e32
- <Package Folder>/files/DaemonServer
- <Package Folder>/shared_prefs/AGOO_HOST.xml
- <Package Folder>/databases/Zuoyoo_db
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/shared_prefs/Game_recommend.xml
- <Package Folder>/databases/reach.database.ad-journal
- <Package Folder>/shared_prefs/GATHER.xml.bak
- <Package Folder>/files/.yflurryfreqcap.1ae6c836e2248e32
- <Package Folder>/shared_prefs/sp_cache.xml
- <Package Folder>/app_dex/reach-sdk.zip.tmp
- <Package Folder>/files/mesosphere.jar
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/files/snowfox_sdk_so-v22.jar
- <Package Folder>/shared_prefs/Reach.xml
- <Package Folder>/shared_prefs/GATHER.xml
- <Package Folder>/files/snowfox_v22.jar
- <Package Folder>/databases/snowfoxad_msg.db
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes9372416.zip
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/databases/db_snowfox.db
- <Package Folder>/files/dat.dat
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/files/.imprint
- <Package Folder>/files/libs/armeabi/libadecloc.so
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-600923480.zip
- <Package Folder>/databases/Zuoyoo_db-journal
- <Package Folder>/shared_prefs/MASTER_DATA.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/agoo.pid
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml
- <Package Folder>/files/AppEventsLogger.persistedevents
- <Package Folder>/files/<Package>.zip
- <Package Folder>/files/libs/armeabi-v7a/libadecloc.so
- <Package Folder>/files/.yflurrydatasenderblock.7e8b5597-ab8b-422b-8af1-97faef6fa8c4
- <Package Folder>/shared_prefs/v2_local_login.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/shared_prefs/CurArticleInfo.xml
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml.bak
- <Package Folder>/shared_prefs/Prophet.xml
- <Package Folder>/files/mesosphere.so
- <Package Folder>/shared_prefs/Game_recommend.xml.bak
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_3P45XVCCWY2TFXTGX2G5_216
- <Package Folder>/shared_prefs/Reach.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/libs/x86/libadecloc.so
- <Package Folder>/shared_prefs/sp_cache.xml.bak
- <Package Folder>/databases/db_snowfox.db-journal
- <Package Folder>/files/.yflurryadlog.1ae6c836e2248e32
- <Package Folder>/cache/webviewCacheChromium/f_000018
- <Package Folder>/cache/webviewCacheChromium/f_000019
- <Package Folder>/cache/webviewCacheChromium/f_000016
- <Package Folder>/cache/webviewCacheChromium/f_000017
- <Package Folder>/cache/webviewCacheChromium/f_000014
- <Package Folder>/cache/webviewCacheChromium/f_000015
- <Package Folder>/cache/webviewCacheChromium/f_000012
- <Package Folder>/cache/webviewCacheChromium/f_000013
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/app_dex/reach-sdk.zip
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/shared_prefs/PhoneUtil.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/BSModelForPlaced.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/files/snowfox_v22.so
- <Package Folder>/shared_prefs/test.xml
- <Package Folder>/shared_prefs/AGOO_CONNECT.xml
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/shared_prefs/CountryRelevant.xml
- <Package Folder>/files/libs/arm64-v8a/libadecloc.so
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/cache/webviewCacheChromium/f_00001b
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/cache/webviewCacheChromium/f_00001a
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/files/lib.dat
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/databases/MsgLogStore.db-journal
- <Package Folder>/databases/snowfoxad_msg.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 95
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- sh
- <dexopt>
- chmod 500 <Package Folder>/files/DaemonServer
Может автоматически отправлять СМС-сообщения.
