Техническая информация
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) oss.newairc####.com:80
- TCP(TLS/1.0) 1####.217.17.142:443
- TCP(TLS/1.0) oss.newairc####.com:443
- TCP(TLS/1.0) s####.ml####.cc:443
- TCP(TLS/1.0) h5.newairc####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5226
- 7j####.c####.z0.####.com
- a####.b####.qq.com
- a####.u####.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- c####.g####.ig####.com
- c-h####.g####.com
- h5.newairc####.com
- img.newairc####.com
- oss.newairc####.com
- pub-####.qin####.com
- s####.ml####.cc
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- oss.newairc####.com/ynzxb/pic/201703/17/1e3af46c-bc78-4a7f-80d6-05492609...
- oss.newairc####.com/ynzxb/pic/201703/17/af2877b2-b939-4d28-8186-ef0bd337...
- oss.newairc####.com/ynzxb/pic/201708/29/3d1dfcde-8d1b-4353-b968-4de88422...
- oss.newairc####.com/ynzxb/pic/201708/29/4efdf4e2-d1e3-4083-9d84-5b96f856...
- oss.newairc####.com/ynzxb/pic/201708/29/c3039ae8-2ea0-4e7a-afc2-8e94a9f3...
- qin####.com.www.####.com/tdata_EDT369
- t####.c####.q####.####.com/config/hz-hzv6.conf
- t####.c####.q####.####.com/tdata_Soq141
- t####.c####.q####.####.com/tdata_fEV688
- t####.c####.q####.####.com/tdata_ilz707
- t####.c####.q####.####.com/tdata_siA393
- a####.u####.com/app_logs
- aexcep####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- c-h####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
- /data/data/####/-1312716470
- /data/data/####/-1383936327
- /data/data/####/.imprint
- /data/data/####/015f906579a92fc504da2047728713428807d4515793efc....0.tmp
- /data/data/####/1084282501
- /data/data/####/1389023919
- /data/data/####/142a0e5cebc3608ad23b0b6af910e9633382ef9230bc320....0.tmp
- /data/data/####/1678336216
- /data/data/####/1695857311
- /data/data/####/1864066650
- /data/data/####/2014240786
- /data/data/####/358a799eb512a582f9b91af7e6711cf65c419f5713e1eb3....0.tmp
- /data/data/####/386967948
- /data/data/####/492179048
- /data/data/####/4a14cfeeef9f1845f5638adaaac499964758d5d9386aaef....0.tmp
- /data/data/####/563056240
- /data/data/####/6bb46aa49bf9d007375e66da528a29e4558da47330425e4....0.tmp
- /data/data/####/722586575
- /data/data/####/7bf0fe0331e08477cdd4508dbfe0ac4a1c18e6218248257....0.tmp
- /data/data/####/7c1ea7c923febc152db6c1c03d39a8077001c61f9bc78bd....0.tmp
- /data/data/####/83d382a66c4fa0ea40e54c00c2f4da00c049d6503739ce6....0.tmp
- /data/data/####/8958c0228fd326c9c23fe58a9c2b8128daeedd66b6f7372....0.tmp
- /data/data/####/94e7c65ee7aab2ec545b7e8fec8da19213bfb36141105d2....0.tmp
- /data/data/####/9ea1ddcc6766
- /data/data/####/FZLTXHK-GBK_YS.ttf
- /data/data/####/QQ_3x.png
- /data/data/####/amazeui.min.css
- /data/data/####/amazeui.min.js
- /data/data/####/angular1.4.6.min.js
- /data/data/####/base.css
- /data/data/####/bugly_db_legu-journal
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/columnId.xml
- /data/data/####/com.founder.ynzxb-1.apk.classes-109116938.zip
- /data/data/####/core_info
- /data/data/####/d607741508201ae9e3ba04214de4bb432b97b7766ccc1f7....0.tmp
- /data/data/####/d6b07e72a1416eed879e9ac4c9a7b906ed216fd2de32a83....0.tmp
- /data/data/####/db_founder0-journal
- /data/data/####/de093feeb9f914666d627bc44804e0f793b288cb71d5822....0.tmp
- /data/data/####/device_id.xml.xml
- /data/data/####/e428a0c91bc284c97689d9a907592990e7a9145192aa07e....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f6dcef0dc32453934dc079191ee4ca95670e5ad1dfb4681....0.tmp
- /data/data/####/fontawesome-webfont.ttf
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/great_button.png
- /data/data/####/great_cancel_button.png
- /data/data/####/gx_sp.xml
- /data/data/####/helpMsg.xml
- /data/data/####/icon-images.png
- /data/data/####/icon_audio_play.png
- /data/data/####/icon_file.png
- /data/data/####/icon_file_down.png
- /data/data/####/icon_meta_voice.png
- /data/data/####/icon_praise.png
- /data/data/####/icon_praiseStar.png
- /data/data/####/icon_selector_normal.png
- /data/data/####/icon_selector_press.png
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/jquery.min2.2.0.js
- /data/data/####/js.combine.min.js
- /data/data/####/libshella-2.10.1.so
- /data/data/####/libufix.so
- /data/data/####/loading.png
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/multidex.version.xml
- /data/data/####/mwsdk_analytics.db-journal
- /data/data/####/native_record_lock
- /data/data/####/news_detail.html
- /data/data/####/persistent_data.xml
- /data/data/####/play.png
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/reader.db-journal
- /data/data/####/run.pid
- /data/data/####/sanjiaoxing.png
- /data/data/####/security_info
- /data/data/####/shareTimeline_3x.png
- /data/data/####/sina_3x.png
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_Soq141
- /data/data/####/tdata_Soq141.jar
- /data/data/####/tdata_fEV688
- /data/data/####/tdata_fEV688.jar
- /data/data/####/tdata_ilz707
- /data/data/####/tdata_ilz707.jar
- /data/data/####/tdata_siA393
- /data/data/####/tdata_siA393.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/video.png
- /data/data/####/wx_3x.png
- /data/media/####/.nomedia
- /data/media/####/app.db
- /data/media/####/com.founder.ynzxb.bin
- /data/media/####/com.founder.ynzxb.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/journal.tmp
- /data/media/####/localTemplate.zip
- /data/media/####/tdata_Soq141
- /data/media/####/tdata_fEV688
- /data/media/####/tdata_ilz707
- /data/media/####/tdata_siA393
- /data/media/####/test.log
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.GeTuiPushService 24737 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.10.1.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- mount
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.GeTuiPushService 24737 300 0
- Bugly
- getuiext2
- libnfix
- libshella-2.10.1
- libufix
- nfix
- ufix
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding