Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.906.origin
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- UDP(DNS) 1####.114.114.114:53
- TCP(HTTP/1.1) v.adma####.com.cn:80
- TCP(HTTP/1.1) res####.a####.top:80
- TCP(HTTP/1.1) dup.baidust####.com:80
- TCP(HTTP/1.1) ip.j####.com:99
- TCP(HTTP/1.1) s.zhito####.com:88
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) 2####.187.227.204:99
- TCP(HTTP/1.1) r####.v####.qq.com:80
- TCP(HTTP/1.1) cgi.con####.qq.com:80
- TCP(HTTP/1.1) 1####.62.44.93:80
- TCP(HTTP/1.1) u####.a####.top:80
- TCP(HTTP/1.1) 1####.29.29.29:80
- TCP(HTTP/1.1) s.zhito####.com:808
- TCP(HTTP/1.1) z####.heyc####.net:80
- TCP(HTTP/1.1) cdn.i.arie####.com:80
- TCP(HTTP/1.1) api.yunco####.com:80
- TCP(HTTP/1.1) f####.a####.com:8000
- TCP(HTTP/1.1) ivy.pcon####.com.cn:80
- TCP(HTTP/1.1) api.lubang####.com:80
- TCP(HTTP/1.1) kou####.a####.top:80
- TCP(HTTP/1.1) filt####.a####.top:80
- TCP(HTTP/1.1) s.zhito####.com:807
- TCP(HTTP/1.1) 47.1####.185.46:80
- TCP(HTTP/1.1) i####.pcon####.com.cn:80
- TCP(HTTP/1.1) l####.l.qq.com:80
- TCP(HTTP/1.1) isds####.qq.com:80
- TCP(HTTP/1.1) 47.1####.211.73:80
- TCP(HTTP/1.1) q####.0####.com:13967
- TCP(HTTP/1.1) i####.com.edg####.net:80
- TCP(TLS/1.0) wild####.go-mp####.net.####.net:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) wildca####.go-mp####.net.####.net:443
- TCP(TLS/1.0) c.gridsum####.com:443
- TCP(TLS/1.0) pc####.i####.com:443
- TCP(TLS/1.0) sb.scoreca####.com.####.net:443
- TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) m.pc####.com.cn:443
- TCP(TLS/1.0) res.wx.qq.####.com:443
- TCP(TLS/1.0) c####.pc####.com.cn:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) se####.v####.i####.com:443
- TCP(TLS/1.0) w####.jd.com:443
- TCP(TLS/1.0) l####.v####.qq.com:443
- TCP(TLS/1.0) v####.qq.com.####.net:443
- TCP(TLS/1.0) ad.doublec####.net:443
- TCP(TLS/1.0) nl####.i####.com:443
- TCP(TLS/1.0) t.hy####.com.cn:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) i####.com.edg####.net:443
- TCP(TLS/1.0) cili####.cn:443
- TCP(TLS/1.0) h####.v####.qq.com:443
- TCP(TLS/1.0) shp.q####.cn:443
- TCP(TLS/1.0) h####.evergr####.com:443
- TCP(TLS/1.0) img.pcon####.com.####.cn:443
- TCP(TLS/1.0) wl.jd.com.####.com:443
- TCP(TLS/1.0) safebro####.google####.com:443
- TCP(TLS/1.0) v.adma####.com.cn:443
- TCP(TLS/1.0) ur####.jd.com:443
- TCP(TLS/1.0) c####.i####.com:443
- TCP(TLS/1.0) g.1####.com:443
- TCP(TLS/1.0) ec####.b####.com:443
- TCP(TLS/1.0) p####.m.jd.com:443
- TCP(TLS/1.0) l####.l.qq.com:443
- TCP(TLS/1.0) m####.m.jd.com:443
- TCP(TLS/1.0) ei.c####.com:443
- TCP(TLS/1.0) api.g####.vip:443
- TCP(TLS/1.0) i####.i####.com:443
- TCP(TLS/1.0) cr.3con####.com:443
- TCP(TLS/1.0) 2####.58.208.106:443
- TCP(TLS/1.0) mg####.pcon####.com.cn:443
- TCP(TLS/1.0) js.3con####.com:443
- TCP(TLS/1.0) a####.evergr####.com:443
- TCP(TLS/1.0) a.c####.com:443
- TCP(TLS/1.0) sec.v####.qq.com:443
- TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) i####.pcon####.com.cn:443
- TCP(TLS/1.0) i####.jd.com:443
- TCP(TLS/1.0) 2####.58.211.110:443
- TCP(TLS/1.0) v.q####.com:443
- TCP(TLS/1.0) www.pc####.com.####.cn:443
- TCP(TLS/1.0) bt####.v####.qq.com:443
- TCP(TLS/1.0) i.g####.cn.####.com:443
- TCP(TLS/1.0) p####.pc####.com.cn:443
- TCP(TLS/1.0) i####.j####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) ivy.pcon####.com.cn:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) contr####.i####.com:443
- TCP(TLS/1.0) i.gridsum####.com:443
- TCP(TLS/1.0) 1####.217.168.234:443
- TCP(TLS/1.0) m####.qy.net:443
- TCP(TLS/1.0) g.cn.miao####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
- TCP(TLS/1.0) nl-no####.i####.com:443
- TCP(TLS/1.0) u.j####.com:443
- TCP(TLS/1.0) pro####.pcon####.com.cn:443
- TCP(TLS/1.0) stc.iqiy####.com:443
- TCP(TLS/1.0) iqiy####.com.edg####.net:443
- TCP(TLS/1.0) imgc####.qq.com.####.com:443
- TCP(TLS/1.0) cdn.boo####.com.####.com:443
- TCP(TLS/1.0) st####.i####.com.####.net:443
- TCP(TLS/1.2) 2####.58.208.106:443
Запросы DNS:
- 617.a####.top
- 617.a####.top.####.8
- a####.evergr####.com
- a####.m.jd.com
- a.c####.com
- ad.doublec####.net
- and####.google####.com
- api.g####.vip
- api.lubang####.com
- api.meiju####.n####.####.8
- api.meiju####.net/
- api.yunco####.com
- bt####.v####.qq.com
- c####.i####.com
- c####.i####.com
- c####.mm####.com
- c####.pc####.com.cn
- c####.v####.i####.com
- c.c####.com
- c.go-mp####.net
- c.gridsum####.com
- cdn.boo####.com
- cdn.i.arie####.com
- cgi.con####.qq.com
- cha####.pch####.com.cn
- cili####.cn
- contr####.i####.com
- cr.3con####.com
- d####.b####.com
- d####.qq.com
- dc.pcon####.com.cn
- dl.pcon####.com.cn
- dup.baidust####.com
- ec####.b####.com
- ei.c####.com
- f####.a####.com
- f####.evergr####.com
- filt####.a####.top
- g.1####.com
- g.cn.miao####.com
- h####.evergr####.com
- h####.v####.qq.com
- h5s####.m.jd.com
- hm.b####.com
- i####.360bu####.com
- i####.i####.com
- i####.iqiy####.com
- i####.jd.com
- i####.pcon####.com.cn
- i.g####.cn
- i.gridsum####.com
- if####.i####.com
- im####.pc####.com.cn
- img.pcon####.com.cn
- imgc####.qq.com
- instant####.google####.com
- ip.j####.com
- ip.zhito####.com
- isds####.qq.com
- ivy.pc####.com.cn
- ivy.pcon####.com.cn
- js.3con####.com
- kou####.a####.top
- l####.l.qq.com
- l####.v####.qq.com
- lhyysdk####.oss-cn-####.aliy####.com
- m####.go####.com
- m####.m.jd.com
- m####.qy.net
- m.360bu####.com
- m.iqiy####.com
- m.pc####.com.cn
- mg####.pcon####.com.cn
- mo####.pcon####.com.cn
- msg.v####.q####.com
- nl####.i####.com
- nl-no####.i####.com
- note####.pcon####.com.cn
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.m.jd.com
- p####.pc####.com.cn
- pc####.i####.com
- pcw####.i####.com
- plb####.u####.com
- pos.b####.com
- pro####.pcon####.com.cn
- q####.0####.com
- r####.v####.qq.com
- r####.wx.qq.com
- res####.a####.top
- s.go-mp####.net
- s.zhito####.com
- s23.c####.com
- s4.c####.com
- s5.c####.com
- s9.c####.com
- s96.c####.com
- safebro####.google####.com
- sb.scoreca####.com
- se####.v####.i####.com
- sec.v####.qq.com
- secu####.i####.com
- shp.q####.cn
- st####.i####.com
- st####.q####.com
- stc.iqiy####.com
- sto####.360bu####.com
- t-####.hy####.com.cn
- t7z.c####.i####.com
- u####.a####.top
- u####.u####.com
- u.j####.com
- ur####.jd.com
- v####.qq.com
- v.adma####.com.cn
- v.q####.com
- v1.c####.com
- w####.jd.com
- w####.jd.com
- w####.pc####.com.cn
- w####.pc####.com.cn
- w####.pc####.com.cn
- w####.pch####.com.cn
- w####.pcon####.com.cn
- w####.pcon####.com.cn
- w.c####.com
- wq.360bu####.com
- www.i####.com
- www.iqiy####.com
- www.pc####.com.cn
- www.pch####.com.cn
- www.pcon####.com.cn
- z####.heyc####.net
- z1.c####.com
- z12.c####.com
- z2.c####.com
- z3.c####.com
- z5.c####.com
- z6.c####.com
- z9.c####.com
Запросы HTTP GET:
- 2####.187.227.204:99/wap/index.php?0####
- cdn.i.arie####.com/e/i.js
- cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?status_os=####&stat...
- dup.baidust####.com/js/os.js
- f####.a####.com:8000/DongFengSys/miaozhen.jsp?url=https://v.admaster.com...
- filt####.a####.top/filter_control_617.json
- i####.com.edg####.net/v_19rv6f41cw.html
- i####.pcon####.com.cn/blank.gif
- ip.j####.com:99/IP/Index/geturls
- ip.j####.com:99/Public/Access/js/main.js
- ip.j####.com:99/Public/Access/js/modules/common.js
- ip.j####.com:99/Public/Access/js/modules/creifr.js
- ip.j####.com:99/ip/index.html
- isds####.qq.com/cgi-bin/v.cgi?flag1=####&flag2=####&1=####&2=####
- ivy.pcon####.com.cn/click?id=####&adid=####&watch=####
- kou####.a####.top/kouling.json
- l####.l.qq.com/qqvideo/?requestid=####&pf=####&chid=####&adtype=####&tim...
- pos.b####.com/actm?psi=dd018d1e598ff0cb21fd25f3978f9a8d&di=6688728&dri=0...
- pos.b####.com/bczm?psi=af2944cfc6b5c24ab07e2a85bb8140ed&di=6688728&dri=0...
- pos.b####.com/ecym?psi=572f8fa66d80eedd81a4d8d6d8a69435&di=6611856&dri=0...
- pos.b####.com/scrm?psi=f7805c48da009bda80472d42f6c39a53&di=6611856&dri=0...
- r####.v####.qq.com/web_report?cmd=####&url=####&ver=####&ua=####&int1=##...
- res####.a####.top/LHYY.png
- res####.a####.top/sdk1.png
- res####.a####.top/sdk13_2.png
- res####.a####.top/sdk17.png
- res####.a####.top/sdk18.png
- res####.a####.top/sdk5_2.png
- res####.a####.top/sdk8.png
- s.zhito####.com:807/528/jf0622.html
- s.zhito####.com:807/528/wang/1/jd.html?9####
- s.zhito####.com:807/528/wang/1/jd110.html
- s.zhito####.com:807/528/wang/1/jd900.html
- s.zhito####.com:808/0622/index.html
- s.zhito####.com:808/0622/style="display:
- s.zhito####.com:808/0622/yrc_001mobile.js
- s.zhito####.com:88/wap.html
- u####.a####.top/617.html
- u####.a####.top/favicon.ico
- v.adma####.com.cn/i/a136990,b3871321,c2,i0,m202,8a2,8b3,h,uhttps://im-x....
- v.adma####.com.cn/i/a136990,b3871350,c2,i0,m202,8a2,8b3,h,uhttps://im-x....
Запросы HTTP POST:
- api.lubang####.com/domain.php
- api.lubang####.com/srp.php
- api.yunco####.com/service/rest
- q####.0####.com:13967/x5qn0/
- z####.heyc####.net/getlist
- z####.heyc####.net/xlogin
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.__mob_ad_data.xml
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.jgck
- /data/data/####/.zx
- /data/data/####/005bb92749461c36_0
- /data/data/####/008b2f503130946d_0
- /data/data/####/00fdd7e03095819c_0
- /data/data/####/010cce61bcf53705_0 (deleted)
- /data/data/####/020cb0e1601f904f_0 (deleted)
- /data/data/####/02a8e240a499a974_0
- /data/data/####/02eeb739472e38cc_0
- /data/data/####/0325798c3add3389_0
- /data/data/####/0325798c3add3389_1
- /data/data/####/032ae719ffba63f8_0
- /data/data/####/032ae719ffba63f8_1
- /data/data/####/0389ab9faa3d953a_0
- /data/data/####/04443cc8dd7ed602_0
- /data/data/####/06b8ce2b3d267951_0
- /data/data/####/06f723a54a89a4a7_0
- /data/data/####/088cf7f7c09da2c7_0
- /data/data/####/088cf7f7c09da2c7_1
- /data/data/####/09582d0abd56e38a_0
- /data/data/####/09582d0abd56e38a_1
- /data/data/####/09f101986ddfd8c6_0
- /data/data/####/0a0ddcc6d704a366_0
- /data/data/####/0a3b2b70a414d6d2_0
- /data/data/####/0b033bd1be4e67d6_0
- /data/data/####/0b033bd1be4e67d6_1
- /data/data/####/0b6c4cc20a341ba6_0
- /data/data/####/0b94f81c1476685e_0
- /data/data/####/0d8f6e73b2ed59a1_0
- /data/data/####/0da7506a4750b770_0
- /data/data/####/0e562136a285debb_0
- /data/data/####/0e701f4364f0faba_0 (deleted)
- /data/data/####/0ed23233763172c6_0
- /data/data/####/0f792f2ad2d539b2_0
- /data/data/####/1.dex
- /data/data/####/1.dex.flock (deleted)
- /data/data/####/1.jar
- /data/data/####/10036244cdf60fe9_0
- /data/data/####/1023ee16580e00c7_0
- /data/data/####/1112c85d1f44816c_0
- /data/data/####/112cb1282ec64b58_0
- /data/data/####/1144eb48b4697206_0
- /data/data/####/11eb5f31f9820656_0
- /data/data/####/1230ba3f28326e0b_0
- /data/data/####/1230ba3f28326e0b_1
- /data/data/####/128fb2f9eee26bf2_0 (deleted)
- /data/data/####/131f01e97c380bab_0 (deleted)
- /data/data/####/13_2.dex (deleted)
- /data/data/####/13_2.dex.flock (deleted)
- /data/data/####/13_2.jar
- /data/data/####/15479c0106883639_0
- /data/data/####/159ba0a5d83dcfd5_0
- /data/data/####/15d1d48e9bbc3d17_0
- /data/data/####/160df401e9163733_0
- /data/data/####/162df2ad6b0fc749_0
- /data/data/####/16ea9183c220ae6f_0
- /data/data/####/17.dex (deleted)
- /data/data/####/17.dex.flock (deleted)
- /data/data/####/17.jar
- /data/data/####/17c8dc80ee1f4c52_0
- /data/data/####/17fbd24ded63e2ec_0
- /data/data/####/18.dex
- /data/data/####/18.dex.flock (deleted)
- /data/data/####/18.jar
- /data/data/####/182af78b856f7b4b_0
- /data/data/####/186fba7dfe5bcbcf_0
- /data/data/####/1904bebf53048c4e_0
- /data/data/####/1904bebf53048c4e_1
- /data/data/####/19249379a1e38659_0
- /data/data/####/1a75d86a65abbcf8_0
- /data/data/####/1a9a0d3b2be4a912_0
- /data/data/####/1aeabca88eacd4fd_0
- /data/data/####/1b073510930ad992_0
- /data/data/####/1b15a8aec6124c17_0
- /data/data/####/1bd014f23fb207e0_0
- /data/data/####/1bd0572d2d816473_0
- /data/data/####/1c05b2942d50b7c4_0
- /data/data/####/1c222ec45fc25b0e_0
- /data/data/####/1c7000914bc26bcd_0
- /data/data/####/1cc2eb8aa61fd12b_0
- /data/data/####/1cc2eb8aa61fd12b_0 (deleted)
- /data/data/####/1d1e5b107310eaf3_0
- /data/data/####/1d1e5b107310eaf3_1
- /data/data/####/1d34ba78dbcb69ee_0
- /data/data/####/1deed7936f7b7aa8_0
- /data/data/####/1e22a2b5b58b56b3_0
- /data/data/####/1e969d0bcb321147_0
- /data/data/####/1e99c1536694963f_0
- /data/data/####/1fd07fbe4f2049ea_0 (deleted)
- /data/data/####/20166b8b9a6582da_0
- /data/data/####/204468eb42e37387_0
- /data/data/####/20e567da4750c06e_0
- /data/data/####/20e567da4750c06e_1
- /data/data/####/20e6ad27f0195ca8_0 (deleted)
- /data/data/####/213ec33ac747d46b_0
- /data/data/####/215b74589eae58d4_0
- /data/data/####/218d629dc392c3e7_0
- /data/data/####/218d629dc392c3e7_1
- /data/data/####/21f9a2c478aff7a8_0
- /data/data/####/21f9a2c478aff7a8_1
- /data/data/####/23aa0a8a5ba87210_0
- /data/data/####/23aa0a8a5ba87210_1
- /data/data/####/23f55bce25ca399f_0
- /data/data/####/24e5fbd19230714d_0
- /data/data/####/24e5fbd19230714d_1
- /data/data/####/26036ed9cbdf8ed2_0 (deleted)
- /data/data/####/2690d2c5b4137719_0
- /data/data/####/269855efb55f0314_0
- /data/data/####/269855efb55f0314_1
- /data/data/####/26a3cddcc24ed215_0
- /data/data/####/27221e5fcea6f2c0_0
- /data/data/####/276f65d3b339c4aa_0
- /data/data/####/27caf228dfb2be9f_0
- /data/data/####/27dac8705e581c47_0
- /data/data/####/27dac8705e581c47_1
- /data/data/####/280449a6c9ea1e96_0
- /data/data/####/280fb61bfa1460fb_0
- /data/data/####/280fb61bfa1460fb_1
- /data/data/####/29734aa579cdba92_0
- /data/data/####/2a89d8855707ac00_0
- /data/data/####/2ad0a9b7cee9a483_0
- /data/data/####/2b4747cb54246395_0
- /data/data/####/2b750a038c92883c_0
- /data/data/####/2c649830da04d7ad_0
- /data/data/####/2caf933934cb13e1_0
- /data/data/####/2d7dbb7560ef5d52_0
- /data/data/####/2d9ae4a6b6711e53_0
- /data/data/####/2daf851c1a88b641_0
- /data/data/####/2ddcb18f3dcc9595_0
- /data/data/####/2e316f90aa3ec773_0
- /data/data/####/2e3b1af82330bccf_0
- /data/data/####/2e651c76d846c6c9_0
- /data/data/####/2e651c76d846c6c9_1
- /data/data/####/2fd508511645ca0b_0
- /data/data/####/304c7ecb35dbe1b8_0
- /data/data/####/314d021bb6050fb2_0 (deleted)
- /data/data/####/31788cf1ee3cdfc5_0
- /data/data/####/31ac5bf3abce2470_0
- /data/data/####/3400b14a561c71ba_0
- /data/data/####/345e4661d48b92e2_0
- /data/data/####/3483c8b52ecc6d9e_0
- /data/data/####/3596e5932cf34ff3_0
- /data/data/####/364d3c6de28fdcc8_0 (deleted)
- /data/data/####/36bb03ebe11fc9b7_0
- /data/data/####/36eb2146a592af3a_0
- /data/data/####/36f502cfab24c6c2_0
- /data/data/####/37224ceb514ed59f_0
- /data/data/####/37f187d9df7207d3_0
- /data/data/####/38841f47e7ba0eb4_0
- /data/data/####/38841f47e7ba0eb4_1
- /data/data/####/39ac2e95d1ce73a1_0
- /data/data/####/3a13f29b0aec2d29_0
- /data/data/####/3a86800dbf73a8b8_0
- /data/data/####/3ab21c30189e86e0_0
- /data/data/####/3ad4a1e159e1f063_0
- /data/data/####/3ad92a079a00a222_0
- /data/data/####/3aeddcf720d2838c_0
- /data/data/####/3b31d000a1157627_0
- /data/data/####/3b71239d15e3e21a_0
- /data/data/####/3b71e11581cf8886_0
- /data/data/####/3ba6bfe1b6979c0f_0
- /data/data/####/3be8da3d1394c8fc_0
- /data/data/####/3be8da3d1394c8fc_1
- /data/data/####/3c6a29593e679c32_0
- /data/data/####/3de8a5a447f12ec0_0
- /data/data/####/3e80271ccf0028d2_0
- /data/data/####/3e80271ccf0028d2_1
- /data/data/####/3f0592be335f0bba_0
- /data/data/####/3f4f781711cf4502_0 (deleted)
- /data/data/####/3f5dea6aef19852e_0
- /data/data/####/40e153a139bd0a94_0
- /data/data/####/40efc922cbaa1583_0
- /data/data/####/4137b2870ba59f1a_0
- /data/data/####/4180700b0b7c59b7_0
- /data/data/####/4180700b0b7c59b7_1
- /data/data/####/41984bc3ca569f9d_0
- /data/data/####/4214d19cf9190695_0
- /data/data/####/42ccd6eee5a2d69a_0
- /data/data/####/4300c0e87194b40f_0
- /data/data/####/43bd1e57e0e9dad1_0
- /data/data/####/43d01f531a0cd792_0
- /data/data/####/43d01f531a0cd792_1
- /data/data/####/44229e1d969878e4_0
- /data/data/####/444b926455f67996_0
- /data/data/####/44ded89f884d07f5_0
- /data/data/####/46bf16837da3abc8_0
- /data/data/####/471a1a35afc97f4d_0
- /data/data/####/485b221cdbf7aa92_0
- /data/data/####/485b221cdbf7aa92_1
- /data/data/####/488efb01bed1e936_0
- /data/data/####/49aa9e66f16dca3f_0
- /data/data/####/49fc355e9fea0c55_0
- /data/data/####/49fc355e9fea0c55_1
- /data/data/####/4a284e7508e8cbb3_0
- /data/data/####/4b18065eb8bc787d_0
- /data/data/####/4c027647827ac7a3_0
- /data/data/####/4c34fc98b0a72adc_0
- /data/data/####/4d0ab4f670d744c8_0
- /data/data/####/4d9499a39a925027_0
- /data/data/####/4ef20537a20132a3_0
- /data/data/####/50de740725a2f7b0_0
- /data/data/####/51d3e869fc2f44b5_0
- /data/data/####/52332115bea2e5702d7659cb48fa5c3a.db
- /data/data/####/52521b45e1cb9dbe_0
- /data/data/####/526e3bcf43884c1f_0
- /data/data/####/52a089ce5c37763b_0
- /data/data/####/536609984f29f11a_0
- /data/data/####/538b3ffd91567d29_0
- /data/data/####/538b3ffd91567d29_1
- /data/data/####/53e6a5c8ac99b2e2_0
- /data/data/####/540ec8ef2753de72_0
- /data/data/####/54a35e994a1bb784_0
- /data/data/####/54a9a2689637df1f_0
- /data/data/####/54a9a2689637df1f_1
- /data/data/####/54b474ab001b84d3_0
- /data/data/####/556ea2a5968c6e3d_0
- /data/data/####/557582344a6b7ad7_0
- /data/data/####/5597653f9642981c_0
- /data/data/####/55b1689ffe0783ac_0
- /data/data/####/55ff5a03944e823d_0 (deleted)
- /data/data/####/560e0d53b33d874a_0
- /data/data/####/561b63b2fb359419_0
- /data/data/####/56689f92fda5cef5_0
- /data/data/####/56689f92fda5cef5_1
- /data/data/####/566e967ad10285f5_0
- /data/data/####/567801cf23cceefa_0
- /data/data/####/56811bdcf0bd6c10_0
- /data/data/####/56a7407b23e3b46a_0
- /data/data/####/5730d4a2ed80e567_0
- /data/data/####/587e8c7b7bf69d9d_0
- /data/data/####/587e8c7b7bf69d9d_1
- /data/data/####/589bb1bc1c5b750c_0
- /data/data/####/5982e6b119611bc1_0
- /data/data/####/59bb1f9f9ed52d32_0
- /data/data/####/59db0be042dcd905_0
- /data/data/####/59db0be042dcd905_1
- /data/data/####/59e795fd25d782c7_0
- /data/data/####/59e795fd25d782c7_1
- /data/data/####/59f9a8610ffbce2b_0
- /data/data/####/5_2.dex (deleted)
- /data/data/####/5_2.dex.flock (deleted)
- /data/data/####/5_2.jar
- /data/data/####/5a1d610fd9244574_0
- /data/data/####/5a62ecbff43de4c9_0
- /data/data/####/5ae882e40a575751_0
- /data/data/####/5ae882e40a575751_1
- /data/data/####/5b1b5cc73d6cc03d_0 (deleted)
- /data/data/####/5bf15ef944a83ac6_0
- /data/data/####/5c8a38c2d17b3314_0
- /data/data/####/5c9856186ecde876_0
- /data/data/####/5caee178439e9614_0
- /data/data/####/5caee178439e9614_1
- /data/data/####/5cfc797a541ce120_0
- /data/data/####/5d28e0a77e903bcf_0
- /data/data/####/5d54654746d47cbb_0
- /data/data/####/5d58bcda667657f3_0
- /data/data/####/5d84fa5c9445a447_0
- /data/data/####/5da827bcf0aa9f68_0
- /data/data/####/5e43e309e6af847c_0
- /data/data/####/5e43e309e6af847c_1
- /data/data/####/5e721c24fbadc4d2_0
- /data/data/####/5e8c7e3d504d764e_0
- /data/data/####/5efe03a21c75da72_0
- /data/data/####/5f37b19ea8d17548_0
- /data/data/####/600b6322e5b5cb57_0
- /data/data/####/6042d84521321e64_0
- /data/data/####/608278ec8f72086a_0
- /data/data/####/60bc369c4361983d_0
- /data/data/####/60d4adc2dbfa7ee0_0
- /data/data/####/61bbd0c41736bd31_0
- /data/data/####/61c490d6d27b31f6_0
- /data/data/####/61c490d6d27b31f6_1
- /data/data/####/627a408b286d29b9_0
- /data/data/####/631fafa34a38359c_0 (deleted)
- /data/data/####/64afbcae458596be_0 (deleted)
- /data/data/####/658448571ee847ad_0
- /data/data/####/66ffe0d4642ed456_0
- /data/data/####/673113bc1ca8b2bc_0
- /data/data/####/679826697e1cc1d5_0
- /data/data/####/68007bf2eba699a2_0
- /data/data/####/6804c0bb0b5e17b0_0
- /data/data/####/6804c0bb0b5e17b0_1
- /data/data/####/681a457ccd575ce0_0 (deleted)
- /data/data/####/69a804184cb22fce_0
- /data/data/####/6a97283703a165e8_0
- /data/data/####/6aa4a8b7c9e83b3d_0
- /data/data/####/6ba83a1a839e1473_0
- /data/data/####/6ba8a047a5a10cc9_0
- /data/data/####/6bf7e577b96aa2e9_0
- /data/data/####/6bf7e577b96aa2e9_0 (deleted)
- /data/data/####/6c4b18e01da632cd_0
- /data/data/####/6c5194f42d8e5d71_0
- /data/data/####/6ca79d16a7badb9b_0 (deleted)
- /data/data/####/6cb82b21c087519d_0
- /data/data/####/6cbf65ad274dccae_0 (deleted)
- /data/data/####/6d0b5f01ebaf142a_0
- /data/data/####/6d0ebcc2ae290998_0
- /data/data/####/6d0ebcc2ae290998_1
- /data/data/####/6d10a0ea842b0b49_0
- /data/data/####/6e62a1c1224a4166_0
- /data/data/####/6ecbf145202aff58_0
- /data/data/####/6fd3c6d2120c717e_0
- /data/data/####/70772331cf89b0de_0
- /data/data/####/70a48e9309337950_0
- /data/data/####/70c1d51663b60f5e_0
- /data/data/####/70cc5151fa268223_0
- /data/data/####/711c0287e4f28363_0
- /data/data/####/713fd7a9b3f68fef_0
- /data/data/####/71661ded6238ffd0_0
- /data/data/####/716a9ac424a4040a_0
- /data/data/####/71ea5b1652c720cc_0
- /data/data/####/722bfaaaad5877ea_0
- /data/data/####/7295ece1696c2c3e0ee9a8b27f4b49a3.db
- /data/data/####/72d270af50328cbc_0 (deleted)
- /data/data/####/735e0911ab158d7f_0
- /data/data/####/735e0911ab158d7f_1
- /data/data/####/73d92204e9d2f6f2_0
- /data/data/####/742c16e2bfde9427_0
- /data/data/####/7445b1a08b6b17ac_0
- /data/data/####/7445b1a08b6b17ac_1
- /data/data/####/74f7fc7949148eef_0
- /data/data/####/75883bc9b10ea58d_0
- /data/data/####/762fb57ef2d53e49_0
- /data/data/####/76451315b4428c44_0
- /data/data/####/76924073b8c910199fef670575272677.db
- /data/data/####/76a12070ce601320_0
- /data/data/####/771bdfb88b985ac3_0
- /data/data/####/786c2308289855c6_0
- /data/data/####/7881087791d53a7e_0
- /data/data/####/79529065ce31c26a_0
- /data/data/####/7958388b2794a276_0
- /data/data/####/7a168423c33e62d4_0
- /data/data/####/7a187420b3b82056_0 (deleted)
- /data/data/####/7b4abe41d845511b_0
- /data/data/####/7b64d770e6976e65_0
- /data/data/####/7bcd85e82673a96f_0
- /data/data/####/7c3f9dd8f74300a9_0
- /data/data/####/7c3f9dd8f74300a9_1
- /data/data/####/7c5b82e19d5310d5_0
- /data/data/####/7c939cce956f3b29_0
- /data/data/####/7d2e1fc3461893b8_0
- /data/data/####/7dac32c916ad10d1_0
- /data/data/####/7e2d57be484a8794_0 (deleted)
- /data/data/####/7e54dbc2331027cf_0
- /data/data/####/7eb50f1fc3f7d414_0
- /data/data/####/7f3006c0b4dbc497_0
- /data/data/####/8.dex
- /data/data/####/8.dex.flock (deleted)
- /data/data/####/8.jar
- /data/data/####/808ae25b8aeba0a0_0
- /data/data/####/80cb346fe3580cb8_0
- /data/data/####/815887e26b8c65b6_0
- /data/data/####/81a338af908bb773_0 (deleted)
- /data/data/####/82be7c1dcf7e2fff_0
- /data/data/####/8327d205973541f4_0
- /data/data/####/83693f5e78e57006_0
- /data/data/####/838bf0bbc35ee83c_0
- /data/data/####/838bf0bbc35ee83c_1
- /data/data/####/843e0159faf98850_0
- /data/data/####/848d6b1fee3c07bf_0
- /data/data/####/84b89be5e70dbfb9_0
- /data/data/####/84b89be5e70dbfb9_1
- /data/data/####/856718f824863c09_0
- /data/data/####/85f5633b6144df64_0
- /data/data/####/866937e0029710d9_0
- /data/data/####/86e0d3f870f6be0a_0 (deleted)
- /data/data/####/877b8ed752eaf93d_0
- /data/data/####/88a2e8bb77d8ee4b_0
- /data/data/####/88a2e8bb77d8ee4b_0 (deleted)
- /data/data/####/88bca2eeeddc8cb8_0
- /data/data/####/891acc988b9a2f15_0
- /data/data/####/8945e58ffbe4a4c1_0
- /data/data/####/8945e58ffbe4a4c1_1
- /data/data/####/89c9b3b0299e5754_0
- /data/data/####/8a6ec8d0aded0451_0
- /data/data/####/8a6ec8d0aded0451_1
- /data/data/####/8b2d40ab190347f9_0
- /data/data/####/8b2d40ab190347f9_0 (deleted)
- /data/data/####/8bad9f1d67d391b2_0
- /data/data/####/8bde82cf62a202bd_0
- /data/data/####/8c43ef226e0b706d_0
- /data/data/####/8c8d04a5655919f0_0
- /data/data/####/8cae15a7587ecf72_0
- /data/data/####/8d5c0e31ff1fae19_0
- /data/data/####/8d5c0e31ff1fae19_1
- /data/data/####/8d88afff7dac9ac3_0
- /data/data/####/8d999de25cda553b_0
- /data/data/####/8d999de25cda553b_1
- /data/data/####/8e02cda27fc476d3_0
- /data/data/####/8e236583e7d97c5b_0
- /data/data/####/8f98327ae6c2a087_0
- /data/data/####/8fd202430b8f7da6_0
- /data/data/####/8fd202430b8f7da6_1
- /data/data/####/90dfba84c7b68214_0
- /data/data/####/9261fcf76b792bb1_0
- /data/data/####/92628ea4b79ed4a2_0
- /data/data/####/926bb91540f4c23a_0 (deleted)
- /data/data/####/9291fd12886339db_0 (deleted)
- /data/data/####/932ba810968d6691_0
- /data/data/####/939aeda7afa6afd4_0
- /data/data/####/939aeda7afa6afd4_1
- /data/data/####/93c1e879cb573796_0 (deleted)
- /data/data/####/95be0bd2975e4eef_0
- /data/data/####/95d6b4dc232c73a5_0
- /data/data/####/967cd7af61812815_0
- /data/data/####/96d4e227db77ea92_0
- /data/data/####/96e3d1eb6dace75b_0 (deleted)
- /data/data/####/973a9a98c4174897_0
- /data/data/####/973c19bad840db26_0
- /data/data/####/973c19bad840db26_1
- /data/data/####/9798db0e5084ab03_0
- /data/data/####/97bdbfedaf4c835e_0
- /data/data/####/97cd15f4ac12d8ea_0
- /data/data/####/9802b84940762f76_0
- /data/data/####/985958d976619751_0
- /data/data/####/985958d976619751_1
- /data/data/####/9a51ae6b891c1205_0
- /data/data/####/9a51ae6b891c1205_1
- /data/data/####/9a6aaadbc7886349_0
- /data/data/####/9a6aaadbc7886349_1
- /data/data/####/9aedd945762d43e4_0
- /data/data/####/9b223baf13ab1112_0
- /data/data/####/9c3115d9a4165a3e_0
- /data/data/####/9c3115d9a4165a3e_1
- /data/data/####/9c45071a4b54ea6c_0
- /data/data/####/9e1a4a0c7f28b858_0
- /data/data/####/9eaa305140f60263_0
- /data/data/####/9ed4c179605a8d71_0
- /data/data/####/9efa54e8cd606ccd_0
- /data/data/####/9fafefd5c2c47fa9_0
- /data/data/####/Cookies-journal
- /data/data/####/HttpDNSConstantsJson.xml
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/XkdjsIx132mM356507059351895comm.xml
- /data/data/####/XkdjsIx132mM356507059351895tasks.xml
- /data/data/####/XkdjsIx132mM356507059351895tasks.xml.bak
- /data/data/####/XkdjsIx132mMskey1.xml
- /data/data/####/_p.xml
- /data/data/####/_pn
- /data/data/####/_sh.xml
- /data/data/####/_shn
- /data/data/####/a029b1e69243c27f_0
- /data/data/####/a02acb6bf0aab84f_0
- /data/data/####/a0552dacc86a8340_0
- /data/data/####/a09a6f55c5fd3518_0
- /data/data/####/a0c3b4a33804b140_0
- /data/data/####/a149f2ea1ed3d397_0
- /data/data/####/a1b51f43bdbc9ba1_0
- /data/data/####/a1ba1c9a11de5aac_0
- /data/data/####/a21156fcef39af2f_0
- /data/data/####/a23b40723f9dd7f2_0
- /data/data/####/a25fbf6df5202c0d_0
- /data/data/####/a2861dd262093901_0
- /data/data/####/a2a0afc05b98cfb3_0
- /data/data/####/a3d9d6af01f1b552_0
- /data/data/####/a3ed4681a2d3acce_0
- /data/data/####/a400477b4a240046_0
- /data/data/####/a400477b4a240046_1
- /data/data/####/a60d36e1d6c15081_0
- /data/data/####/a7dc980d341d4cf9_0
- /data/data/####/a7dc980d341d4cf9_1
- /data/data/####/a826327090167833_0
- /data/data/####/a826327090167833_1
- /data/data/####/a89c0f74a36023ea_0
- /data/data/####/a90a5612dc2d231d_0
- /data/data/####/a9754692c69e2086_0
- /data/data/####/aa0f95c6a18d0b97_0
- /data/data/####/aa3cec6737a18c15_0
- /data/data/####/aa4918093cecb72c_0
- /data/data/####/aa65c909ec02a1d0_0
- /data/data/####/abdcf81179505421_0
- /data/data/####/accb641e487648a8_0
- /data/data/####/ad014b8fbd1e923d_0
- /data/data/####/ae15b646f9700502_0
- /data/data/####/ae51b33fcb3b91e9_0
- /data/data/####/ae590a5129284fe7_0
- /data/data/####/aed66396f7670740_0
- /data/data/####/af2c69c61b7b25c4_0
- /data/data/####/af3bcb51e65c607d_0
- /data/data/####/af5041e969669400_0
- /data/data/####/af5fbdb9381fd7d3_0
- /data/data/####/af8042a1e009204d_0
- /data/data/####/af9cbe074846e6d8_0
- /data/data/####/afd450125c4576e0_0
- /data/data/####/ahq_spu_ti.xml
- /data/data/####/b02b6ad0ef4da244_0 (deleted)
- /data/data/####/b0c2e0101fd2571d_0
- /data/data/####/b0cc21a25f558039_0
- /data/data/####/b11b50fe2178fc30_0 (deleted)
- /data/data/####/b1f30d6d2b0bedc2_0
- /data/data/####/b2010cb3a084eb14_0
- /data/data/####/b2d414a221ef86ee_0
- /data/data/####/b41cdb429cc57b3b_0
- /data/data/####/b428357b7b257efc_0
- /data/data/####/b4b087dcbcac375c_0
- /data/data/####/b4b087dcbcac375c_1
- /data/data/####/b50692349f12fe36_0
- /data/data/####/b5234ca6188f194e_0
- /data/data/####/b5e077d1bae86968_0
- /data/data/####/b60153c0784e2437_0
- /data/data/####/b6bdb63689fc1151_0
- /data/data/####/b6ea8df78f61ef04_0
- /data/data/####/b7051f90dedf1c1c_0
- /data/data/####/b75febc034f42368_0
- /data/data/####/b78e1ee92bdd17e2_0
- /data/data/####/b88e1a5ab47d710d_0
- /data/data/####/b8f297c1f442d05a_0
- /data/data/####/b970f2fd8814789b_0
- /data/data/####/b970f2fd8814789b_1
- /data/data/####/ba0110a01584c4b8_0
- /data/data/####/ba38bf3133713593_0
- /data/data/####/ba9745bba32b90fc_0
- /data/data/####/bd271ba8778d57bc_0
- /data/data/####/be79ddce7f309645_0
- /data/data/####/be94fd46c5d6851d_0
- /data/data/####/bedd830248feb49c_0
- /data/data/####/bf32d7bc6caad831_0
- /data/data/####/bfe6fdfee3b86fb4_0
- /data/data/####/c08d00eaba704865_0
- /data/data/####/c17f4a79fdac765f_0
- /data/data/####/c2aa9bb5c6b97e29_0
- /data/data/####/c2bc304cbf46e768_0
- /data/data/####/c2bdeb0926cf83cd_0 (deleted)
- /data/data/####/c2e349e3e4c5150e_0
- /data/data/####/c32a739c18dc3a7a_0
- /data/data/####/c355d14573f64b6a_0
- /data/data/####/c36957ba8104a07a_0
- /data/data/####/c3a97041a4a931a7_0
- /data/data/####/c3a97041a4a931a7_1
- /data/data/####/c42c939f391f11ca_0
- /data/data/####/c49398a6a9ebf812_0
- /data/data/####/c49398a6a9ebf812_1
- /data/data/####/c4f15c391b95d924_0
- /data/data/####/c6104839b4800e48_0
- /data/data/####/c6104839b4800e48_1
- /data/data/####/c79ad426f1a4b135_0
- /data/data/####/c79ad426f1a4b135_1
- /data/data/####/c7ce1868366f1643_0
- /data/data/####/c80e342194b00e9b_0
- /data/data/####/c965d01afe53177c_0
- /data/data/####/c97d9c7b4841b38b_0 (deleted)
- /data/data/####/ca53c6d87cdc68b0_0
- /data/data/####/ca76e8599c36ccda_0
- /data/data/####/cac5d0cd48ef64f9_0
- /data/data/####/cb207d285fd4105b_0
- /data/data/####/cbee5c53073232da_0
- /data/data/####/cc4a706bdeea7fc9_0
- /data/data/####/cccca05da3076cfe_0
- /data/data/####/cd5df220b541161c_0
- /data/data/####/cd76a202682142db_0
- /data/data/####/cddb98638fd4cd81_0
- /data/data/####/ceb53b102f40ef45_0 (deleted)
- /data/data/####/cecd73e4ec4cd17c_0
- /data/data/####/cecd9e3c202946ab_0
- /data/data/####/cecd9e3c202946ab_1
- /data/data/####/ced715b9efbb4851_0 (deleted)
- /data/data/####/ceeecf7666ff75e9_0
- /data/data/####/cf3ff1efbc6b3770_0
- /data/data/####/cf4cf4444e75fcfe_0
- /data/data/####/cf97196cda20fdba_0
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.oat
- /data/data/####/com.meiju592.app.xml
- /data/data/####/com.meiju592.app_preferences.xml
- /data/data/####/com.tencent.open.config.json.1106779540
- /data/data/####/countIp.xml
- /data/data/####/d04f1062d692df99_0
- /data/data/####/d061f30dd8daaf9f_0
- /data/data/####/d07444cce2869831_0
- /data/data/####/d07444cce2869831_1
- /data/data/####/d08b4e14d82f5002_0
- /data/data/####/d1a697f95b336dc3_0
- /data/data/####/d1d19f9efb1ee87b_0
- /data/data/####/d1e384771a5ccfa3_0
- /data/data/####/d1e95ff75f667059_0
- /data/data/####/d235d50545b92f88_0
- /data/data/####/d242a02e3b9100f0_0
- /data/data/####/d35c7a172a0ff050_0 (deleted)
- /data/data/####/d3a35c36a9b57e67_0
- /data/data/####/d3c0afe9b6e8dfcf_0
- /data/data/####/d4219fff9a178666_0
- /data/data/####/d4219fff9a178666_1
- /data/data/####/d5115f67912f0caa_0 (deleted)
- /data/data/####/d5737fd4a0e8acc1_0
- /data/data/####/d5737fd4a0e8acc1_1
- /data/data/####/d5ddc695a31aa53e_0
- /data/data/####/d5fdda696379a2c9_0
- /data/data/####/d5fdda696379a2c9_1
- /data/data/####/d610f1c85c12d6d3_0
- /data/data/####/d7d918848a64f8c0_0
- /data/data/####/d855220268c2032c_0
- /data/data/####/d855220268c2032c_1
- /data/data/####/d870c33211690f82_0
- /data/data/####/d8a039c1ca5485ef_0
- /data/data/####/d8a2ad887e70d879_0 (deleted)
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTc1MzQ2NDI3MzA0;
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTc1MzQ2NDIzNzM2;
- /data/data/####/da365923ec106800_0
- /data/data/####/da36c551bfa8790a_0
- /data/data/####/da9406c75a6c6aac_0
- /data/data/####/da9406c75a6c6aac_1
- /data/data/####/daa6099ed2b291c3_0
- /data/data/####/db05e832ae94f527_0
- /data/data/####/db9ab6cb9f3740b9_0
- /data/data/####/dbe6ce490ae7598b_0
- /data/data/####/dc01e50c10016e19_0
- /data/data/####/dd1f1f651b3b683d_0
- /data/data/####/dd6ebba0a6c25176_0
- /data/data/####/dd8d6ed6ba4ddee1bd53a4222dd60c3e.db
- /data/data/####/deaccc83aa5a6869_0
- /data/data/####/deeb263f45008a8c_0
- /data/data/####/deeb263f45008a8c_1
- /data/data/####/def86c4c5077cce6_0
- /data/data/####/device_id.xml.xml
- /data/data/####/df3f48f0483fd8f7_0
- /data/data/####/dns_ip_info.db
- /data/data/####/dns_ip_info.db-journal
- /data/data/####/downUmeng.dex (deleted)
- /data/data/####/downUmeng.dex.flock (deleted)
- /data/data/####/downUmeng.jar
- /data/data/####/dpi
- /data/data/####/e07f6fd0f8b8f186_0
- /data/data/####/e09bc14822f0bc67_0
- /data/data/####/e0c6fd8d0f2ba858_0
- /data/data/####/e14f76de855682b9_0
- /data/data/####/e18793f3953d789e_0
- /data/data/####/e1a9318422b5c714_0
- /data/data/####/e1e88d79a8cce30c_0 (deleted)
- /data/data/####/e21c0c3698d73290_0
- /data/data/####/e23e5937ef414c60_0
- /data/data/####/e2678e57994bd2fb_0
- /data/data/####/e28d72e2351dc6fb_0
- /data/data/####/e28d72e2351dc6fb_1
- /data/data/####/e29012ce25467f00_0
- /data/data/####/e326761aec060829_0
- /data/data/####/e3ae7749b25e8d56_0
- /data/data/####/e41653f03c521a54_0
- /data/data/####/e41653f03c521a54_1
- /data/data/####/e639c3e7ffc779d5_0
- /data/data/####/e6740be65e62f6b4_0
- /data/data/####/e717a310ceb0c850_0
- /data/data/####/e717a310ceb0c850_1
- /data/data/####/e7236594925dbbab_0
- /data/data/####/e7717e35d4650909_0 (deleted)
- /data/data/####/e7b7757407075848_0
- /data/data/####/e7b7757407075848_1
- /data/data/####/e95e4bfaf2c2e4ea_0
- /data/data/####/e97f6a28a9f1c050_0
- /data/data/####/e9caa6e0376d79b0_0
- /data/data/####/ea465c7bc6d0c7f8_0
- /data/data/####/eba8ae13c827b66b_0
- /data/data/####/eba8ae13c827b66b_1
- /data/data/####/ebffee8912f4f56f_0
- /data/data/####/ed0159b6fc213011_0
- /data/data/####/ed0159b6fc213011_1
- /data/data/####/edd21f355173cd10_0
- /data/data/####/ee17fddf045f2563_0 (deleted)
- /data/data/####/ee6802e5fa51650a_0
- /data/data/####/ee992d8ff2fbc2b2_0
- /data/data/####/eeebc754a39233ab_0
- /data/data/####/eeebc754a39233ab_1
- /data/data/####/ef6e5f97a82102a3_0
- /data/data/####/ef6e5f97a82102a3_1
- /data/data/####/ef97dce565220179_0
- /data/data/####/ef98bb51f4f2ad1e_0
- /data/data/####/efcadb0c3b38fd82_0
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f04479f10ab9d876_0
- /data/data/####/f055a623f8dfd329_0
- /data/data/####/f096eaf6717a2e33_0
- /data/data/####/f0a84eddd67c68bd_0
- /data/data/####/f152b31e2cdb67aa_0
- /data/data/####/f1ad8cdacca96d6d_0
- /data/data/####/f1ebf19bda05c62d_0
- /data/data/####/f1ebf19bda05c62d_1
- /data/data/####/f27b47acc620af12_0
- /data/data/####/f2856e30b74a683a_0
- /data/data/####/f293a894e9de5536_0
- /data/data/####/f446a661d9800ced_0
- /data/data/####/f462c3bed654fac8_0
- /data/data/####/f4f59a85fba6c94d_0
- /data/data/####/f545df56aa63744d_0 (deleted)
- /data/data/####/f602e76b4fae61f4_0
- /data/data/####/f602e76b4fae61f4_1
- /data/data/####/f62995a4dffd6417_0
- /data/data/####/f64f90fbdf0e2b81_0
- /data/data/####/f6c22a340f14c9d9_0
- /data/data/####/f757bcf553a0eea2_0
- /data/data/####/f7c7816d9ddffe97_0
- /data/data/####/f7c7816d9ddffe97_1
- /data/data/####/f800e6f406e76153_0
- /data/data/####/f8756f4f3ac5d9e5_0
- /data/data/####/f940d8bc4a3bace5_0
- /data/data/####/f98affab9fd64dca_0
- /data/data/####/fa5edad95c4c3ae7_0
- /data/data/####/fa8e8d1c1ec4cb31_0
- /data/data/####/fb7138146f4281e9_0
- /data/data/####/fb9f0328f622c76f_0
- /data/data/####/fcb0334d2d9da6f4_0
- /data/data/####/fe17a3067d3ace52_0
- /data/data/####/fe17a3067d3ace52_1
- /data/data/####/fea509b3e34f05b1_0
- /data/data/####/ff92fa8ee764d768_0
- /data/data/####/hhq_spu_ti.xml
- /data/data/####/hid.db
- /data/data/####/http_s.zhitoudsp.com_808.localstorage-journal
- /data/data/####/https_appd.evergrande.com_0.localstorage-journal
- /data/data/####/https_pos.baidu.com_0.localstorage-journal
- /data/data/####/https_pro.m.jd.com_0.localstorage-journal
- /data/data/####/https_www.iqiyi.com_0.localstorage-journal
- /data/data/####/i==1.2.0&&5.4.2_1575346423718_envelope.log
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/libjiagu.so
- /data/data/####/meijuniaoV2.db-journal
- /data/data/####/metrics_guid
- /data/data/####/msy.xml
- /data/data/####/proc_auxv
- /data/data/####/the-real-index
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_down_18.db
- /data/data/####/umeng_down_5_2.db
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng.jar --oat-fd=82 --oat-location=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng/downUmeng.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/1.jar --oat-fd=103 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/1.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/13_2.jar --oat-fd=160 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/13_2.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/17.jar --oat-fd=160 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/17.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/18.jar --oat-fd=164 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/18.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/5_2.jar --oat-fd=158 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/5_2.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/8.jar --oat-fd=161 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/8.dex --compiler-filter=speed
- /system/bin/sh
- cat /proc/cpuinfo
- cat /sys/class/android_usb/android0/idProduct
- cat /sys/class/android_usb/android0/idVendor
- cat /sys/class/net/wlan0/address
- getprop
- ls -l /dev
- ls -l /dev/__properties__
- ls -l /dev/block
- ls -l /dev/block/pci
- ls -l /dev/block/pci/pci0000:00
- ls -l /dev/block/pci/pci0000:00/0000:00:01.1
- ls -l /dev/block/pci/pci0000:00/0000:00:01.1/by-num
- ls -l /dev/block/vold
- ls -l /dev/bus
- ls -l /dev/bus/usb
- ls -l /dev/bus/usb/001
- ls -l /dev/com.android.settings
- ls -l /dev/com.android.settings.daemon
- ls -l /dev/cpuctl
- ls -l /dev/cpuset
- ls -l /dev/cpuset/background
- ls -l /dev/cpuset/foreground
- ls -l /dev/cpuset/foreground/boost
- ls -l /dev/cpuset/system-background
- ls -l /dev/cpuset/top-app
- ls -l /dev/fscklogs
- ls -l /dev/graphics
- ls -l /dev/input
- ls -l /dev/memcg
- ls -l /dev/memcg/apps
- ls -l /dev/pts
- ls -l /dev/snd
- ls -l /dev/socket
- ls -l /dev/stune
- ls -l /dev/stune/background
- ls -l /dev/stune/foreground
- ls -l /dev/stune/top-app
- ls /
- ls /sys/class/thermal
- ps
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
- RSA-None-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
- RSA-None-PKCS1Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
Управляет Wi-Fi-подключением.
