Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.1014.origin
- Android.Triada.4567
- Android.Triada.510.origin
- Android.Triada.546.origin
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) y####.k8####.com:80
- TCP(HTTP/1.1) c####.6k####.com:10238
- TCP(HTTP/1.1) pop.onlinem####.com:80
- TCP(HTTP/1.1) x####.me####.com:10238
- TCP(HTTP/1.1) api.videob####.vi####.com:80
- TCP(HTTP/1.1) f2e.videob####.com:80
- TCP(HTTP/1.1) nhk.leo####.com:80
- TCP(HTTP/1.1) 35.1####.235.102:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) d0####.98####.com:10091
- TCP(HTTP/1.1) c####.6k####.com:10278
- TCP(HTTP/1.1) 18.1####.162.254:80
- TCP(HTTP/1.1) d3epst7####.cloudf####.net:80
- TCP(HTTP/1.1) p####.leo####.com:80
- TCP(HTTP/1.1) pz.gamesky####.com:80
- TCP(HTTP/1.1) p####.ji####.xyz:80
- TCP(HTTP/1.1) cdn.he####.xyz:80
- TCP(HTTP/1.1) yh.coolnet####.com:80
- TCP(HTTP/1.1) log.leo####.com:80
- TCP(HTTP/1.1) x####.me####.com:10248
- TCP(HTTP/1.1) etl.mym####.com:80
- TCP(HTTP/1.1) ddl.be####.space:80
- TCP(HTTP/1.1) bi####.bi####.com:10238
- TCP(HTTP/1.1) api.pz.leoma####.com:80
- UDP(NTP) p####.ntp.org:123
- TCP(TLS/1.0) i.y####.com:443
- TCP(TLS/1.0) d1c7eqt####.cloudf####.net:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) 7a3bdcd####.safef####.googles####.com:443
- TCP(TLS/1.0) pcooki####.ta####.com:443
- TCP(TLS/1.0) us####.al####.com.####.net:443
- TCP(TLS/1.0) ddi.shu####.cn:443
- TCP(TLS/1.0) retcode####.a####.aliy####.com:443
- TCP(TLS/1.0) t.appsf####.com:443
- TCP(TLS/1.0) net.ray####.com:443
- TCP(TLS/1.0) acco####.go####.com:443
- TCP(TLS/1.0) d####.shu####.cn:443
- TCP(TLS/1.0) a.adma####.top:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) hot.onlinem####.com:443
- TCP(TLS/1.0) 64.2####.165.95:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) fk-set####.ray####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) co####.in####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) c####.b####.com:443
- TCP(TLS/1.0) st####.adma####.top:443
- TCP(TLS/1.0) api.appsf####.com:443
- TCP(TLS/1.0) fk-old-####.ray####.com:443
- TCP(TLS/1.0) cdn.amppro####.org:443
- TCP(TLS/1.0) rep####.crashly####.com:443
- TCP(TLS/1.0) cdn-adn####.ray####.com:443
- TCP(TLS/1.0) securep####.g.doublec####.net:443
- TCP(TLS/1.0) cdn-ad####.ray####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) gj.mm####.com:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) sdk.adti####.com:443
- TCP(TLS/1.0) analy####.ray####.com:443
- TCP(TLS/1.0) placem####.ta####.com:443
- TCP(TLS/1.0) eu-aebr####.aliexp####.com:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) eu####.aliexp####.com:443
- TCP(TLS/1.0) g####.8####.com:443
- TCP(TLS/1.0) eu####.al####.com.####.net:443
- TCP(TLS/1.0) etl.n####.com:443
- TCP(TLS/1.0) pop.onlinem####.com:443
- TCP(TLS/1.0) d3epst7####.cloudf####.net:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
- TCP(TLS/1.0) dai.shu####.cn:443
- TCP(TLS/1.0) m.ali####.com.####.net:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) 64.2####.162.95:443
- TCP(TLS/1.0) unit####.edges####.net:443
- TCP(TLS/1.0) con####.ta####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) tim####.akama####.net:443
- TCP(TLS/1.0) 64.2####.163.95:443
- TCP(TLS/1.0) ev####.appsf####.com:443
- TCP(TLS/1.0) a####.shu####.cn:443
- TCP(TLS/1.2) 1####.194.73.94:443
- TCP(TLS/1.2) 1####.194.222.95:443
- TCP(TLS/1.2) 1####.217.17.78:443
- TCP(TLS/1.2) 74.1####.205.100:443
- TCP(TLS/1.2) 64.2####.163.95:443
- TCP(TLS/1.2) ev####.appsf####.com:443
- TCP(TLS/1.2) 64.2####.165.95:443
- TCP(TLS/1.2) 1####.194.73.95:443
Запросы DNS:
- 242547a####.safef####.googles####.com
- 7a3bdcd####.safef####.googles####.com
- a####.al####.com
- a####.shu####.cn
- a.adma####.top
- acco####.go####.com
- acs.aliexp####.com
- adser####.go####.com
- adser####.go####.nl
- analy####.ray####.com
- and####.b####.qq.com
- android####.go####.com
- api.appsf####.com
- api.pz.leoma####.com
- api.videob####.vi####.com
- as####.al####.com
- bi####.bi####.com
- c####.6k####.com
- c####.b####.com
- c####.s9####.com
- cdn-ad####.ray####.com
- cdn-adn####.ray####.com
- cdn.amppro####.org
- cdn.he####.xyz
- cdn.zip.be####.space
- co####.in####.com
- co####.unit####.uni####.com
- con####.ta####.com
- d####.shu####.cn
- d0####.98####.com
- d1c7eqt####.cloudf####.net
- d26bc9z####.cloudf####.net
- d3epst7####.cloudf####.net
- daa.shu####.cn
- dai.shu####.cn
- ddi.shu####.cn
- ddl.be####.space
- etl.mym####.com
- etl.n####.com
- ev####.appsf####.com
- f####.google####.com
- f2e.videob####.com
- g####.8####.com
- g####.face####.com
- gj.mm####.com
- googl####.g.doublec####.net
- gpsf####.aliexp####.com
- h####.b####.com
- hot.onlinem####.com
- hu####.wap.n####.com
- hub####.n####.com
- i.y####.com
- log.leo####.com
- m####.aliexp####.com
- m####.go####.com
- m.ali####.com
- m.aliexp####.com
- md####.google####.com
- net.ray####.com
- nhk.leo####.com
- p####.ji####.xyz
- p####.leo####.com
- p####.ntp.org
- pag####.googles####.com
- pco####.aliexp####.com
- placem####.ta####.com
- pop.onlinem####.com
- pz.gamesky####.com
- rep####.crashly####.com
- retcode####.a####.aliy####.com
- s.c####.aliexp####.com
- sdk.adti####.com
- securep####.g.doublec####.net
- set####.ray####.com
- sett####.crashly####.com
- st####.adma####.top
- t.appsf####.com
- tim####.akama####.net
- tpc.googles####.com
- web####.unit####.uni####.com
- www.go####.com
- www.google-####.com
- www.googlet####.com
- x####.me####.com
- y####.k8####.com
- yh.coolnet####.com
Запросы HTTP GET:
- api.pz.leoma####.com/sdkconfig/list?sdk=####&sdkver=####&market=####&aid...
- api.videob####.vi####.com/api/advert/v1/advert/position/get?get_slaves=#...
- api.videob####.vi####.com/api/advert/v1/event/show/report?advert_id=####...
- api.videob####.vi####.com/api/advert/v1/sdk/conf/videobuddy/get?nonce=##...
- api.videob####.vi####.com/api/config/v1/config/common_store/get?config_t...
- api.videob####.vi####.com/api/home/v2/home/filters/get/1?nonce=####&ts=#...
- api.videob####.vi####.com/api/home/v3/tab/banner_slide/get?advert_pos_id...
- api.videob####.vi####.com/api/home/v3/tab/feed/get?advert_pos_id=####&fe...
- api.videob####.vi####.com/api/subscribe/v1/feed/home_list/status?nonce=#...
- api.videob####.vi####.com/api/subscribe/v1/user/subscribe_info/get?nonce...
- api.videob####.vi####.com/charts/me_navigator?nonce=####&ts=####&sign=####
- api.videob####.vi####.com/global_config?nonce=####&ts=####&sign=####
- api.videob####.vi####.com/ip?nonce=####&ts=####&sign=####
- api.videob####.vi####.com/sign/v2/newbie_reward?nonce=####&ts=####&sign=...
- api.videob####.vi####.com/sisyphus/lockscreens?nonce=####&ts=####&sign=#...
- api.videob####.vi####.com/sisyphus/persistent/message?cursor=####&nonce=...
- api.videob####.vi####.com/sisyphus/push/local?nonce=####&ts=####&sign=####
- api.videob####.vi####.com/tag/v2/config?nonce=####&ts=####&sign=####
- api.videob####.vi####.com/upgrade?nonce=####&ts=####&sign=####
- api.videob####.vi####.com/upgrade_archive?archive=####&version=####&nonc...
- api.videob####.vi####.com/vcoin/v1/coin/history/change?nonce=####&ts=###...
- cdn.he####.xyz/configfile/vb17_all_chaodi_1112_TheLimbaughLetter_v1.6.so
- d3epst7####.cloudf####.net/videobuddy/1574248621-e8383bf7a087-vc闪屏2_w108...
- ddl.be####.space/uion/6962_6963_6964_6965_6966_6967_6968_6969_6970_6971_...
- f2e.videob####.com/fe-static/mult-region-vshop/index.html?tab=####&xl_sh...
- f2e.videob####.com/fe-static/mult-region-vshop/static/css/index.ae6cb219...
- f2e.videob####.com/fe-static/mult-region-vshop/static/css/vendor.66c6baf...
- log.leo####.com/ad/getofferpackages?onlinestatus=####&country=####&s_st=...
- pop.onlinem####.com/xlcdn/lib/vue/2.6.11/vue.runtime.min.js
- pz.gamesky####.com/bmw?type=####&vc=####&channel=####&aid=####
- y####.k8####.com/hwyw/deahexwot.zip
- y####.k8####.com/hwyw/styaoduyar.zip
- y####.k8####.com/zhuti/Yl5PGV5tmj1116.zip
- y####.k8####.com/zhuti/j0jEJl4xec1116.zip
- yh.coolnet####.com/powerful/cfg/?sdk=####&vc=####&ch=####&aid=####&count...
- yh.coolnet####.com/powerful/cfg/?type=####&vc=####&s_st=####
Запросы HTTP POST:
- and####.b####.qq.com/rqd/async?aid=####
- api.videob####.vi####.com/api/subscribe/v1/user/channel/unsubscribe_all?...
- api.videob####.vi####.com/bunshin/add?nonce=####&ts=####&sign=####
- api.videob####.vi####.com/christis/app/authorize?nonce=####&ts=####&sign...
- api.videob####.vi####.com/vcoin/reachout?nonce=####&ts=####&sign=####
- api.videob####.vi####.com/vcoin/v1/coin/task/do?nonce=####&ts=####&sign=...
- api.videob####.vi####.com/vcoin/v1/task/info/batch?nonce=####&ts=####&si...
- bi####.bi####.com:10238/czwwwkpmfl/
- bi####.bi####.com:10238/phvttztyax/
- c####.6k####.com:10238/2ejolc/
- c####.6k####.com:10238/dts57h/
- c####.6k####.com:10238/z2s8gh/
- c####.6k####.com:10278/42elke/
- c####.6k####.com:10278/jn9zpb/
- d0####.98####.com:10091/wisdom/marking
- etl.mym####.com/api/event_report/v1/vidhunter/event/report?nonce=####&ts...
- log.leo####.com/?market=####&ver=####&category=####&size=####&t=####&typ...
- log.leo####.com/ad/v2/finectrnew
- log.leo####.com/ad/v2/sswitch
- log.leo####.com/log/v5/mutisdk
- log.leo####.com/sensor
- nhk.leo####.com/ad/v2/sswitch
- p####.ji####.xyz/api/report/packages?sdk=####&sdkver=####&market=####&ai...
- p####.leo####.com/leoads/api/m-p-upgrade
- x####.me####.com:10238/czwwwkpmfl/
- x####.me####.com:10238/phvttztyax/
- x####.me####.com:10248/iysyxb/
- x####.me####.com:10248/ng1fxo/
- x####.me####.com:10248/pauumd/
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-2088356683-433083394
- /data/data/####/-957467319.zip (deleted)
- /data/data/####/.mainiconfig
- /data/data/####/0.xml
- /data/data/####/1002
- /data/data/####/1004
- /data/data/####/1210653279-64099375
- /data/data/####/1574de1c9116d05bacdc0d7ba2e3283fd88189c1e7bca68....0.tmp
- /data/data/####/1605768969531
- /data/data/####/1605769041037
- /data/data/####/1605769041803
- /data/data/####/2449e6d7b4909a85571efefb94f5157f
- /data/data/####/2449e6d7b4909a85571efefb94f5157f-header
- /data/data/####/288aa1edf550b15485d0f7f5cf491476
- /data/data/####/288aa1edf550b15485d0f7f5cf491476-header
- /data/data/####/2bae65e04d4600a45c0ccf9c2ec9fee7
- /data/data/####/2bae65e04d4600a45c0ccf9c2ec9fee7-header
- /data/data/####/2e828729eb3d79da697f368b074b1c6f
- /data/data/####/2e828729eb3d79da697f368b074b1c6f-header
- /data/data/####/30051a4596edf6ca_0
- /data/data/####/35d7e8520086823aefeac15172c0c9917a7bf5607918f10....0.tmp
- /data/data/####/3c978e51c3abb30b7e262c4f5adf09e3
- /data/data/####/3c978e51c3abb30b7e262c4f5adf09e3-header
- /data/data/####/4176b5712990d489396739c1af572970
- /data/data/####/4176b5712990d489396739c1af572970-header
- /data/data/####/47984b41b241535a9b7dd061a7a81a74
- /data/data/####/47984b41b241535a9b7dd061a7a81a74-header
- /data/data/####/4a5826140f6cbc9c9e41488174048cb2
- /data/data/####/4a5826140f6cbc9c9e41488174048cb2-header
- /data/data/####/4edbf242a68533c3c7c50f30bc9efcb4
- /data/data/####/4edbf242a68533c3c7c50f30bc9efcb4-header
- /data/data/####/5AF192A3611C6DCF6210DA03A6013AC0.dex
- /data/data/####/5AF192A3611C6DCF6210DA03A6013AC0.dex.flock (deleted)
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537E.cls_temp
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537EBeginSession.cls_temp
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537EBeginSession.json
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537ESessionApp.cls_temp
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537ESessionApp.json
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537ESessionCrash.cls_temp
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537ESessionDevice.cls_temp
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537ESessionDevice.json
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537ESessionOS.cls_temp
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537ESessionOS.json
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537ESessionUser.cls_temp
- /data/data/####/5FB616F70289-0001-0D1E-C2B2BB8B537Ekeys.meta
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537E.cls_temp
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537EBeginSession.cls_temp
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537EBeginSession.json
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537ESessionApp.cls_temp
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537ESessionApp.json
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537ESessionCrash.cls_temp
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537ESessionDevice.cls_temp
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537ESessionDevice.json
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537ESessionOS.cls_temp
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537ESessionOS.json
- /data/data/####/5FB6172101A3-0002-0D1E-C2B2BB8B537ESessionUser.cls_temp
- /data/data/####/5FB6172B038D-0003-0D1E-C2B2BB8B537EBeginSession.cls_temp
- /data/data/####/5FB6172B038D-0003-0D1E-C2B2BB8B537EBeginSession.json
- /data/data/####/5FB6172B038D-0003-0D1E-C2B2BB8B537ESessionApp.cls_temp
- /data/data/####/5FB6172B038D-0003-0D1E-C2B2BB8B537ESessionApp.json
- /data/data/####/5FB6172B038D-0003-0D1E-C2B2BB8B537ESessionDevice.cls_temp
- /data/data/####/5FB6172B038D-0003-0D1E-C2B2BB8B537ESessionDevice.json
- /data/data/####/5FB6172B038D-0003-0D1E-C2B2BB8B537ESessionOS.cls_temp
- /data/data/####/5FB6172B038D-0003-0D1E-C2B2BB8B537ESessionOS.json
- /data/data/####/5FB6173F01DE-0001-1065-C2B2BB8B537EBeginSession.cls_temp
- /data/data/####/5FB6173F01DE-0001-1065-C2B2BB8B537EBeginSession.json
- /data/data/####/5FB6173F01DE-0001-1065-C2B2BB8B537ESessionApp.cls_temp
- /data/data/####/5FB6173F01DE-0001-1065-C2B2BB8B537ESessionApp.json
- /data/data/####/5FB6173F01DE-0001-1065-C2B2BB8B537ESessionDevice.cls_temp
- /data/data/####/5FB6173F01DE-0001-1065-C2B2BB8B537ESessionDevice.json
- /data/data/####/5FB6173F01DE-0001-1065-C2B2BB8B537ESessionOS.cls_temp
- /data/data/####/5FB6173F01DE-0001-1065-C2B2BB8B537ESessionOS.json
- /data/data/####/5FB6173F01DE-0001-1065-C2B2BB8B537Ekeys.meta
- /data/data/####/5FB61771006E-0001-12F5-C2B2BB8B537EBeginSession.cls_temp
- /data/data/####/5FB61771006E-0001-12F5-C2B2BB8B537EBeginSession.json
- /data/data/####/5FB61771006E-0001-12F5-C2B2BB8B537ESessionApp.cls_temp
- /data/data/####/5FB61771006E-0001-12F5-C2B2BB8B537ESessionApp.json
- /data/data/####/5FB61771006E-0001-12F5-C2B2BB8B537ESessionDevice.cls_temp
- /data/data/####/5FB61771006E-0001-12F5-C2B2BB8B537ESessionDevice.json
- /data/data/####/5FB61771006E-0001-12F5-C2B2BB8B537ESessionOS.cls_temp
- /data/data/####/5FB61771006E-0001-12F5-C2B2BB8B537ESessionOS.json
- /data/data/####/5FB61771006E-0001-12F5-C2B2BB8B537Ekeys.meta
- /data/data/####/63952eeee83302702266e07f2e99ff70
- /data/data/####/63952eeee83302702266e07f2e99ff70-header
- /data/data/####/6eba89ae271987f98671a38476011556
- /data/data/####/6eba89ae271987f98671a38476011556-header
- /data/data/####/7a67d04445a53bcc4e15595c3fc4cda7
- /data/data/####/7a67d04445a53bcc4e15595c3fc4cda7-header
- /data/data/####/7df67ec0c0cb70a141924e72cb8f5515-header
- /data/data/####/7df67ec0c0cb70a141924e72cb8f5515cache
- /data/data/####/8C8F552939218D4D55F5ACC7505AE2C6.xml
- /data/data/####/90d7b8875a6ac2ff2a27c0550980b888-header
- /data/data/####/90d7b8875a6ac2ff2a27c0550980b888cache
- /data/data/####/9145E4178974FEAFB084264767F30932.xml
- /data/data/####/98FDECB17B837318717C64311D2C05D8.dex
- /data/data/####/98FDECB17B837318717C64311D2C05D8.dex.flock (deleted)
- /data/data/####/9B29C2F5242C6A564DFEF1DF4F020D57.dex
- /data/data/####/9B29C2F5242C6A564DFEF1DF4F020D57.dex.flock (deleted)
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/ArchiveManifest.json
- /data/data/####/Cookies-journal
- /data/data/####/CrashSP.xml
- /data/data/####/CrashSP.xml.bak
- /data/data/####/DownloadManager.xml
- /data/data/####/E796DC7A583043BFD4849DB0067F31E4.xml
- /data/data/####/E796DC7A583043BFD4849DB0067F31E4.xml.bak
- /data/data/####/Identify.txt
- /data/data/####/MSPConf.xml
- /data/data/####/SPHelper_sp_main.xml
- /data/data/####/SPHelper_sp_main.xml.bak
- /data/data/####/SP_HOMEPAGE_NEW.xml
- /data/data/####/SP_HOMEPAGE_NEW.xml.bak (deleted)
- /data/data/####/SharedData.xml
- /data/data/####/SharedData.xml.bak
- /data/data/####/TheLimbaughLetter_v1.6.tmp
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/UnityAdsStorage-private-data.json
- /data/data/####/UnityAdsStorage-public-data.json
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml.bak
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml.bak (deleted)
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/__send_data_1605768953721
- /data/data/####/__send_data_1605768984822
- /data/data/####/__send_data_1605768995516
- /data/data/####/__send_data_1605769025342
- /data/data/####/__send_data_1605769029060
- /data/data/####/__send_data_1605769077243
- /data/data/####/_toolbox_prefs.xml
- /data/data/####/_toolbox_prefs.xml.bak
- /data/data/####/a0b33cf90ea7245ba1ed5ab3a8dcd6df
- /data/data/####/a0b33cf90ea7245ba1ed5ab3a8dcd6df-header
- /data/data/####/a2c9a8801ba240daa99c2ff2ab112062
- /data/data/####/a2c9a8801ba240daa99c2ff2ab112062-header
- /data/data/####/account.xml
- /data/data/####/ad_configure
- /data/data/####/adtiming.db
- /data/data/####/adtiming.db-journal
- /data/data/####/analytics.db (deleted)
- /data/data/####/analytics.db-journal
- /data/data/####/app-downloader.db-journal
- /data/data/####/appsflyer-data.xml
- /data/data/####/appsflyer-data.xml.bak
- /data/data/####/appsflyer-data.xml.bak (deleted)
- /data/data/####/b2c95f0d0386803ccaf414fb1cb427e1-header
- /data/data/####/b2c95f0d0386803ccaf414fb1cb427e1cache
- /data/data/####/baf1c8b9d4faeaba056b98166319b729
- /data/data/####/baf1c8b9d4faeaba056b98166319b729-header
- /data/data/####/basic_main_sp.xml
- /data/data/####/bugly_db_-journal
- /data/data/####/c9eedfddbf8dc71e230a9dd905a11ccf
- /data/data/####/c9eedfddbf8dc71e230a9dd905a11ccf-header
- /data/data/####/cd4a306a6fb46b771909812260d4f45c-header
- /data/data/####/cd4a306a6fb46b771909812260d4f45ccache
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
- /data/data/####/com.crashlytics.sdk.android;answers;settings.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.USER_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.google.InstanceId.properties
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak (deleted)
- /data/data/####/com.im.keyValueStore.aes_key_store.xml
- /data/data/####/com.im.keyValueStore.aes_key_store.xml.bak
- /data/data/####/com.im.keyValueStore.batch_processing_info.xml
- /data/data/####/com.im.keyValueStore.coppa_store.xml
- /data/data/####/com.im.keyValueStore.sdk_version_store.xml
- /data/data/####/com.im.keyValueStore.sdk_version_store.xml.bak
- /data/data/####/com.im.keyValueStore.uid_store.xml
- /data/data/####/com.im_9.0.0.db
- /data/data/####/com.im_9.0.0.db-journal
- /data/data/####/com.superman.afs.temp
- /data/data/####/com.superman.alst.temp
- /data/data/####/com.superman.cleanmaster.temp
- /data/data/####/com.superman.flight.temp
- /data/data/####/com.superman.hearing.temp
- /data/data/####/com.superman.hk.temp
- /data/data/####/com.superman.lv.temp
- /data/data/####/com.superman.nhk.temp
- /data/data/####/com.superman.script.temp
- /data/data/####/com.superman.strength.temp
- /data/data/####/com.superman.vision.temp
- /data/data/####/com.vid007.archive.dlso.json
- /data/data/####/com.vid007.archive.vodso.json
- /data/data/####/com.vid007.videobuddy.BETA_VALUES.xml
- /data/data/####/com.vid007.videobuddy_dna.xml
- /data/data/####/com.vid007.videobuddy_preferences.xml
- /data/data/####/com.vid007.videobuddy_preferences.xml.bak
- /data/data/####/com.vid007.videobuddy_prefs.xml
- /data/data/####/com.vid007.videobuddy_prefs.xml.bak
- /data/data/####/crab_app_life.xml
- /data/data/####/crab_crash_1605768971354
- /data/data/####/crab_crash_switch.xml
- /data/data/####/crab_crash_switch.xml.bak (deleted)
- /data/data/####/crab_user_info.xml
- /data/data/####/crash_marker
- /data/data/####/crashrecord.xml
- /data/data/####/cv.xml
- /data/data/####/d319c8ecd4040ba4_0
- /data/data/####/data@app@com.superman.afs__17102.dex
- /data/data/####/data@app@com.superman.alst__17101.dex
- /data/data/####/data@app@com.superman.alst__17101.dex.flock (deleted)
- /data/data/####/data@app@com.superman.cleanmaster__17121.dex
- /data/data/####/data@app@com.superman.cleanmaster__17121.dex.fl...leted)
- /data/data/####/data@app@com.superman.flight__17121.dex
- /data/data/####/data@app@com.superman.flight__17121.dex.flock (deleted)
- /data/data/####/data@app@com.superman.hearing__17104.dex
- /data/data/####/data@app@com.superman.hearing__17104.dex.flock (deleted)
- /data/data/####/data@app@com.superman.hk__17122.dex
- /data/data/####/data@app@com.superman.hk__17122.dex.flock (deleted)
- /data/data/####/data@app@com.superman.lv__17121.dex
- /data/data/####/data@app@com.superman.lv__17121.dex.flock (deleted)
- /data/data/####/data@app@com.superman.nhk__17108.dex
- /data/data/####/data@app@com.superman.nhk__17108.dex.flock (deleted)
- /data/data/####/data@app@com.superman.script__17102.dex
- /data/data/####/data@app@com.superman.script__17102.dex.flock (deleted)
- /data/data/####/data@app@com.superman.strength__17104.dex
- /data/data/####/data@app@com.superman.strength__17104.dex.flock (deleted)
- /data/data/####/data@app@com.superman.vision__17102.dex
- /data/data/####/data@app@com.superman.vision__17102.dex.flock (deleted)
- /data/data/####/default_global_config.json
- /data/data/####/default_me_entry_config.json
- /data/data/####/downloading_bt_play_info.xml
- /data/data/####/downloadlib_update_setting.xml
- /data/data/####/du.lock
- /data/data/####/du_ad_ts.db-journal
- /data/data/####/e21e1403aa6605a0_0
- /data/data/####/events2-journal
- /data/data/####/f48ddf555e600a3c_0
- /data/data/####/f764adcabb7fced728b0069dfe42a3d91252869d25cba4e....0.tmp
- /data/data/####/fe2d9f35513b209f9c83e991f614feef
- /data/data/####/fe2d9f35513b209f9c83e991f614feef-header
- /data/data/####/fiverocks.xml
- /data/data/####/fiverocks.xml.bak
- /data/data/####/follow_manger.xml
- /data/data/####/folow_tabs
- /data/data/####/gameid
- /data/data/####/gameid.zip
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/home_page_feed_page_json_data
- /data/data/####/homepage_response_71fb6c86bd329d0b03ab9928ae86073a
- /data/data/####/hubble_sdk_setting.xml
- /data/data/####/index
- /data/data/####/initialization_marker
- /data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.android.n.xml
- /data/data/####/journal.tmp
- /data/data/####/l_sensor_preference.xml
- /data/data/####/lani.png
- /data/data/####/last_init_crab.xml
- /data/data/####/leo_cm_preference.xml
- /data/data/####/libaplayer_android_1.2.2.327.so
- /data/data/####/libcuid_v3.so
- /data/data/####/libxl_stat.so
- /data/data/####/libxl_thunder_sdk.so
- /data/data/####/libzvje.so
- /data/data/####/libzvje.so-32
- /data/data/####/libzvje.so-64
- /data/data/####/local_crash_lock
- /data/data/####/local_crash_lock (deleted)
- /data/data/####/lock_screen.xml
- /data/data/####/lsb_e__local_last_session.json
- /data/data/####/lsb_e__local_stat_cache.json
- /data/data/####/m_alst.xml
- /data/data/####/m_build_cpt.xml
- /data/data/####/m_wqyg.xml
- /data/data/####/manifest-so.md5
- /data/data/####/map_record.txt
- /data/data/####/metrics_guid
- /data/data/####/mintegral.msdk.db-journal
- /data/data/####/mintegral.xml
- /data/data/####/mintegral.xml.bak
- /data/data/####/native_record_lock
- /data/data/####/native_record_lock (deleted)
- /data/data/####/nhk.db-journal
- /data/data/####/ovm.xml
- /data/data/####/permanent_notification.xml
- /data/data/####/permission_report.xml
- /data/data/####/proc_auxv
- /data/data/####/reg_record.txt
- /data/data/####/rqd_record.eup
- /data/data/####/sa_41c26b6d-f01a-4e80-a4c5-a7d9a06f0a57_1605768970119.tap
- /data/data/####/sa_c309ffd4-6e1b-4df0-907d-ef5744dc54b3_1605768981263.tap
- /data/data/####/sa_pkg_mapping_cfg.db-journal
- /data/data/####/sandboxads_configs.xml
- /data/data/####/search.db-journal
- /data/data/####/search_v_coin.xml
- /data/data/####/security_info
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap (deleted)
- /data/data/####/session_analytics.tap.tmp
- /data/data/####/settings.xml
- /data/data/####/share_date.xml
- /data/data/####/share_date.xml.bak
- /data/data/####/sp_ad_configure.xml
- /data/data/####/sp_mwbsnd.xml
- /data/data/####/sp_mwbsnd.xml.bak
- /data/data/####/sp_push.xml
- /data/data/####/sp_qyejw.xml
- /data/data/####/sp_toovck.xml
- /data/data/####/sp_uqzi.xml
- /data/data/####/sp_uqzi.xml.bak
- /data/data/####/sp_uqzi.xml.bak (deleted)
- /data/data/####/temp
- /data/data/####/the-real-index
- /data/data/####/thunder_tasks.db-journal
- /data/data/####/tjcPrefrences.xml
- /data/data/####/tjcPrefrences.xml.bak (deleted)
- /data/data/####/tomb.zip
- /data/data/####/tomb_1605769017899.txt
- /data/data/####/trhsfdgx.dex (deleted)
- /data/data/####/trhsfdgx.dex.flock (deleted)
- /data/data/####/trhsfdgx.jar
- /data/data/####/userlist.xml
- /data/data/####/v_coin_count_down.xml
- /data/data/####/v_coin_sign_in.xml
- /data/data/####/v_coin_sign_in.xml.bak (deleted)
- /data/data/####/webview_data.lock
- /data/data/####/xl-acc-device-id.xml
- /data/data/####/xl_auth_token.json
- /data/data/####/xl_basic_resolve.json
- /data/data/####/yd_config_c.xml
- /data/data/####/zfgs.xml
- /data/media/####/-1013782810
- /data/media/####/-939952949
- /data/media/####/.0c30da06-5133-42e1-8fde-2f8caa4ed42b.txt
- /data/media/####/.90b7918b-bcfc-476a-8eb2-689104de10c8.txt
- /data/media/####/._android.dat
- /data/media/####/._system.dat
- /data/media/####/.azmh
- /data/media/####/.duid
- /data/media/####/.emb
- /data/media/####/.gjuwpnpjlgwszw
- /data/media/####/.mrq
- /data/media/####/.n_a
- /data/media/####/.n_b
- /data/media/####/.n_c
- /data/media/####/.n_d
- /data/media/####/.nomedia
- /data/media/####/.o_a
- /data/media/####/.xhlc
- /data/media/####/010A49A6E8E3C69CFE25DABA89EDAB8E
- /data/media/####/07FF16DB080F4E65D466A6F207B85F13
- /data/media/####/1415c311e2a71f19ea30b4c16edf10d0.jpg
- /data/media/####/1D302D3E6464EA39840D761291936A8C
- /data/media/####/2897ce76e7a25cd38e9947bf508f4968.jpg
- /data/media/####/2C344A84BF636168885E0702D7E43456
- /data/media/####/2C344A84BF636168885E0702D7E43456.temp
- /data/media/####/2C344A84BF636168885E0702D7E43456.zip
- /data/media/####/4d0b3513f6abb1338739e89468e304b5.jpg
- /data/media/####/5064d5ed7f8698868c06d4b02664ff90.vbdl
- /data/media/####/5AF192A3611C6DCF6210DA03A6013AC0.temp
- /data/media/####/5AF192A3611C6DCF6210DA03A6013AC0.zip
- /data/media/####/678ec189e8eee644216bf6b4f7ca12db.jpg
- /data/media/####/76782189dcaf905f4f69018eb0e4c3d1.vbdl
- /data/media/####/7da5ce418bb4b37533f099dbdcee3be4.png
- /data/media/####/87d0846886e545d55062e4684a076cad.jpg
- /data/media/####/8b209f88036243a8725c66c8f2313886.jpg
- /data/media/####/9298283a1cc2a523f8420e4d02434876.jpg
- /data/media/####/98FDECB17B837318717C64311D2C05D8
- /data/media/####/98FDECB17B837318717C64311D2C05D8.jar
- /data/media/####/98FDECB17B837318717C64311D2C05D8.temp
- /data/media/####/9B29C2F5242C6A564DFEF1DF4F020D57.jar
- /data/media/####/9B29C2F5242C6A564DFEF1DF4F020D57.temp
- /data/media/####/UnityAdsTest.txt
- /data/media/####/UnityAdsTest.txt (deleted)
- /data/media/####/UnityAdsWebApp.html
- /data/media/####/VideoBuddy_12913.apk
- /data/media/####/VideoBuddy_12913.temp
- /data/media/####/_android.dat
- /data/media/####/_system.dat
- /data/media/####/bb9c0786ae90f075ad09193c71483998.jpg
- /data/media/####/c071f115a51789985981417da9cc27a0.jpg
- /data/media/####/com.vid007.archive.dlso-9000-7a81c4f10fd7c13a9...66.zip
- /data/media/####/com.vid007.archive.vodso-13000-9d8376f7881f922...07.zip
- /data/media/####/d9686d62a0064a5c17fff8b3d351d947.jpg
- /data/media/####/de60d53d258649225a1a0ad46fb25afd.vbdl
- /data/media/####/downloads.db
- /data/media/####/downloads.db-journal
- /data/media/####/downloads_extra.db
- /data/media/####/downloads_extra.db-journal
- /data/media/####/duid
- /data/media/####/e6037e806fe23dc93f487bbcfa06ce92.jpg
- /data/media/####/hzx
- /data/media/####/n_a
- /data/media/####/n_b
- /data/media/####/n_c
- /data/media/####/n_d
- /data/media/####/o_a
- /data/media/####/om_js_content.txt
- /data/media/####/permanent_notification.json
- /data/media/####/rwa
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.ybhbn/trhsfdgx.jar --oat-fd=51 --oat-location=/data/user/0/<Package>/.ybhbn/trhsfdgx.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/module/data/module/com.superman.hk__17122/base.dex --oat-fd=34 --oat-location=/data/user/0/<Package>/module/opt/data@app@com.superman.hk__17122.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/pftd/<Package>/vard/98FDECB17B837318717C64311D2C05D8.jar --oat-fd=51 --oat-location=/data/user/0/<Package>/files/98FDECB17B837318717C64311D2C05D8.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/pftd/<Package>/vard/9B29C2F5242C6A564DFEF1DF4F020D57.jar --oat-fd=68 --oat-location=/data/user/0/<Package>/files/9B29C2F5242C6A564DFEF1DF4F020D57.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/qtoag/<Package>/naac/2C344A84BF636168885E0702D7E43456.zip --oat-fd=66 --oat-location=/data/user/0/<Package>/files/2C344A84BF636168885E0702D7E43456.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/qtoag/<Package>/naac/5AF192A3611C6DCF6210DA03A6013AC0.zip --oat-fd=96 --oat-location=/data/user/0/<Package>/files/5AF192A3611C6DCF6210DA03A6013AC0.dex --compiler-filter=speed
- cat /proc/version
- cat /sys/class/net/wlan0/address
- date
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.afs__17102/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.afs__17102.dex --instruction-set=x86 --compiler-filter=interpret-only
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.alst__17101/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.alst__17101.dex --instruction-set=x86 --compiler-filter=interpret-only
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.cleanmaster__17121/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.cleanmaster__17121.dex --instruction-set=x86 --compiler-filter=interpret-only
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.flight__17121/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.flight__17121.dex --instruction-set=x86 --compiler-filter=interpret-only
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.hearing__17104/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.hearing__17104.dex --instruction-set=x86 --compiler-filter=interpret-only
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.lv__17121/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.lv__17121.dex --instruction-set=x86 --compiler-filter=interpret-only
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.nhk__17108/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.nhk__17108.dex --instruction-set=x86 --compiler-filter=interpret-only
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.script__17102/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.script__17102.dex --instruction-set=x86 --compiler-filter=interpret-only
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.strength__17104/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.strength__17104.dex --instruction-set=x86 --compiler-filter=interpret-only
- dex2oat --runtime-arg -classpath --runtime-arg & --dex-file=/data/user/0/<Package>/module/data/module/com.superman.vision__17102/base.dex --oat-file=/data/user/0/<Package>/module/opt/data@app@com.superman.vision__17102.dex --instruction-set=x86 --compiler-filter=interpret-only
- df
- getprop
- getprop ro.board.platform
- getprop ro.build.display.id
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.debuggable
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.smartisan.version
- getprop ro.vivo.os.version
- getprop ro.yunos.build.version
- id
- ip link
- logcat -d -v threadtime -s dalvikvm art zygote zygote64 OpenGLRenderer Bugly-libunwind:S
- logcat -t 1000 -v threadtime Bugly-libunwind:S
- logcat -t 200 -v time
- logcat -v time
- ls -l /system/bin/su
- ls /dev/socket
- ls /system/fonts
- mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
- ps
- service call iphonesubinfo 1
- sh
- sh -c cat /proc/meminfo
- sh -c cat /sys/class/net/eth0/address
- sh -c cd /proc/;cat cpuinfo
- sh -c cd /proc/net/ && cat arp
- sh -c cd /proc/self/;cat status
- sh -c echo MDFEMTkyMzEzODdGN0U2ODgyNjZFRDc5OTk5NTI5QkVlNzNkZDQxODA4YzM0MTQ4YmE3Y2Q4MzQ0YTI3NTI1Nwo= > <SD-Card>/../../../../../..<SD-Card>/.duid
- sh -c echo MDFEMTkyMzEzODdGN0U2ODgyNjZFRDc5OTk5NTI5QkVlNzNkZDQxODA4YzM0MTQ4YmE3Y2Q4MzQ0YTI3NTI1Nwo= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/duid
- sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/.n_a
- sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/.n_b
- sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/.n_c
- sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/.n_d
- sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_a
- sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_b
- sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_c
- sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_d
- sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
- sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/.o_a
- sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
- sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/o_a
- sh -c echo QzZCODhDMEU5QkVDRkZCMENFRjlDMEI3QzQ4M0MwMjdENTAyNDc6NjA5ODU4OjRFQzgwMg== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
- sh -c echo QzZCODhDMEU5QkVDRkZCMENFRjlDMEI3QzQ4M0MwMjdENTAyNDc6NjA5ODU4OjRFQzgwMg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
- which busybox
- which su
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- DES
- RSA
- RSA-ECB-PKCS1Padding
- RSA-ECB-nopadding
- RSA-None-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding
- DES
- RSA-None-PKCS1Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
