Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.Click.345.origin
- Android.DownLoader.1007.origin
- Android.RemoteCode.314.origin
- Android.Triada.4567
- Android.Triada.482.origin
- Android.Triada.510.origin
- Android.Triada.534.origin
- Android.Triada.559.origin
- Android.Triada.563.origin
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) api.a####.ads####.cn:80
- TCP(HTTP/1.1) app.a####.top:80
- TCP(HTTP/1.1) kyy####.wwe####.com:17002
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) xiaox####.adse####.adan####.com:80
- TCP(HTTP/1.1) wa.bu####.vip:80
- TCP(HTTP/1.1) 14.17.1####.182:80
- TCP(HTTP/1.1) r####.bu####.vip:80
- TCP(HTTP/1.1) newap####.math####.cn:80
- TCP(HTTP/1.1) lo.bu####.vip:80
- TCP(HTTP/1.1) api.yunco####.com:80
- TCP(HTTP/1.1) res####.a####.com:80
- TCP(HTTP/1.1) ip####.com:80
- TCP(HTTP/1.1) www.f####.com:80
- TCP(HTTP/1.1) ad.toads####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) 1####.27.70.235:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) flf####.aog####.com:19001
- TCP(HTTP/1.1) j####.g####.vip:80
- TCP(HTTP/1.1) cn.f####.top:8080
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) 78####.cc:80
- TCP(HTTP/1.1) f####.st####.z####.com:80
- TCP(HTTP/1.1) cw####.mintl####.cn:80
- TCP(HTTP/1.1) 2####.186.173.17:8888
- TCP(HTTP/1.1) 1####.76.103.4:28018
- TCP(HTTP/1.1) 1####.77.67.185:28018
- TCP(HTTP/1.1) p####.ugd####.com.####.com:80
- TCP(HTTP/1.1) mg.meit####.com:8071
- TCP(HTTP/1.1) pro.wildpet####.com:80
- TCP(HTTP/1.1) u####.com:80
- TCP(HTTP/1.1) co####.ssp.adoc####.com:80
- TCP(HTTP/1.1) a.78####.cc:80
- TCP(HTTP/1.1) api.adoc####.com:80
- TCP(HTTP/1.1) ssp.k####.com:80
- TCP(HTTP/1.1) 2####.73.129.195:28018
- TCP(HTTP/1.1) pro.wildpet####.com:201
- TCP(HTTP/1.1) 47.95.1####.130:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) down####.baiyuns####.com:80
- TCP(HTTP/1.1) u####.a####.top:80
- TCP(HTTP/1.1) geb####.slj####.com:17001
- TCP(HTTP/1.1) api.z####.com:80
- TCP(HTTP/1.1) sd.bu####.vip:80
- TCP(HTTP/1.1) 1####.201.175.19:80
- TCP(HTTP/1.1) kyy####.wwe####.com:17001
- TCP(HTTP/1.1) jp####.njt####.com:10091
- TCP(HTTP/1.1) p####.api.adoc####.com:80
- TCP(HTTP/1.1) gd.a.s####.com:80
- TCP(HTTP/1.1) kyy####.wwe####.com:18001
- TCP(HTTP/1.1) www.78####.cc:80
- TCP(HTTP/1.1) geb####.slj####.com:17002
- TCP(HTTP/1.1) cl-5307####.g####.co:80
- TCP(HTTP/1.1) 4####.98.31.107:901
- TCP(HTTP/1.1) 52.2####.173.174:80
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) a####.dsa.bd####.com:443
- TCP(TLS/1.0) f####.58.com:443
- TCP(TLS/1.0) tm-####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) lbs.net####.im:443
- TCP(TLS/1.0) a####.d####.com:443
- TCP(TLS/1.0) qy-swa####.qi####.com:443
- TCP(TLS/1.0) s####.e.qq.com:443
- TCP(TLS/1.0) 1####.74.90.25:31828
- TCP(TLS/1.0) api.g####.vip:443
- TCP(TLS/1.0) it####.a####.com.####.net:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) analy####.map.qq.com:443
- TCP(TLS/1.0) alldo####.linx####.com.####.com:443
- TCP(TLS/1.0) di####.b####.net:443
- TCP(TLS/1.0) p####.ugd####.com.####.com:443
- TCP(TLS/1.0) 1713464####.cn-hang####.fc.####.com:443
- TCP(TLS/1.0) dm.tou####.com:443
- TCP(TLS/1.0) otherbd####.x2s####.t####.####.com:443
- TCP(TLS/1.0) sw4.d####.com:443
- TCP(TLS/1.0) 00img####.eas####.com.####.com:443
- TCP(TLS/1.0) 2####.107.1.100:443
- TCP(TLS/1.0) sy.cl####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) mi.g####.qq.com:443
- TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) we####.58.com:443
- TCP(TLS/1.0) trac####.58.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) 74.1####.205.95:443
- TCP(TLS/1.0) 07img####.eas####.com.####.com:443
- TCP(TLS/1.0) j1.5####.com.####.com:443
- TCP(TLS/1.0) res####.a####.com:443
- TCP(TLS/1.0) securit####.sp####.mig.####.net:443
- TCP(TLS/1.0) u####.com:443
- TCP(TLS/1.0) al####.u####.com:443
- TCP(TLS/1.0) jingtai####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) ap1.qi####.com:443
- TCP(TLS/1.0) api16-a####.pa####.io.####.net:443
- TCP(TLS/1.2) 1####.194.73.94:443
- TCP(TLS/1.2) 1####.194.73.95:443
- TCP(TLS/1.2) 64.2####.161.101:443
- TCP 1####.27.113.135:33900
- TCP 1####.27.113.225:33899
- TCP l####.net####.im:8080
Запросы DNS:
- 00img####.eas####.com
- 02img####.eas####.com
- 04img####.eas####.com
- 07img####.eas####.com
- 602.a####.top
- 602.a####.top.####.8
- 653.a####.top
- 653.a####.top.####.8
- 78####.cc
- a####.d####.com
- a####.man.aliy####.com
- a.78####.cc
- ad.toads####.com
- amdc####.m.ta####.com
- analy####.map.qq.com
- and####.b####.qq.com
- ap1.qi####.com
- api.a####.ads####.cn
- api.adoc####.com
- api.g####.vip
- api.yunco####.com
- api.z####.com
- api16-a####.pa####.io
- app.a####.top
- bbt####.wwe####.com
- c####.f####.top
- c####.mm####.com
- c.5####.com.cn
- c.c####.com
- cdn.boo####.com
- cdn.qcv####.cn
- cn.f####.top
- co####.ssp.adoc####.com
- cw####.mintl####.cn
- d####.58.com
- dig.b####.net
- dm.byted####.com
- dm.ps####.com
- dm.tou####.com
- down####.baiyuns####.com
- dwf.linx####.com
- dxp.b####.com
- dy.cn.wildpet####.xyz
- f####.58.com
- f####.st####.z####.com
- flf####.aog####.com
- geb####.slj####.com
- gn####.f####.top
- h####.b####.com
- h####.c####.com
- hm.b####.com
- iji####.pes####.com
- img.5####.com.cn
- ip####.com
- it####.a####.com
- j####.g####.vip
- j1.5####.com.cn
- jingtai####.oss-cn-####.aliy####.com
- jp####.njt####.com
- jump####.58.com
- jxs####.slj####.com
- kyy####.wwe####.com
- l####.58.com
- l####.net####.im
- l####.tbs.qq.com
- lbs.net####.im
- lg.ca####.com
- lhyysdk####.oss-cn-####.aliy####.com
- lla####.slj####.com
- lo.bu####.vip
- mg.meit####.com
- mi.g####.qq.com
- newap####.math####.cn
- now####.pes####.com
- p####.5####.com.cn
- p####.api.adoc####.com
- p####.hfc####.com
- p####.ugd####.com
- pang####.sn####.com
- plb####.u####.com
- pro.wildpet####.com
- pv.s####.com
- q####.qq.com
- qy-swa####.qi####.com
- r####.bu####.vip
- r####.bu####.vip
- r####.wx.qq.com
- res####.a####.com
- res####.a####.top
- s####.e.qq.com
- s4.c####.com
- s9.c####.com
- s96.c####.com
- sd.bu####.vip
- sf3-fe####.pglstat####.com
- sf3-ttc####.ps####.com
- ssp.k####.com
- sw4.d####.com
- sy.cl####.com
- t####.a####.top
- t####.m.qq.com
- tm-####.oss-cn-####.aliy####.com
- to####.ctobsn####.com
- trac####.58.com
- tys####.wwe####.com
- u####.a####.top
- u####.com
- u####.u####.com
- umen####.m.ta####.com
- umengj####.m.ta####.com
- v1.c####.com
- wa.bu####.vip
- we####.58.com
- www.78####.cc
- www.f####.com
- xh.ma####.com
- xiaox####.adse####.adan####.com
- ycb####.slj####.com
- yun.b####.com
- z12.c####.com
- z2.c####.com
- z3.c####.com
- z6.c####.com
Запросы HTTP GET:
- 78####.cc/index/count/count_shell?shellname=####
- a.78####.cc/index/upapp/app_datas?upapp_id=####&imei=####&channel_id=####
- api.a####.ads####.cn/thirdparty/sapi/callback?cid=####&adspaceid=####&mc...
- api.z####.com/v1/advert/config?platform=####&versionCode=####×tamp=...
- app.a####.top/anshuaControl.json
- app.a####.top/api.json
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/z_stat.php?id=####&web_id=####
- cl-5307####.g####.co/p14_01.ttf
- cl-5307####.g####.co/p28_09.ttf
- cl-5307####.g####.co/p3_02.ttf
- cn.f####.top:8080/qsad/api/getAd/jSgmbuon650qyNjGUVuLZg==
- co####.ssp.adoc####.com/api/v2/SDKActiveConfig?version=####&channelCode=...
- co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
- co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
- co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
- cw####.mintl####.cn/c/12Y7TDHJSTY.zip
- cw####.mintl####.cn/c/TervaiDur.zip
- cw####.mintl####.cn/c/jz/elqsydt.zip
- cw####.mintl####.cn/c/l/11Y24jsbuliang.zip
- cw####.mintl####.cn/c/l/11Y30JUHEKOULING.zip
- cw####.mintl####.cn/c/oiasdnequw.zip
- cw####.mintl####.cn/two/SOI349RED8EO35RE98FE359E844T9R.zip
- cw####.mintl####.cn/u/qwertyuask.zip
- down####.baiyuns####.com/static/default.css
- down####.baiyuns####.com/static/index.js
- down####.baiyuns####.com/static/logo_40.png
- f####.st####.z####.com/php12123/03900daf4277d586d8954ac206d479cc.jpg
- f####.st####.z####.com/php12123/0a2c8486fc98e3fc2945462cead89386.png
- f####.st####.z####.com/php12123/20190319/1d0ad428ee3db572f8d7dc9caf5318a...
- f####.st####.z####.com/php12123/24f87b460ec4e6ca966c3692edc8cd00.jpg
- f####.st####.z####.com/php12123/26b2583c6409ef5c73da511bde19e5c9.png
- f####.st####.z####.com/php12123/2f4b9f425c93b7cffcb4e3a390c34f66.png
- f####.st####.z####.com/php12123/579184f08ba1dfa1ff0516443b809eae.jpg
- f####.st####.z####.com/php12123/9238f5e7e2ae2bb9d4c54f3626f57043.png
- f####.st####.z####.com/php12123/a090b59461ec2f39c49b972a51a622e3.png
- f####.st####.z####.com/php12123/b923d47945e1931a97b0d84980bacb7e.jpg
- f####.st####.z####.com/php12123/b94d24874b874867140d16d8a0224383.png
- f####.st####.z####.com/php12123/bb34ad448e50f3ccb7fceea9d0fc00f0.png
- f####.st####.z####.com/php12123/e2c51eff44598107d3404f290051f9f4.jpg
- f####.st####.z####.com/php12123/e5b26ebf3720c717b9dafd685f816fe5.png
- f####.st####.z####.com/php12123/ec137e054372b08acb387ca7f4cadbe6.png
- f####.st####.z####.com/php12123/f048ab95be2eb0d52523606bf7e43108.png
- gd.a.s####.com/cityjson?ie=####
- ip####.com/json/?lang=####
- j####.g####.vip/fd.js
- lo.bu####.vip/v1/log/track?key=####&mtype=####&device_####&pkg=####&subi...
- newap####.math####.cn/ssp/mgm/task?taskId=####&ip=####
- p####.api.adoc####.com/ip
- p####.ugd####.com.####.com/gdt/0/EABCILyAQ4AeAAAAgBFBfSLlOCO3RH8o1.jpg/0...
- r####.bu####.vip/assets/bdtj/clipboard102.html?hmsr=####&hmpl=####
- r####.bu####.vip/assets/bdtj/it8.html?hmsr=####&hmpl=####
- r####.bu####.vip/assets/bdtj/ppt.html?hmsr=####&hmpl=####&hmcu=####
- r####.bu####.vip/assets/cnzz/clipboard102.html
- r####.bu####.vip/favicon.ico
- sd.bu####.vip/v1/log/track?key=####&mtype=####&device_####&pkg=####&subi...
- u####.a####.top/653.html
- u####.a####.top/js1002.html
- u####.com/tkio/2aM7Jna
- www.78####.cc/index/param/get_param?pro_name=####
- www.78####.cc/index/project/project_status?action=####
- www.78####.cc/index/publics/get_ip
- www.f####.com/search/6761722d323535_1.html
- www.f####.com/static/js/dist/clipboard.min.js
- z.c####.com/stat.htm?id=####&cnzz_eid=####
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- ad.toads####.com/api/angent
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- and####.b####.qq.com/rqd/async?aid=####
- api.a####.ads####.cn/thirdparty/sapi/chn
- api.adoc####.com/titan/monitor/device_info
- api.yunco####.com/service/rest
- api.z####.com/app/version/android-upgrade
- api.z####.com/push-tag/list
- api.z####.com/tab-conf/app-column-conf
- api.z####.com/tab-conf/app-sys-conf
- api.z####.com/tab-conf/uuid
- api.z####.com/tips/index
- api.z####.com/v1/advert/list
- api.z####.com/v1/news/list
- api.z####.com/v1/news/type
- cn.f####.top:8080/qsad/api/c/c
- flf####.aog####.com:19001/tchvohfkyf/
- geb####.slj####.com:17001/an2y3z/
- geb####.slj####.com:17001/karawc/
- geb####.slj####.com:17002/5rhxg/
- jp####.njt####.com:10091/wisdom/marking
- kyy####.wwe####.com:17001/cbcvu9/
- kyy####.wwe####.com:17001/karawc/
- kyy####.wwe####.com:17002/6a4it/
- kyy####.wwe####.com:17002/jw1pw/
- kyy####.wwe####.com:18001/begzf1/
- kyy####.wwe####.com:18001/w0619s/
- l####.tbs.qq.com/ajax?c=####&k=####
- mg.meit####.com:8071/api/v101
- pro.wildpet####.com/dycn/update
- pro.wildpet####.com:201/proxy/get?e=####&r=####
- res####.a####.com/v3/weather/weatherInfo
- s####.e.qq.com/activate
- s####.e.qq.com/launch
- sd.bu####.vip/v1/project/sdk
- ssp.k####.com/api/useful
- wa.bu####.vip/v1/wake/list
- www.78####.cc/index/backend/pro_data
- www.78####.cc/index/publics/put_text3
- xiaox####.adse####.adan####.com/server/ad/v1
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-1135038580-754662270
- /data/data/####/.imprint
- /data/data/####/.turing.dat
- /data/data/####/0030fdc98a551171_0
- /data/data/####/035d580666ca2be0_0
- /data/data/####/0bb8920827c1385e_0
- /data/data/####/0bb8920827c1385e_1
- /data/data/####/0e92f310e8edc19f_0
- /data/data/####/1002
- /data/data/####/1004
- /data/data/####/105498_auMini_1
- /data/data/####/1385302404954.0
- /data/data/####/1416f4da233ec65233b16f4a6f686f16.temp
- /data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
- /data/data/####/1dadeeaab69e7c21_0
- /data/data/####/1ebc280ebda9fd96_0
- /data/data/####/24f7d3db6eaaa22a_0
- /data/data/####/28522ea405c6c597_0 (deleted)
- /data/data/####/29857e5b185b6c8f_0
- /data/data/####/29857e5b185b6c8f_0 (deleted)
- /data/data/####/29857e5b185b6c8f_1
- /data/data/####/29c7af28fc510cdc_0
- /data/data/####/2EC68123E317AA1FD3F2E11EBECF4D88.xml
- /data/data/####/2a0096605d23fb0f_0
- /data/data/####/2e0dd1b88e948719_0
- /data/data/####/2ed6b12b9982b325_0
- /data/data/####/2ed6b12b9982b325_1
- /data/data/####/32DpkDWPxC6Ik6J7me6dObt1fYs.cnt
- /data/data/####/336b8a40c156a00e_0
- /data/data/####/385E7FA9A763AF89E661BD99B4A389AC.dex
- /data/data/####/385E7FA9A763AF89E661BD99B4A389AC.dex.flock (deleted)
- /data/data/####/3A0BC3C0D4BC531841993226451CFE45.xml
- /data/data/####/3bb3241b1701c875_0
- /data/data/####/3f27ff11f319f8b7_0
- /data/data/####/3yx2RLa1TWiwf7IdvA-zz88uUfE.1622130028.tmp
- /data/data/####/401f577af1d806e0_0
- /data/data/####/40f3f98d125a9521_0
- /data/data/####/43087a53e410e552_0
- /data/data/####/43087a53e410e552_1
- /data/data/####/481b0863c157dae7_0
- /data/data/####/48ac58e2be5926f2_0
- /data/data/####/49384455503186.0
- /data/data/####/494e1d29ab576214_0
- /data/data/####/49e07fd91277756d_0
- /data/data/####/4dfeeca76a29fc95_0 (deleted)
- /data/data/####/4ec52135bee15690_0
- /data/data/####/53f86ed1cfb5eb5d_0
- /data/data/####/54ee9cc5c8694637_0
- /data/data/####/55D7BCC60A702BAE5286696DA6D7F6E4.dex
- /data/data/####/55D7BCC60A702BAE5286696DA6D7F6E4.dex.flock (deleted)
- /data/data/####/57045d104923a588_0 (deleted)
- /data/data/####/5984d3d8916af0fe_0
- /data/data/####/599d8f58e7422d2a_0
- /data/data/####/599d8f58e7422d2a_1
- /data/data/####/5ddb31136855e5d4_0
- /data/data/####/5e96da3275a94481_0
- /data/data/####/5e96da3275a94481_1
- /data/data/####/5eca177b72a5020c_0
- /data/data/####/5eca177b72a5020c_0 (deleted)
- /data/data/####/5eca177b72a5020c_1
- /data/data/####/5fd5e8aec90dad98_0
- /data/data/####/61380216603748.0
- /data/data/####/62c478aa049580ec_0
- /data/data/####/63f04198d94599bd_0
- /data/data/####/689d0538d1d34e1e8901eeef228f6ce2
- /data/data/####/6KrF430qkev7p2rSKCHETnJZPKE.2085990867.tmp
- /data/data/####/6c3f8473ad9fc9e9_0
- /data/data/####/6f4579bceb23fe45_0
- /data/data/####/727367beab4afc59_0
- /data/data/####/74380810972659.0
- /data/data/####/7LrAIiDPBVumNYftpBqHGGHvLbY.1683939858.tmp
- /data/data/####/7ZVNIofUmwqcQsVXA3DP5kAUMks.1505961869.tmp
- /data/data/####/7a9180e0ed6bbe19_0
- /data/data/####/7a9f0dd021841056_0 (deleted)
- /data/data/####/7b4664be39e47982_0
- /data/data/####/7ba9a9db263108523469055fe693c18c
- /data/data/####/7ba9a9db263108523469055fe693c18c (deleted)
- /data/data/####/7bb1e9c388f8b5d3_0
- /data/data/####/7bb1e9c388f8b5d3_1
- /data/data/####/7f2abbdfc7988c34_0
- /data/data/####/80503487acbc8f45_0
- /data/data/####/80503487acbc8f45_1
- /data/data/####/8327f78368c29d2b_0
- /data/data/####/8327f78368c29d2b_1
- /data/data/####/875219b738ad05bc_0
- /data/data/####/890ea028e4f82409_0
- /data/data/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.dex
- /data/data/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.dex.flock (deleted)
- /data/data/####/8EAD111D030291821E19A80E344C340A.xml
- /data/data/####/8b60a217e15e648f_0
- /data/data/####/8e926e49204b543d_0
- /data/data/####/8e988d96c6a77848d6e8765280690a75
- /data/data/####/983192334df152ac_0
- /data/data/####/9B060EC94F8A7CCEA899EA8436E636EA.dex
- /data/data/####/9B060EC94F8A7CCEA899EA8436E636EA.dex.flock (deleted)
- /data/data/####/9bc670b294adfcbda65bf11397a1975a.temp
- /data/data/####/9edf934c462f262c_0
- /data/data/####/9f849b7688d69a1a_0
- /data/data/####/A2718DA4862E9DAE5851B4034FDE2192.dex
- /data/data/####/A2718DA4862E9DAE5851B4034FDE2192.dex.flock (deleted)
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK.xml.bak
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml.bak
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alvin2.xml
- /data/data/####/BUGLY_COMMON_VALUES.xml
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/CCCC5B8911BBCB224E5317F7FB929A12.dex
- /data/data/####/CCCC5B8911BBCB224E5317F7FB929A12.dex.flock (deleted)
- /data/data/####/ContextData.xml
- /data/data/####/Cookies-journal
- /data/data/####/CprPt.dex
- /data/data/####/CprPt.dex.flock (deleted)
- /data/data/####/CprPt.jar
- /data/data/####/D75E99C9A338D24A1F840F280B0877ED.dex
- /data/data/####/D75E99C9A338D24A1F840F280B0877ED.dex.flock (deleted)
- /data/data/####/D967A959D8E39AF63D48D9EACAEC1F70.dex
- /data/data/####/D967A959D8E39AF63D48D9EACAEC1F70.dex.flock (deleted)
- /data/data/####/Databases.db-journal
- /data/data/####/DuKVLvGWnIZwLKihT-L8Ad7tIvs.116536087.tmp
- /data/data/####/ER1GHkW_jNdSUAxruG7BhOT0Hlw.1245318203.tmp
- /data/data/####/Emp.xml
- /data/data/####/Emp.xml.bak
- /data/data/####/Emp.xml.bak (deleted)
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/HFdipWo9iSzVXK6BtMXSnA43y5E.438579542.tmp
- /data/data/####/Ix132mMskey1.xml
- /data/data/####/Ix132mMtasks.xml
- /data/data/####/Ix132mMtasks.xml.bak
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/NIMSDK_Config_f7274dbc6d1b56317a1437bb9d42f596.xml
- /data/data/####/NIMSDK_Config_f7274dbc6d1b56317a1437bb9d42f596_...d4.xml
- /data/data/####/OFItoHZPl0UsZW1m15lgbnJybRE.265862337.tmp
- /data/data/####/PROXYDATA.xml
- /data/data/####/PROXYDATA.xml.bak
- /data/data/####/PiR2ehSmMlFyCkuKDMjEvd-v4kk.158158329.tmp
- /data/data/####/QuotaManager-journal
- /data/data/####/Sb29GLRLarhEigvSDKipCSZ3IQ8.1555852133.tmp
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/Unicorn.f7274dbc6d1b56317a1437bb9d42f596.xml
- /data/data/####/Unicorn.f7274dbc6d1b56317a1437bb9d42f596.xml.bak
- /data/data/####/VUgwE5xJtoENdWu_r7ustPGhjPk.291431590.tmp
- /data/data/####/WebViewBasePrefs.xml
- /data/data/####/WebViewBasePrefs.xml.bak
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/ZH503.dex
- /data/data/####/ZH503.dex.flock (deleted)
- /data/data/####/ZH503.jar
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/___rb.p12___
- /data/data/####/__cid__v1__.dat
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/__rbpr_up18__
- /data/data/####/__send_data_1611435339844
- /data/data/####/_p.xml
- /data/data/####/_sh.xml
- /data/data/####/a0bb8befca0fcf21_0
- /data/data/####/a13168f032ffdbfb_0
- /data/data/####/a1361580668b5da2_0
- /data/data/####/a19677a629e00ac3_0
- /data/data/####/a4310967445f53ad_0
- /data/data/####/a52378a1b9c20b8b_0
- /data/data/####/a607bc0033142622_0
- /data/data/####/a607bc0033142622_1
- /data/data/####/a60813a98041e5e4_0
- /data/data/####/a6d6e4a7cafe62e342c8d78e76f8571b
- /data/data/####/a952021ba7c28fdb_0
- /data/data/####/ab413a0348d40dcb_0
- /data/data/####/ab9f03d66e586bf5_0
- /data/data/####/ab9f03d66e586bf5_1
- /data/data/####/accs.db-journal
- /data/data/####/adinitdex.xml
- /data/data/####/af92a9ba60c94063b807c79a15c9b9ce
- /data/data/####/agoo.pid
- /data/data/####/ahq_spu_ti.xml
- /data/data/####/appuserid.xml
- /data/data/####/b12a12d8d0cbb5d3_0
- /data/data/####/b350550ea93625e4_0
- /data/data/####/b43777b3a37c98b0_0
- /data/data/####/b96dd64ece75b9682b0863fbf4ebb8bb.0
- /data/data/####/bac583bc0497fb9d_0 (deleted)
- /data/data/####/baed1190b959dbc2_0 (deleted)
- /data/data/####/baidu_mtj_sdk_record.xml
- /data/data/####/bcad57c0b4d0e6af_0
- /data/data/####/bd_embed_tea_agent.db-journal
- /data/data/####/be0fa7a5c3d2475e_0
- /data/data/####/be18eddcba8c4e79e761c913fbe81d34.temp
- /data/data/####/bugly_db_-journal
- /data/data/####/c1ffe0b6981fdebf_0
- /data/data/####/c731d7a0eabcfd2b_0
- /data/data/####/c83e0abf80ea8354_0
- /data/data/####/cV1beyozyQCzIpj0vWfNOhB7HkQ.651654433.tmp
- /data/data/####/cac3f7c6bcf46bbb_0
- /data/data/####/ccd0394cbe518deb_0
- /data/data/####/ccd0394cbe518deb_1
- /data/data/####/cdfb191e22a2beb4_0
- /data/data/####/cdu_st_-1897404729
- /data/data/####/cdu_st_-1963733048
- /data/data/####/cdu_st_-724289219
- /data/data/####/cdu_st_-752754616
- /data/data/####/cdu_st_1495260626
- /data/data/####/cdu_st_1606883332
- /data/data/####/cdu_st_465275389
- /data/data/####/cdu_st_759790841
- /data/data/####/ce6b85216491be9c6960dbbe14aeec9e
- /data/data/####/channel_umeng_common_config.xml
- /data/data/####/chuanglan_report_2.2.1.db
- /data/data/####/chuanglan_report_2.2.1.db-journal
- /data/data/####/cmwnuonk.dex (deleted)
- /data/data/####/cmwnuonk.dex.flock (deleted)
- /data/data/####/cmwnuonk.jar
- /data/data/####/com.qiyukf.analytics.xml
- /data/data/####/com.qq.e.sdkconfig.xml
- /data/data/####/com.wswy.wzcx.BETA_VALUES.xml
- /data/data/####/com.wswy.wzcx.BETA_VALUES.xml.bak
- /data/data/####/com.wswy.wzcx_preferences.xml
- /data/data/####/commsdoisfkf.xml
- /data/data/####/commsdoisfkf.xml.bak
- /data/data/####/comwroteogigeoig.xml
- /data/data/####/comxcxid.xml
- /data/data/####/config
- /data/data/####/core_info
- /data/data/####/core_umeng_common_config.xml
- /data/data/####/countApi.xml
- /data/data/####/crashrecord.xml
- /data/data/####/d1EU5aaqIAA0B8WaThMJFIj3GUg.2022278965.tmp
- /data/data/####/d284e4ac30119cd3_0 (deleted)
- /data/data/####/d479e100ca70bb5e_0
- /data/data/####/d586008fde470a73_0
- /data/data/####/d7652769b53d1803_0
- /data/data/####/d7a14e30636d52e10b35d10c02578019
- /data/data/####/d80d874d3d232f5d_0 (deleted)
- /data/data/####/dW1weF9pbnRlcm5hbF8xNjExNDM1MzMyNjI4;
- /data/data/####/data.m
- /data/data/####/db1a9d0cead13e06_0
- /data/data/####/db1a9d0cead13e06_1
- /data/data/####/dd72dac79507c9d9_0
- /data/data/####/de6fc6e6d00bdf773ac85456213ada55.temp
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/download_upload
- /data/data/####/downloader.db-journal
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/e0bce42ac2385c60_0
- /data/data/####/e5eae7927a3c2e75_0
- /data/data/####/e5eae7927a3c2e75_0 (deleted)
- /data/data/####/e60b058c9080fc35_0
- /data/data/####/e60b058c9080fc35_1
- /data/data/####/e710ce1cf33437c4_0
- /data/data/####/e710ce1cf33437c4_1
- /data/data/####/e799e41aabef6f31_0
- /data/data/####/e85353d64db1469a_0
- /data/data/####/eHhkX3Nw.xml
- /data/data/####/ea0d0eafb0634f1f_0
- /data/data/####/ec48404aa71d0954_0
- /data/data/####/ef3f252ad2784b7a_0 (deleted)
- /data/data/####/embed_applog_stats.xml
- /data/data/####/embed_header_custom.xml
- /data/data/####/embed_last_sp_session.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f43ffc1e6af67458_0
- /data/data/####/f585feacbc0fcd6c_0
- /data/data/####/f70f823c021b4355_0
- /data/data/####/fas.xml
- /data/data/####/fas.xml.bak
- /data/data/####/fbf46f66e5f47e81_0
- /data/data/####/fd49456b1b748d98_0
- /data/data/####/gameid
- /data/data/####/gameid.zip
- /data/data/####/gank_device_id.xml.xml
- /data/data/####/gdt_config.cfg
- /data/data/####/gdt_download.db
- /data/data/####/gdt_download.db-journal
- /data/data/####/gdt_stat.db
- /data/data/####/gdt_stat.db-journal
- /data/data/####/gdt_suid
- /data/data/####/he1G7TGf5qtNWIpHChVJj3pNOnA.108322780.tmp
- /data/data/####/hmdb
- /data/data/####/hmdb-journal
- /data/data/####/http_umeng.acw88.top_0.localstorage-journal
- /data/data/####/httpdns_config_cache.xml
- /data/data/####/httpdns_config_cache.xml.bak
- /data/data/####/https_facai.58.com_0.localstorage (deleted)
- /data/data/####/https_facai.58.com_0.localstorage-journal
- /data/data/####/https_luna.58.com_0.localstorage-journal
- /data/data/####/hxdata.xml
- /data/data/####/i==1.2.0&&3.8.3_1611435332632_envelope.log
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/jcp12003984.apk
- /data/data/####/jcp12003984_o
- /data/data/####/jcp12003984_o.flock (deleted)
- /data/data/####/journal
- /data/data/####/journal.tmp
- /data/data/####/k.store
- /data/data/####/kDUB0ypHpgxf5XkltPTnJn5G5n4.1847280379.tmp
- /data/data/####/kk_datas_info.xml
- /data/data/####/km01
- /data/data/####/km09_4951.so
- /data/data/####/km09_4951.so_tmp
- /data/data/####/km13
- /data/data/####/kms_02ext
- /data/data/####/kw_133069
- /data/data/####/kw_133069_tmp (deleted)
- /data/data/####/libCtaApiLib.so
- /data/data/####/libMMANDKSignature.so
- /data/data/####/libShanYCore.so
- /data/data/####/libcocklogic-1.1.3.so
- /data/data/####/libcuid.so
- /data/data/####/libgifimage.so
- /data/data/####/libimagepipeline.so
- /data/data/####/libkm05.so
- /data/data/####/libkm05_64.so
- /data/data/####/libnative-filters.so
- /data/data/####/libnative-imagetranscoder.so
- /data/data/####/libnms.so
- /data/data/####/libnnc.so
- /data/data/####/libnthjvo.so
- /data/data/####/libnthjvo.so-32
- /data/data/####/libnthjvo.so-64
- /data/data/####/libpf
- /data/data/####/libpl_droidsonroids_gif.so
- /data/data/####/libtnet-3.1.14.so
- /data/data/####/libtobEmbedEncrypt.so
- /data/data/####/libturingau.so
- /data/data/####/libyaqcore_gdtadv.so
- /data/data/####/libyaqstub_gdtadv.so
- /data/data/####/local_crash_lock
- /data/data/####/local_crash_lock (deleted)
- /data/data/####/logdb.db
- /data/data/####/logdb.db-journal
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/metrics_guid
- /data/data/####/mok.xml
- /data/data/####/mp28.tmp
- /data/data/####/mp3.tmp
- /data/data/####/mpdc_105498_1
- /data/data/####/msg.db-journal
- /data/data/####/mtaois.png
- /data/data/####/myconfig.xml
- /data/data/####/myconfig.xml.bak
- /data/data/####/nFp9byL9T2PMuHlffpObyB75Jws.1726214131.tmp
- /data/data/####/native_record_lock (deleted)
- /data/data/####/npth.xml
- /data/data/####/npth_log.db-journal
- /data/data/####/pQndFLQb0_FwLLriPzPDLlPoWlo.41374406.tmp
- /data/data/####/pp-Pl0vwwRC9G47uAHMHH2DheUg.489244837.tmp
- /data/data/####/preload
- /data/data/####/proc_auxv
- /data/data/####/qiyu_save_f7274dbc6d1b56317a1437bb9d42f596.xml
- /data/data/####/qqsz_file.xml
- /data/data/####/qqsz_file.xml.bak
- /data/data/####/rjf932161.apk
- /data/data/####/rjf932161_o
- /data/data/####/rjf932161_o.flock (deleted)
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/sdkinit.xml
- /data/data/####/sdkinit.xml.bak
- /data/data/####/security_info
- /data/data/####/shanyan_share_data.xml
- /data/data/####/shanyan_share_data.xml.bak
- /data/data/####/simple-main-req.dat
- /data/data/####/snssdk_openudid.xml
- /data/data/####/sp2.dex.flock (deleted)
- /data/data/####/sp2.jar
- /data/data/####/sp28.dex
- /data/data/####/sp28.dex.flock (deleted)
- /data/data/####/sp28.jar
- /data/data/####/sp3.dex
- /data/data/####/sp3.dex.flock (deleted)
- /data/data/####/sp3.jar
- /data/data/####/spUtils.xml
- /data/data/####/sp_name.xml
- /data/data/####/sp_name.xml.bak
- /data/data/####/sp_push_time.xml
- /data/data/####/spu_ti.xml
- /data/data/####/spu_yj.xml
- /data/data/####/ssoconfigs.xml
- /data/data/####/t7uJ9ZL2H1ammmF1d1Fx3Esfcqk.1497404035.tmp
- /data/data/####/t==8.1.2&&3.8.3_1611435334024_envelope.log
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_config.xml.bak
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbs_pv_config
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/the-real-index
- /data/data/####/trace_circle.data
- /data/data/####/tt_ad_sdk_sp.xml
- /data/data/####/tt_dns_settings.xml
- /data/data/####/tt_sdk_settings.xml
- /data/data/####/tt_sdk_settings.xml.bak
- /data/data/####/tt_sp_app_list.xml
- /data/data/####/tt_sp_app_list.xml.bak
- /data/data/####/ttopenadsdk.xml
- /data/data/####/ttopenadsdk.xml.bak
- /data/data/####/ttopensdk.db-journal
- /data/data/####/turingfd_conf_105498_auMini.xml
- /data/data/####/turingfd_conf_105498_auMini.xml.bak
- /data/data/####/turingfd_conf_105498_auMini.xml.bak (deleted)
- /data/data/####/turingfd_protect_105498_47_auMini.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_common_location.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/umengc.db
- /data/data/####/unicorn#cheese#
- /data/data/####/update_lc
- /data/data/####/upz_5
- /data/data/####/wBrand.xml
- /data/data/####/weizhangapp.xml
- /data/data/####/weizhangapp.xml.bak
- /data/data/####/xdtversion.xml
- /data/data/####/yd_config_c.xml
- /data/data/####/z-a6KWwyo6Ovkk5TcZdRmCXTcBs.2080893162.tmp
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.confd
- /data/media/####/.confd-journal
- /data/media/####/.did
- /data/media/####/.kkid
- /data/media/####/.nid
- /data/media/####/.timestamp
- /data/media/####/.turing.dat
- /data/media/####/.umm.dat
- /data/media/####/.usdis
- /data/media/####/1611435343732.db
- /data/media/####/1c780418d96f66cadad7c03545cdd706.tmp
- /data/media/####/385E7FA9A763AF89E661BD99B4A389AC (deleted)
- /data/media/####/385E7FA9A763AF89E661BD99B4A389AC.jar
- /data/media/####/385E7FA9A763AF89E661BD99B4A389AC.temp
- /data/media/####/47FEE291DE9632708B158D0CB085EE66
- /data/media/####/55D7BCC60A702BAE5286696DA6D7F6E4
- /data/media/####/55D7BCC60A702BAE5286696DA6D7F6E4.temp
- /data/media/####/55D7BCC60A702BAE5286696DA6D7F6E4.zip
- /data/media/####/7256A17995AA65F989B6622B9B448418
- /data/media/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE
- /data/media/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.temp
- /data/media/####/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.zip
- /data/media/####/9B060EC94F8A7CCEA899EA8436E636EA
- /data/media/####/9B060EC94F8A7CCEA899EA8436E636EA.temp
- /data/media/####/9B060EC94F8A7CCEA899EA8436E636EA.zip
- /data/media/####/9e5da8c0b3049a08cdbe910d66cd0b0e.tmp
- /data/media/####/A2718DA4862E9DAE5851B4034FDE2192
- /data/media/####/A2718DA4862E9DAE5851B4034FDE2192.temp
- /data/media/####/A2718DA4862E9DAE5851B4034FDE2192.zip
- /data/media/####/AA3AC224E846BAE7653E4BF402AF8019
- /data/media/####/Alvin2.xml
- /data/media/####/C2BCE207F8DC95728EE62069E6A30887
- /data/media/####/C428E4BC6FBA4CC143BD8F028EF43452
- /data/media/####/CCCC5B8911BBCB224E5317F7FB929A12
- /data/media/####/CCCC5B8911BBCB224E5317F7FB929A12.jar
- /data/media/####/CCCC5B8911BBCB224E5317F7FB929A12.temp
- /data/media/####/ContextData.xml
- /data/media/####/D0AECBFDEEC2125A8DD4A844CBE9938B
- /data/media/####/D75E99C9A338D24A1F840F280B0877ED
- /data/media/####/D75E99C9A338D24A1F840F280B0877ED.temp
- /data/media/####/D75E99C9A338D24A1F840F280B0877ED.zip
- /data/media/####/D967A959D8E39AF63D48D9EACAEC1F70
- /data/media/####/D967A959D8E39AF63D48D9EACAEC1F70.temp
- /data/media/####/D967A959D8E39AF63D48D9EACAEC1F70.zip
- /data/media/####/_pn
- /data/media/####/_shn
- /data/media/####/alsn20170807.db
- /data/media/####/alsn20170807.db-journal
- /data/media/####/meta.dat
- /data/media/####/tbslog.txt
- /data/media/####/temp_pkg_info.json
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /proc/4951/exe
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.mqglg/cmwnuonk.jar --oat-fd=270 --oat-location=/data/user/0/<Package>/.mqglg/cmwnuonk.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_xddd/p28/sp28.jar --oat-fd=220 --oat-location=/data/user/0/<Package>/app_xddd/p28/sp28.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_xddd/p3/sp3.jar --oat-fd=128 --oat-location=/data/user/0/<Package>/app_xddd/p3/sp3.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/jcp12003984.apk --oat-fd=120 --oat-location=/data/user/0/<Package>/files/jcp12003984_o --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/rjf932161.apk --oat-fd=140 --oat-location=/data/user/0/<Package>/files/rjf932161_o --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tda/ZH503.jar --oat-fd=149 --oat-location=/data/user/0/<Package>/files/tda/ZH503.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tda/ZH503.jar --oat-fd=212 --oat-location=/data/user/0/<Package>/files/tda/ZH503.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/385E7FA9A763AF89E661BD99B4A389AC.jar --oat-fd=231 --oat-location=/data/user/0/<Package>/files/385E7FA9A763AF89E661BD99B4A389AC.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/55D7BCC60A702BAE5286696DA6D7F6E4.zip --oat-fd=256 --oat-location=/data/user/0/<Package>/files/55D7BCC60A702BAE5286696DA6D7F6E4.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.zip --oat-fd=234 --oat-location=/data/user/0/<Package>/files/8E9A20EC5272B8CE23E7EA5D5F8ABBFE.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/9B060EC94F8A7CCEA899EA8436E636EA.zip --oat-fd=140 --oat-location=/data/user/0/<Package>/files/9B060EC94F8A7CCEA899EA8436E636EA.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/A2718DA4862E9DAE5851B4034FDE2192.zip --oat-fd=212 --oat-location=/data/user/0/<Package>/files/A2718DA4862E9DAE5851B4034FDE2192.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/CCCC5B8911BBCB224E5317F7FB929A12.jar --oat-fd=134 --oat-location=/data/user/0/<Package>/files/CCCC5B8911BBCB224E5317F7FB929A12.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/D75E99C9A338D24A1F840F280B0877ED.zip --oat-fd=289 --oat-location=/data/user/0/<Package>/files/D75E99C9A338D24A1F840F280B0877ED.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/D967A959D8E39AF63D48D9EACAEC1F70.zip --oat-fd=270 --oat-location=/data/user/0/<Package>/files/D967A959D8E39AF63D48D9EACAEC1F70.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=<Package Folder>/extfiles/CprPt.jar --oat-fd=245 --oat-location=<Package Folder>/extfiles/CprPt.dex --compiler-filter=speed
- /system/bin/df
- /system/bin/getprop
- /system/lib/arm/houdini <Package Folder>/files/kw_133069 <Package Folder>/files/kw_133069 3 267887
- cat /proc/version
- cat /sys/class/net/wlan0/address
- chmod 777 /data/user/0/<Package>/cache/Download
- getprop
- getprop ro.board.platform
- getprop ro.build.display.id
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.letv.release.version
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.smartisan.version
- getprop ro.vivo.os.build.display.id
- getprop ro.vivo.os.version
- getprop ro.yunos.build.version
- logcat -d -v threadtime
- ls -l /system/bin/su
- ls /
- ls /sys/class/thermal
- mount
- sh -c <Package Folder>/files/kw_133069 3 267887 &
- sh -c cat /proc/4974/maps
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES
- DES-CBC-PKCS5Padding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-None-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- DES
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-None-PKCS1Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию о настроках APN.
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
