Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pub-####.qin####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) st####.re####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) img.re####.com:80
- TCP(HTTP/1.1) nav.cn.ron####.com:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) app.re####.com:80
- TCP(TLS/1.0) s####.cn.ron####.com:443
- TCP 1####.92.122.155:8609
- TCP c####.g####.ig####.com:5225
- TCP sdk.o####.t####.####.com:5224
- 7j####.c####.z0.####.com
- a####.u####.com
- and####.b####.qq.com
- app.re####.com
- c####.g####.ig####.com
- c-h####.g####.com
- img.re####.com
- log.u####.com
- nav.cn.ron####.com
- pub-####.qin####.com
- s####.cn.ron####.com
- s####.u####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st####.re####.com
- app.re####.com/Case/index/id/1211
- app.re####.com/Case/index/id/1223
- app.re####.com/redocn.apk
- et2-na6####.wagbr####.ali####.####.com/bar/get/5917fa74e88bad72b90020d5/...
- img.re####.com/201706/20170623/20170623_0fadab95b05d8059f3b2kxNnPV6btfrA...
- img.re####.com/201706/20170623/20170623_19daf6ca7533f7d99d87rfhFXShOnWt4...
- img.re####.com/201706/20170623/20170623_1c23039b78eac74bd1d0YEVhjAhprOZu...
- img.re####.com/201706/20170623/20170623_397bea3291b6e384f4919KZSw5uk0kSV...
- img.re####.com/201706/20170623/20170623_3c95b0f12cfa415ea655ccC6GJVfI25M...
- img.re####.com/201706/20170623/20170623_5b3b7db858baae3ed57f561agzczUGD7...
- img.re####.com/201706/20170623/20170623_8259d2b9428ab8111512qPdxZPDH8GVI...
- img.re####.com/201706/20170623/20170623_9c635328665aadfeef5dLzrWVuf4KNgG...
- img.re####.com/201706/20170623/20170623_ace6541f30591320b444eNqFKkT3eO4B...
- img.re####.com/201706/20170623/20170623_bad583122e16039d73efnXUp51s3xmcR...
- img.re####.com/201706/20170623/20170623_d2a60f93140f1e2b3e558NCrxTMZ8Lmj...
- img.re####.com/201706/20170626/20170626_2b746572fc49819f5849mBmqPgBbV2Px...
- img.re####.com/201706/20170626/20170626_438c52f4ab712cd7675eUALs8Ihb0i4z...
- img.re####.com/201706/20170626/20170626_5772fd711f23b4e0e533iwBtFoJjXN8m...
- img.re####.com/201706/20170626/20170626_8a8bd00fed7b20e87faaDFOBVxk3WzCH...
- img.re####.com/201706/20170626/20170626_95b5fe2da02956701fb9ZWks420AFNzL...
- img.re####.com/201706/20170626/20170626_9ebcccb7af6ede0e628anDxkkAnIyGH2...
- img.re####.com/201706/20170626/20170626_d85a3d036d787795bc5d9FYBKiCDBUfX...
- img.re####.com/201707/20170712/20170712_4f0c5cf063d6be74d6f0sawEVhGY8WyH...
- img.re####.com/201709/20170925/20170925_4992e1ef1da85491395aH7cydDPuaLXx...
- img.re####.com/201709/20170926/20170926_231208a15ff7cfa9f167N1oztq39ViVp...
- img.re####.com/201709/20170926/20170926_5535e8d3a93d16fbf5f1HT2ZEXVNOdpO...
- img.re####.com/201709/20170926/20170926_c293e7f6fe288519daaadVarlvGrCAHq...
- img.re####.com/201709/20170927/20170927_053f510f4cd642c1cba8tBJgmnogBkbM...
- img.re####.com/201711/20171124/20171124_43f90447011a20855296QqheOSZilJ8R...
- img.re####.com/201804/20180415/20180415_99ca7026286a8def4ff1OTF0jFEJDFw5...
- img.re####.com/201804/20180419/20180419_6e617a3abcbe983b7fc04HoJndaOT7Lg...
- img.re####.com/201804/20180420/20180420_c9001c3084679e33ebdbdM7QAE0WewSq...
- img.re####.com/201805/20180521/20180521_138e45c052a2eebdef91oZCC4m2hSiog...
- img.re####.com/201805/20180525/20180525_c4660fb70d462041a26bYBSnsNUhoHwR...
- img.re####.com/201805/20180531/20180531_fba07255cc99918c6b27wNGRHde6cJ4B...
- img.re####.com/201808/20180814/20180814_f0177586598eb0216778mFphm71HuJ1P...
- img.re####.com/201809/20180911/20180911_fee9d8c72e4095596d6bH7saaYywnrwX...
- img.re####.com/201809/20180926/20180926_d5a896df6c502e086c92C9p1W0JarAUV...
- img.re####.com/201810/20181010/20181010_4d3082313925fd6a2f6026E0KlYK7VzB...
- img.re####.com/201810/20181028/20181028_01daf99c54283f4e3660CbPUZyIb65MM...
- img.re####.com/201810/20181028/20181028_09e943e76be5f87e7779SBnj8Vy0VTzY...
- img.re####.com/201810/20181028/20181028_23d7dbbeb523f5e022ebzenEWAOZKSsC...
- img.re####.com/201810/20181028/20181028_285119ded812c2047819WnP81D8KqjuD...
- img.re####.com/201810/20181028/20181028_668695f7e86f3635009cmVvHXg7NvoSS...
- img.re####.com/201810/20181028/20181028_76c7ca29816edb7015daXcPKCjcfd45U...
- img.re####.com/201810/20181028/20181028_7a58b23a33e34f2fde33mEER3CfGErOv...
- img.re####.com/201810/20181028/20181028_c06b899993101937199cXG99mf1FmVDK...
- img.re####.com/201810/20181028/20181028_fa4f4e72247ca6097a80orJ8o2MmDknv...
- img.re####.com/201810/20181028/20181028_fc28c39836bb87960d78yVOW7NRqUC4W...
- img.re####.com/201810/20181028/20181028_fd374390e5cbba476c07xZL74dKG88A2...
- img.re####.com/avatar/001/36/59/149803366835_avatar_big.jpg
- img.re####.com/avatar/001/36/59/150606001037_avatar_big.jpg
- img.re####.com/avatar/001/36/59/150606722338_avatar_big.jpg
- img.re####.com/avatar/001/63/81/152137550361_avatar_big.jpg
- img.re####.com/avatar/001/72/70/150606009359_avatar_big.jpg
- img.re####.com/avatar/001/74/87/150606717921_avatar_big.jpg
- img.re####.com/avatar/002/83/99/149803374966_avatar_big.jpg
- img.re####.com/avatar/002/83/99/150606033672_avatar_big.jpg
- img.re####.com/avatar/005/20/14/150606006226_avatar_big.jpg
- img.re####.com/avatar/005/20/14/152566396530_avatar_big.jpg
- img.re####.com/avatar/005/37/71/150606097954_avatar_big.jpg
- img.re####.com/avatar/005/37/71/151592802852_avatar_big.jpg
- pub-####.qin####.com/tdata_EDT356
- st####.re####.com/app/css/app.min.css?t=####
- st####.re####.com/app/images/icon-back.png
- st####.re####.com/public/css/reset.min.css?t=####
- st####.re####.com/usercenter/js/jquery1.8.min.js?t=####
- t####.c####.q####.####.com/config/hz-hzv3.conf
- t####.c####.q####.####.com/tdata_MkX219
- t####.c####.q####.####.com/tdata_iGj879
- a####.u####.com/app_logs
- and####.b####.qq.com/rqd/async?aid=####
- app.re####.com/Case/case_list
- app.re####.com/Designer/detail
- app.re####.com/Index/index
- app.re####.com/Index/update_version
- c-h####.g####.com/api.php?format=####&t=####
- nav.cn.ron####.com/navipush.json
- sdk.o####.p####.####.com/api.php?format=####&t=####
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/1004
- /data/data/####/1541641552765.log
- /data/data/####/1541641552795.log
- /data/data/####/29598bfd3ae9d4166b19dae8817e732c
- /data/data/####/3CzdL7oqncGi95DTVZP_Z0mbDKk.167393705.tmp
- /data/data/####/4EX_OHaXsBTj6kwy7gz3Wr94R28.859020277.tmp
- /data/data/####/5iAz3AEi_W3hvE2eZ7NIcmo6iDI.890912831.tmp
- /data/data/####/5kAnsxWOFDiJWFNURoWXAFuiVXQ.1254140930.tmp
- /data/data/####/8T_xnlS0mi6X5jJ3J50nup8Pkzk.-2042180214.tmp
- /data/data/####/9ebc2e722633
- /data/data/####/AZQDCgxW73eMIdPYqFfD6loD9HY.673452421.tmp
- /data/data/####/BZjWU2vwa11PGEFRJVLyZTWKkvM.-2119877470.tmp
- /data/data/####/COUNTLY_STORE.xml
- /data/data/####/Dz-Dt2pGP8baLI4bYnd3oY0w0QY.-376714765.tmp
- /data/data/####/KOvLJSsZcv_c_zN8EL5AJ2n2cVg.-11859565.tmp
- /data/data/####/KQhhs0i0Yxk2BMt6lXGXrni7WTI.-1055202246.tmp
- /data/data/####/LYsjuLlbQZAjdRdzT-IYmt1fFH0.-1345004857.tmp
- /data/data/####/MNKJyGfZ5CUEy5Yl3ltAMdZKTEE.-515606729.tmp
- /data/data/####/MultiDex.lock
- /data/data/####/NFxAZqN5MhRCt7ifPjpEA8gpWhw.-950202754.tmp
- /data/data/####/NeT4z2HqwRDI6-SKRjpSvYbdfV0.-1979995055.tmp
- /data/data/####/O2Uyr8NxxeB_qJphhp7M3WBEJhQ.-164373875.tmp
- /data/data/####/RedocnConfig.xml
- /data/data/####/RedocnSearchModeldb-journal
- /data/data/####/RongPush.xml
- /data/data/####/Statistics.xml
- /data/data/####/U6BmV2YlH931Q6uZUtmxNoCPRVk.1095724869.tmp
- /data/data/####/Wwj0MKSNA75xwxMn3CrO90vxVYA.-1848334995.tmp
- /data/data/####/YdEPWjpUBrc85ojAs5y4V88OWt4.-987311734.tmp
- /data/data/####/bmpIbgqOjtLananbBaqnt0i2Gl0.-522425744.tmp
- /data/data/####/bugly_db_-journal
- /data/data/####/cLcFCAP6HETBRx-c-wLq424J_TI.-1399125940.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cr_RCxMWXWuQzMbiCtquizBG3C8.1981819485.tmp
- /data/data/####/crashrecord.xml
- /data/data/####/crashrecord.xml (deleted)
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/eipVvITC2vldkBB2XmCxmt20EQc.-103675543.tmp
- /data/data/####/etQ9nkgZEieczROblzlkn4gK3q0.-16825665.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/journal.tmp
- /data/data/####/kQ7USgkYAy3m1rOaxAcyn9hWpeI.675696999.tmp
- /data/data/####/lZM7J4ig6JoX3Obr_Uj_syOR-Iw.2002359036.tmp
- /data/data/####/libjiagu.so
- /data/data/####/local_crash_lock
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/opihGgPiiQQUCUXYW4SUZ_O6MGc.268365320.tmp
- /data/data/####/push.pid
- /data/data/####/push_daemon
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qZ_qtseRLJCDmke--iDhzqzNWgo.-982752552.tmp
- /data/data/####/rfb53Xtlh578sVX78ruGZh7VYSs.-2124732276.tmp
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/tdata_MkX219
- /data/data/####/tdata_MkX219.jar
- /data/data/####/tdata_iGj879
- /data/data/####/tdata_iGj879.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/vYyCkAMlwBB0o6Rsv2pfWqMkNTw.919735907.tmp
- /data/data/####/wTTYHg3ottIoN1U8DTQNJGE2Jtk.1372136277.tmp
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/RongLog_2_8_17.log
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.redocn.redocn.db
- /data/media/####/redocn.apk
- /data/media/####/tdata_MkX219
- /data/media/####/tdata_iGj879
- /data/media/####/test.log
- /system/bin/chmod 777 <Package Folder>/app_lib/x86/push_daemon
- /system/bin/sh -c getprop
- /system/bin/sh -c type su
- <Package Folder>/app_lib/x86/push_daemon <Package> io.rong.push.PushService /storage/emulated/0/.rongLock
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24681 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- getprop
- mount
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24681 300 0
- Bugly
- RongIMLib
- getuiext2
- imagepipeline
- libjiagu
- push
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding