Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mixi.16.origin
- Android.Mixi.33.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.baidust####.com:80
- TCP(HTTP/1.1) m####.v####.i####.com:80
- TCP(HTTP/1.1) re####.i####.com:80
- TCP(HTTP/1.1) www.goo####.software:80
- TCP(HTTP/1.1) msg.v####.q####.com:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) hq.fin####.i####.com:80
- TCP(HTTP/1.1) wei.sz####.top:9000
- TCP(HTTP/1.1) w####.tjj.com:80
- TCP(HTTP/1.1) i####.qiy####.com:80
- TCP(HTTP/1.1) t7z.c####.i####.com:80
- TCP(HTTP/1.1) gdv.a.s####.com:80
- TCP(HTTP/1.1) pa####.i####.com:80
- TCP(HTTP/1.1) www.c####.com.####.net:80
- TCP(HTTP/1.1) sgfp####.ifen####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) i.ge####.cn:80
- TCP(HTTP/1.1) my.1####.com:80
- TCP(HTTP/1.1) i####.sogo####.com.####.com:80
- TCP(HTTP/1.1) cm.b####.com:80
- TCP(HTTP/1.1) ifen####.com.edg####.net:80
- TCP(HTTP/1.1) union-c####.jd.com:80
- TCP(HTTP/1.1) com####.i####.com:80
- TCP(HTTP/1.1) hc.z####.today:8082
- TCP(HTTP/1.1) msg.vip.q####.com:80
- TCP(HTTP/1.1) ctslb-b####.ctrip####.com:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) a####.m.sm.cn:80
- TCP(HTTP/1.1) h5.1####.com:80
- TCP(HTTP/1.1) m.c####.com.####.net:80
- TCP(HTTP/1.1) hc.s####.top.####.com:80
- TCP(HTTP/1.1) c####.v####.q####.com:80
- TCP(HTTP/1.1) b####.1####.cn:80
- TCP(HTTP/1.1) api.t.i####.com:80
- TCP(HTTP/1.1) d####.v####.q####.com:80
- TCP(HTTP/1.1) i.i####.com:80
- TCP(HTTP/1.1) m.i####.com:80
- TCP(HTTP/1.1) c####.be####.s####.com:80
- TCP(HTTP/1.1) cm.ad####.com:80
- TCP(HTTP/1.1) wn.pos.b####.com:80
- TCP(HTTP/1.1) si####.jom####.com:80
- TCP(HTTP/1.1) api.anal####.tjj.com:80
- TCP(HTTP/1.1) moc.xj.gmi.####.com:80
- TCP(HTTP/1.1) con####.i.i####.com:80
- TCP(HTTP/1.1) st####.i####.com:80
- TCP(HTTP/1.1) v.1####.com.####.com:80
- TCP(HTTP/1.1) m.fm.i####.com:80
- TCP(HTTP/1.1) www.1####.com.####.com:80
- TCP(HTTP/1.1) gao####.1####.cn:80
- TCP(HTTP/1.1) c####.b####.com:80
- TCP(HTTP/1.1) qiy####.com.edg####.net:80
- TCP(HTTP/1.1) subscri####.i####.com:80
- TCP(HTTP/1.1) img.lu.sogo####.####.com:80
- TCP(HTTP/1.1) a.c####.com:80
- TCP(HTTP/1.1) eiv.b####.com:80
- TCP(HTTP/1.1) as.g5s.i####.com:80
- TCP(HTTP/1.1) gs.a.s####.com:80
- TCP(HTTP/1.1) cm.fas####.net:80
- TCP(HTTP/1.1) i####.i####.com:80
- TCP(HTTP/1.1) i####.com.edg####.net:80
- TCP(TLS/1.0) acti####.m.i####.com:443
- TCP(TLS/1.0) av1.x####.com:443
- TCP(TLS/1.0) secu####.i####.com:443
- TCP(TLS/1.0) st####.i####.com:443
- TCP(TLS/1.0) c####.baidust####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) s####.tc.qq.com:443
- TCP(TLS/1.0) my.1####.com:443
- TCP(TLS/1.0) union-c####.jd.com:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) gdv.a.s####.com:443
- TCP(TLS/1.0) gs.a.s####.com:443
- TCP(TLS/1.0) 2-01-2c####.cdx.ced####.net:443
- TCP(TLS/1.0) 8.cpi####.com:443
DNS requests:
- 0d077ef####.cdn.so####.com
- 8.i####.com
- a####.m.sm.cn
- a.c####.com
- acti####.m.i####.com
- api.1####.com
- api.anal####.tjj.com
- api.icl####.i####.com
- api.t.i####.com
- as.g5s.i####.com
- av1.x####.com
- b####.1####.cn
- b####.h####.s####.com
- b####.t####.s####.com
- c####.b####.com
- c####.baidust####.com
- c####.baidust####.com
- c####.be####.s####.com
- c####.jd.com
- c####.mm####.com
- c####.v####.q####.com
- c.c####.com
- c0.ifen####.com
- cdn.jsde####.net
- chan####.itc.cn
- chan####.s####.com
- cm.ad####.com
- cm.b####.com
- cm.fas####.net
- com####.i####.com
- con####.i.i####.com
- d####.v####.q####.com
- d.ifen####.com
- e.chan####.s####.com
- eiv.b####.com
- f####.ur####.s####.com
- f10.b####.com
- f11.b####.com
- f12.b####.com
- gao####.1####.cn
- h5.1####.com
- hc.s####.top
- hc.z####.today
- hm.b####.com
- hq.fin####.i####.com
- i####.i####.com
- i####.qiy####.com
- i####.sogo####.com
- i####.sogo####.com
- i####.sogo####.com
- i####.sogo####.com
- i.ge####.cn
- i.i####.com
- i.t####.com
- ifas####.i####.com
- ifenghu####.i####.com
- ifm.i####.com
- img.lu.sogo####.com
- j####.gol####.s####.com
- jti.h####.s####.com
- m####.71.am
- m####.v####.i####.com
- m.c####.com
- m.fm.i####.com
- m.i####.com
- m.i####.com
- m.qiy####.com
- msg.v####.q####.com
- msg.vip.q####.com
- my.1####.com
- n####.mer####.s####.com
- o####.t####.s####.com
- osc.ur####.s####.com
- p####.gol####.s####.com
- p####.gou.s####.com
- p####.p####.s####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.zhanz####.b####.com
- p0.ifen####.com
- p1.ifen####.com
- p2.ifen####.com
- p3.ifen####.com
- pa####.i####.com
- pos.b####.com
- q14.c####.com
- qxm.p####.s####.com
- r####.mer####.s####.com
- r####.t####.s####.com
- r####.wx.qq.com
- re####.i####.com
- s22.c####.com
- s95.c####.com
- secu####.i####.com
- sgfp####.ifen####.com
- st####.i####.com
- st####.i####.com
- su####.itc.cn
- subscri####.i####.com
- t####.sogo####.com
- t7z.c####.i####.com
- u.c####.com
- union-c####.jd.com
- v.1####.com
- v1.c####.com
- w####.tjj.com
- w.c####.com
- wei.sz####.top
- wn.pos.b####.com
- www.1####.com
- www.1####.com
- www.c####.com
- www.go####.com
- www.goo####.software
- www.i####.com
- www.qiy####.com
- x####.h####.s####.com
- x####.ur####.s####.com
- y2.ifen####.com
- y3.ifen####.com
- z1.c####.com
- z4.c####.com
- z6.c####.com
HTTP GET requests:
- a####.m.sm.cn/rest?method=####&size=####&from=####&callback=####&_=####
- a.c####.com/dplusTrack/?data=ey####&img=####&ip=####&dataver=####&_=####
- api.anal####.tjj.com/analycore?asid=####&ref=####&loc=####&ts=####
- api.anal####.tjj.com/mjs?asid=####
- api.t.i####.com/feed/get_feeds?wallId=####&count=####&version=####&hasRe...
- api.t.i####.com/feed/outline?hasRecomFeed=####&feedTypes=####&circleid=#...
- as.g5s.i####.com/FA0?cl=####&adids=####&uid=####&w=####&h=####&dm=####&t...
- as.g5s.i####.com/FA0?cl=####&adids=####&w=####&h=####&uid=####&dm=####&t...
- as.g5s.i####.com/FA0?cl=####&h=####&adids=####&w=####&dm=####&uid=####&c...
- as.g5s.i####.com/FA0?cl=####&tc=####&adids=####&w=####&dm=####&uid=####&...
- as.g5s.i####.com/FA0?cl=####&uid=####&adids=####&w=####&h=####&dm=####&t...
- as.g5s.i####.com/FA0?cl=####&w=####&adids=####&uid=####&dm=####&h=####&t...
- as.g5s.i####.com/GZHGXDs?cl=####&adids=####&uid=####&w=####&h=####&dm=##...
- as.g5s.i####.com/GZHGXDs?cl=####&dm=####&h=####&w=####&uid=####&tc=####&...
- as.g5s.i####.com/GZHGXDs?cl=####&uid=####&dm=####&w=####&adids=####&cb=#...
- as.g5s.i####.com/GZHGXDs?cl=####&w=####&uid=####&adids=####&h=####&dm=##...
- as.g5s.i####.com/J2Bc?cl=####&adids=####&uid=####&w=####&h=####&tc=####&...
- as.g5s.i####.com/J2Bc?cl=####&dm=####&uid=####&adids=####&w=####&h=####&...
- as.g5s.i####.com/J2Bc?cl=####&uid=####&adids=####&w=####&dm=####&h=####&...
- as.g5s.i####.com/J2Bc?cl=####&uid=####&adids=####&w=####&tc=####&dm=####...
- as.g5s.i####.com/J2Bc?cl=####&uid=####&w=####&h=####&adids=####&tc=####&...
- as.g5s.i####.com/J2Bc?cl=####&w=####&adids=####&uid=####&h=####&tc=####&...
- as.g5s.i####.com/Pxlv2L?cl=####&adids=####&uid=####&w=####&h=####&tc=###...
- as.g5s.i####.com/Pxlv2L?cl=####&adids=####&w=####&h=####&uid=####&dm=###...
- as.g5s.i####.com/Pxlv2L?cl=####&h=####&uid=####&adids=####&dm=####&w=###...
- as.g5s.i####.com/Pxlv2L?cl=####&tc=####&w=####&uid=####&h=####&adids=###...
- as.g5s.i####.com/Pxlv2L?cl=####&uid=####&adids=####&w=####&h=####&dm=###...
- as.g5s.i####.com/Pxlv2L?cl=####&w=####&adids=####&h=####&tc=####&cb=####...
- as.g5s.i####.com/i?p=####&_r=####
- as.g5s.i####.com/jWtgT?cl=####&adids=####&uid=####&dm=####&w=####&h=####...
- as.g5s.i####.com/jWtgT?cl=####&adids=####&uid=####&h=####&dm=####&w=####...
- as.g5s.i####.com/jWtgT?cl=####&adids=####&uid=####&w=####&h=####&tc=####...
- as.g5s.i####.com/jWtgT?cl=####&adids=####&uid=####&w=####&tc=####&h=####...
- as.g5s.i####.com/jWtgT?cl=####&uid=####&w=####&h=####&dm=####&adids=####...
- b####.1####.cn/auycdt.js
- b####.1####.cn/kfxolcnncimhnlou.js
- c####.b####.com/js/o.js
- c####.baidust####.com/cpro/exp/closead/img/bd_logo.png
- c####.baidust####.com/cpro/exp/closead/img/bg_rb.png
- c####.baidust####.com/cpro/ui/c.js
- c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bg.png
- c####.baidust####.com/cpro/ui/noexpire/img/4.0.0/pc_ads.1x.png
- c####.baidust####.com/cpro/ui/noexpire/img/4.0.0/pc_ads_bear.1x.png
- c####.baidust####.com/cpro/ui/noexpire/js/4.0.0/adClosefeedbackUpgrade.m...
- c####.baidust####.com/cpro/ui/noexpire/js/4.0.1/adClosefeedbackUpgrade.m...
- c####.baidust####.com/cpro/ui/pr.js
- c####.baidust####.com/sync.htm?cproid=####
- c####.be####.s####.com/action_ask?callback=####&url=####
- c####.be####.s####.com/ask?id=####&cb=####&ssi0=####&wsg=####&_v=####
- c####.be####.s####.com/wap_ask_service?callback=####&url=####
- c####.be####.s####.com/wapxml?id=####&h=####&w=####&fv=####&if=####&mi=#...
- c####.v####.q####.com/jp/collection/447987202/1/?src=####&_=####&callbac...
- c####.v####.q####.com/jp/othlist/205025001/4/?src=####&idType=####&_=###...
- c####.v####.q####.com/jp/pc/pr/205025001/?src=####&qyid=####&_=####&call...
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/dplus.php?id=####
- c.c####.com/stat.php?id=####&web_id=####
- c.c####.com/z_stat.php?id=####&web_id=####
- cm.ad####.com/CookieMapping?mid=####&uid=####&_r=####
- cm.b####.com/pixel?media_sign=####&media_site=####
- cm.fas####.net/?dspid=####&x=####&noredirect=####&dspuid=####&_r=####
- com####.i####.com/get.php?job=####&format=####&callback=####&var=####&do...
- con####.i.i####.com/control/content_config?business=####&is_iqiyi=####&i...
- ctslb-b####.ctrip####.com/union/CtripRedirect.aspx?TypeID=####&Alliancei...
- d####.v####.q####.com/v.mp4?_=####&callback=####
- eiv.b####.com/hmt/icon/21.gif
- gao####.1####.cn/bf/uh?c=####
- gao####.1####.cn/ldbksndi?dae=####&sez=####&ze=####&hpq=####&atlo=####&l...
- gao####.1####.cn/m.html?baidu_error=####×tamp=####
- gdv.a.s####.com/api/2/config/get/cyrSdULJz?callback=####
- gdv.a.s####.com/api/2/user/info?callback=####&client_id=####&login_termi...
- gdv.a.s####.com/api/3/topic/liteload?callback=####&client_id=####&topic_...
- gdv.a.s####.com/api/3/user/get_unread_profile?callback=####&client_id=##...
- gdv.a.s####.com/api/gold/prop/comments_prop?cmt_ids=####&callback=####&_...
- gdv.a.s####.com/dataService/getConfig?callback=####&appId=####&_=####
- gdv.a.s####.com/debug/cookie?callback=####
- gdv.a.s####.com/debug/cookie?setCook####&callback=####&Thu Nov####
- gdv.a.s####.com/stat/event?clientid=####&uuid=####&topicId=####&type=####
- gdv.a.s####.com/stat/uvstat?uuid=####&client_id=####&category_id=####&to...
- gdv.a.s####.com/upload/changyan.js
- gm.mm####.com/9.gif?abc=####&rnd=####
- gs.a.s####.com//mdevp/extensions/longloop/002/longloop.js?_=####
- gs.a.s####.com/avatarimg/s_30000001_1393915338665_c55
- gs.a.s####.com/avatarimg/s_30000001_1393915339795_c55
- gs.a.s####.com/avatarimg/s_30000001_1393915341679_c55
- gs.a.s####.com/avatarimg/s_30000001_1393915341955_c55
- gs.a.s####.com/avatarimg/s_30000001_1393915342630_c55
- gs.a.s####.com/avatarimg/s_30000001_1393915343402_c55
- gs.a.s####.com/avatarimg/s_30000001_1393915343668_c55
- gs.a.s####.com/mdevp/extensions/cmt-box/063/cmt-box.js
- gs.a.s####.com/mdevp/extensions/cmt-float-bar/029/cmt-float-bar.js
- gs.a.s####.com/mdevp/extensions/cmt-footer/048/cmt-footer.js
- gs.a.s####.com/mdevp/extensions/cmt-header/076/cmt-header.js
- gs.a.s####.com/mdevp/extensions/cmt-list/061/cmt-list.js
- gs.a.s####.com/mdevp/extensions/cmt-notice/023/cmt-notice.js
- gs.a.s####.com/mdevp/extensions/cy-auto-recommand/005/cy-auto-recommand.js
- gs.a.s####.com/mdevp/extensions/cy-av/025/cy-av.js
- gs.a.s####.com/mdevp/extensions/cy-grade/008/cy-grade.js
- gs.a.s####.com/mdevp/extensions/cy-prop/051/cy-prop.js
- gs.a.s####.com/mdevp/extensions/cy-report/022/cy-report.js
- gs.a.s####.com/mdevp/extensions/cy-score/006/cy-score.js
- gs.a.s####.com/mdevp/extensions/cy-skin/028/cy-skin.js
- gs.a.s####.com/mdevp/extensions/cy-user-avatar/014/cy-user-avatar.js
- gs.a.s####.com/mdevp/extensions/cy-user-feedback/047/cy-user-feedback.js
- gs.a.s####.com/mdevp/extensions/cy-user-info/063/cy-user-info.js
- gs.a.s####.com/mdevp/extensions/cy-user-notice/045/cy-user-notice.js
- gs.a.s####.com/mdevp/extensions/cy-user-page/035/cy-user-page.js
- gs.a.s####.com/mdevp/extensions/cy-user-set/018/cy-user-set.js
- gs.a.s####.com/mdevp/extensions/cy-user-task/032/cy-user-task.js
- gs.a.s####.com/mdevp/extensions/cy-user-view/031/cy-user-view.js
- gs.a.s####.com/mdevp/extensions/disable-user-photo/007/disable-user-phot...
- gs.a.s####.com/mdevp/extensions/face/015/face.js
- gs.a.s####.com/mdevp/extensions/first-login-prompt/003/first-login-promp...
- gs.a.s####.com/mdevp/extensions/hot-topic/021/hot-topic.js
- gs.a.s####.com/mdevp/extensions/icp-tips/017/icp-tips.js
- gs.a.s####.com/mdevp/extensions/jump-url/008/jump-url.js
- gs.a.s####.com/mdevp/extensions/phone-verify/004/phone-verify.js
- gs.a.s####.com/mdevp/extensions/sohu-treaty/007/sohu-treaty.js
- gs.a.s####.com/v3/v20171228893/src/adapter.min.js
- gs.a.s####.com/v3/v20171228893/src/start.min.js
- h5.1####.com/
- h5.1####.com/static/css/common.css
- h5.1####.com/static/css/main.css
- h5.1####.com/static/image/big.png
- h5.1####.com/static/image/logo.png
- h5.1####.com/static/image/logo/1430195668@2x.png
- h5.1####.com/static/image/logo/1430195699@2x.png
- h5.1####.com/static/image/logo/1430195773@2x.png
- h5.1####.com/static/image/logo/1430195934@2x.png
- h5.1####.com/static/image/logo/1430195989@2x.png
- h5.1####.com/static/image/logo/1463545746@2x.png
- h5.1####.com/static/image/logo/1463545813@2x.png
- h5.1####.com/static/image/logo/1463545853@2x.png
- h5.1####.com/static/image/logo/1463545942@2x.png
- h5.1####.com/static/image/logo/1463545962@2x.png
- h5.1####.com/static/image/logo/1463556231@2x.png
- h5.1####.com/static/image/logo/1496376776@2x.png
- h5.1####.com/static/image/logo/cpjihua.jpg
- h5.1####.com/static/image/logo/jmyp.jpg
- h5.1####.com/static/image/logo/tm1221.jpg
- h5.1####.com/static/image/s.png
- hc.s####.top.####.com/c867ccfb805f8e-e201796acz9.js
- hc.s####.top.####.com/dasdsad/shoufengdata.shtml
- hc.s####.top.####.com/fm/read/h5/aaa_/getTuijianResource.html?callback=#...
- hc.s####.top.####.com/gpfile/pfiles/1500809497389.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809763387.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809811269.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809824846.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809904349.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809930147.slz
- hc.s####.top.####.com/gpfile/pfiles/1500810016794.slz
- hc.s####.top.####.com/gpfile/pfiles/1500810035053.slz
- hc.s####.top.####.com/gpfile/pfiles/1500810168210.slz
- hc.s####.top.####.com/gpfile/pfiles/gofile/des_V17041702Aj1so32.zip
- hc.s####.top.####.com/gpfile/pfiles/gofile/goplaysdk_statistics_all.dat
- hc.s####.top.####.com/new/fbjpic/25005_0/getFlagData.shtml
- hc.s####.top.####.com/new/fbjpicL/25002_0/getFlagData.shtml
- hc.s####.top.####.com/p/ax_2_1.js
- hc.s####.top.####.com/pdt/cfg/ad/js/20160812/mobile_inice_v1.js
- hm.b####.com/h.js?39d27ce####
- hm.b####.com/h.js?883d579####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?2f51177####
- hm.b####.com/hm.js?d1f57d1####
- hq.fin####.i####.com/q.php?l=####&f=####&from=####
- i####.com.edg####.net/css/20171114/h5-comment.css
- i####.com.edg####.net/css/20171114/h5-paopao-play.css
- i####.com.edg####.net/css/20171208/h5-play-v3.css
- i####.com.edg####.net/ext/common/iconography/iconfont.ttf
- i####.com.edg####.net/js/common/7d183edd03bc4414b315e8964fb41826.js
- i####.com.edg####.net/js/common/ares-4-0-92-25fcbb121b2331ce9acb.min.js
- i####.com.edg####.net/js/html5/js/lib/lib.2.0.5.min.js?sea1.2.####
- i####.com.edg####.net/js/html5/js/lib/qoe.min.js?v=####
- i####.com.edg####.net/js/html5/js/page/playMovie/e77f905684!app.js
- i####.com.edg####.net/v_19rrf2xqjc.html
- i####.i####.com/irt?_iwt_t=####&_iwt_id=####&_iwt_UA=####&r=####
- i####.qiy####.com/image/paopao/paopao_5a41b52514d455788829be5d_default.j...
- i####.qiy####.com/image/paopao/paopao_5a44dd21f6882e270acc9d68_default.j...
- i####.qiy####.com/image/ppopen/ppopen_59ad5836f6882e7304842cb8_0.jpg
- i####.qiy####.com/image/ppopen/ppopen_59dac4e3f6882e60a167c705_0.jpg
- i####.qiy####.com/image/ppopen/ppopen_5a27709774d5792e745fd150_0.jpg
- i####.qiy####.com/image/ppopen/ppopen_5a38d7a4d2999d07d532dba0_0.jpg
- i####.sogo####.com.####.com/app/a/200630/017c321cccb6138da90aec1d3e2550f9
- i####.sogo####.com.####.com/app/a/200630/056865c73fdef97ad612eb28c66ee200
- i####.sogo####.com.####.com/app/a/200630/12d575ff0abdd93dc572785d7c51e1b2
- i####.sogo####.com.####.com/app/a/200630/39c89060aca7bd8205ae3b77ae25702c
- i####.sogo####.com.####.com/app/a/200630/48f63388992b156837afde139bdd823a
- i####.sogo####.com.####.com/app/a/200630/49e8bea50835546dff20c478f13f1864
- i####.sogo####.com.####.com/app/a/200630/55a0ef7e91110cd7469cd9f609d50364
- i####.sogo####.com.####.com/app/a/200630/b703875c0b3939e9d48b889d0a5ba6de
- i####.sogo####.com.####.com/app/a/200630/d2c9223b6f2b2395ee2b330388a61ead
- i####.sogo####.com.####.com/app/a/200630/daeee454609cb596421f31c450a6d518
- i####.sogo####.com.####.com/app/a/200630/fa3d7e98c39ea8d48f5e25b866e4c0f2
- i####.sogo####.com.####.com/app/a/200630/fe65ab91b63d7e2b7defc469aab77c0d
- i.ge####.cn/images/899.jpg?0d077ef####
- i.i####.com/
- i.i####.com/favicon.ico
- ifen####.com.edg####.net/29b92e35b2b20708/2017/16/logo_0418.png
- ifen####.com.edg####.net/29b92e35b2b20708/2017/16/search02_0418.png
- ifen####.com.edg####.net/29b92e35b2b20708/2017/16/search_0418.png
- ifen####.com.edg####.net/29b92e35b2b20708/2017/21/ifengapp_download_fast...
- ifen####.com.edg####.net/29b92e35b2b20708/2017/28/ifeng_index_touch_main...
- ifen####.com.edg####.net/29b92e35b2b20708/2017/48/touch1201.js
- ifen####.com.edg####.net/29daa33abbbc4bbc/2017/51/hongbao1218.png
- ifen####.com.edg####.net/a/2015/0716/jquery-2.1.4.min.js
- ifen####.com.edg####.net/a/2015/0716/jquery.lazyload.min.js
- ifen####.com.edg####.net/a/2016/0809/sta_collection_common_iifeng_v4.js
- ifen####.com.edg####.net/a/2016_52/29879fe7c5dc70b_size8_w144_h144.png
- ifen####.com.edg####.net/a/2016_52/361d4b54d01e021_size6_w80_h80.png
- ifen####.com.edg####.net/a/2017/0301/6536a6cc8eded54.js
- ifen####.com.edg####.net/a/2017/0329/sta_collection_iifeng_pv_v8.js
- ifen####.com.edg####.net/a/2017/0427/ifengWeather_v6.js
- ifen####.com.edg####.net/a/2017/0510/wemediaExposureTJ_v5.js
- ifen####.com.edg####.net/a80c2beeeff78280/2017/28/luckybagclose.png
- ifen####.com.edg####.net/a80c2beeeff78280/2017/39/439x76x0224_2.png
- ifen####.com.edg####.net/a80c2beeeff78280/2017/39/close_commonshare.png
- ifen####.com.edg####.net/a80c2beeeff78280/2017/39/snifer-v1.css
- ifen####.com.edg####.net/a80c2beeeff78280/2017/39/snifer-v1.js
- ifen####.com.edg####.net/a80c2beeeff78280/2017/44/count_index_v2.js
- ifen####.com.edg####.net/ae2b95e1d35710ab/2017/21/idownloadwap01.jpg
- ifen####.com.edg####.net/buyAlbum/images/ifengad/2017061201/fm-icon-play...
- ifen####.com.edg####.net/cmpp/2016/09/26/c05798b91fdb9fcc6e5316a4163c539...
- ifen####.com.edg####.net/common/reset_160525.css
- ifen####.com.edg####.net/fe/iifeng_index_touch/images/i_sprite_2b0970e1....
- ifen####.com.edg####.net/fe/iifeng_index_touch/images/ifengapp_download_...
- ifen####.com.edg####.net/fe/iifeng_index_touch/images/loading_eb0d4350.gif
- ifen####.com.edg####.net/fe/iifeng_index_touch/images/safari_pop_bg_c68e...
- ifen####.com.edg####.net/fe/iifeng_index_touch/images/safari_pop_close_e...
- ifen####.com.edg####.net/fe/iifeng_index_touch/images/safari_pop_icon_17...
- ifen####.com.edg####.net/fe/iifeng_index_touch/images/video_download_022...
- ifen####.com.edg####.net/fe/iifeng_index_touch/styles/iifeng_index_touch...
- ifen####.com.edg####.net/ifengimcp/sta/20140312/jquery_1.11.js
- ifen####.com.edg####.net/w138_h98_q75/p0.ifengimg.com/pmop/2018/0101/08D...
- ifen####.com.edg####.net/w138_h98_q75/p0.ifengimg.com/pmop/2018/0101/814...
- ifen####.com.edg####.net/w138_h98_q75/p1.ifengimg.com/cmpp/2018/01/01/11...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/FM/2016/1207/ugcimg/2...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/a/2017_11/9015e126048...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/a/2017_13/7f381ed4a9c...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/a/2017_19/67c2f78a94f...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/a/2017_30/de8c424a91a...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/a/2017_35/83a088b534d...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/a/2017_35/f27eb3e5e29...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/a/2017_43/4cfefd85643...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/a/2017_52/83bf4b6b145...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2017/03/14/cdb0c...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2017/05/15/8ce90...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2017/05/26/024ec...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2017/06/16/90756...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2017/08/08/5a035...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2017/09/14/10bdf...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2017/12/22/c7bc5...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2017/12/29/1779f...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2017/12/31/f5605...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2018/01/01/77ef2...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/cmpp/2018/01/01/e1315...
- ifen####.com.edg####.net/w220_h144/p0.ifengimg.com/fck/2017_52/6f7be8c42...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/a/2017_17/c94ca3f655f...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/a/2017_43/eaf0aea9c2c...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/a/2017_43/ff8c537f1b7...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/a/2017_45/285f63c618e...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2017/08/08/12a67...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2017/09/01/ca89d...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2017/09/14/282bf...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2017/09/14/c7a9f...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2017/12/18/16c8c...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2017/12/19/b6409...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2017/12/30/d87e6...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2017/12/30/eed85...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2017/12/31/6ccef...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2018/01/01/334d2...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2018/01/01/a03c8...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2018/01/01/beb59...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/cmpp/2018/01/01/d0f3b...
- ifen####.com.edg####.net/w220_h144/p1.ifengimg.com/fck/2017_52/36a5e30cf...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/a/2017_13/70a528b9301...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/a/2017_52/d28d9de6d43...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/cmpp/2016/09/18/e0a9f...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/cmpp/2017/06/21/7de46...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/cmpp/2017/06/23/392e3...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/cmpp/2017/09/14/a0368...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/cmpp/2017/12/29/3a44b...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/cmpp/2017/12/29/815fa...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/cmpp/2017/12/29/a5dd8...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/cmpp/2017/12/31/f8c63...
- ifen####.com.edg####.net/w220_h144/p2.ifengimg.com/cmpp/2018/01/01/ffd30...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/FM/images/programimg/...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/a/2017_11/62bf070b909...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/a/2017_36/881e6f3f491...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/a/2017_38/7b007fe792c...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/a/2017_46/9d9eabf8c8f...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/a/2018_01/7f610d320b1...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2016/11/23/467cc...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2017/05/16/b6937...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2017/07/24/09a39...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2017/07/24/f1138...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2017/09/01/b8319...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2017/09/14/9fb85...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2017/11/24/69569...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2017/12/01/88851...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2017/12/14/4a291...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2017/12/31/a6a05...
- ifen####.com.edg####.net/w220_h144/p3.ifengimg.com/cmpp/2018/01/01/2102e...
- ifen####.com.edg####.net/w220_h144/y3.ifengimg.com/cmpp/2015/11/13/2f452...
- ifen####.com.edg####.net/w347_h210/p3.ifengimg.com/a/2018_01/9baf97ae650...
- ifen####.com.edg####.net/w702_h260/p3.ifengimg.com/cmpp/2018/01/01/471c3...
- ifen####.com.edg####.net/w750_h350/p0.ifengimg.com/cmpp/2018/01/01/7036a...
- ifen####.com.edg####.net/w750_h350/p1.ifengimg.com/cmpp/2018/01/01/49e4f...
- ifen####.com.edg####.net/w750_h350/p2.ifengimg.com/cmpp/2018/01/01/8f6b2...
- ifen####.com.edg####.net/w750_h350/p2.ifengimg.com/cmpp/2018/01/01/da78d...
- ifen####.com.edg####.net/w750_h350/p3.ifengimg.com/cmpp/2017/12/31/e4e66...
- ifen####.com.edg####.net/w750_h350/p3.ifengimg.com/cmpp/2018/01/01/16530...
- ifen####.com.edg####.net/w750_h350/p3.ifengimg.com/cmpp/2018/01/01/b9e0c...
- img.lu.sogo####.####.com/wap/images/sg_logo.png
- img.lu.sogo####.####.com/wap/js/anticheat-min.js
- img.lu.sogo####.####.com/wap/js/wuc.js
- m####.v####.i####.com/jp/albums/205025001?callback=####
- m####.v####.i####.com/jp/mixin/albums/205025001/songs?_=####&callback=####
- m####.v####.i####.com/jp/recommend/videos?type=####&page=####&size=####&...
- m.c####.com.####.net/html5/?allianceid=####&sid=####&ouid=####&utm_mediu...
- m.fm.i####.com/h5/js/ifengad/fm-ad.js
- m.i####.com/burroughsnews?type=####&from=####&n=####&uid=####&callback=#...
- m.i####.com/newH5Weather?key=####&value=####&callback=####&_=####
- moc.xj.gmi.####.com/c_zoom,w_200/fac494264beff70ed91fedf32783552b_defaul...
- moc.xj.gmi.####.com/pFSDZeW_png
- moc.xj.gmi.####.com/pFSE7Vd_png
- moc.xj.gmi.####.com/pFSEOOQ_png
- moc.xj.gmi.####.com/pFSEdA7_png
- moc.xj.gmi.####.com/pFSEmA0_png
- moc.xj.gmi.####.com/pKLlEb3_png
- moc.xj.gmi.####.com/pKLlTQO_png
- moc.xj.gmi.####.com/pKLlZUq_png
- moc.xj.gmi.####.com/pKLlexR_png
- moc.xj.gmi.####.com/pKLlhvp_png
- moc.xj.gmi.####.com/pKLlrdF_png
- msg.v####.q####.com/b?t=####&bstp=####&pf=####&p=####&p1=####&u=####&pu=...
- msg.v####.q####.com/cp2.gif?p=####&rd=####&rc=####&t=####&e=####&y=####&...
- msg.v####.q####.com/cp2.gif?p=####&t=####&lc=####&e=####&y=####&u=####&a...
- msg.v####.q####.com/cp2.gif?p=####&t=####&rc=####&rd=####&ai=####&e=####...
- msg.v####.q####.com/jpb.gif?rdm=####&qtcurl=####&rfr=####&flshuid=####&l...
- msg.v####.q####.com/tmpstats.gif?type=####&des=####&mse=####&p2p=####&p=...
- msg.vip.q####.com/qya.gif?qy_n=####&qy_cid=####&qy_fcode=####&qy_platfor...
- my.1####.com/ip/?callback=####&_=####
- my.1####.com/tongxun.html
- pa####.i####.com/apis/e/paopao/list.action?authcookie=####&device_id=###...
- pa####.i####.com/apis/e/starwall/wallBaseInfos.action?device_id=####&age...
- pos.b####.com/ecom?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/ecom?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&r...
- pos.b####.com/ecom?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&ari=####&dc=####&cfv=...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####<r=####&cec=####&ps=...
- pos.b####.com/sync_pos.htm?cproid=####
- qiy####.com.edg####.net/common/20171106/ac/1b/vip_100000_v_601_0_34.png
- qiy####.com.edg####.net/common/fix/h5-aura/foot.png
- qiy####.com.edg####.net/common/fix/h5-aura/picicon-bg-20171011.png
- qiy####.com.edg####.net/common/fix/h5-aura/player-bg.png
- qiy####.com.edg####.net/common/fix/h5-aura/player-default-logo.png
- qiy####.com.edg####.net/common/fix/h5-paopao/handledefeture.png
- qiy####.com.edg####.net/common/fix/h5-paopao/paopao-xiaopao.png
- qiy####.com.edg####.net/common/fix/h5-v3/c-grade-vipNormal.png
- qiy####.com.edg####.net/common/fix/h5-v3/iqiyi-logo.png
- qiy####.com.edg####.net/common/fix/h5-v3/logoH5_v-2x.png
- qiy####.com.edg####.net/common/fix/h5-v3/player-tip-bg.jpg
- qiy####.com.edg####.net/common/fix/h5-v3/video-pp-bg.png
- qiy####.com.edg####.net/common/fix/h5-v3/video-pp.png
- qiy####.com.edg####.net/common/fix/headicons/female06-130.png
- qiy####.com.edg####.net/common/fix/iqiyi-wechat/logo.jpg
- qiy####.com.edg####.net/image/20140903/80/9d/a_100006924_m_601_195_260.jpg
- qiy####.com.edg####.net/image/20141201/07/50/66/a_100003633_m_601_m14_19...
- qiy####.com.edg####.net/image/20151015/38/72/a_100006840_m_601_m9_195_26...
- qiy####.com.edg####.net/image/20160307/02/a0/p_2000404_m_601_m1_160_160....
- qiy####.com.edg####.net/image/20160307/3d/2d/p_1050493_m_601_m1_160_160....
- qiy####.com.edg####.net/image/20160307/51/9c/p_2005700_m_601_m2_160_160....
- qiy####.com.edg####.net/image/20160307/76/f4/p_1040892_m_601_m1_160_160....
- qiy####.com.edg####.net/image/20160307/a8/a4/p_2007401_m_601_m1_160_160....
- qiy####.com.edg####.net/image/20160307/c7/64/p_2003823_m_601_m1_160_160....
- qiy####.com.edg####.net/image/20160307/e9/bb/p_2002161_m_601_m1_160_160....
- qiy####.com.edg####.net/image/20160307/ed/3f/p_1059435_m_601_m1_160_160....
- qiy####.com.edg####.net/image/20160308/23/51/p_2003165_m_601_m2_160_160....
- qiy####.com.edg####.net/image/20160308/26/ee/p_2005249_m_601_m3_160_160....
- qiy####.com.edg####.net/image/20160510/58/58/p_5206272_m_601_m2_160_160....
- qiy####.com.edg####.net/image/20160928/37/17/a_100033199_m_601_195_260.jpg
- qiy####.com.edg####.net/image/20161028/ec/40/p_5216782_m_601_160_160.jpg
- qiy####.com.edg####.net/image/20170715/94/a0/a_100012874_m_601_m3_195_26...
- qiy####.com.edg####.net/image/20171009/d5/fc/a_100039904_m_601_m4_195_26...
- qiy####.com.edg####.net/image/20171020/d5/08/a_100040138_m_601_m9_195_26...
- qiy####.com.edg####.net/image/20171025/bb/24/a_100034746_m_601_m3_195_26...
- qiy####.com.edg####.net/image/20171103/43/29/a_100018964_m_601_m6_195_26...
- qiy####.com.edg####.net/image/20171109/38/f3/a_100107323_m_601_m4_195_26...
- qiy####.com.edg####.net/image/20171122/d5/6c/a_100112251_m_601_m1_195_26...
- qiy####.com.edg####.net/image/20171204/72/a4/a_100114038_m_601_m2_195_26...
- qiy####.com.edg####.net/image/20171213/4c/d2/a_100114907_m_601_m2_195_26...
- qiy####.com.edg####.net/image/20171219/57/ec/v_114314684_m_601_m1_480_27...
- qiy####.com.edg####.net/image/20171219/af/ad/a_100035374_m_601_m4_195_26...
- qiy####.com.edg####.net/image/20171221/23/81/v_114343242_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171221/43/33/v_114343487_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171221/52/d0/v_114343617_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171221/55/30/v_114344436_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171221/7c/19/v_114343059_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171221/88/94/v_114342962_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171221/e5/94/v_114343390_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171222/c9/e3/v_114352127_m_601_m2_284_16...
- qiy####.com.edg####.net/image/20171225/c4/40/a_100112879_m_601_m17_195_2...
- qiy####.com.edg####.net/image/20171226/8b/0c/v_114393387_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171226/fa/79/v_114393357_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171228/07/6e/a_100055586_m_601_m22_195_2...
- qiy####.com.edg####.net/image/20171228/19/ef/v_114403060_m_601_m2_284_16...
- qiy####.com.edg####.net/image/20171228/7c/fc/v_114403027_m_601_m1_284_16...
- qiy####.com.edg####.net/image/20171228/f7/9c/a_100118658_m_601_m2_195_26...
- re####.i####.com/get?format=####&callback=####
- sgfp####.ifen####.com/wap/js/wp.js
- si####.jom####.com/it/u=1002118827,4228894555&fm=76
- si####.jom####.com/it/u=1049517307,196280721&fm=76
- si####.jom####.com/it/u=1337334481,1827956017&fm=76
- si####.jom####.com/it/u=1365333821,1853860630&fm=76
- si####.jom####.com/it/u=1434921163,49929291&fm=76
- si####.jom####.com/it/u=181700746,3277300746&fm=76
- si####.jom####.com/it/u=1868734638,2703572929&fm=76
- si####.jom####.com/it/u=1886691825,2661757422&fm=76
- si####.jom####.com/it/u=196413550,2249532699&fm=76
- si####.jom####.com/it/u=209360716,1784922900&fm=76
- si####.jom####.com/it/u=2102452602,3374994301&fm=76
- si####.jom####.com/it/u=216298548,3106148710&fm=76
- si####.jom####.com/it/u=224437016,2129838148&fm=76
- si####.jom####.com/it/u=233238460,2169426828&fm=76
- si####.jom####.com/it/u=243522553,211790100&fm=76
- si####.jom####.com/it/u=2823335861,2616289189&fm=76
- si####.jom####.com/it/u=2832993730,995684295&fm=76
- si####.jom####.com/it/u=300215231,1798577201&fm=76
- si####.jom####.com/it/u=3059151468,3543266969&fm=76
- si####.jom####.com/it/u=330705681,1772584878&fm=76
- si####.jom####.com/it/u=3701994385,2305095443&fm=76
- si####.jom####.com/it/u=3720561523,3726712644&fm=76
- si####.jom####.com/it/u=3820631650,2263538423&fm=76
- si####.jom####.com/it/u=3904422266,3685730185&fm=76
- si####.jom####.com/it/u=3997110021,1478316769&fm=76
- si####.jom####.com/it/u=4000181200,1395707807&fm=76
- si####.jom####.com/it/u=406982088,1975561641&fm=76
- si####.jom####.com/it/u=4114833405,1201690256&fm=76
- si####.jom####.com/it/u=421563567,3205554815&fm=76
- si####.jom####.com/it/u=4219385304,861812511&fm=76
- si####.jom####.com/it/u=466377828,3810391412&fm=76
- si####.jom####.com/it/u=474400276,2126107715&fm=76
- si####.jom####.com/it/u=506598912,2220714535&fm=76
- si####.jom####.com/it/u=509827831,3061346639&fm=76
- si####.jom####.com/it/u=573793778,632108324&fm=76
- si####.jom####.com/it/u=731490585,2090984525&fm=76
- si####.jom####.com/it/u=81552091,1532889724&fm=76
- si####.jom####.com/it/u=959100585,1197998252&fm=76
- st####.i####.com/apwsta.js?datatype=####&url=####&ar=####&ap=####&cu=###...
- st####.i####.com/wapsta?url=####&ref=####&mid=####&ua=####&ci=####&sid=#...
- subscri####.i####.com/dingyue/api/isSubscribed.action?agent_type=####&su...
- t7z.c####.i####.com/show2?e=####&h=####&a=####&u=####&p=####&s=####&_=##...
- t7z.c####.i####.com/track2?w=####&dts=####&nr=####&c=####&f=####&g=####&...
- union-c####.jd.com/ifeng?ifuserid=####&_r=####
- union-c####.jd.com/jdc?d=####
- v.1####.com.####.com/favicon.ico
- v.1####.com.####.com/h5/static/css/css.css
- v.1####.com.####.com/h5/static/images/btm_icon.png
- v.1####.com.####.com/h5/static/images/icon.png
- v.1####.com.####.com/h5/static/images/loading.gif
- v.1####.com.####.com/h5/static/images/logo.png
- v.1####.com.####.com/h5/static/js/main.js
- v.1####.com.####.com/h5/static/js/ylmf_mb.min.js
- v.1####.com.####.com/img/2013/11/19/v114la/movie/10/g4604UM2q35.jpg
- v.1####.com.####.com/img/2015/05/23/pps/comic/2/YSm99732095.jpg
- v.1####.com.####.com/img/2015/09/11/qq/movie/10/II814U8Q849.jpg
- v.1####.com.####.com/img/2017/07/10/hunantv/movie/9/4xR99U2809V.jpg
- v.1####.com.####.com/img/2017/12/18/qy/tvs/2/B76SG4D3y66.jpg
- v.1####.com.####.com/img/2017/12/19/v114la/movie/3/ncz7H2e0410.jpg
- v.1####.com.####.com/img/2017/12/19/v114la/movie/6/s860J5f2E17.jpg
- v.1####.com.####.com/img/2017/12/30/huashu/tvs/8/332VRBu1J08.jpeg
- v.1####.com.####.com/img/2017/12/30/qq/tvs/1/W4t2oT04425.jpg
- v.1####.com.####.com/img/2018/01/01/hunantv/tvs/5/62905uF8391.jpg
- v.1####.com.####.com/img/2018/01/01/qq/tvs/4/7nC7i1I1049.jpg
- v.1####.com.####.com/img/2018/01/01/qy/tvs/9/B4S437JH826.jpg
- v.1####.com.####.com/img/focus_img/201712/151427456841823.jpg
- v.1####.com.####.com/img/up_img/201606/146580600037172.jpg
- v.1####.com.####.com/img/up_img/201707/149905592823253.jpg
- v.1####.com.####.com/img/up_img/201708/150296811760394.jpg
- v.1####.com.####.com/img/up_img/201708/150338455994947.jpg
- v.1####.com.####.com/img/up_img/201712/151237249590511.png
- v.1####.com.####.com/img/up_img/201712/151237262145014.png
- v.1####.com.####.com/img/up_img/201712/151237960994838.jpg
- v.1####.com.####.com/img/up_img/201712/151237984351666.jpg
- v.1####.com.####.com/img/up_img/201712/151263769829041.jpg
- v.1####.com.####.com/img/up_img/201712/151297744846950.jpg
- v.1####.com.####.com/img/up_img/201712/151305839677538.jpg
- v.1####.com.####.com/img/up_img/201712/151306634353822.jpg
- v.1####.com.####.com/img/up_img/201712/151314875724825.jpg
- v.1####.com.####.com/img/up_img/201712/151315013327196.jpg
- v.1####.com.####.com/img/up_img/201712/151315047392944.jpg
- v.1####.com.####.com/img/up_img/201712/151322070859872.jpg
- v.1####.com.####.com/img/up_img/201712/151324184058651.jpg
- v.1####.com.####.com/img/up_img/201712/151365045429126.jpg
- v.1####.com.####.com/img/up_img/201712/151365048332345.jpg
- v.1####.com.####.com/img/up_img/201712/151365074130972.jpg
- v.1####.com.####.com/img/up_img/201712/151366912121349.jpg
- v.1####.com.####.com/img/up_img/201712/151367263635589.jpg
- v.1####.com.####.com/img/up_img/201712/151367294432158.jpg
- v.1####.com.####.com/img/up_img/201712/151382246865265.jpg
- v.1####.com.####.com/img/up_img/201712/151383556943833.jpg
- v.1####.com.####.com/img/up_img/201712/151418779225743.jpg
- v.1####.com.####.com/img/up_img/201712/151425953472256.jpg
- v.1####.com.####.com/img/up_img/201712/151425978028076.jpg
- v.1####.com.####.com/img/up_img/201712/151426028655654.jpg
- v.1####.com.####.com/img/up_img/201712/151426053485421.jpg
- v.1####.com.####.com/img/up_img/201712/151426090285961.jpg
- v.1####.com.####.com/img/up_img/201712/151426107154276.jpg
- v.1####.com.####.com/img/up_img/201712/151426115297798.jpg
- v.1####.com.####.com/img/up_img/201712/151426144753544.jpg
- v.1####.com.####.com/img/up_img/201712/151427655632187.jpg
- v.1####.com.####.com/img/up_img/201712/151427665937316.jpg
- v.1####.com.####.com/img/up_img/201712/151427675119622.jpg
- v.1####.com.####.com/img/up_img/201712/151427681166535.jpg
- v.1####.com.####.com/img/up_img/201712/151427701380546.jpg
- v.1####.com.####.com/img/up_img/201712/151427705429127.png
- v.1####.com.####.com/img/up_img/201712/151427711144200.jpg
- v.1####.com.####.com/img/up_img/201712/151427720283721.jpg
- v.1####.com.####.com/img/up_img/201712/151427774418607.jpg
- v.1####.com.####.com/img/up_img/201712/151444813686266.jpg
- v.1####.com.####.com/img/up_img/201712/151444822739886.jpg
- v.1####.com.####.com/img/up_img/201712/151444850181575.jpg
- v.1####.com.####.com/img/up_img/201712/151452121599130.jpg
- v.1####.com.####.com/img/up_img/201712/151452648858131.jpg
- v.1####.com.####.com/img/up_img/201712/151452654053386.jpg
- v.1####.com.####.com/img/up_img/201712/151452658641822.jpg
- v.1####.com.####.com/img/up_img/201712/151452664382418.jpg
- v.1####.com.####.com/img/up_img/201712/151452673627505.jpg
- v.1####.com.####.com/img/up_img/201712/151452680755662.jpg
- v.1####.com.####.com/img/up_img/201712/151453222186404.jpg
- v.1####.com.####.com/img/up_img/201712/151453229795163.jpg
- v.1####.com.####.com/img/up_img/201712/151453252295309.jpg
- v.1####.com.####.com/img/up_img/201712/151453261717848.jpg
- v.1####.com.####.com/img/up_img/201712/151453268418262.jpg
- v.1####.com.####.com/img/up_img/201712/151453671619385.jpg
- v.1####.com.####.com/img/up_img/201712/151453907713821.jpg
- v.1####.com.####.com/img/zt/2015/08/2015082414490416388.jpg
- v.1####.com.####.com/img/zt/2015/08/2015082414491534864.jpg
- v.1####.com.####.com/img/zt/2015/08/2015082414503138628.jpg
- v.1####.com.####.com/m
- v.1####.com.####.com/m/
- v.1####.com.####.com/m/?ct=####&ac=####&show=####&pid=####
- v.1####.com.####.com/play-20838466.html?url=####&code=####
- v.1####.com.####.com/static/images/closead.png
- v.1####.com.####.com/static/images/i_qy.png
- v.1####.com.####.com/tv/20838466.html
- v.1####.com.####.com/video/H5/static/images/close.png
- v.1####.com.####.com/video/H5/static/images/s1212_800_120.jpg
- v.1####.com.####.com/video/H5/static/images/s1212_800_150.jpg?v=####
- v.1####.com.####.com/video/H5/static/images/ysdq.jpg
- v.1####.com.####.com/video/static/city/base.json
- v.1####.com.####.com/video/static/css/common.css
- v.1####.com.####.com/video/static/css/norrow.css?9####
- v.1####.com.####.com/video/static/css/sub.css
- v.1####.com.####.com/video/static/images/common.png
- v.1####.com.####.com/video/static/images/logo.png
- v.1####.com.####.com/video/static/images/sd_bt.png
- v.1####.com.####.com/video/static/js/jquery-1.7.1.min.js
- v.1####.com.####.com/video/static/js/jquery.scrollLoading-min.js
- v.1####.com.####.com/video/static/js/main.js
- v.1####.com.####.com/video/static/js/sha1_min.js
- v.1####.com.####.com/video/static/js/size.js
- v.1####.com.####.com/video/static/wimg/w_01.jpg
- w####.tjj.com/index?u=http://v.114la.com/play-20838466.html?url=####&cod...
- wei.sz####.top:9000/ad/list?did=####&cid=####&vid=####
- wei.sz####.top:9000/d/atv?did=####&cid=####&vid=####&no=####&ei=####&si=...
- wn.pos.b####.com/adx.php?c=####
- www.1####.com.####.com/static/js/stat_click.js
- www.1####.com.####.com/static/js/tjj_click.js
- www.1####.com.####.com/static/js/upload_ad.js
- www.c####.com.####.net/?allianceid=####&sid=####&ouid=####&utm_medium=##...
- www.go####.com/complete/search?hl=####&client=####&q=####
- www.goo####.software/cr/sv/getGoFile?name=####
- www.goo####.software/cr/sv/getRecord?eids=####&appKey=####&flag=####
- www.goo####.software/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&p...
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
HTTP POST requests:
- hc.z####.today:8082/spdumread/service/rtLogRecord
- www.goo####.software/cr/sv/getEPList
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.md
- <Package Folder>/files/####/0CF28EFB54955A81453E8D89C23B8864
- <Package Folder>/files/####/1510835405995_2131
- <Package Folder>/files/####/1510835406029_2131
- <Package Folder>/files/####/1510835406065_2131
- <Package Folder>/files/####/1510835407731_2131
- <Package Folder>/files/####/1510835451796_2131
- <Package Folder>/files/####/1510835451796_2131 (deleted)
- <Package Folder>/files/####/1510835451942_2131
- <Package Folder>/files/####/1510835453941_2131
- <Package Folder>/files/####/1510835454276_2131
- <Package Folder>/files/####/5app22<System Property>46
- <Package Folder>/files/####/7792821A0A8ED2E9476B032798D94675
- <Package Folder>/files/####/88BB83634A8E2262DD7DDEAC26E6EB90
- <Package Folder>/files/####/<Package>12<System Property>2
- <Package Folder>/files/####/A24328C52C13CB5266964BA4716B5CD3
- <Package Folder>/files/####/AD8F24D8894380B8BE0DC178FE7FF593
- <Package Folder>/files/####/BFEAC36FEE6ACFAF94DE5BC9ED21AFC3
- <Package Folder>/files/####/C558ADE2EC7C303C4D8865D950DC1261
- <Package Folder>/files/####/DFB24337BA3D3CB278C1789FDB61625D
- <Package Folder>/files/####/E707345731F47F8191269A01BD0707A4
- <Package Folder>/files/####/gpdu
- <Package Folder>/files/####/test
- <Package Folder>/files/1510835408729_V17041702Aj1so32.so
- <Package Folder>/files/1805.jar
- <Package Folder>/files/408.jar
- <Package Folder>/files/421.jar
- <Package Folder>/files/430.jar
- <Package Folder>/files/610.jar
- <Package Folder>/files/611.jar
- <Package Folder>/files/617.jar
- <Package Folder>/files/640.jar
- <Package Folder>/files/806.jar
- <Package Folder>/files/<System Property>112.jar
- <Package Folder>/files/hftJcw46N.jar
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime0.xml
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/TDpref_shorttime0.xml
- <Package Folder>/shared_prefs/tdid.xml
- <SD-Card>/.tcookieid
- <SD-Card>/com.android.system.atv.pk
- <SD-Card>/com.android.system.pk
Miscellaneous:
Executes next shell scripts:
- <Package Folder>/files/.play/test <Package Folder>/files/.play/ c97ca17027ed8644583abc9d4419b725
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c97ca17027ed8644583abc9d4419b725 <Package Folder>/.syslib-
- chmod 0771 <Package Folder>/.syslib-
- chmod 770 <Package Folder>/files/.play/test
- getenforce
- getprop
- rm -f <Package Folder>/files/hftJcw46N.dex
- rm -f <Package Folder>/files/hftJcw46N.jar
- rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- rm <Package Folder>/files/hftJcw46N.dex
- rm <Package Folder>/files/hftJcw46N.jar
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ c97ca17027ed8644583abc9d4419b725
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c97ca17027ed8644583abc9d4419b725 <Package Folder>/.syslib-
Loads the following dynamic libraries:
- 1510835408729_V17041702Aj1so32
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about running applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
