Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.14.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) m####.qy.net:80
- TCP(HTTP/1.1) api####.i####.com:80
- TCP(HTTP/1.1) c####.v####.i####.com:80
- TCP(HTTP/1.1) si.ei.senb####.com:80
- TCP(HTTP/1.1) c.g####.qq.com:80
- TCP(HTTP/1.1) t7z.c####.i####.com:80
- TCP(HTTP/1.1) vide####.i####.com.####.net:80
- TCP(HTTP/1.1) pa####.i####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) i####.i####.com:80
- TCP(HTTP/1.1) emotico####.i####.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) secu####.i####.com:80
- TCP(HTTP/1.1) v.g####.qq.com:80
- TCP(HTTP/1.1) subscri####.i####.com:80
- TCP(HTTP/1.1) b.scoreca####.com.####.net:80
- TCP(HTTP/1.1) iqiy####.com.edg####.net:80
- TCP(HTTP/1.1) www.51bt####.com:80
- TCP(HTTP/1.1) contr####.i####.com:80
- TCP(HTTP/1.1) d####.v####.i####.com:80
- TCP(HTTP/1.1) act.vip.i####.com:80
- TCP(HTTP/1.1) d.g####.qq.com:80
- TCP(HTTP/1.1) d####.b####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) api.durianc####.com:80
- TCP(HTTP/1.1) msg.i####.com:80
- TCP(HTTP/1.1) a####.i####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) miao####.i####.com:80
- TCP(HTTP/1.1) c####.m.i####.com:80
- TCP(HTTP/1.1) i####.com.edg####.net:80
- TCP(TLS/1.0) m####.qy.net:443
- TCP(TLS/1.0) c####.i####.com:443
- TCP(TLS/1.0) secu####.i####.com:443
- TCP(TLS/1.0) iqiy####.com.edg####.net:443
- TCP(TLS/1.0) nl####.i####.com:443
DNS requests:
- a####.i####.com
- a####.u####.com
- act.vip.i####.com
- ak####.i####.i####.com
- ak####.i####.i####.com
- ak####.i####.i####.com
- api####.i####.com
- api.durianc####.com
- b.scoreca####.com
- c####.i####.com
- c####.m.i####.com
- c####.v####.i####.com
- c.g####.qq.com
- contr####.i####.com
- d####.b####.com
- d####.v####.i####.com
- d.g####.qq.com
- emotico####.i####.com
- hm.b####.com
- i####.i####.com
- i####.iqiy####.com
- imgc####.qq.com
- m####.71.am
- m####.qy.net
- m.i####.com
- m.iqiy####.com
- mi.g####.qq.com
- msg.i####.com
- nl####.i####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.ugd####.com
- pa####.i####.com
- pub.m.i####.com
- qzones####.g####.cn
- s####.e.qq.com
- secu####.i####.com
- si.ei.senb####.com
- st####.i####.com
- subscri####.i####.com
- t####.m.cn.####.com
- t7z.c####.i####.com
- v.g####.qq.com
- www.51bt####.com
- www.iqiy####.com
HTTP GET requests:
- a####.i####.com/feed/get_feeds?wallId=####&count=####&version=####&hasRe...
- a####.i####.com/feed/outline?hasRecomFeed=####&feedTypes=####&circleid=#...
- act.vip.i####.com/interact/api/show?P00001=####&code=####&platform=####&...
- api####.i####.com/index/front?area=####&cid=####&dim=####&len=####
- api####.i####.com/index/top?utype=####&cid=####&dim=####&len=####&area=#...
- b.scoreca####.com.####.net/beacon.js
- c####.m.i####.com/jp/tmts/1278202000/78a822b12fcc7ff9a03c980fd9d84cf9/?u...
- c####.v####.i####.com/jp/pc/1268632800,1275941900,1256172800/?qyid=####&...
- c####.v####.i####.com/jp/pc/203472101,218014601,203559501/?_=####&callba...
- c.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=...
- contr####.i####.com/control/content_config?business=####&is_iqiyi=####&i...
- d####.b####.com/x.gif?he=[mag####&prot_ver=####&app_id=####&rnd=####&log...
- d####.b####.com/x.js?si=####&dm=####
- d####.v####.i####.com/v.mp4?_=####&callback=####
- d####.v####.i####.com/videos/other/20180816/0b/5d/24f8ea291a187d7422d0b0...
- d.g####.qq.com/fcg-bin/gdt_appdetail.fcg?ico=####&op_appid=####
- emotico####.i####.com/jaguar-core/query_config?bussiness=####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?5df871a####
- i####.com.edg####.net/
- i####.com.edg####.net/a_19rrh5bu5h.html
- i####.com.edg####.net/css/2018062517/h5-mine-aura.css
- i####.com.edg####.net/css/20180710/h5-album-aura.css
- i####.com.edg####.net/css/20180710/h5-paopao-play-aura.css
- i####.com.edg####.net/css/20180710/h5-reportFaq-aura.css
- i####.com.edg####.net/css/2018080717/h5-play-aura.css
- i####.com.edg####.net/css/2018082017/h5-aura.css
- i####.com.edg####.net/ext/common/auraIcon/iconfont.ttf
- i####.com.edg####.net/ext/common/auraIcon20180622/iconfont.ttf
- i####.com.edg####.net/js/common/7d183edd03bc4414b315e8964fb41826.js
- i####.com.edg####.net/js/common/ares4-h5.min.js
- i####.com.edg####.net/js/html5/js/app/app.e79ab6f61994dc914557.js
- i####.com.edg####.net/js/html5/js/app/chunk-vendors.70ec8e9ef67bb4e5ee2a...
- i####.com.edg####.net/js/html5/js/lib/clipboard.min.js
- i####.com.edg####.net/js/html5/js/lib/h5lib.removesea.1.0.1.js
- i####.com.edg####.net/js/html5/js/lib/lib.2.0.8.min.js?sea1.2.####
- i####.com.edg####.net/js/html5/js/lib/qoe.3.0.3.min.js?v=####
- i####.com.edg####.net/js/html5/js/page/feedback/993de20e92!app.js
- i####.com.edg####.net/js/html5/js/page/newAlbum/eb23a59b94!app.js
- i####.com.edg####.net/js/html5/js/page/newChannel/669821d1ae!app.js
- i####.com.edg####.net/js/html5/js/page/playLong/14b0effce6!app.js
- i####.com.edg####.net/m5/feedback/FAQ.html
- i####.com.edg####.net/shaoer/
- i####.com.edg####.net/u/record
- i####.com.edg####.net/v_19rqzjjmkc.html
- i####.i####.com/irt?_iwt_t=####&_iwt_id=####&_iwt_UA=####&r=####
- iqiy####.com.edg####.net/common/20171106/ac/1b/vip_100000_v_601_0_60.png
- iqiy####.com.edg####.net/common/20180322/b78ffa490af04be394dc908de16f1e3...
- iqiy####.com.edg####.net/common/20180509/70ea099b771d43189d4cf0d7ffd7a16...
- iqiy####.com.edg####.net/common/20180509/9c64fce5ad2940d289c84c5586085b0...
- iqiy####.com.edg####.net/common/20180510/d9bd60258fac424a8aa71068559efeb...
- iqiy####.com.edg####.net/common/20180627/reliao_1530091658440.png
- iqiy####.com.edg####.net/common/fix/h5-aura/channel-icon-20180119.png
- iqiy####.com.edg####.net/common/fix/h5-aura/foot.png
- iqiy####.com.edg####.net/common/fix/h5-aura/icon-handMore.png
- iqiy####.com.edg####.net/common/fix/h5-aura/imgLogo-b.png
- iqiy####.com.edg####.net/common/fix/h5-aura/imgLogo-s.png
- iqiy####.com.edg####.net/common/fix/h5-aura/iqiyi-logo.png
- iqiy####.com.edg####.net/common/fix/h5-aura/iqydown-flow.jpg
- iqiy####.com.edg####.net/common/fix/h5-aura/kefu-icon.png
- iqiy####.com.edg####.net/common/fix/h5-aura/menu-more-icon.png
- iqiy####.com.edg####.net/common/fix/h5-aura/nav-linebg.png
- iqiy####.com.edg####.net/common/fix/h5-aura/picicon-bg-20180509.png
- iqiy####.com.edg####.net/common/fix/h5-aura/playPage-icon-20180228.png
- iqiy####.com.edg####.net/common/fix/h5-aura/player-bg.png
- iqiy####.com.edg####.net/common/fix/h5-aura/player-default-logo.png
- iqiy####.com.edg####.net/common/fix/h5-aura/player-iqy-rap-icon.png
- iqiy####.com.edg####.net/common/fix/h5-aura/pp-entrance-icon.png
- iqiy####.com.edg####.net/common/fix/h5-aura/qibabu-pop-close-new.png
- iqiy####.com.edg####.net/common/fix/h5-aura/rank-num-bg.png
- iqiy####.com.edg####.net/common/fix/h5-aura/report-faq.png
- iqiy####.com.edg####.net/common/fix/h5-aura/tab-navbg-20171011.png
- iqiy####.com.edg####.net/common/fix/h5-aura/video-pp.png
- iqiy####.com.edg####.net/common/fix/h5-paopao/current3.png
- iqiy####.com.edg####.net/common/fix/h5-paopao/paopao-xiaopao.png
- iqiy####.com.edg####.net/common/fix/h5-paopao/pgc-icons2.png
- iqiy####.com.edg####.net/common/fix/h5-paopao/share-icons1.png
- iqiy####.com.edg####.net/common/fix/h5-v3/am-update-icon.png
- iqiy####.com.edg####.net/common/fix/h5-v3/horizontal-img-220-124.jpg
- iqiy####.com.edg####.net/common/fix/h5-v3/iqy-linklogo.png
- iqiy####.com.edg####.net/common/fix/h5-v3/loading-green-circle.png
- iqiy####.com.edg####.net/common/fix/h5-v3/player-tip-bg.jpg
- iqiy####.com.edg####.net/common/fix/headicons/female-130.png
- iqiy####.com.edg####.net/common/fix/headicons/male-130.png
- iqiy####.com.edg####.net/common/lego/20170915/35d844f8af07412e9980d56cb7...
- iqiy####.com.edg####.net/common/lego/20170915/3e2d8d029f104eea9261ef9dca...
- iqiy####.com.edg####.net/common/lego/20170915/5909cbd78fd44f6fa3d9b78dc9...
- iqiy####.com.edg####.net/common/lego/20170915/7df91c03d5db4113848f7ca1b9...
- iqiy####.com.edg####.net/common/lego/20170915/bc4532a1bfd64f3c929b6f9200...
- iqiy####.com.edg####.net/common/lego/20170921/3ba9004a0a1e43939cf4631a5f...
- iqiy####.com.edg####.net/common/lego/20180201/34b505af4dad4528a87cb15e2e...
- iqiy####.com.edg####.net/common/lego/20180313/1ec63628efbb4f75a5e75f94e1...
- iqiy####.com.edg####.net/common/lego/20180330/e7e094c6cc2142afbfb5aaf9f2...
- iqiy####.com.edg####.net/common/lego/20180424/064f2e9901b54731926fea7cca...
- iqiy####.com.edg####.net/common/lego/20180527/322f29ea82774f83862603d904...
- iqiy####.com.edg####.net/common/lego/20180809/e185308410d34b7183cb92c25f...
- iqiy####.com.edg####.net/common/lego/20180817/2461a180b7cf4f759cd7bc3250...
- iqiy####.com.edg####.net/common/lego/20180820/802bbb62a5a34ad19d5206eef7...
- iqiy####.com.edg####.net/common/lego/20180820/f1368c8fec144569a9b1b0c1f4...
- iqiy####.com.edg####.net/common/lego/20180821/c7976ce4a2234133b69d9cd5ae...
- iqiy####.com.edg####.net/common/lego/20180823/7fc50d3ed98a489b8021b42a3b...
- iqiy####.com.edg####.net/common/lego/20180824/5adff6021622409490306f3295...
- iqiy####.com.edg####.net/common/lego/20180824/711f410e951a41f6ada68c46dc...
- iqiy####.com.edg####.net/common/lego/20180825/ad9b526d3b99432fac68adef52...
- iqiy####.com.edg####.net/common/lego/20180826/000fc6357d6a42ac8a906cce40...
- iqiy####.com.edg####.net/common/lego/20180826/13a0806cdbfe4946a7709a9a0c...
- iqiy####.com.edg####.net/common/lego/20180826/60ad52debd374b3aa6c63ea4e4...
- iqiy####.com.edg####.net/common/lego/20180826/df1442860f634eb99ce5ee07b4...
- iqiy####.com.edg####.net/image/20140608/e6/25/v_106559739_m_601_m2_284_1...
- iqiy####.com.edg####.net/image/20170629/a4/0e/v_109319392_m_601_m4_284_1...
- iqiy####.com.edg####.net/image/20170829/7e/ae/a_100030416_m_601_m5_284_1...
- iqiy####.com.edg####.net/image/20170829/95/73/a_100014963_m_601_m4_284_1...
- iqiy####.com.edg####.net/image/20170829/e8/7e/a_100020026_m_601_m14_160_...
- iqiy####.com.edg####.net/image/20180109/9b/31/a_100107144_m_601_m6_160_9...
- iqiy####.com.edg####.net/image/20180323/df/10/v_115294891_m_601_284_160....
- iqiy####.com.edg####.net/image/20180326/ae/5a/v_115340116_m_601_284_160....
- iqiy####.com.edg####.net/image/20180613/3f/cc/v_116691444_m_601_m1_284_1...
- iqiy####.com.edg####.net/image/20180713/12/42/v_117337136_m_601_284_160....
- iqiy####.com.edg####.net/image/20180715/7b/70/v_117379862_m_601_284_160....
- iqiy####.com.edg####.net/image/20180718/fd/78/v_117448236_m_601_284_160....
- iqiy####.com.edg####.net/image/20180724/bd/86/v_117599259_m_601_284_160....
- iqiy####.com.edg####.net/image/20180725/78/52/v_117633078_m_601_284_160....
- iqiy####.com.edg####.net/image/20180801/92/fd/v_117785769_m_601_m3_284_1...
- iqiy####.com.edg####.net/image/20180802/7b/d2/a_100170931_m_601_m1_128_1...
- iqiy####.com.edg####.net/image/20180808/67/0b/v_117959766_m_601_m1_284_1...
- iqiy####.com.edg####.net/image/20180811/d2/91/v_118034760_m_601_284_160....
- iqiy####.com.edg####.net/image/20180815/04/6f/v_118147632_m_601_284_160....
- iqiy####.com.edg####.net/image/20180815/3d/76/v_118147636_m_601_284_160....
- iqiy####.com.edg####.net/image/20180815/3f/50/v_118147626_m_601_284_160....
- iqiy####.com.edg####.net/image/20180815/9b/d7/v_118147629_m_601_284_160....
- iqiy####.com.edg####.net/image/20180815/ae/e3/v_118147625_m_601_284_160....
- iqiy####.com.edg####.net/image/20180815/ce/aa/v_118147640_m_601_284_160....
- iqiy####.com.edg####.net/image/20180815/e2/b7/v_118147620_m_601_284_160....
- iqiy####.com.edg####.net/image/20180818/df/79/v_118196392_m_601_m4_160_9...
- iqiy####.com.edg####.net/image/20180820/56/32/v_118226895_m_601_m5_284_1...
- iqiy####.com.edg####.net/image/20180820/7b/d2/a_100170931_m_601_m8_260_3...
- iqiy####.com.edg####.net/image/20180826/0f/a8/v_118418984_m_601_m3_284_1...
- iqiy####.com.edg####.net/image/20180826/0f/a8/v_118418984_m_601_m3_480_2...
- iqiy####.com.edg####.net/u3/image/20180819/39/39/uv_5027818798_m_601_480...
- iqiy####.com.edg####.net/u7/image/20180822/0c/60/uv_3084004282_m_601_284...
- iqiy####.com.edg####.net/u7/image/20180823/81/ff/uv_628780088_m_601_284_...
- iqiy####.com.edg####.net/u7/image/20180823/c1/66/uv_5028355634_m_601_480...
- iqiy####.com.edg####.net/u7/image/20180826/01/f7/uv_3084283869_m_601_720...
- m####.qy.net/b?s1=####&s2=####&rfr=####&msrc=####&vfm=####&ve=####&ce=##...
- m####.qy.net/b?t=####&bstp=####&pf=####&p=####&p1=####&u=####&pu=####&bl...
- m####.qy.net/b?t=####&pf=####&p=####&p1=####&u=####&pu=####&jsuid=####&c...
- m####.qy.net/cp2.gif?p=####&rd=####&rc=####&t=####&e=####&y=####&u=####&...
- m####.qy.net/cp2.gif?p=####&t=####&lc=####&e=####&y=####&u=####&a=####&a...
- m####.qy.net/cp2.gif?p=####&t=####&lc=####&e=####&y=####&u=####&av=####&...
- m####.qy.net/cp2.gif?p=####&t=####&oi=####&ri=####&di=####&fi=####&e=###...
- m####.qy.net/cp2.gif?p=####&t=####&rc=####&rd=####&ai=####&e=####&y=####...
- m####.qy.net/cp2.gif?p=####&t=####&x=####&e=####&y=####&u=####&a=####&av...
- m####.qy.net/cp2.gif?t=####&p=####&od=####&ct=####&dp=####&as=####&x=###...
- m####.qy.net/jpb.gif?rdm=####&qtcurl=####&rfr=####&flshuid=####&lrfr=###...
- m####.qy.net/pop?t=####&p1=####&u=####&pu=####&mkey=####&wallid=####&wal...
- m####.qy.net/tmpstats.gif?type=####&des=####&mse=####&p2p=####&p=####
- m####.qy.net/tmpstats.gif?usract=####&event_id=####&bkt=####&area=####&t...
- m####.qy.net/vodpb.gif?rec=####&mse=####&url=####&fetch=####&rtc=####&ws...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
- miao####.i####.com/x/k=2091919&p=7HQIV&dx=__IPDX__&rt=2&ns=95.211.190.19...
- msg.i####.com/b?t=####&bstp=####&pf=####&p=####&p1=####&u=####&pu=####&b...
- msg.i####.com/b?t=####&pf=####&p=####&p1=####&u=####&pu=####&jsuid=####&...
- msg.i####.com/jpb.gif?rdm=####&qtcurl=####&rfr=####&flshuid=####&lrfr=##...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.appcache
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg02.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg03.jpg
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg07.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close02.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close03.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon....
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon_...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/gdt_logo_black...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-close.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/inter_close_lo...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/popup_ad_car_b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/score.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/sdk_bg.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tc-gdt-sdk-ope...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.appcache
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.html
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/i...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- pa####.i####.com/apis/e/paopao/list.action?authcookie=####&m_device_id=#...
- pa####.i####.com/apis/e/starwall/basic_wall.action?wallId=####&qypid=###...
- s####.tc.qq.com/gdt/0/DAAHU5BAKAAPAAAjBbSHTKAgBsMSJi.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/transformer_3390932327314057719_1533623667_114.jpg...
- s####.tc.qq.com/gdt/0/transformer_7965249044853711888_1534930358_114.jpg...
- secu####.i####.com/api/getNewAdInfo?pageName=####&appNum=####&key=####&v...
- secu####.i####.com/jp/h5/albums/228622601?callback=####
- secu####.i####.com/jp/h5/count/play/1278202000?_=####&callback=####
- secu####.i####.com/jp/h5/count/play/228622601?_=####&callback=####
- secu####.i####.com/jp/h5/play/fragment/1278202000/?albumId=####&_=####&c...
- secu####.i####.com/jp/h5/recommend/videos/?area=####&size=####&type=####...
- secu####.i####.com/jp/h5/recommend/videos/?page=####&size=####&area=####...
- subscri####.i####.com/dingyue/api/isSubscribed.action?agent_type=####&su...
- t7z.c####.i####.com/show2?e=AF48R####&h=####&a=####&u=####&p=####&s=####...
- t7z.c####.i####.com/track2?f=####&g=####&h=####&i=####&j=####&k=####&n=#...
- t7z.c####.i####.com/track2?w=####&dts=####&nr=####&c=####&f=####&g=####&...
- vide####.i####.com.####.net/videos/other/20180816/0b/5d/24f8ea291a187d74...
HTTP POST requests:
- a####.u####.com/app_logs
- api.durianc####.com/video/v1/config.jsp
- api.durianc####.com/video/v1/info.jsp
- s####.e.qq.com/activate
- s####.e.qq.com/click
- s####.e.qq.com/msg
- si.ei.senb####.com/P/e4d6l
- si.ei.senb####.com/sl/MKG/Nw/d646k
- v.g####.qq.com/gdt_stats.fcg
- www.51bt####.com/apps/client/GetAppData8.php
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/65e0775c716622ec8f14b7ac8cd050db.temp
- /data/data/####/Alvin2.xml
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/ContextData.xml
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/WebViewSettings.xml
- /data/data/####/_i-1539603061.xml
- /data/data/####/_w-1539603061.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.uinixeea.jar
- /data/data/####/com.yujinwe.az.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/f_000036
- /data/data/####/f_000037
- /data/data/####/f_000038
- /data/data/####/f_000039
- /data/data/####/f_00003a
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_plugin.tmp.sig
- /data/data/####/gdt_suid
- /data/data/####/index
- /data/data/####/mscom.xhxm.media.e.xml
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/update_lc
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/zce4d646b.xml
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/xhxm
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- DES
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- DES
- RSA-ECB-PKCS1Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
