Adware.Gexin.3013

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) w####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) api.map.b####.com:80
TCP(HTTP/1.1) www.pand####.cn:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) m.w####.cn:80
TCP(HTTP/1.1) pco####.ta####.com:80
TCP(HTTP/1.1) kln.g####.sina####.com:80
TCP(HTTP/1.1) m1.pand####.cn:80
TCP(TLS/1.0) kln.g####.sina####.com:443
TCP(TLS/1.0) 2####.58.212.142:443
TCP(TLS/1.0) weib####.g####.sina####.com:443
TCP(TLS/1.0) tvaw####.g####.sina####.com:443
TCP(TLS/1.0) imgaliy####.mia####.com:443
TCP(TLS/1.0) w####.com.edg####.net:443
TCP(TLS/1.0) m.w####.cn:443

DNS requests:

api.map.b####.com
c####.mm####.com
c.c####.com
h5.sin####.cn
i####.pand####.cn
imgaliy####.mia####.com
l####.tbs.qq.com
m.w####.cn
m1.pand####.cn
pand####.cn
pco####.c####.com
s11.c####.com
sit####.b####.com
t####.sin####.cn
u.pand####.cn
w####.com
ww1.sin####.cn
ww2.sin####.cn
ww3.sin####.cn
ww4.sin####.cn
www.pand####.cn
www.w####.com
wx1.sin####.cn
wx2.sin####.cn
z13.c####.com

HTTP GET requests:

api.map.b####.com/getscript?v=####&ak=####&services=####&t=####
api.map.b####.com/images/blank.gif?product=####&v=####&t=####&code=####
c.c####.com/core.php?web_id=####&t=####
c.c####.com/z_stat.php?id=####&web_id=####
gm.mm####.com/9.gif?abc=####&rnd=####
kln.g####.sina####.com/upload/2015/06/12/2/toolbar_icon_discuss_default....
m.w####.cn/5066970342?&jumpfrom=####
m1.pand####.cn/Api/PlatProps/CheckAppVersion?AppType=####
m1.pand####.cn/Api/PlatProps/CheckAppVersion?isDiff=####&android=####&ap...
m1.pand####.cn/Article/Detail?id=####&title=####
m1.pand####.cn/assets/2018/04/29/3311e2b6451-275220_jpg!800x800.jpg
m1.pand####.cn/assets/2018/04/29/336cc5a2041-143150_jpg!800x800.jpg
m1.pand####.cn/assets/2018/04/30/342bcb57815-9600_png!100x100.png
m1.pand####.cn/assets/2018/04/30/342d5249197-9600_png!100x100.png
m1.pand####.cn/assets/2018/04/30/34445b91613-11097_png!100x100.png
m1.pand####.cn/assets/2018/04/30/344a57e3093-13357_png!100x100.png
m1.pand####.cn/assets/2018/04/30/344f7449582-10445_png!100x100.png
m1.pand####.cn/assets/2018/05/25/2b1b2c01005-333809_jpg!1500x1500.jpg
m1.pand####.cn/assets/2018/06/04/26a989b9071-188862_jpg!1134x1134.jpg
m1.pand####.cn/assets/2018/06/07/6bf72da6890-278499_jpg!800x800.jpg
m1.pand####.cn/assets/2018/06/09/17785741169-207933_jpg!1181x1181.jpg
m1.pand####.cn/assets/2018/06/09/565c7073129-165210_jpg!1181x1181.jpg
m1.pand####.cn/assets/2018/06/11/3371cf62134-367579_jpg!1600x1600.jpg
m1.pand####.cn/assets/2018/06/13/51728ba6527-197721_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/13/58a3bee6517-193712_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/14/1315d5c5096-215221_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/14/14e9b2c2154-142140_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/15/2818b762328-328732_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/15/342edc23511-287559_jpg!500x500.jpg
m1.pand####.cn/assets/2018/06/22/262c1bd6158-146419_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/22/2aedeb87633-216248_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/06/28/342ea739109-182276_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/07/04/34014673366-203384_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/07/09/2b856359714-187466_jpg!640x1000.jpg
m1.pand####.cn/assets/2018/07/14/2a6476c6096-373514_jpg!750x750.jpg
m1.pand####.cn/assets/2018/07/14/347400a9206-141520_jpg!800x800.jpg
m1.pand####.cn/assets/2018/07/14/34ad2862347-245984_jpg!750x1177.jpg
m1.pand####.cn/assets/2018/08/14/5715ae04022-35587_jpg!800x800.jpg
m1.pand####.cn/assets/2018/08/27/57123821718-290079_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/08/28/628900e8944-139555_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/08/29/62291bf5449-109299_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/08/30/33e34ed4478-130518_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/08/31/273c9f34552-146547_jpg!750x360.jpg
m1.pand####.cn/assets/2018/08/31/28268413640-263747_jpg!750x360.jpg
m1.pand####.cn/assets/2018/08/31/282c1159052-197548_jpg!750x360.jpg
m1.pand####.cn/assets/2018/08/31/288d76f5375-15889_png!200x200.png
m1.pand####.cn/assets/2018/08/31/28a39939231-16175_png!200x200.png
m1.pand####.cn/assets/2018/09/01/5a5b8d01922-180883_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/03/5793c865774-16139_png!167x167.png
m1.pand####.cn/assets/2018/09/03/5874de58368-117046_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/04/57ef4827425-114543_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/06/592eed18056-210562_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/12/18a84157246-211032_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/12/1d1f0538775-176727_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/12/1d6d10b6814-151158_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/12/e588cc6619-140011_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/14/4fa69649668-245612_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/14/61ac8524913-252563_png!659x169.png
m1.pand####.cn/assets/2018/09/15/27663322525-175840_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/25/137bec73744-180351_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/25/29051744113-140275_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/25/29960c89336-159524_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/25/501c4315248-136623_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/25/6191cd86355-114949_jpg!1000x1000.jpg
m1.pand####.cn/assets/2018/09/25/6278cd05919-194070_jpg!1000x1000.jpg
m1.pand####.cn/assets/images/loading-74-74.gif
pco####.ta####.com/app.gif?&cna=####
w####.com/5066970342
www.pand####.cn/?title=####
www.pand####.cn/authorization/index.html
www.pand####.cn/html/news/index.html
www.pand####.cn/statics/css/base_news.css
www.pand####.cn/statics/css/reset_index.css
www.pand####.cn/statics/css/style.css
www.pand####.cn/statics/css/style_news.css
www.pand####.cn/statics/images/bg.jpg
www.pand####.cn/statics/images/bg_1.jpg
www.pand####.cn/statics/images/bg_2.jpg
www.pand####.cn/statics/images/bg_3.jpg
www.pand####.cn/statics/images/border.png
www.pand####.cn/statics/images/controls.png
www.pand####.cn/statics/images/loading.gif
www.pand####.cn/statics/images/loading_background.png
www.pand####.cn/statics/images/logo.png
www.pand####.cn/statics/images/mask.png
www.pand####.cn/statics/images/music.png
www.pand####.cn/statics/images/overlay.png
www.pand####.cn/statics/images/p2-4.png
www.pand####.cn/statics/images/p2-5.png
www.pand####.cn/statics/images/p2-6.png
www.pand####.cn/statics/images/progress.gif
www.pand####.cn/statics/images/ui-bg-tabbtn.png
www.pand####.cn/statics/images/ui-case-eye.png
www.pand####.cn/statics/images/ui-contact-wechat.png
www.pand####.cn/statics/images/ui-contact-weibo.png
www.pand####.cn/statics/images/ui-plax-bird2.png
www.pand####.cn/statics/images/ui-plax-bird3.png
www.pand####.cn/statics/images/ui-plax-design.png
www.pand####.cn/statics/images/ui-plax-logo.png
www.pand####.cn/statics/images/ui-plax-xiongzai-other.png
www.pand####.cn/statics/images/ui-plax-xiongzai.png
www.pand####.cn/statics/images/ui-title-about.png
www.pand####.cn/statics/images/ui-title-authorization.png
www.pand####.cn/statics/images/ui-title-contact.png
www.pand####.cn/statics/images/ui-title-news.png
www.pand####.cn/statics/images/ui-title-theatre.png
www.pand####.cn/statics/images/wechat.jpg
www.pand####.cn/statics/images/works_ahover.png
www.pand####.cn/statics/images/xz.mp3
www.pand####.cn/statics/js/Slide.js
www.pand####.cn/statics/js/app.min.js?ver=####
www.pand####.cn/statics/js/f2e.js
www.pand####.cn/statics/js/f2e_authorization.js
www.pand####.cn/statics/js/global.js
www.pand####.cn/statics/js/html5.js
www.pand####.cn/statics/js/init.min.js
www.pand####.cn/statics/js/jquery-1.8.2.min.js
www.pand####.cn/statics/js/jquery-ui.min.js
www.pand####.cn/statics/js/jquery.colorbox-min.js
www.pand####.cn/statics/js/jquery.min.js
www.pand####.cn/statics/js/jquery.nav.js
www.pand####.cn/statics/js/jquery.plugin.js
www.pand####.cn/statics/js/jquery.poshytip.js
www.pand####.cn/statics/js/jquery.scrollTo.js
www.pand####.cn/statics/js/jquery.waypoints.js
www.pand####.cn/statics/js/main.js
www.pand####.cn/statics/js/mosaic.1.0.1.js
www.pand####.cn/statics/js/plax.js
www.pand####.cn/statics/js/script.js
www.pand####.cn/statics/js/script_news.js
www.pand####.cn/statics/js/system/util/objectUtil.js?ver=####
www.pand####.cn/thetare_1.html
www.pand####.cn/thetare_2.html
www.pand####.cn/thetare_3.html
www.pand####.cn/thetare_4.html
www.pand####.cn/uploadfile/2015/0613/20150613014318747.jpg
www.pand####.cn/uploadfile/2015/0613/20150613015029577.jpg
www.pand####.cn/uploadfile/2015/0613/20150613015055686.jpg
www.pand####.cn/uploadfile/2015/0615/20150615095226420.jpg
www.pand####.cn/uploadfile/2015/0615/20150615095424660.jpg
www.pand####.cn/uploadfile/2015/0615/20150615095604279.jpg
www.pand####.cn/uploadfile/2015/0615/20150615095734237.jpg
www.pand####.cn/uploadfile/2015/0615/20150615095921470.jpg
www.pand####.cn/uploadfile/2015/0615/20150615100034735.jpg
www.pand####.cn/uploadfile/2016/0922/thumb_300_130_20160922104308882.jpg
www.pand####.cn/uploadfile/2016/0922/thumb_300_130_20160922110309993.jpg
www.pand####.cn/uploadfile/2016/1007/20161007015629233.jpg
www.pand####.cn/uploadfile/haibao/01_1.jpg
www.pand####.cn/uploadfile/haibao/02_1.jpg
www.pand####.cn/uploadfile/haibao/03_1.jpg
www.pand####.cn/uploadfile/image/20130117/20121228095610_28712.jpg
www.pand####.cn/uploadfile/juchang/01/01.jpg
www.pand####.cn/uploadfile/juchang/01/02.jpg
www.pand####.cn/uploadfile/juchang/01/03.jpg
www.pand####.cn/uploadfile/juchang/01/04.jpg
www.pand####.cn/uploadfile/juchang/01/05.jpg
www.pand####.cn/uploadfile/juchang/01/06.jpg
www.pand####.cn/uploadfile/juchang/01/07.jpg
www.pand####.cn/uploadfile/juchang/01/08.jpg
www.pand####.cn/uploadfile/juchang/01/09.jpg
www.pand####.cn/uploadfile/juchang/01/10.jpg
www.pand####.cn/uploadfile/juchang/01/11.jpg
www.pand####.cn/uploadfile/juchang/01/12.jpg
www.pand####.cn/uploadfile/juchang/01/13.jpg
www.pand####.cn/uploadfile/juchang/01/14.jpg
www.pand####.cn/uploadfile/juchang/01/15.jpg
www.pand####.cn/uploadfile/juchang/01/16.jpg
www.pand####.cn/uploadfile/juchang/01/17.jpg
www.pand####.cn/uploadfile/juchang/01/18.jpg
www.pand####.cn/uploadfile/juchang/01/19.jpg
www.pand####.cn/uploadfile/juchang/01/20.jpg
www.pand####.cn/uploadfile/juchang/01/21.jpg
www.pand####.cn/uploadfile/juchang/01/22.jpg
www.pand####.cn/uploadfile/juchang/01/23.jpg
www.pand####.cn/uploadfile/juchang/01/24.jpg
www.pand####.cn/uploadfile/juchang/01/25.jpg
www.pand####.cn/uploadfile/juchang/01/26.jpg
www.pand####.cn/uploadfile/juchang/01/27.jpg
www.pand####.cn/uploadfile/juchang/01/28.jpg
www.pand####.cn/uploadfile/juchang/01/29.jpg
www.pand####.cn/uploadfile/juchang/01/30.jpg
www.pand####.cn/uploadfile/juchang/01/31.jpg
www.pand####.cn/uploadfile/juchang/01/32.jpg
www.pand####.cn/uploadfile/juchang/01/33.jpg
www.pand####.cn/uploadfile/juchang/01/34.jpg
www.pand####.cn/uploadfile/juchang/01/35.jpg
www.pand####.cn/uploadfile/juchang/01/36.jpg
www.pand####.cn/uploadfile/juchang/01/37.jpg
www.pand####.cn/uploadfile/juchang/01/38.jpg
www.pand####.cn/uploadfile/juchang/01/39.jpg
www.pand####.cn/uploadfile/juchang/01/40.jpg
www.pand####.cn/uploadfile/juchang/01/41.jpg
www.pand####.cn/uploadfile/juchang/01/42.jpg
www.pand####.cn/uploadfile/juchang/01/43.jpg
www.pand####.cn/uploadfile/juchang/01/44.jpg
www.pand####.cn/uploadfile/juchang/01/45.jpg
www.pand####.cn/uploadfile/juchang/01/46.jpg
www.pand####.cn/uploadfile/juchang/01/47.jpg
www.pand####.cn/uploadfile/juchang/01/48.jpg
www.pand####.cn/uploadfile/juchang/01/49.jpg
www.pand####.cn/uploadfile/juchang/01/50.jpg
www.pand####.cn/uploadfile/juchang/01/51.jpg
www.pand####.cn/uploadfile/juchang/01/52.jpg
www.pand####.cn/uploadfile/juchang/02/01.jpg
www.pand####.cn/uploadfile/juchang/02/02.jpg
www.pand####.cn/uploadfile/juchang/02/03.jpg
www.pand####.cn/uploadfile/juchang/02/04.jpg
www.pand####.cn/uploadfile/juchang/02/05.jpg
www.pand####.cn/uploadfile/juchang/02/06.jpg
www.pand####.cn/uploadfile/juchang/02/07.jpg
www.pand####.cn/uploadfile/juchang/02/08.jpg
www.pand####.cn/uploadfile/juchang/02/09.jpg
www.pand####.cn/uploadfile/juchang/02/10.jpg
www.pand####.cn/uploadfile/juchang/02/11.jpg
www.pand####.cn/uploadfile/juchang/02/12.jpg
www.pand####.cn/uploadfile/juchang/02/13.jpg
www.pand####.cn/uploadfile/juchang/02/14.jpg
www.pand####.cn/uploadfile/juchang/02/15.jpg
www.pand####.cn/uploadfile/juchang/02/16.jpg
www.pand####.cn/uploadfile/juchang/02/17.jpg
www.pand####.cn/uploadfile/juchang/02/18.jpg
www.pand####.cn/uploadfile/juchang/02/19.jpg
www.pand####.cn/uploadfile/juchang/02/20.jpg
www.pand####.cn/uploadfile/juchang/02/21.jpg
www.pand####.cn/uploadfile/juchang/02/22.jpg
www.pand####.cn/uploadfile/juchang/02/23.jpg
www.pand####.cn/uploadfile/juchang/02/24.jpg
www.pand####.cn/uploadfile/juchang/02/25.jpg
www.pand####.cn/uploadfile/juchang/02/26.jpg
www.pand####.cn/uploadfile/juchang/02/27.jpg
www.pand####.cn/uploadfile/juchang/02/28.jpg
www.pand####.cn/uploadfile/juchang/02/29.jpg
www.pand####.cn/uploadfile/juchang/02/30.jpg
www.pand####.cn/uploadfile/juchang/02/31.jpg
www.pand####.cn/uploadfile/juchang/02/32.jpg
www.pand####.cn/uploadfile/juchang/02/33.jpg
www.pand####.cn/uploadfile/juchang/02/34.jpg
www.pand####.cn/uploadfile/juchang/02/35.jpg
www.pand####.cn/uploadfile/juchang/02/36.jpg
www.pand####.cn/uploadfile/juchang/02/37.jpg
www.pand####.cn/uploadfile/juchang/02/38.jpg
www.pand####.cn/uploadfile/juchang/02/39.jpg
www.pand####.cn/uploadfile/juchang/02/40.jpg
www.pand####.cn/uploadfile/juchang/02/41.jpg
www.pand####.cn/uploadfile/juchang/02/42.jpg
www.pand####.cn/uploadfile/juchang/02/43.jpg
www.pand####.cn/uploadfile/juchang/02/44.jpg
www.pand####.cn/uploadfile/juchang/02/45.jpg
www.pand####.cn/uploadfile/juchang/02/46.jpg
www.pand####.cn/uploadfile/juchang/02/47.jpg
www.pand####.cn/uploadfile/juchang/02/48.jpg
www.pand####.cn/uploadfile/juchang/02/49.jpg
www.pand####.cn/uploadfile/juchang/02/50.jpg
www.pand####.cn/uploadfile/juchang/02/51.jpg
www.pand####.cn/uploadfile/juchang/02/52.jpg
www.pand####.cn/uploadfile/juchang/03/01.jpg
www.pand####.cn/uploadfile/juchang/04/01.jpg
www.pand####.cn/uploadfile/juchang/04/02.jpg
www.pand####.cn/uploadfile/juchang/04/03.jpg
www.pand####.cn/uploadfile/juchang/04/04.jpg
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...

HTTP POST requests:

l####.tbs.qq.com/ajax?c=####&k=####
l####.tbs.qq.com/ajax?c=####&v=####&k=####
m1.pand####.cn/Api/Ad/IndexAd
m1.pand####.cn/Api/Article/HeadLine
m1.pand####.cn/Api/Product/Index
m1.pand####.cn/Api/Slide/IndexBanner
m1.pand####.cn/api/PlatProps/PlatBaseData
m1.pand####.cn/api/PlatProps/PlatVendor
m1.pand####.cn/api/PlatProps/SetUserMenuStates
m1.pand####.cn/api/PlatProps/UserMenuStates

Modified file system:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/0b64ce14b17f10e210b31193214fde1f1845e616660ac5f....0.tmp
/data/data/####/0ceff1c986f9a91d45820132d3e582de8b95dd48759c96e....0.tmp
/data/data/####/0f9a83acba42df0d7b11df8665ac630ed21e145ff5b4967....0.tmp
/data/data/####/1241399989b91df928b20f29ebad29bf2da7f153c32d5f7....0.tmp
/data/data/####/163d5aa0f06541ae8e50a7d20b043270d5b0cd7a5ffe8f3....0.tmp
/data/data/####/17bafc8588015ba4f030fa94fc4d31b8524683e3f9b1289....0.tmp
/data/data/####/29a397d8bee17938933261a49102c384452f40957d1d320....0.tmp
/data/data/####/2bc84f344867893e142c0fd7bf4bcb3a261feff0012860c....0.tmp
/data/data/####/3465faeec90634635a01fb2d8ac59c6fa8210372a7579de....0.tmp
/data/data/####/35d8727d2eba668394d36e0d2b823b44287b2d0ab41e9b1....0.tmp
/data/data/####/38621109dc8351a50e47128b3aff90616525e5f17dca34d....0.tmp
/data/data/####/4145d620b3f9e47758e90e4fbf89c16845a7f499935d92e....0.tmp
/data/data/####/438f41d196916d351ecbead185ec49b70b9475af21062dc....0.tmp
/data/data/####/517caf5fcecb5720fe2c705f704ba11f8d415d8202fd664....0.tmp
/data/data/####/551766938674fcc51eaaa4791d35c6d17a2b37e756bb3db....0.tmp
/data/data/####/581a29acbe503fb534261f2cc12135812ac5bf1c3f85af1....0.tmp
/data/data/####/59c49f33c286e7d47e73daefc0fde586a9272e0d8302586....0.tmp
/data/data/####/5b085a69866f9a41d267d87e3ada3b1c1906ff747cf8399....0.tmp
/data/data/####/5b1993cadfaf07a9d709a685288c87e80a15f322525372b....0.tmp
/data/data/####/66e6b0086ec394a3b8acdafec981c71ed314911dcb0618b....0.tmp
/data/data/####/68a63322e3d1c47c88f1867b0371a8c0ed019f2c6d70704....0.tmp
/data/data/####/6fa95f15c9ca91762e168d69d19e764eb65e634abd4c483....0.tmp
/data/data/####/70685e78e7e95981a1780d4aa260145ea3fe09c0380341c....0.tmp
/data/data/####/7325e18de1ca702429f502e6d08079fb452445372deb00c....0.tmp
/data/data/####/74dfb4d4f708f7e22e7415401dce606e3a6557e33ffed08....0.tmp
/data/data/####/759f45d1a215c55a3b715085b6e4342d02be4410f3f2e1f....0.tmp
/data/data/####/7d365d4925acc89c4e6117dff2ce78d2ea0db7f7403e111....0.tmp
/data/data/####/7d41bc32d25be31ca534e5cee87ac2d1c875948ca870e99....0.tmp
/data/data/####/7e92dcf4ffa39b38b511ced879f115c56cbdf05e44d5a86....0.tmp
/data/data/####/865af199e9265b4919b4acd75b7a0f3395b2d1b1428057c....0.tmp
/data/data/####/867d3b6a60022bd2edbefaac0d8b4d78ba8f760ab8c177d....0.tmp
/data/data/####/8765ec71eaa027a4414da50e275a809c6f393c84cd4e550....0.tmp
/data/data/####/8d1b2616e42504db0025904301aecf4a4300f2b7ef9a510....0.tmp
/data/data/####/967bf131ec91ad5e5abd61fc907e7920848152b32bc4e66....0.tmp
/data/data/####/9bda328134df5e49dba2449842d00c37bf0db06c2368584....0.tmp
/data/data/####/9fd484f3d9410417a41ee982599e117be0ee79e00b94370....0.tmp
/data/data/####/BMWEEXOPEN_NATIVE_SP.xml
/data/data/####/CookiePrefsFile.xml
/data/data/####/MultiDex.lock
/data/data/####/Updater.xml
/data/data/####/WXStorage-journal
/data/data/####/a1110162fed518ba4b7c4fc18937703acc0f10ee6dab756....0.tmp
/data/data/####/a714f4fd48b24849701579c089a6a0763598ede10f45571....0.tmp
/data/data/####/a7bff7a9e91f2d164e91b5c479e9536750a20b19a6b03c1....0.tmp
/data/data/####/ad77a21bf51b26382949813c036afebf2c0055a9751bced....0.tmp
/data/data/####/bc57703ae9f69e5af63f5b2bb599f89c09a4b453ebbab71....0.tmp
/data/data/####/bcf3727edfde36824316539d82ff430340fa25d4f4dc543....0.tmp
/data/data/####/bdbe67324a323515003d24e5631008db279d5b05863a44e....0.tmp
/data/data/####/bf75bfded0d4991c17acda41afc274babf38c1ffd9533ac....0.tmp
/data/data/####/bfc49c207723b15a435acdc04d50a4e78a63c429a9bc5c1....0.tmp
/data/data/####/c139f1bf2a7c616753e608043f383a194f5b67148fefe9f....0.tmp
/data/data/####/c14a9d7ee6dc6a8bd2d280ff81b0dc3bc4acdfdae80e3ee....0.tmp
/data/data/####/c1d4ee002ddda519818d0cd19e56f9b9e3f76f892c93a85....0.tmp
/data/data/####/c2ec2f21fc740424a555d29855bc0251474e1ff5cb7c9cb....0.tmp
/data/data/####/c62237e570b949fbed6946d588d0c039012e95a6ac29840....0.tmp
/data/data/####/c898873fc057a3d58c1808c147457a182303e1fd4de3806....0.tmp
/data/data/####/ca68c95a9e7f33704d52bc8fd14a39f241ec023651fa2a6....0.tmp
/data/data/####/cc6c6fadf838f5b52264be60e15dc836594c094e3f36f1f....0.tmp
/data/data/####/core_info
/data/data/####/d3fb35063e13c0b0ba813973d8dd8fde4ed34188bbbff42....0.tmp
/data/data/####/d6d290e86975fe7a641037bfac88eecd90759aecee4ec8d....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dbca87c42f8fbdfb9c08db9dd1e9f703f5139307ed108a3....0.tmp
/data/data/####/debug.conf
/data/data/####/df36c67faa7cb6a05c3616e4ba73c4c6f44e3de7db4c77d....0.tmp
/data/data/####/e617dcb23b33ad0020bd0519353dcdb2b396cd05bd3dadd....0.tmp
/data/data/####/ed1db85e2d493e9cdf84e27ccde7a9cd3401c9b2ce60d44....0.tmp
/data/data/####/ed8fed4a8d0751f1c48f5904bccf46b7028e1b15d34a9ab....0.tmp
/data/data/####/efc7c966176ed6b28f2c6e24c4f4bd0c5d9d3d744faf163....0.tmp
/data/data/####/efe3d84dfbd1b6713f970bf849a49cfbd548e5338ffdfc1....0.tmp
/data/data/####/f5a6189b63b65d0fed6f953cc1f751eee7070c96723c842....0.tmp
/data/data/####/f7ca666fa18b24dd55346ad8580e7d4a5ed29dd72ce5559....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/f_000039
/data/data/####/f_00003a
/data/data/####/index
/data/data/####/journal.tmp
/data/data/####/libjiagu1390117721.so
/data/data/####/libweexjsb.so
/data/data/####/multidex.version.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/Share.png
/data/media/####/ad_sel.png
/data/media/####/add.png
/data/media/####/addAddress.js
/data/media/####/addressEdit.js
/data/media/####/agencyArea.js
/data/media/####/agencyAreaStat.js
/data/media/####/agentDistribution.js
/data/media/####/appSaveImageSlider.js
/data/media/####/applyAgent.js
/data/media/####/applyUpgrade.js
/data/media/####/arror.png
/data/media/####/award.js
/data/media/####/b1.png
/data/media/####/b10.png
/data/media/####/b11.png
/data/media/####/b12.png
/data/media/####/b2.png
/data/media/####/b3.png
/data/media/####/b4.png
/data/media/####/b5.png
/data/media/####/b6.png
/data/media/####/b7.png
/data/media/####/b8.png
/data/media/####/b9.png
/data/media/####/bankEdit.js
/data/media/####/blank.html
/data/media/####/blank.png
/data/media/####/bot_arrow_1.png
/data/media/####/bot_arrow_2.png
/data/media/####/bundle.zip
/data/media/####/buy.png
/data/media/####/c10_ico.png
/data/media/####/c11_ico.png
/data/media/####/c12_ico.png
/data/media/####/c13_ico.png
/data/media/####/c14_ico.png
/data/media/####/c15_ico.png
/data/media/####/c16_ico.png
/data/media/####/c17_ico.png
/data/media/####/c18_ico.png
/data/media/####/c19_ico.png
/data/media/####/c1_ico.png
/data/media/####/c20_ico.png
/data/media/####/c21_ico.png
/data/media/####/c22_ico.png
/data/media/####/c23_ico.png
/data/media/####/c24_ico.png
/data/media/####/c25_ico.png
/data/media/####/c26_ico.png
/data/media/####/c27_ico.png
/data/media/####/c2_ico.png
/data/media/####/c31_ico.png
/data/media/####/c32_ico.png
/data/media/####/c33_ico.png
/data/media/####/c3_ico.png
/data/media/####/c4_ico.png
/data/media/####/c5_ico.png
/data/media/####/c6_ico.png
/data/media/####/c7_ico.png
/data/media/####/c8_ico.png
/data/media/####/c9_ico.png
/data/media/####/card.png
/data/media/####/card_pic.png
/data/media/####/center_bg.png
/data/media/####/close.png
/data/media/####/code.png
/data/media/####/code_ico.png
/data/media/####/collect_off.png
/data/media/####/collect_on.png
/data/media/####/commission.js
/data/media/####/cumulativeInventory.js
/data/media/####/evaluationList.js
/data/media/####/evaluationSubmission.js
/data/media/####/exchange.js
/data/media/####/face.jpg
/data/media/####/face.png
/data/media/####/face1.jpg
/data/media/####/face1.png
/data/media/####/face2.png
/data/media/####/fhadd.png
/data/media/####/font_1469606063_76593.ttf
/data/media/####/font_1469606522_9417143.woff
/data/media/####/font_zn5b3jswpofuhaor.ttf
/data/media/####/forget.js
/data/media/####/fx_ico1.png
/data/media/####/fx_ico2.png
/data/media/####/fx_ico3.png
/data/media/####/gamesList.js
/data/media/####/home_ico.png
/data/media/####/icon_close.png
/data/media/####/iconfont-eros.ttf
/data/media/####/iconfont.ttf
/data/media/####/index.js
/data/media/####/index_banner_bg.png
/data/media/####/integral.js
/data/media/####/join.js
/data/media/####/joininfo.js
/data/media/####/kefu.js
/data/media/####/kefu.png
/data/media/####/kejian.png
/data/media/####/list-card.png
/data/media/####/lmtt_ico.png
/data/media/####/loading-50-50.gif
/data/media/####/loading-74-74.gif
/data/media/####/login.js
/data/media/####/logo.png
/data/media/####/md5.json
/data/media/####/messageDetail.js
/data/media/####/messages.js
/data/media/####/modifyPwd.js
/data/media/####/msg_agent.png
/data/media/####/msg_distribution.png
/data/media/####/msg_finance.png
/data/media/####/msg_ico.png
/data/media/####/msg_order.png
/data/media/####/msg_other.png
/data/media/####/msg_system.png
/data/media/####/myCollect.js
/data/media/####/myFans.js
/data/media/####/myTeam.js
/data/media/####/n1_ico.png
/data/media/####/n2_ico.png
/data/media/####/n3_ico.png
/data/media/####/n4_ico.png
/data/media/####/n5_ico.png
/data/media/####/nav1.png
/data/media/####/nav2.png
/data/media/####/nav3.png
/data/media/####/nav4.png
/data/media/####/nav5.png
/data/media/####/nearbyStores.js
/data/media/####/none_ico.png
/data/media/####/off_check.png
/data/media/####/off_radio.png
/data/media/####/onlinekefu.png
/data/media/####/orderDetail.js
/data/media/####/orderList.js
/data/media/####/orderLogistics.js
/data/media/####/orderPay.js
/data/media/####/orderPut.js
/data/media/####/parentchildComment.js
/data/media/####/parentchildLive.js
/data/media/####/parentchildTV.js
/data/media/####/parentchildTVList.js
/data/media/####/paySuccess.js
/data/media/####/pcode_ico.png
/data/media/####/photo_ico.png
/data/media/####/pl_ico.png
/data/media/####/pl_ico1.png
/data/media/####/post_ico.png
/data/media/####/post_icoy.png
/data/media/####/price.png
/data/media/####/pro.png
/data/media/####/pro1.png
/data/media/####/pro2.png
/data/media/####/proDetail.js
/data/media/####/proList.js
/data/media/####/pro_1.png
/data/media/####/pro_2.png
/data/media/####/product1.png
/data/media/####/psd.png
/data/media/####/purchase.js
/data/media/####/purchaseApplications.js
/data/media/####/purchaseMoney.js
/data/media/####/q1.png
/data/media/####/q2.png
/data/media/####/q3.png
/data/media/####/q4.png
/data/media/####/qou.png
/data/media/####/qq_ico.png
/data/media/####/rebate.js
/data/media/####/rebatePerformance.js
/data/media/####/rebateStat.js
/data/media/####/rebateTable.js
/data/media/####/recharge.js
/data/media/####/recommendFriends.js
/data/media/####/register.js
/data/media/####/remittanceCertificate.js
/data/media/####/resetpwd.js
/data/media/####/saixuan.png
/data/media/####/salesSend.js
/data/media/####/saveImageSlider.js
/data/media/####/search.png
/data/media/####/search_ico.png
/data/media/####/sel_check.png
/data/media/####/sel_radio.png
/data/media/####/sendBackProduct.js
/data/media/####/sendGoods.js
/data/media/####/set_face.png
/data/media/####/setting.js
/data/media/####/sfz1.png
/data/media/####/sfz2.png
/data/media/####/share.js
/data/media/####/share_wx_circle.png
/data/media/####/share_wx_friend.png
/data/media/####/ship1.js
/data/media/####/ship2.js
/data/media/####/ship3.js
/data/media/####/shipOrder.js
/data/media/####/shipmentMoney.js
/data/media/####/shop.png
/data/media/####/shop_ico.png
/data/media/####/star-off.png
/data/media/####/star-on.png
/data/media/####/star.png
/data/media/####/statistics.js
/data/media/####/stock.js
/data/media/####/stockRecord.js
/data/media/####/storeDetail.js
/data/media/####/storeManage.js
/data/media/####/subordinate.js
/data/media/####/suc_pic.png
/data/media/####/t_bg.png
/data/media/####/teamOrder.js
/data/media/####/tel.png
/data/media/####/tj_banner.png
/data/media/####/top_arrow_1.png
/data/media/####/top_arrow_2.png
/data/media/####/tvDetail.js
/data/media/####/tv_ico.png
/data/media/####/tz1.png
/data/media/####/tz2.png
/data/media/####/up.jpg
/data/media/####/upgrade.js
/data/media/####/userBill.js
/data/media/####/userinfo.js
/data/media/####/vip_ico.png
/data/media/####/warehouseStock.js
/data/media/####/webView.js
/data/media/####/weix_ico.png
/data/media/####/withdraw.js
/data/media/####/withdrawList.js
/data/media/####/wx_ico.png
/data/media/####/xz_ico.png
/data/media/####/xzlogo.png
/data/media/####/yuer_ico.png
/data/media/####/zan.png
/data/media/####/zan1.png
/data/media/####/zt_ico1.png
/data/media/####/zt_ico2.png
/data/media/####/zy_img.png

Miscellaneous:

Executes next shell scripts:

/data/app-lib/<Package>-1/libweexjsb.so 50 0
chmod 755 <Package Folder>/.jiagu/libjiagu1390117721.so
getprop ro.product.cpu.abi

Loads the following dynamic libraries:

Patcher
libjiagu1390117721
weexjsc

Uses the following algorithms to encrypt data:

DESede-ECB-PKCS5Padding
RSA-ECB-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Gains access to telephone information (number, imei, etc.).

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial