Technical information
- Adware.Gexin.3.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) eco-pus####.me####.com:80
- TCP(HTTP/1.1) api.compas####.hk:80
- TCP(HTTP/1.1) pin####.qq.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(TLS/1.0) 1####.217.17.110:443
- TCP(TLS/1.0) s3-qc####.me####.com.####.com:443
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) eco####.me####.com.####.com:443
- TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
- TCP sdk.o####.t####.####.com:5224
- UDP 1####.168.126.1:137
- TCP c####.g####.ig####.com:5225
- aexcep####.b####.qq.com
- and####.b####.qq.com
- api.compas####.hk
- c####.g####.ig####.com
- c-h####.g####.com
- cdn.compas####.hk
- eco####.me####.com
- eco-pus####.me####.com
- i####.compas####.hk
- l####.compas####.hk
- log.u####.com
- mo####.compas####.hk
- pi####.qq.com
- pin####.qq.com
- plb####.u####.com
- pub-####.qin####.com
- s3-qc####.me####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sec.u####.com
- u####.u####.com
- www.compas####.hk
- api.compas####.hk/index.php/page/index/succ?id=####
- api.compas####.hk/index.php/page/index/succs?id=####
- api.compas####.hk/public/static/page/CSS/main.css?v=####
- api.compas####.hk/public/static/page/CSS/mui.min.css
- api.compas####.hk/public/static/page/JS/jquery-2.2.0.min.js
- api.compas####.hk/public/static/page/JS/mui.min.js
- api.compas####.hk/public/static/page/JS/vue.min.js
- api.compas####.hk/upload/news/P190109181847.jpg
- api.compas####.hk/upload/news/P190114105510.jpg
- eco-pus####.me####.com/pusher/websocket?browser_id=####&ent_id=####&visi...
- qin####.com.www.####.com/tdata_EDT356
- ti####.c####.l####.####.com/11.jpg?imageVi####
- ti####.c####.l####.####.com/24.jpg?imageVi####
- ti####.c####.l####.####.com/285.jpg?imageVi####
- ti####.c####.l####.####.com/43.jpg?imageVi####
- ti####.c####.l####.####.com/45.jpg?imageVi####
- ti####.c####.l####.####.com/banner-mid.jpg?imageMo####
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- ti####.c####.l####.####.com/course/img_20190212143049.jpg
- ti####.c####.l####.####.com/course/img_20190212144354.jpg
- ti####.c####.l####.####.com/course/img_20190221103947.jpg
- ti####.c####.l####.####.com/index-icons/1.png
- ti####.c####.l####.####.com/index-icons/2.png
- ti####.c####.l####.####.com/index-icons/3.png
- ti####.c####.l####.####.com/index-icons/4.png
- ti####.c####.l####.####.com/index-icons/5.png
- ti####.c####.l####.####.com/lecture20190228174550.jpg?imageMo####
- ti####.c####.l####.####.com/news/20180926172045.jpg?imageMo####
- ti####.c####.l####.####.com/news/20180926173232.jpg?imageMo####
- ti####.c####.l####.####.com/news/20180926173824.jpg?imageMo####
- ti####.c####.l####.####.com/news/20180926174321.jpg?imageMo####
- ti####.c####.l####.####.com/news/20180928135730.jpg?imageMo####
- ti####.c####.l####.####.com/news/20180928142101.jpg?imageMo####
- ti####.c####.l####.####.com/news/20181003134158.jpg?imageMo####
- ti####.c####.l####.####.com/news/20181003134328.jpg?imageMo####
- ti####.c####.l####.####.com/news1.jpg?imageVi####
- ti####.c####.l####.####.com/news2.jpg?imageVi####
- ti####.c####.l####.####.com/news3.jpg?imageVi####
- ti####.c####.l####.####.com/to-meiqia.png?imageMo####
- ti####.c####.l####.####.com/top20190212143456.jpg?imageMo####
- ti####.c####.l####.####.com/top20190212143733.jpg?imageMo####
- ti####.c####.l####.####.com/top20190301162752.jpg?imageMo####
- ti####.c####.l####.####.com/upload/news/13891-20190301175140.png
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- api.compas####.hk/index.php/api/v1/app/ads/landing
- api.compas####.hk/index.php/api/v1/app/config
- api.compas####.hk/index.php/api/v1/app/popup
- api.compas####.hk/index.php/api/v1/article/show
- api.compas####.hk/index.php/api/v1/index
- c-h####.g####.com/api.php?format=####&t=####
- pi####.qq.com/mstat/report/?index=####
- pin####.qq.com/request
- sdk.o####.p####.####.com/api.php?format=####&t=####
- /data/data/####/.imprint
- /data/data/####/4e998a75c2fd
- /data/data/####/6EduOLO3uyWHNwkShUag7ygz9QU.620948432.tmp
- /data/data/####/7SiuaGGY8RB8ku7zEZ_gmxF9iog.907676591.tmp
- /data/data/####/7orvhSxMhFHFQv5xQsB6UnySgRU.-1917000726.tmp
- /data/data/####/7wsfAbWe9NjBfaq-MIUQsIdD7zM.cnt
- /data/data/####/Alvin2.xml
- /data/data/####/BRmk087V5pDyW7ePFs6tUrHfoPc.-1775238278.tmp
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/ContextData.xml
- /data/data/####/Dr61_S_A2PABAwFsx1VVJaJiqoo.1701940033.tmp
- /data/data/####/F4sz-wmL1rGVbQ2ljI-fgIYJ_yY.cnt
- /data/data/####/IEY0hdocYgudNJVk4o1VCyg1FbI.1433866507.tmp
- /data/data/####/Meiqia.xml
- /data/data/####/MeiqiaSDK.xml
- /data/data/####/O0b9LjCRlXbdeARaKUHl9PoE6yU.1844968661.tmp
- /data/data/####/PyjTZPLiCTgdd6zKZ4lXuc2IRxs.363306313.tmp
- /data/data/####/R1OYisvnEmBAbsbyM-5YVrzykBc.1561630996.tmp
- /data/data/####/RKStorage-journal
- /data/data/####/S2vJ5T13iz4PSdcGxDT_C1O-iyw.-1368418340.tmp
- /data/data/####/SG2Z6cNQFFyrjeQoN7mMa1WYOO8.-126904289.tmp
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/WfVJ-kDkycs0fyd7KooQwDUdMSI.1668904710.tmp
- /data/data/####/XmrBTut-f_UBEwG1z47Z8eshpA0.-1928810804.tmp
- /data/data/####/ZU_FZVblxuqt0rQIh5EDeZpSyDY.985092839.tmp
- /data/data/####/Zf-nchI8j04xR32JEOJuz7Sxi8Q.-740870324.tmp
- /data/data/####/_w9munj1jXFp3-LKadKoZncq2PM.cnt
- /data/data/####/a==7.5.3&&1.1.1_1551693038966_envelope.log
- /data/data/####/a==7.5.3&&1.1.1_1551693089694_envelope.log
- /data/data/####/am40L8ttWiwjBGYI8GekHUpGtdk.-1671363941.tmp
- /data/data/####/b_IBQ1pk2XETV6EmobpR0hgqXeI.-1121412038.tmp
- /data/data/####/be7b7b05-7ca6-433e-b4b8-e26585aa3a9b
- /data/data/####/bugly_db_legu-journal
- /data/data/####/com.google.InstanceId.properties
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.guideapp.mid.world.ro.xml
- /data/data/####/com.guideapp_preferences.xml
- /data/data/####/d==7.5.3&&1.1.1_1551693040625_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693043018_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693044807_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693045937_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693048663_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693051158_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693053998_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693056777_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693059546_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693060949_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693061525_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693063006_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693065762_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693068625_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693069365_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693070245_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693071627_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693073545_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693074857_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693077746_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693080496_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693082795_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693083565_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693084340_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693085868_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693087955_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693089235_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693089815_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693091439_envelope.log
- /data/data/####/d==7.5.3&&1.1.1_1551693092765_envelope.log
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTUxNjkzMDQxNDI2;
- /data/data/####/dW1weF9zaGFyZV8xNTUxNjkzMDQwOTY1;
- /data/data/####/dW1weF9zaGFyZV8xNTUxNjkzMDQxMTE2;
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/fnjZZTjMfpx64FS0nkyxKZAFnb0.cnt
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/i==1.2.0&&1.1.1_1551693041509_envelope.log
- /data/data/####/iiabUQkxLkGtZj59mM0SvpSFqMI.2126752314.tmp
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/ldONGexYub1SqfoWy5ovwNMv53A.638057664.tmp
- /data/data/####/legu_tencent_analysis.db_com.guideapp-journal
- /data/data/####/lf5cU7LyCwsC0mAwc7GNQUwE7jM.821171880.tmp
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.0.5.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/meiqia.db
- /data/data/####/meiqia.db-journal
- /data/data/####/mix.dex
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/oAFEH64YiP-5T3DNL3OhvgEA_cA.52098390.tmp
- /data/data/####/pdIf-C24ftPEPn0_jH6xrfiWv9I.-1829650379.tmp
- /data/data/####/pri_legu_tencent_analysis.db_com.guideapp-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qRXPK0MOo28Ewwtcnya_YwejEdM.2063341584.tmp
- /data/data/####/qRXPK0MOo28Ewwtcnya_YwejEdM.cnt
- /data/data/####/qZGTvy_sMx44aO-6f8o4HRbIeJc.-615453981.tmp
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/share.db-journal
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_common_location.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/vyljksy8-k36HbostjbH9zSSOx8.-228638801.tmp
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/xZp33AU1PFCgpYVQniRB3bYY3M0.cnt
- /data/data/####/yprtfmL8mW-e34NmOjI_-eh9pnQ.-1471573087.tmp
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.mid.txt
- /data/media/####/.mid.txt1000001
- /data/media/####/.nomedia
- /data/media/####/.umm.dat
- /data/media/####/255633e1-f975-458f-b4f0-e0c2f879ad1f
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/app.db
- /data/media/####/com.guideapp.bin
- /data/media/####/com.guideapp.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/test.log
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.getui.PushCustomService 24212 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.5.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- ls /
- ls /sys/class/thermal
- mount
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.getui.PushCustomService 24212 300 0
- Bugly
- MtaNativeCrash
- getuiext2
- imagepipeline
- libfb
- libnfix
- libreactnativejni
- libshella-2.9.0.5
- libufix
- libyoga
- nfix
- securityenv
- ufix
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-NONE-PKCS1PADDING
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-GCM-NoPadding