Adware.Gexin.17378

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) p####.xxt.cn:80
TCP(HTTP/1.1) m.x####.cn:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) 2####.205.239.188:80
UDP(NTP) 2.and####.p####.####.org:123
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) p####.xxt.cn:443
TCP(TLS/1.0) 1####.114.54.3:443
TCP(TLS/1.0) 1####.15.61.197:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) 2####.58.208.110:443
TCP(TLS/1.0) m.x####.cn:443
TCP(TLS/1.0) 1####.15.61.202:443
TCP(TLS/1.0) ser####.xxt.cn:443
TCP(TLS/1.2) p####.google####.com:443

DNS requests:

2.and####.p####.####.org
api.map.b####.com
instant####.google####.com
l####.tbs.qq.com
m.x####.cn
p####.google####.com
p####.xxt.cn
safebro####.google####.com
ser####.xxt.cn
st####.xxt.cn

HTTP GET requests:

m.x####.cn/android/image/home_article.png
m.x####.cn/android/image/home_blog.png
m.x####.cn/android/image/home_course_big_logo.png
m.x####.cn/android/image/home_course_hbjxt.png
m.x####.cn/android/image/home_english.png
m.x####.cn/android/image/home_famous_book.png
m.x####.cn/android/image/home_language.png
m.x####.cn/android/image/home_poetry.png
m.x####.cn/android/image/home_ttl.png
m.x####.cn/android/image/home_ttl_big_logo.png
p####.xxt.cn/upload/2017/xxt_new/index_notice/0626/6adedc987f5b150fa69e6...
p####.xxt.cn/upload/2017/xxt_new/index_notice/0626/a0043629fe9f242b721bb...
p####.xxt.cn/upload/2017/xxt_new/index_notice/0628/ee7c8eecb01de99fd675f...
p####.xxt.cn/upload/2017/xxt_new/index_notice/0704/3b6d06a42da3be0b96fda...
p####.xxt.cn/upload/2017/xxt_new/index_notice/0706/8bf6fc850b84d6d4ec95c...
p####.xxt.cn/upload/2017/xxt_new/index_notice/0728/eed17a1253639b0ba4f5a...
p####.xxt.cn/upload/2019/xxt_new/index_notice/0817/15e4bc5e80a2897268739...

HTTP POST requests:

l####.tbs.qq.com/ajax?c=####&k=####
l####.tbs.qq.com/ajax?c=####&v=####&k=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/000925d071b0f3e8.0
/data/data/####/004a122e2dc1c6de.0
/data/data/####/008175b628019b45.0
/data/data/####/00fb7971538fec86.0
/data/data/####/032ebd8eac406f76.0
/data/data/####/0335bd06b39bc174.0
/data/data/####/04514214b4e2aaed.0
/data/data/####/0515f8a1a485f37a.0
/data/data/####/0593dc52a6060857.0
/data/data/####/061a4a66170487cd.0
/data/data/####/068b9b51479e06ec.0
/data/data/####/069a4e0420b26fa2.0
/data/data/####/06c6897c77f6122668a84c78877071bf.0.tmp
/data/data/####/06c6897c77f6122668a84c78877071bf.1.tmp
/data/data/####/07077b316ba0bfb7.0
/data/data/####/0824e182d52c33d4.0
/data/data/####/085b1a9ee1309fbf.0
/data/data/####/0861d02229bd7bc7.0
/data/data/####/08a97223f0f4b2ea.0
/data/data/####/08b17c5f600ef9b4.0
/data/data/####/08b5a68f73525025.0
/data/data/####/0ac921064193057a.0
/data/data/####/0b636bc6534d3da6.0
/data/data/####/0cc9a862f9d1f3a8.0
/data/data/####/0eeaa5cf69b6a84e.0
/data/data/####/0f193d72f71a5340.0
/data/data/####/0f7b611340d5de11.0
/data/data/####/0fdf89bdd15d5f14.0
/data/data/####/1002
/data/data/####/1004
/data/data/####/100da44495bd60b4.0
/data/data/####/102a18145eda47c7.0
/data/data/####/105f179954d531f4.0
/data/data/####/107bbf278b7d890b.0
/data/data/####/111001b52f9418f8.0
/data/data/####/123bf358826c1e6c.0
/data/data/####/133c562d0872c4d4.0
/data/data/####/135d285adc32376b.0
/data/data/####/13924dd8115b231d.0
/data/data/####/13df41cb588edf8d.0
/data/data/####/13fb4e50756c039a.0
/data/data/####/147b3236bc395935.0
/data/data/####/14cad06d8ab538ae.0
/data/data/####/14cc8873b1cca5e4.0
/data/data/####/15ec6784c7974499.0
/data/data/####/16f932520442cb14.0
/data/data/####/17b842ffc817f26e.0
/data/data/####/18d1a011e5298021.0
/data/data/####/1d082a31bd791102.0
/data/data/####/1dd4c041f997e879.0
/data/data/####/1f3343c57903f1ee.0
/data/data/####/1ffe26b12ef07759.0
/data/data/####/206ae1356cfe8247.0
/data/data/####/209a1388b5351b6e.0
/data/data/####/20cc4c167fda058a.0
/data/data/####/215505b3002d7874.0
/data/data/####/21d551b5136dadc9.0
/data/data/####/228ec0bc907ae71a.0
/data/data/####/2306efc6746018f2.0
/data/data/####/236e8d322c3b927a.0
/data/data/####/237ba81665f9571f.0
/data/data/####/23904fd23966e743.0
/data/data/####/24add838fede7f96.0
/data/data/####/262054938b9d6448.0
/data/data/####/26e445554ec441e8.0
/data/data/####/2723fdd4986b0fd0.0
/data/data/####/27598eb55d4d8775.0
/data/data/####/280379982eb050cb.0
/data/data/####/28510a276b224f2c.0
/data/data/####/28ab9110b35c4be8.0
/data/data/####/2a2f71ce4cdc46d8.0
/data/data/####/2a58512ea9fd4246.0
/data/data/####/2af6ce3aa6fe4deb.0
/data/data/####/2b66c28a3b4e90b46da0e1a0e1800e40.0.tmp
/data/data/####/2b66c28a3b4e90b46da0e1a0e1800e40.1.tmp
/data/data/####/2b75f72d8e0933bc.0
/data/data/####/2ba2343e338faddb.0
/data/data/####/2c4dbcac0a39af26.0
/data/data/####/2c4e83ce5ce2cfc5.0
/data/data/####/2c92ae9987dac713.0
/data/data/####/2dca4e1b25374fd5.0
/data/data/####/2e5fc84f0bd26316.0
/data/data/####/2eec41fb36b7b1c6.0
/data/data/####/2f738406a9afcf85.0
/data/data/####/2fd6d2d16945ac7f.0
/data/data/####/3040d9c81a3b3122.0
/data/data/####/30a22cdad3fd0aea.0
/data/data/####/3221ff391d7e9bcb.0
/data/data/####/331636ad269d012b.0
/data/data/####/336dfc29b3ca7daa.0
/data/data/####/357262b272fe418f.0
/data/data/####/35ff48cee2e76a79.0
/data/data/####/37dfbfb5df3737c9.0
/data/data/####/37e371b86e522d77.0
/data/data/####/3802fc23eb5b663d.0
/data/data/####/381adb519acd3250.0
/data/data/####/38a97948c1cd95fd1a07c7a6244e4e36.0.tmp
/data/data/####/38a97948c1cd95fd1a07c7a6244e4e36.1.tmp
/data/data/####/39601344fa40fd96.0
/data/data/####/39c1973862bb44c9.0
/data/data/####/39f4e0d85b3e31de.0
/data/data/####/39f54d25c083959a.0
/data/data/####/3a66ddf0d844566c.0
/data/data/####/3aa34e629d494a0e.0
/data/data/####/3ae49afb15c51ea4.0
/data/data/####/3d94ca48911a36d8.0
/data/data/####/3da95c1adc1f206d.0
/data/data/####/3dd3c78189195232.0
/data/data/####/3e948afac7ecaf9a.0
/data/data/####/3f1ff23d61c258bb.0
/data/data/####/3f3f4b23ef99233b.0
/data/data/####/40a2a5891d5e0537.0
/data/data/####/41a69d0ce03b80f2.0
/data/data/####/43c83418c4518a45.0
/data/data/####/440547a3f40e6940.0
/data/data/####/443ad5cc2ab073d6.0
/data/data/####/4513ea38aae9e9cb.0
/data/data/####/456a0ee7724906c9.0
/data/data/####/46131e4be56e27a5.0
/data/data/####/46ac2eb0bdc64332.0
/data/data/####/46c3048b06cb76fc52907dc9c77274a7.0.tmp
/data/data/####/46c3048b06cb76fc52907dc9c77274a7.1.tmp
/data/data/####/478628dde9ecb735.0
/data/data/####/48ddcbbc794da03a.0
/data/data/####/4b4ff73257bd3a22.0
/data/data/####/4b98147673796205.0
/data/data/####/4d5ed67662503313.0
/data/data/####/4f67ae144a7a1bf1.0
/data/data/####/4f8cf7534a8eab61.0
/data/data/####/4fc80782dad45e8f.0
/data/data/####/50bf2efcb30b6c0c.0
/data/data/####/50fabf612e50a5e6.0
/data/data/####/50fd9dfbd836150e.0
/data/data/####/52e0e4d4f01dca95.0
/data/data/####/537d71a09883182b.0
/data/data/####/5399f2ca04960dc6.0
/data/data/####/53abdf659a48f4f5.0
/data/data/####/541f8f59c732010b.0
/data/data/####/555977432228c9f0.0
/data/data/####/556f322a2ff10c3af33b82525fa9809e.0.tmp
/data/data/####/556f322a2ff10c3af33b82525fa9809e.1.tmp
/data/data/####/562284af331aa026.0
/data/data/####/579c6a254de65a6d.0
/data/data/####/57d83ed0a65d12ec.0
/data/data/####/58ddcbbb8dece9a0.0
/data/data/####/59b48106ff3cd474.0
/data/data/####/5aa6348a90b7644e.0
/data/data/####/5b580811da054f4e.0
/data/data/####/5b58ceb3ba73386d.0
/data/data/####/5b605fabb7ef7c4e.0
/data/data/####/5b675df72ade835f.0
/data/data/####/5b9a083013443bc1bc18d2d509ba72d7.0.tmp
/data/data/####/5b9a083013443bc1bc18d2d509ba72d7.1.tmp
/data/data/####/5c3a020891dce1d2.0
/data/data/####/5c9d67afa1d0d48f.0
/data/data/####/5d1de829759fbdf5.0
/data/data/####/5f0574fd77d060c5.0
/data/data/####/5f196731968105ef.0
/data/data/####/5ffb63a0050f7cd8d570a820a03389c1.0.tmp
/data/data/####/5ffb63a0050f7cd8d570a820a03389c1.1.tmp
/data/data/####/60c8647582aaf04a.0
/data/data/####/61bf9f37ed45c1cb.0
/data/data/####/62b16a0d0c560853.0
/data/data/####/6349b4f0634f990460c18c5f24b18f45.0.tmp
/data/data/####/6349b4f0634f990460c18c5f24b18f45.1.tmp
/data/data/####/63b41eac77adf1e07c3159341901f966.0.tmp
/data/data/####/63b41eac77adf1e07c3159341901f966.1.tmp
/data/data/####/63c8ce7526f66e8a.0
/data/data/####/6419ccbe4a61cd9c.0
/data/data/####/64789b82b68dd82b.0
/data/data/####/649d14b5f75d1e0d.0
/data/data/####/650b1bddbdf295cb.0
/data/data/####/654a53783b8e57918777ea23c06bce6b.0.tmp
/data/data/####/654a53783b8e57918777ea23c06bce6b.1.tmp
/data/data/####/6619e809f40490b9_0
/data/data/####/6619e809f40490b9_s
/data/data/####/668864d4a455f3f2.0
/data/data/####/67e76e9481f4187c.0
/data/data/####/67f443b405b8068c.0
/data/data/####/685f107f2c64a22f.0
/data/data/####/69b82929523c676a.0
/data/data/####/6a186dc9373413b3.0
/data/data/####/6b6c4345a1a1f7ad.0
/data/data/####/6bc97307f8949322.0
/data/data/####/6bf1cd40a301dcc8.0
/data/data/####/6e81fc96e78772f1.0
/data/data/####/70ad6d72c77970b3.0
/data/data/####/719e42b5f3d77653.0
/data/data/####/72f580ec2988a6aa.0
/data/data/####/72f6deb36edf26bd.0
/data/data/####/73be4a77ee1ac8e3.0
/data/data/####/74ae75ba741fcbe3.0
/data/data/####/75ad679bafb96b67.0
/data/data/####/75bf1d0250855dde.0
/data/data/####/75c070fafbf034ad.0
/data/data/####/77c97560f11e71c2.0
/data/data/####/79a3be557d39bd04.0
/data/data/####/79b58bcd50e0dfc7.0
/data/data/####/79d1f49630def68b.0
/data/data/####/7b21b368e75411a8.0
/data/data/####/7c8bb8eb6f807c1e.0
/data/data/####/7e2b19c1404cc1ef.0
/data/data/####/7e5ea0c7ac575179.0
/data/data/####/7eb274a7dc0bb3f7.0
/data/data/####/7eeb19a8ef26488a.0
/data/data/####/7faee1c1c32766fb.0
/data/data/####/806e30e1fc03eb40.0
/data/data/####/809107babfd668b7.0
/data/data/####/81f2e6409804b2fd.0
/data/data/####/82aed141f1018720.0
/data/data/####/831210316e2ad8d3.0
/data/data/####/831d78505808b03c.0
/data/data/####/84bf3295dec69d46.0
/data/data/####/8544b98862062d3d.0
/data/data/####/858adcb771553773.0
/data/data/####/85da5cbbad1f7c95.0
/data/data/####/880ddb14c2bf0dad.0
/data/data/####/88bda3bbe19886c0.0
/data/data/####/89e08cf95551f4ce.0
/data/data/####/8a515b324e10eaad.0
/data/data/####/8a9a329acc23371aad008ade965acd5c.0.tmp
/data/data/####/8a9a329acc23371aad008ade965acd5c.1.tmp
/data/data/####/8b4a81cba132f673.0
/data/data/####/8bcd19fbb3128bd3.0
/data/data/####/8c24c14d2d139e9f.0
/data/data/####/8c3118884cf4fc52.0
/data/data/####/8c7eb502886d6556.0
/data/data/####/8cfcf0e61d71ac6f3315642c55b9674f.0.tmp
/data/data/####/8cfcf0e61d71ac6f3315642c55b9674f.1.tmp
/data/data/####/8dc64e12157fb1dc.0
/data/data/####/901f8c8049666bb4.0
/data/data/####/908b7e0a16ca9d54f133e8b918be11e7.0.tmp
/data/data/####/908b7e0a16ca9d54f133e8b918be11e7.1.tmp
/data/data/####/918fc9ad37e6788c.0
/data/data/####/91cc9a283db9d3a9.0
/data/data/####/93e06e1e470f5ddf.0
/data/data/####/94540895e04cb5ba.0
/data/data/####/94b57dd0ff4d17f9.0
/data/data/####/94f1bccf1e399fad.0
/data/data/####/96134564ce54ecf4.0
/data/data/####/9725b33a4bc17e0b.0
/data/data/####/9777368fcfb2d511.0
/data/data/####/9ab3e1d06db49478.0
/data/data/####/9ab574f03bd84c9421875afd7250cb6e.0.tmp
/data/data/####/9ab574f03bd84c9421875afd7250cb6e.1.tmp
/data/data/####/9abd108400d1c5d8.0
/data/data/####/9b2e592ccee3a274.0
/data/data/####/9d5d6746a1191d57.0
/data/data/####/9d630c47ddf11686.0
/data/data/####/9e07c02b0d722947.0
/data/data/####/9f1fdeff7d9c5fed.0
/data/data/####/CookiePersistence.xml
/data/data/####/Cookies-journal
/data/data/####/EnContactInfo.db
/data/data/####/EnContactInfo.db-journal
/data/data/####/EnContactInfo.db-journal (deleted)
/data/data/####/EnXxtLogin.db
/data/data/####/EnXxtLogin.db-journal
/data/data/####/EnXxtLogin.db-journal (deleted)
/data/data/####/EnXxtLogin.db-shm (deleted)
/data/data/####/EnXxtLogin.db-wal
/data/data/####/EnXxtLogin.db-wal (deleted)
/data/data/####/EnXxtUserInfo.db
/data/data/####/EnXxtUserInfo.db-journal
/data/data/####/EnXxtUserInfo.db-shm (deleted)
/data/data/####/EnXxtUserInfo.db-wal
/data/data/####/EnZxjxMsgExecuteDate.db
/data/data/####/EnZxjxMsgExecuteDate.db-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a01a2af9bc233f17.0
/data/data/####/a09c7c801f1ba27b.0
/data/data/####/a0e4618854561c2b.0
/data/data/####/a0f85ac041112f9703e151589a860505.0.tmp
/data/data/####/a0f85ac041112f9703e151589a860505.1.tmp
/data/data/####/a1321f193dac645c.0
/data/data/####/a1403cb6efaff11824a25afb14bf69cb.0.tmp
/data/data/####/a1403cb6efaff11824a25afb14bf69cb.1.tmp
/data/data/####/a1785d1c0d25234f_0
/data/data/####/a1785d1c0d25234f_s
/data/data/####/a183f5ccbf6bc09d.0
/data/data/####/a1a74ffe66904549.0
/data/data/####/a20e6163a088fb16.0
/data/data/####/a2b5713a8a267400.0
/data/data/####/a383f0cbc072e51e.0
/data/data/####/a3a4283f3da471d4.0
/data/data/####/a4ac90be7b5b0a9f.0
/data/data/####/a6668ee39d722e6b9fc32a2fc8e0c365.0.tmp
/data/data/####/a6668ee39d722e6b9fc32a2fc8e0c365.1.tmp
/data/data/####/a6dad4693ca95385.0
/data/data/####/a6e6edba7ac8774a.0
/data/data/####/a6e83e00dd47ee41.0
/data/data/####/a7cdaaa007d8b71c.0
/data/data/####/a7f58ed72470b988.0
/data/data/####/a856a99d4b26e1e3.0
/data/data/####/a9736e2a9d85e859.0
/data/data/####/a9934703e8f3686a.0
/data/data/####/aa65bcf4292373c6.0
/data/data/####/abbe9a8bc5d917be.0
/data/data/####/ac2be1b21b0bd3e4.0
/data/data/####/ac2d82b1dda4a320_0
/data/data/####/access_20190821163544_0000.log.tmp
/data/data/####/access_20190821163545_0000.log.tmp
/data/data/####/ad3c8a5a3de30917.0
/data/data/####/ad_auth.xml
/data/data/####/adaf7608953c3837.0
/data/data/####/adf97492a9669131aa84f5e7152aaba2.0.tmp
/data/data/####/adf97492a9669131aa84f5e7152aaba2.1.tmp
/data/data/####/af661a030a72508a.0
/data/data/####/af7b3fd5176ebe37.0
/data/data/####/application_shared_prefs.xml
/data/data/####/application_shared_prefs.xml.bak
/data/data/####/authStatus_cn.jxt.android.xml
/data/data/####/b151713a520e50c1.0
/data/data/####/b1fd7ca1cb09156a.0
/data/data/####/b330c7a42c634fe0.0
/data/data/####/b37976fb4b24e7f4.0
/data/data/####/b4834a490d25caac.0
/data/data/####/b4a41510e7b8c9ff.0
/data/data/####/b675466b95f16810.0
/data/data/####/b760aabb810fdfa3.0
/data/data/####/b81519d9ef56810c.0
/data/data/####/b90c832a1eca9b8f.0
/data/data/####/ba67926ecb8e4dee.0
/data/data/####/bb0fffe86028b1c3.0
/data/data/####/bbdfe0e45b603efa565070f3bda417df.0.tmp
/data/data/####/bbdfe0e45b603efa565070f3bda417df.1.tmp
/data/data/####/bf52180023d658a7.0
/data/data/####/bf75e3ad587c90d7.0
/data/data/####/bfc05db1c86649e9.0
/data/data/####/bugly_db_-journal
/data/data/####/c0c26b0695544a94.0
/data/data/####/c0f80291638b144d.0
/data/data/####/c14ccec162133f7f.0
/data/data/####/c22cbd42aa319c43.0
/data/data/####/c36637dbaa87550c.0
/data/data/####/c40b6e50c06ab8d7.0
/data/data/####/c4e1f16537072e90.0
/data/data/####/c59a05e846176bf7.0
/data/data/####/c756483ec999a970.0
/data/data/####/c7afc20acaef7804.0
/data/data/####/c7ba3be4d83dbb34.0
/data/data/####/c88f0d5ce90a543a.0
/data/data/####/c8de0f64945d9ff8.0
/data/data/####/c934348586356130.0
/data/data/####/cb27ba4738eaa544.0
/data/data/####/cbbd7fdc86ecbf88.0
/data/data/####/cc528cf79f7c2741.0
/data/data/####/cceda3f2e1e1dacc.0
/data/data/####/ccf0f655bbeda8e5.0
/data/data/####/cd1a0efa89967bca.0
/data/data/####/cd4c8f6c21697e5f.0
/data/data/####/cd770fd60895d303.0
/data/data/####/cd9fad172c7cb886.0
/data/data/####/cf8690834dc0beb6.0
/data/data/####/circle.db
/data/data/####/circle.db-journal
/data/data/####/click_20190821163546_0000.log.tmp
/data/data/####/cloud.db
/data/data/####/cloud.db-journal
/data/data/####/cn.jxt.android_preferences.xml
/data/data/####/common_20190821163618_0000.log.tmp
/data/data/####/core_info
/data/data/####/d0244afe22aa41df.0
/data/data/####/d0cc9e26821a5105.0
/data/data/####/d0f8c8e2ffa64393.0
/data/data/####/d1cf9c204bca441b.0
/data/data/####/d2143d094ba78b0f.0
/data/data/####/d37de3da91cd43f5.0
/data/data/####/d47265a7c4f33a30.0
/data/data/####/d5179f8052ec50ab.0
/data/data/####/d5b4438116fd7b8a.0
/data/data/####/d5e01693bde467a8.0
/data/data/####/d61c1d982b005fea.0
/data/data/####/d7f0e2b8b2b752cb.0
/data/data/####/d89913caaa8ccdc6.0
/data/data/####/d8f35a3f6a67a05c.0
/data/data/####/d9342579205b30ff.0
/data/data/####/d956d3402386931e.0
/data/data/####/da584bd16c011a52.0
/data/data/####/daa7c5545886eb3e.0
/data/data/####/dbab36ba424ce952.0
/data/data/####/dc1ec6919a16307d.0
/data/data/####/dda424267a085b33.0
/data/data/####/de8f61d9da643d5a.0
/data/data/####/debug.conf
/data/data/####/dec90cedafd0f422.0
/data/data/####/def18fc736364211.0
/data/data/####/device_20190821163545_0000.log.tmp
/data/data/####/dff8cf98180158aa.0
/data/data/####/download_upload
/data/data/####/e0a715fe6645df95.0
/data/data/####/e0c3fb82ccce7485.0
/data/data/####/e1beba62f15165b6.0
/data/data/####/e1ef4ebfeeffd42d.0
/data/data/####/e230703799338c57.0
/data/data/####/e41f66f45eb94101.0
/data/data/####/e61b369191a08853.0
/data/data/####/e65af406b582c332.0
/data/data/####/e73338d1e6f8e5d0.0
/data/data/####/e7798fec73ab4230.0
/data/data/####/e809fc1c6b10a573.0
/data/data/####/e86fc216c10e0d3c.0
/data/data/####/e924a4a2eb2a58b4.0
/data/data/####/e92cae3f60c1b22d.0
/data/data/####/e9335afb5fa2f25e.0
/data/data/####/e9e9ee05a7ff9d4e.0
/data/data/####/ea2302ed8c9a0952.0
/data/data/####/eadb0325be74719c393af220dcbba76d.0.tmp
/data/data/####/eadb0325be74719c393af220dcbba76d.1.tmp
/data/data/####/eadfb90225e4cd2ada084b5804ad92d5.0.tmp
/data/data/####/eadfb90225e4cd2ada084b5804ad92d5.1.tmp
/data/data/####/ebfefd14d052031f.0
/data/data/####/ec8ffb2f2d2306bd.0
/data/data/####/f09b38b854e48893.0
/data/data/####/f0e4d9b10351741d628c6f466d463a6f.0.tmp
/data/data/####/f0e4d9b10351741d628c6f466d463a6f.1.tmp
/data/data/####/f29e794ba24d8fbd.0
/data/data/####/f2bc1c069acc009b.0
/data/data/####/f341f3d26c156bba.0
/data/data/####/f390da2492a1fee6.0
/data/data/####/f6642a6ab47e59ff.0
/data/data/####/f69d75deb8a9a5a0.0
/data/data/####/f6c12e74f7745580.0
/data/data/####/f79a500f01af476cbaa11ebcce51f91a.0.tmp
/data/data/####/f79a500f01af476cbaa11ebcce51f91a.1.tmp
/data/data/####/f7cb10a1c3b189c5.0
/data/data/####/f896adfa7cae41a8.0
/data/data/####/f8c346b1110c5b93.0
/data/data/####/f95155d93cb3ade8.0
/data/data/####/f962f84ba654d42b.0
/data/data/####/f9f3fe7187b52d52.0
/data/data/####/fa0d8458e0c49f9e.0
/data/data/####/fbc7937bc904aae0.0
/data/data/####/fbc906ab474d8414.0
/data/data/####/fd06b2fdb4d83bfd.0
/data/data/####/fd1300297e12a819.0
/data/data/####/fe3e82d342810cf3.0
/data/data/####/ff3484af23e652d8.0
/data/data/####/ff7a1f93309d0696.0
/data/data/####/hnxxtContacts.db
/data/data/####/hnxxtContacts.db-journal
/data/data/####/hnxxtMessage.db
/data/data/####/hnxxtMessage.db-journal
/data/data/####/hnxxtMsgExecuteDate.db
/data/data/####/hnxxtMsgExecuteDate.db-journal
/data/data/####/hnxxtRecommendSMS.db
/data/data/####/hnxxtRecommendSMS.db-journal
/data/data/####/homework.db
/data/data/####/homework.db-journal
/data/data/####/index
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jxhdZxjxMessage.db
/data/data/####/jxhdZxjxMessage.db-journal
/data/data/####/jxtMsgExecuteDate.db
/data/data/####/jxtMsgExecuteDate.db-journal
/data/data/####/jxtMsgFile.db
/data/data/####/jxtMsgFile.db-journal
/data/data/####/jxtMsgGroupDB.db
/data/data/####/jxtMsgGroupDB.db-journal
/data/data/####/jxtPermissionUnit.db
/data/data/####/jxtPermissionUnit.db-journal
/data/data/####/libcuid.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/log_config_table.db
/data/data/####/log_config_table.db-journal
/data/data/####/log_config_table.db-shm (deleted)
/data/data/####/log_config_table.db-wal (deleted)
/data/data/####/login_sp_file.xml
/data/data/####/mac.xml
/data/data/####/metrics_guid
/data/data/####/native_record_lock
/data/data/####/network_20190821163545_0000.log.tmp
/data/data/####/news.db
/data/data/####/news.db-journal
/data/data/####/notice.db
/data/data/####/notice.db-journal
/data/data/####/notice.db-shm (deleted)
/data/data/####/notice.db-wal
/data/data/####/notice.db-wal (deleted)
/data/data/####/operator.db
/data/data/####/operator.db-journal
/data/data/####/proc_auxv
/data/data/####/push_sp_file.xml
/data/data/####/run_20190821163545_0000.log.tmp
/data/data/####/security_info
/data/data/####/service_sp_file.xml
/data/data/####/service_sp_file.xml.bak
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/the-real-index
/data/data/####/vodChannel.db
/data/data/####/vodChannel.db-journal
/data/data/####/vodChannel.db-journal (deleted)
/data/data/####/vodChannel.db-shm (deleted)
/data/data/####/vodChannel.db-wal
/data/data/####/webCacheDbV1.db
/data/data/####/webCacheDbV1.db-journal
/data/data/####/xxtArrangedContacts.db
/data/data/####/xxtArrangedContacts.db-journal
/data/data/####/xxtGradeInfo.db
/data/data/####/xxtGradeInfo.db-journal
/data/data/####/xxtGradeInfo.db-shm (deleted)
/data/data/####/xxtGradeInfo.db-wal
/data/data/####/xxtModule.db
/data/data/####/xxtModule.db-journal
/data/data/####/xxtModule.db-journal (deleted)
/data/data/####/xxtMsgFile.db
/data/data/####/xxtMsgFile.db-journal
/data/data/####/zxjxContacts.db
/data/data/####/zxjxContacts.db-journal
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

getprop
getprop ro.product.cpu.abi

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DESede-ECB-PKCS5Padding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial