Technical information
- Adware.Gexin.2.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) wb.110.ta####.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) h####.b####.com:80
- TCP(HTTP/1.1) ada####.m.ta####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) i####.81tou####.net:80
- TCP(HTTP/1.1) zhg.ali####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) i####.hang####.com:80
- TCP(HTTP/1.1) d####.xinjuns####.net:80
- TCP(HTTP/1.1) v.g####.qq.com:80
- TCP(HTTP/1.1) ad####.m.ta####.com:80
- TCP(HTTP/1.1) ro####.g0.p####.####.cn:80
- TCP(HTTP/1.1) si####.jom####.com:80
- TCP(HTTP/1.1) a####.7####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) m.xinjuns####.net:80
- TCP(HTTP/1.1) mobads-####.b####.com:80
- TCP(HTTP/1.1) m.xinju####.net:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) thi####.q####.cn:80
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) cn-n1-c####.leanc####.cn:443
- TCP(TLS/1.0) sh.wagbr####.ta####.com:443
- TCP(TLS/1.0) api.leanc####.cn:443
- a####.7####.com
- a####.u####.com
- ad####.m.ta####.com
- ada####.m.ta####.com
- api.leanc####.cn
- app####.haosh####.com
- bcfeed####.ta####.com
- cn-n1-c####.leanc####.cn
- d####.xinjuns####.net
- f11.b####.com
- h####.b####.com
- i####.81tou####.net
- i####.hang####.com
- i####.xinjuns####.net
- imgc####.qq.com
- log.u####.com
- m.xinju####.net
- m.xinjuns####.net
- mi.g####.qq.com
- mo####.b####.com
- mobads-####.b####.com
- p####.ugd####.com
- ro####.g0.p####.####.cn
- s####.e.qq.com
- s####.u####.com
- thi####.q####.cn
- v.g####.qq.com
- wb.110.ta####.com
- y####.al####.com
- a####.7####.com/xin.js
- ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
- d####.xinjuns####.net/junshitoutiao.apk
- d####.xinjuns####.net/mxinjunshi.apk
- d####.xinjuns####.net/version_update.php?&appkey=####&version_code=####&...
- i####.81tou####.net/160815/4-160Q5160UTS.jpg
- i####.81tou####.net/160901/4-160Z1130255H9.jpg
- i####.81tou####.net/allimg/180123/21-1P1231313240-L.jpg
- i####.81tou####.net/allimg/180123/21-1P1231314480-L.jpg
- i####.81tou####.net/allimg/180123/21-1P1231316170-L.jpg
- i####.81tou####.net/allimg/180125/14312-1P1251614440-L.jpg
- i####.81tou####.net/allimg/180318/15958-1P31P95Q90-L.jpg
- i####.81tou####.net/allimg/180726/0951151N4-3.jpg
- i####.81tou####.net/allimg/180726/09511532Y-7.jpg
- i####.81tou####.net/allimg/180726/0951153A2-1.jpg
- i####.81tou####.net/allimg/180726/0951155036-4.jpg
- i####.81tou####.net/allimg/180726/095115F54-6.jpg
- i####.81tou####.net/allimg/180726/095115I49-0.jpg
- i####.81tou####.net/allimg/180726/095115IX-2.jpg
- i####.81tou####.net/allimg/180726/095115KX-5.jpg
- i####.81tou####.net/allimg/180726/21-1PH61001460-L.jpg
- i####.81tou####.net/allimg/180727/0950101555-1.jpg
- i####.81tou####.net/allimg/180727/0950102129-2.jpg
- i####.81tou####.net/allimg/180727/0950105961-0.jpg
- i####.81tou####.net/allimg/180727/1124131b2-2.jpg
- i####.81tou####.net/allimg/180727/1124132037-1.jpg
- i####.81tou####.net/allimg/180727/1124133229-0.jpg
- i####.81tou####.net/allimg/180727/15958-1PHG123290-L.jpg
- i####.81tou####.net/allimg/180727/17-1PHG524000-L.jpg
- i####.81tou####.net/allimg/180728/0ZQAM1-2.jpg
- i####.81tou####.net/allimg/180728/0ZQB962-0.jpg
- i####.81tou####.net/allimg/180728/0ZQCG8-1.jpg
- i####.81tou####.net/allimg/180728/17-1PHQ53533-50.jpg
- i####.81tou####.net/allimg/180728/17-1PHQ53533.jpg
- i####.81tou####.net/allimg/180728/17-1PHQ53534.jpg
- i####.81tou####.net/allimg/180728/17-1PHQ54537.jpg
- i####.81tou####.net/allimg/180728/17-1PHQ54538-50.jpg
- i####.81tou####.net/allimg/180728/17-1PHQ54538.jpg
- i####.81tou####.net/allimg/180728/21-1PHP914180-L.jpg
- i####.81tou####.net/allimg/180728/21-1PHP914470-L.jpg
- i####.81tou####.net/allimg/180728/21-1PHP915290-L.jpg
- i####.81tou####.net/allimg/180728/21-1PHP916020-L.jpg
- i####.81tou####.net/userup/26478/myface_1523420447.jpg
- i####.hang####.com/api2.4/app.php?mod=####&aid=####
- m.xinju####.net/member_nouse/templets/images/dfboy.png
- m.xinjuns####.net/member_nouse/templets/images/dfboy.png
- mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
- mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
- mo####.b####.com/ads/pa/8/__xadsdk__remote__8.7055.jar
- mo####.b####.com/cpro/ui/mads.php?code2=####
- mobads-####.b####.com/dz.zb?os=android&expire=9979&sn=<IMEI>&forecurl=ht...
- mobads-####.b####.com/dz.zb?type=####&apid=####&appsid=####&bdr=####&bra...
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- ro####.g0.p####.####.cn/v1/route?appId=####&installationId=####&secure=#...
- s####.tc.qq.com/gdt/0/DAAOTgCAUAALQABaBaMz8oBCg5Q5yi.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAVW-pAUAALQABEBZuqivBttVLmi6.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAVW-pAUAALQABTBbMgrfAVlPN2nO.jpg/0?ck=####
- s####.tc.qq.com/gdt/0/DAAXcjnAUAALQABSBbFOZIC8-cYuYz.jpg/0?ck=####
- si####.jom####.com/it/u=1246275349,4145275122&fm=76
- thi####.q####.cn/mmopen/vi_32/m87jJicCbUsodRGW4bXQ6Au44ROTreGPVKWRvfJVkf...
- a####.u####.com/app_logs
- ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
- h####.b####.com/app.gif
- i####.hang####.com/api2.4/app.php?mod=####
- i####.hang####.com/api2.4/app.php?mod=####&act=####&page=####
- i####.hang####.com/api2.4/app.php?mod=####&aid=####&type=####
- i####.hang####.com/api2.4/app.php?mod=####&page=####
- mobads-####.b####.com/brwhis.log
- s####.e.qq.com/activate
- v.g####.qq.com/gdt_stats.fcg
- wb.110.ta####.com/api/update.do
- zhg.ali####.com/saveWb.json
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.log.lock
- /data/data/####/.log.ls
- /data/data/####/0a231bd8575dcf72.txt
- /data/data/####/1532811780631.log
- /data/data/####/1d77ea041509fe06.lock
- /data/data/####/21c22f492aba3de8.lock
- /data/data/####/8ef9c457b3bbb403.lock
- /data/data/####/930a31b34bd52c08.lock
- /data/data/####/AV_CLOUD_API_VERSION_KEY_ZONE.xml
- /data/data/####/AV_PUSH_SERVICE_APP_DATA.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/CookiePrefsFile.xml
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/SGMANAGER_DATA2.tmp
- /data/data/####/UTCommon.xml
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__local_ap_info_cache.json
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/__send_data_1532811778973
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__1dc4a909-0b6d-4868-892...e0.jar
- /data/data/####/__xadsdk__remote__final__2b751510-3e85-449e-9a8...45.jar
- /data/data/####/__xadsdk__remote__final__2b751510-3e85-449e-9a8...leted)
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/__xadsdk_downloaded__version__.xml
- /data/data/####/ap.Lock
- /data/data/####/app_sp.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.avos.avoscloud.RequestStatisticsUtil.data.xml
- /data/data/####/com.avos.push.router.server.cachezja4gnztqflo4x...6d.xml
- /data/data/####/com.avoscloud.chat.message.xml
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/com.shenyuan.militarynews_preferences.xml
- /data/data/####/dbProvider.db-journal
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_plugin.tmp.sig
- /data/data/####/gdt_suid
- /data/data/####/install_sent.xml
- /data/data/####/installation
- /data/data/####/libcuid.so
- /data/data/####/libjiagu.so
- /data/data/####/libsgmainso-5.1.81.so.tmp
- /data/data/####/lock.lock
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/sp.lock
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/update_lc
- /data/data/####/ut.db
- /data/data/####/ut.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/ywPrefsTools.xml
- /data/media/####/.confd
- /data/media/####/.confd-journal
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/.nomedia
- /data/media/####/.timestamp
- /data/media/####/1532811805046 (deleted)
- /data/media/####/1532811810905 (deleted)
- /data/media/####/1532811816293 (deleted)
- /data/media/####/1dmckw6wy55az9gae1ca205xp
- /data/media/####/1i4wqy003mnqsuxkchvj2e4f2
- /data/media/####/1klb36cfpy2ctufsc25jlbjfz
- /data/media/####/1o4eowx3x6csr27bxuk332fw3
- /data/media/####/1wyk6ury32sc2x17zswcbtvqm
- /data/media/####/1yb3yx8f6x2z678dz8m6i2jt9
- /data/media/####/295dl2x15e5t9y55ef0qk8v4
- /data/media/####/2bmb7w1bgi343m56t6ex1u7sv
- /data/media/####/2juyp82j7k59ztkblvevlxmm1
- /data/media/####/2lonbqlhoc0gk26e1577wdx10
- /data/media/####/386h5kflit966s1itza7552nc
- /data/media/####/3cwvmfaiqu9kx6sdjks14459f
- /data/media/####/3d0f4v78w3gt13sdh9r3y5pgf
- /data/media/####/3kg432ztb3am2qxcoxzu7i6zf
- /data/media/####/3ly390f1h8ec3dwhw3f1oet42
- /data/media/####/3w6y7umgm4syvzxchyzpdavlb
- /data/media/####/3ysbzc255zsit1eyxi5pmt843
- /data/media/####/41dlhe27alauyi7c1w8q2zsqf
- /data/media/####/42x8dwblefdknwez2h8uzbmxh
- /data/media/####/4bpmq8yjkfhy0aggg8sn4w2zm
- /data/media/####/4cg0prc6wmxz4e5pw8v085bnf
- /data/media/####/4dhoxdx5mcwetynfbgpibcks0
- /data/media/####/4j0cfvhpo7uel2sebyc9hcqeh
- /data/media/####/4kgebp8pj99iu3732m2903iec
- /data/media/####/4y5el1bln33hrbwtwsz369f7i
- /data/media/####/5a9hm0mmcrqp6mg7dpgnxn212
- /data/media/####/5drhrf0uhx8fp66rit9nrscer
- /data/media/####/5g5kas843sg9hro4j78j3ryj1
- /data/media/####/5hlqckgalzkok8yk13tv1d9kd
- /data/media/####/5s1xskvr52v1kpx8frq2jluu0
- /data/media/####/5vw5mwztxzz2c4x53tjtp7202
- /data/media/####/60ifv7wyf7yhpy48uts9o1mt
- /data/media/####/688snkatmws4opqd78jatcbpl
- /data/media/####/6c709c11d2d46a7b
- /data/media/####/6ge5wdkdyndh0j6gf8ufpr1as
- /data/media/####/6khs7hvklputwsnzz7iohw5kk
- /data/media/####/6oju175qp0ajgf3nr8d1ypcqt
- /data/media/####/6sp7xxv33jml9im8rijcc6jvd
- /data/media/####/6z4byngy914okcptwjrfdhcna
- /data/media/####/6zqbtru8x8yak3w7fdc901x59
- /data/media/####/73n4lk3jns6szxbh3lur7ys9x
- /data/media/####/7b5nzi7am60x4fefglcj2bdr4
- /data/media/####/8zdo8ztmdypln0mqi3htvp4r
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/dd7893586a493dc3
- /data/media/####/dontpanic.cp
- /data/media/####/h6u788j9p81ofnxnbsxcfau3
- /data/media/####/hid.dat
- /data/media/####/if73yd0gh62uwzqam9ep16v2
- /data/media/####/junshitoutiao.apk
- /data/media/####/mxinjunshi.apk
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- crash_analysis
- libjiagu
- sgmainso-5.1
- ut_c_api
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding