Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.906.origin
- Android.RemoteCode.262.origin
- Android.RemoteCode.264.origin
- Android.Triada.248.origin
- Android.Triada.4567
- Android.Triada.464.origin
- Android.Triada.482.origin
Network activity:
Connects to:
- UDP(DNS) 1####.114.114.114:53
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) t####.a####.top:80
- TCP(HTTP/1.1) ln####.jqshe####.com:80
- TCP(HTTP/1.1) api.m2g.adoc####.com:80
- TCP(HTTP/1.1) res####.a####.top:80
- TCP(HTTP/1.1) p####.q####.cn.####.net:80
- TCP(HTTP/1.1) v.h####.com:8071
- TCP(HTTP/1.1) 39.1####.5.68:80
- TCP(HTTP/1.1) api.meiju####.net:80
- TCP(HTTP/1.1) s.n####.cn:8918
- TCP(HTTP/1.1) ad.l####.com:3000
- TCP(HTTP/1.1) a####.78####.cc:9090
- TCP(HTTP/1.1) www.sm####.com:80
- TCP(HTTP/1.1) m####.o####.com:80
- TCP(HTTP/1.1) xt####.g8####.com:20149
- TCP(HTTP/1.1) gd.a.s####.com:80
- TCP(HTTP/1.1) s####.al####.com:80
- TCP(HTTP/1.1) ad.smudge####.com:8986
- TCP(HTTP/1.1) ap####.math####.cn:80
- TCP(HTTP/1.1) ott.h####.com:8071
- TCP(HTTP/1.1) api.liyan####.com:808
- TCP(HTTP/1.1) ad.l####.com:3001
- TCP(HTTP/1.1) a####.adoc####.com:80
- TCP(HTTP/1.1) 47.1####.59.53:900
- TCP(HTTP/1.1) v3.jia####.com:80
- TCP(HTTP/1.1) d####.f####.top:80
- TCP(HTTP/1.1) 1####.29.29.29:80
- TCP(HTTP/1.1) 1####.196.131.99:3001
- TCP(HTTP/1.1) www.78####.cc:80
- TCP(HTTP/1.1) 1142864####.cn-hang####.fc.####.com:80
- TCP(HTTP/1.1) j####.o####.com:13967
- TCP(HTTP/1.1) jp####.njt####.com:10091
- TCP(HTTP/1.1) b####.bugse####.com:80
- TCP(HTTP/1.1) m.jufe####.com:80
- TCP(HTTP/1.1) alldo####.cqs####.com.####.com:80
- TCP(HTTP/1.1) m####.t####.sogo####.####.com:80
- TCP(HTTP/1.1) yun.b####.com:80
- TCP(HTTP/1.1) api.yunco####.com:80
- TCP(HTTP/1.1) ap####.adoc####.com:80
- TCP(HTTP/1.1) ad.l####.com:80
- TCP(HTTP/1.1) wap.78####.cc:80
- TCP(HTTP/1.1) api.no4####.com:80
- TCP(HTTP/1.1) p####.api.adoc####.com:80
- TCP(HTTP/1.1) 2####.186.173.17:8888
- TCP(HTTP/1.1) 1713464####.cn-hang####.fc.####.com:80
- TCP(HTTP/1.1) de.ssp.harm####.cn:80
- TCP(HTTP/1.1) i.ist####.com:8071
- TCP(HTTP/1.1) mh####.b0.a####.com:80
- TCP(HTTP/1.1) a.78####.cc:80
- TCP(HTTP/1.1) tinychi####.q####.com.####.com:80
- TCP(HTTP/1.1) 14.17.1####.182:80
- TCP(HTTP/1.1) d####.f####.top:8080
- TCP(HTTP/1.1) filt####.a####.top:80
- TCP(HTTP/1.1) 78####.cc:80
- TCP(HTTP/1.1) i####.doub####.com:80
- TCP(HTTP/1.1) 60.2####.170.47:7088
- TCP(HTTP/1.1) r.ist####.com:8071
- TCP(HTTP/1.1) 47.1####.185.46:80
- TCP(HTTP/1.1) s2.z####.cn:80
- TCP(HTTP/1.1) co####.ssp.adoc####.com:80
- TCP(HTTP/1.1) b####.bugse####.com:3002
- TCP(HTTP/1.1) oi####.kenanta####.com:80
- TCP(HTTP/1.1) b####.bugse####.com:3000
- TCP(HTTP/1.1) pic.haku6####.com:80
- TCP(HTTP/1.1) ad.toads####.com:80
- TCP(HTTP/1.1) 47.1####.211.73:80
- TCP(HTTP/1.1) app.a####.top:80
- TCP(HTTP/1.1) q####.0####.com:13967
- TCP(HTTP/1.1) weib####.g####.sina####.com:80
- TCP(HTTP/1.1) e4####.0r####.com:10293
- TCP(HTTP/1.1) 39.1####.241.43:6687
- TCP(HTTP/1.1) ssp.k####.com:80
- TCP(HTTP/1.1) wap.tuca####.com:80
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) utp.u####.com:443
- TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) we####.58.com:443
- TCP(TLS/1.0) na61-na####.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) www.58.com.####.com:443
- TCP(TLS/1.0) res.wx.qq.####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) o####.u####.cn:443
- TCP(TLS/1.0) huic####.sm.cn:443
- TCP(TLS/1.0) gd.a.s####.com:443
- TCP(TLS/1.0) log.mm####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) et2.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) i####.u####.cn:443
- TCP(TLS/1.0) sf1-ttc####.ps####.com:443
- TCP(TLS/1.0) l2-tout####.g####.ksyu####.com:443
- TCP(TLS/1.0) i####.doub####.com:443
- TCP(TLS/1.0) dc52####.58.com.####.com:443
- TCP(TLS/1.0) www.a.sh####.com:443
- TCP(TLS/1.0) 1####.217.168.202:443
- TCP(TLS/1.0) g####.b####.com:443
- TCP(TLS/1.0) api.icinep####.com:443
- TCP(TLS/1.0) api.g####.vip:443
- TCP(TLS/1.0) caaceed####.cdn.so####.####.com:443
- TCP(TLS/1.0) m.u####.cn:443
- TCP(TLS/1.0) j1.5####.com.####.com:443
- TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) zz.bdst####.com:443
- TCP(TLS/1.0) ims-####.sm.cn:443
- TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) t####.uc.cn:443
- TCP(TLS/1.0) i####.doub####.com.####.com:443
- TCP(TLS/1.0) g.cn.miao####.com:443
- TCP(TLS/1.0) n####.uc.cn:443
- TCP(TLS/1.0) st3.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) f####.58.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) js.tv.i####.cn:443
- TCP(TLS/1.0) b####.uc.cn:443
- TCP(TLS/1.0) s####.al####.com:443
- TCP(TLS/1.0) www.sm####.com:443
- TCP(TLS/1.0) utp-pec####.uc.cn:443
- TCP(TLS/1.0) mipst####.s####.cn:443
- TCP(TLS/1.0) d####.58.com:443
- TCP(TLS/1.0) img1-do####.b0.a####.com:443
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) cdn.qchann####.cn:443
- TCP(TLS/1.0) im####.uc.cn:443
- TCP(TLS/1.0) p9.ps####.com.####.com:443
- TCP(TLS/1.0) pic.haku6####.com:443
- TCP(TLS/1.0) 1####.217.168.206:443
- TCP(TLS/1.0) na61-####.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) ssls####.jom####.com:443
- TCP(TLS/1.0) trac####.58.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) gs.a.s####.com:443
- TCP(TLS/1.0) g.al####.com:443
- TCP(TLS/1.0) s####.shidux####.com:443
- TCP(TLS/1.2) 1####.217.168.206:443
- TCP(TLS/1.2) 1####.217.168.202:443
- TCP(TLS/1.2) 1####.217.19.195:443
- TCP 1####.0.14.254:34238
- TCP 1####.0.14.254:34236
- TCP 1####.0.14.254:34264
- TCP 1####.0.14.254:34266
- TCP gw.adv####.com:8080
- TCP 1####.0.14.254:34290
- TCP 1####.0.14.254:34292
- TCP 1####.0.14.254:34316
- TCP 39.1####.229.189:9050
- TCP 1####.0.14.254:34312
DNS requests:
- 39d0825####.cdn.so####.com
- 5b0988e####.cdn.so####.com
- 617.a####.top
- 617.a####.top.####.8
- 78####.cc
- a####.58.com
- a####.78####.cc
- a####.adoc####.com
- a####.m.sm.cn
- a####.xapr####.com
- a.78####.cc
- a3####.fj####.cn
- ad.l####.com
- ad.smudge####.com
- ad.toads####.com
- and####.google####.com
- android####.go####.com
- ap####.adoc####.com
- ap####.math####.cn
- api.adoc####.com
- api.g####.vip
- api.icinep####.com
- api.interac####.s####.com
- api.liyan####.com
- api.m2g.adoc####.com
- api.meiju####.n####.####.8
- api.meiju####.net
- api.meiju####.net/
- api.minc####.com
- api.no4####.com
- api.yunco####.com
- app.a####.top
- b####.bugse####.com
- b####.bugse####.com
- b####.uc.cn
- bds.sn####.com
- c####.mm####.com
- c####.tv.itc.cn
- c.5####.com.cn
- c.c####.com
- caaceed####.cdn.so####.com
- cdn.qchann####.cn
- co####.ssp.adoc####.com
- d####.58.com
- d####.f####.top
- de.ssp.harm####.cn
- dm####.gn####.com
- dwf.cqs####.com
- e4####.0r####.com
- ex####.sn####.com
- f####.58.com
- fc.b####.com
- ff.d####.com
- filt####.a####.top
- fou####.ta####.com
- g####.b####.com
- g####.bdst####.com
- g.al####.com
- g.cn.miao####.com
- gm.mm####.com
- gn####.f####.top
- gr####.58.com
- gw.adv####.com
- huic####.sm.cn
- i####.doub####.com
- i####.doub####.com
- i####.doub####.com
- i####.u####.cn
- i####.uc.cn
- i####.uc.cn
- i.ist####.com
- i.sn####.com
- im####.uc.cn
- img.5####.com.cn
- ims-####.sm.cn
- instant####.google####.com
- is.sn####.com
- j####.o####.com
- j1.5####.com.cn
- jp####.njt####.com
- js.s####.com
- js.tv.i####.cn
- l####.m.sm.cn
- l.ace####.com
- lg.ca####.com
- lhyysdk####.oss-cn-####.aliy####.com
- ln####.jqshe####.com
- log.mm####.com
- m####.go####.com
- m####.o####.com
- m####.t####.sogo####.com
- m.5####.com
- m.jufe####.com
- m.s####.com
- m.u####.cn
- md####.google####.com
- mipst####.s####.cn
- mp.s####.com
- n####.uc.cn
- o####.u####.cn
- oi####.kenanta####.com
- ott.h####.com
- p####.5####.com.cn
- p####.api.adoc####.com
- p####.bugse####.com
- p####.google####.com
- p####.pic.s####.com
- p####.q####.cn
- p9.ps####.com
- pco####.sm.cn
- pic.ha####.com
- pic.haku6####.com
- pic.s####.cn
- plb####.u####.com
- pv.s####.com
- q####.0####.com
- r####.wx.qq.com
- r.ist####.com
- r1.baiyuns####.com
- r1.y####.com
- res####.a####.top
- rs1.minc####.com
- s####.al####.com
- s####.m.sm.cn
- s####.shidux####.com
- s.n####.cn
- s2.z####.cn
- s3.ps####.com
- s3a.ps####.com
- s9.c####.com
- s96.c####.com
- se####.m.so####.####.8
- se####.m.so####.com
- sf1-ttc####.ps####.com
- sf3-ttc####.ps####.com
- sf6-ttc####.ps####.com
- sn####.kv####.com
- sp0.b####.com
- ssp.k####.com
- sta####.itc.cn
- t####.a####.top
- t####.s####.com
- t####.uc.cn
- trac####.58.com
- u####.a####.top
- u####.u####.com
- u####.umengc####.com
- uis.mp.s####.com
- utp-pec####.uc.cn
- utp.u####.com
- v####.ix####.com
- v.h####.com
- v2.s####.com
- v3.jia####.com
- w####.58.com
- wap.78####.cc
- wap.tuca####.com
- we####.58.com
- we####.58.com
- wgo.mm####.com
- ww1.sin####.cn
- www.78####.cc
- www.78####.cc
- www.qchann####.cn
- www.sm####.com
- www.toutiao####.com
- wz.78####.cc
- xt####.g8####.com
- y####.m.sm.cn
- ym####.89####.com
- yun.b####.com
- z####.heyc####.net
- z####.heyc####.net.####.8
- z####.sm.cn
- z12.c####.com
- zz.bdst####.com
HTTP GET requests:
- 1142864####.cn-hang####.fc.####.com/qs/?pa=####
- 1142864####.cn-hang####.fc.####.com/xqs/?pa=####
- 1713464####.cn-hang####.fc.####.com/lg/?lg="0E"55wl"55"4F"55dhj)jbnmr2>5...
- 78####.cc/index/count/count_shell?shellname=####
- a####.78####.cc:9090/token/update
- a####.adoc####.com/fw/task?task_id=####&ip=####&network=####&sdk_version...
- a.78####.cc/index/upapp/app_datas?upapp_id=####&imei=####&channel_id=####
- ad.l####.com/sdk_ad
- ad.l####.com:3000/api?rdtime=####&secure=####&channel=####&osv=####&adid...
- ad.l####.com:3001/api?rdtime=####&secure=####&channel=####&osv=####&adid...
- alldo####.cqs####.com.####.com/img/5d8ce6dcb334b.jpg
- alldo####.cqs####.com.####.com/img/5e7e0522ea680.jpg
- alldo####.cqs####.com.####.com/rhsdk/tktest503/xdt.jar
- ap####.adoc####.com/ssp/mgm/task?taskId=####&ip=####
- ap####.math####.cn/ssp/mgm/task?taskId=####&ip=####
- api.no4####.com/api/app/member/ver2/user/login/2/1239?time=####&model=##...
- app.a####.top/anshuaControl.json
- b####.bugse####.com/sdk_ad
- b####.bugse####.com:3000/api?rdtime=####&secure=####&channel=####&osv=##...
- b####.bugse####.com:3002/api?rdtime=####&secure=####&channel=####&osv=##...
- co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
- co####.ssp.adoc####.com/api/v2/fwConfig?channelCode=####&version=####
- co####.ssp.adoc####.com/api/v2/fwWebviewRatioConfig?channelCode=####&ver...
- co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
- co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
- d####.f####.top/login;JSESSIONID=0ac741cf-7231-4f1c-a44d-f17bfc5c9898
- d####.f####.top:8080/ttad/api/jv5/mlGTc0ehU30gjMysddUMFw==/DRW7357D3V1C3...
- filt####.a####.top/filter_control_617.json
- gd.a.s####.com/cityjson?ie=####
- i####.doub####.com/0516000058D36683ADBC094EB400C844
- i####.doub####.com/7e2678c6d65c7cc1f0a12e69ed67557b/5ebe655c/video/tos/c...
- i####.doub####.com/s/uae/g/3o/client_op/resource/20200514/1589449227708_...
- i####.doub####.com/view/photo/s_ratio_poster/public/p2569474710.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2593476143.jpg
- ln####.jqshe####.com/c/jdigwuislgori32387s87w87s.zip
- ln####.jqshe####.com/one/qwertyuiot.zip
- ln####.jqshe####.com/u/qwertyuioc.jar
- m####.o####.com/mp;C;1872;13918;RV7lEUGnFYpmRmN/oMBBM78zY2c=?*####
- m####.t####.sogo####.####.com/wap/js/wp.js
- m.jufe####.com/caihua/libnms.so
- m.jufe####.com/caihua/libnms64.so
- m.jufe####.com/ot/so/sodown.jsp
- m.jufe####.com/ot/so/sodown.jsp?type=####
- m.jufe####.com/v2/cd.jsp?ch=####&appId=####&androidId=####&v=####
- m.jufe####.com/v2/ci.jsp?ch=####&androidId=####&v=####
- m.jufe####.com/v2/cs.jsp?androidId=####&aid=####&action=####&ch=####
- mh####.b0.a####.com/api/sdk-api-ad.js
- mh####.b0.a####.com/favicon.ico
- mh####.b0.a####.com/sdk/tt_001.html
- mh####.b0.a####.com/sm/tx001.js
- mh####.b0.a####.com/sm/tx002.js
- oi####.kenanta####.com/c/jz/wksyl.zip
- oi####.kenanta####.com/c/soiueyqas.zip
- oi####.kenanta####.com/c/sqenchdaz.zip
- p####.api.adoc####.com/ip
- p####.q####.cn.####.net/vcover_vt_pic/0/rmwveg7cmeicjjpt1444975894.jpg/220
- p####.q####.cn.####.net/vcover_vt_pic/0/tldyy9mk2ladxmg1518060417/220
- pic.haku6####.com/upload/vod/2019-10-04/201910041570152187.jpg
- res####.a####.top/617.html
- res####.a####.top/LHYY.png
- res####.a####.top/sdk10_2.png
- res####.a####.top/sdk3.png
- res####.a####.top/sdk6.png
- s####.al####.com/L1/272/6837/static/wap/img/uc-32.png
- s####.al####.com/L1/272/6837/static/wap/img/uc.png
- s.n####.cn:8918/m?v=####
- s2.z####.cn/ims?kt=####&at=####&key=aHR####&sign=yx####&tv=####&x####
- t####.a####.top/anshua.json
- t####.a####.top/pingpaiAD.json
- tinychi####.q####.com.####.com/api_101_api.jar
- tinychi####.q####.com.####.com/lijian.jar
- tinychi####.q####.com.####.com/share_img.png
- tinychi####.q####.com.####.com/sm_test_3_sm_c.jar
- v3.jia####.com/code_mini/jia.js
- wap.78####.cc/api/cn/1
- wap.tuca####.com/
- wap.tuca####.com/d/js/acmsd/thea53.js
- wap.tuca####.com/d/js/acmsd/thea71.js
- wap.tuca####.com/templets/phone/css/comment_operation.css
- wap.tuca####.com/templets/phone/css/index.css
- wap.tuca####.com/templets/phone/css/macrosStarTechnology.css
- wap.tuca####.com/templets/phone/js/comment_operation.js
- wap.tuca####.com/templets/phone/js/index.js
- wap.tuca####.com/templets/phone/js/macrosStarTechnology.js
- wap.tuca####.com/templets/phone/js/plugin/jquery-1.11.3.js
- wap.tuca####.com/templets/phone/js/plugin/praise.js
- wap.tuca####.com/templets/phone/resource/image/macrosStarTechnology/wap_...
- weib####.g####.sina####.com/large/683cb5a1gy1g1mbi0xz6bj20go08cdg8.jpg
- www.78####.cc/index/backend/pro_count?event_id=####&imei=####&channel_id...
- www.78####.cc/index/limit/getLimit?channel=####&project=####
- www.78####.cc/index/limit/limit_count?channel=####&project=####
- www.78####.cc/index/limit/limit_get?channel=####&project=####
- www.78####.cc/index/project/project_status?action=####
- www.78####.cc/index/publics/get_hot_data
- www.sm####.com/smu0/o.js
- yun.b####.com/pw/666f72627974.jpg
- yun.b####.com/pw/70777777.jpg
- yun.b####.com/pw/765f73646b.jpg
- yun.b####.com/tz/6173.jpg
- yun.b####.com/xtz/1579072131.ico
HTTP POST requests:
- ad.smudge####.com:8986/api/5/detail?businessId=####&token=####×tamp...
- ad.toads####.com/api/angent
- ap####.math####.cn/titan/monitor/device_info
- api.liyan####.com:808/get/api
- api.m2g.adoc####.com/ssp/monitor/collect/error
- api.meiju####.net/
- api.yunco####.com/service/rest
- de.ssp.harm####.cn/r
- e4####.0r####.com:10293/widlth/
- e4####.0r####.com:10293/xkeila/
- i.ist####.com:8071/6.2.0/1510864978/1
- j####.o####.com:13967/d0oer/
- jp####.njt####.com:10091/wisdom/marking
- ott.h####.com:8071/api/10
- q####.0####.com:13967/d0oer/
- q####.0####.com:13967/nheae/
- q####.0####.com:13967/x5qn0/
- r.ist####.com:8071/6.2.0/163832107/2
- ssp.k####.com/api/useful
- v.h####.com:8071/8
- www.78####.cc/index/backend/pro_data
- xt####.g8####.com:20149/kysd7h/
File system changes:
Creates the following files:
- /data/data/####/-1127729055-1266689676
- /data/data/####/-8ty96l31bHGC3MjWaYteA==.new
- /data/data/####/-o0CoqLRt7-pQnE92McxD_rE-SM=.new
- /data/data/####/.6173.apk
- /data/data/####/.6173.dex
- /data/data/####/.6173.dex.flock (deleted)
- /data/data/####/.666f72627974.apk
- /data/data/####/.666f72627974.dex
- /data/data/####/.666f72627974.dex.flock (deleted)
- /data/data/####/.70777777.apk
- /data/data/####/.70777777.dex
- /data/data/####/.70777777.dex.flock (deleted)
- /data/data/####/.765f73646b.apk
- /data/data/####/.765f73646b.dex
- /data/data/####/.765f73646b.dex.flock (deleted)
- /data/data/####/.bak
- /data/data/####/.jg.ic
- /data/data/####/.jg.store.report_cf
- /data/data/####/.zx
- /data/data/####/0030fdc98a551171_0
- /data/data/####/00993f511c8b1b878830aa908a599c16c3d7ae512bc2c46....0.tmp
- /data/data/####/034fd43ce0c47da5db73d085e7768524fb762dbf9948d8f....0.tmp
- /data/data/####/0389ab9faa3d953a_0
- /data/data/####/03dda5dbfb65a4a1_0
- /data/data/####/03dda5dbfb65a4a1_1
- /data/data/####/042b705c03135639_0
- /data/data/####/045687b92433a537_0
- /data/data/####/045687b92433a537_1
- /data/data/####/0468f03fd8f38224_0
- /data/data/####/076170285ad99644_0
- /data/data/####/076170285ad99644_1
- /data/data/####/079412a296ffeccc36a38438d5aa974f
- /data/data/####/079412a296ffeccc36a38438d5aa974f.tmp
- /data/data/####/09230ebd5f3fc307_0
- /data/data/####/09ad1e0ac6571c00_0
- /data/data/####/09ad1e0ac6571c00_1
- /data/data/####/0D00AF89839982CAA0B2BFEFD9AF6134.dex
- /data/data/####/0D00AF89839982CAA0B2BFEFD9AF6134.dex.flock (deleted)
- /data/data/####/0a0b6ffbfd9f752b_0 (deleted)
- /data/data/####/0bb8920827c1385e_0
- /data/data/####/0bb8920827c1385e_1
- /data/data/####/0bfabaaf778c8d20_0
- /data/data/####/0bfabaaf778c8d20_1
- /data/data/####/0bfe599ac466ad8c_0
- /data/data/####/0c38b6af9b06d0b0_0
- /data/data/####/0c5bd0667d9dcaf3_0
- /data/data/####/0d24aa4ab5087d9b_0 (deleted)
- /data/data/####/0d959ca528f5770ebdefce6f7b7f4015
- /data/data/####/0d959ca528f5770ebdefce6f7b7f4015.tmp
- /data/data/####/0da42c3166426948_0
- /data/data/####/0da42c3166426948_1
- /data/data/####/0dd31706a8bb694e_0
- /data/data/####/0dd31706a8bb694e_1
- /data/data/####/0e350b766d596aff_0
- /data/data/####/0e350b766d596aff_1
- /data/data/####/1021689741840853517
- /data/data/####/10_2.dex (deleted)
- /data/data/####/10_2.dex.flock (deleted)
- /data/data/####/10_2.jar
- /data/data/####/10a459f91c1df055_0
- /data/data/####/110
- /data/data/####/114569f4076b3e3e_0
- /data/data/####/114569f4076b3e3e_0 (deleted)
- /data/data/####/1151d523748d60a8_0
- /data/data/####/1151d523748d60a8_1
- /data/data/####/1157a710cc32b0ea_0
- /data/data/####/11ec3d72976c60c51417ae1f500b7c19f29f7b790ff748e....0.tmp
- /data/data/####/12242d426430788f_0
- /data/data/####/12242d426430788f_1
- /data/data/####/142
- /data/data/####/143970178-1509997924
- /data/data/####/14bfd48ee03049c6_0
- /data/data/####/14bfd48ee03049c6_0 (deleted)
- /data/data/####/151d7c1e807d4521_0
- /data/data/####/161e8125686aafae_0
- /data/data/####/1727ff0bc5050275_0
- /data/data/####/1727ff0bc5050275_1
- /data/data/####/175
- /data/data/####/183d4bec065e2b53_0
- /data/data/####/183d4bec065e2b53_1
- /data/data/####/184e18b16ba1284c_0
- /data/data/####/18873752c3fbe12ffe85ee4952f33c449532fba942089c4....0.tmp
- /data/data/####/1CC348654F9CF9BAD5D972EB721574B9.xml
- /data/data/####/1a9cc4fcc65e5ac7_0
- /data/data/####/1a9cc4fcc65e5ac7_1
- /data/data/####/1b35351742fbe1af_0
- /data/data/####/1d51b798e0311253_0
- /data/data/####/1e74c50b85b5f18d_0
- /data/data/####/1f342dc146549bc6_0
- /data/data/####/1s.dex
- /data/data/####/1s.dex.flock (deleted)
- /data/data/####/1s.jar
- /data/data/####/214b24e970f6e9a394ac80a4af8a671e.db
- /data/data/####/21a0385fb45e6d55_0
- /data/data/####/21b60fb6adc59d02_0
- /data/data/####/2345cbd470d3532d_0
- /data/data/####/2437898672c2a2ef_0
- /data/data/####/248468d169d59322_0
- /data/data/####/24b8a840bd3e4daf_0
- /data/data/####/24b8a840bd3e4daf_0 (deleted)
- /data/data/####/2599e1052241d510_0
- /data/data/####/267d778e2ab8659263fd9fd49f3b76795a38a2dac099769....0.tmp
- /data/data/####/2773763b3918c88b_0
- /data/data/####/27b5d483019ffdbc_0
- /data/data/####/27b5d483019ffdbc_1
- /data/data/####/27d43f2fe7e6607f_0 (deleted)
- /data/data/####/27f2dd6b1ceca7b927c695cad6d8d546.0
- /data/data/####/27f2dd6b1ceca7b927c695cad6d8d546.1
- /data/data/####/29da4e73dcf8660f_0
- /data/data/####/2B578E8EB0EA86FC8E16C06EF7F9F136
- /data/data/####/2B578E8EB0EA86FC8E16C06EF7F9F136.dex
- /data/data/####/2B578E8EB0EA86FC8E16C06EF7F9F136.dex.flock (deleted)
- /data/data/####/2B578E8EB0EA86FC8E16C06EF7F9F136.jar
- /data/data/####/2B578E8EB0EA86FC8E16C06EF7F9F136.temp
- /data/data/####/2a5ae2a52fb78dad_0
- /data/data/####/2a9a2573739584ae_0
- /data/data/####/2b66a5f6b5d98f29_0
- /data/data/####/2b66a5f6b5d98f29_1
- /data/data/####/2bc2fdca8ac4c598_0
- /data/data/####/2d78ea5f3cb39801_0
- /data/data/####/2d78ea5f3cb39801_1
- /data/data/####/2d9a90deee81eea6_0
- /data/data/####/2dbeb3dfe9caf064_0 (deleted)
- /data/data/####/3.dex (deleted)
- /data/data/####/3.dex.flock (deleted)
- /data/data/####/3.jar
- /data/data/####/300
- /data/data/####/303c40b1a1cb451a_0
- /data/data/####/303c40b1a1cb451a_1
- /data/data/####/315
- /data/data/####/3179068159.apk
- /data/data/####/318
- /data/data/####/325
- /data/data/####/332f09d226bdb83b_0
- /data/data/####/333
- /data/data/####/335
- /data/data/####/336
- /data/data/####/34
- /data/data/####/341
- /data/data/####/345
- /data/data/####/348
- /data/data/####/350
- /data/data/####/351
- /data/data/####/352
- /data/data/####/356
- /data/data/####/362
- /data/data/####/368ae44b1d840131_0
- /data/data/####/36ac79ab2d0c8620_0
- /data/data/####/36bd1ba46f08b1f74e67523b148cad7501751d6bb3c8789....0.tmp
- /data/data/####/374
- /data/data/####/377
- /data/data/####/3855dd2f9bd79fca_0
- /data/data/####/3855dd2f9bd79fca_1
- /data/data/####/391
- /data/data/####/393
- /data/data/####/395
- /data/data/####/396
- /data/data/####/397
- /data/data/####/398
- /data/data/####/3a6718beef4bc51e_0
- /data/data/####/3a6718beef4bc51e_1
- /data/data/####/3af6dc84ee61c320_0
- /data/data/####/3c81c81a9ae29d45_0
- /data/data/####/3ecf7848a39ba610_0
- /data/data/####/3ecf7848a39ba610_1
- /data/data/####/402a3c145e89fe017738b95148df3bc9.0
- /data/data/####/402a3c145e89fe017738b95148df3bc9.1
- /data/data/####/41209e0a8e8352d7_0
- /data/data/####/41209e0a8e8352d7_0 (deleted)
- /data/data/####/41c9917381d146ce_0
- /data/data/####/42dca82dbeeaf72d_0
- /data/data/####/42e3379b554d697429c03f7f78da57aa.0.tmp
- /data/data/####/42e3379b554d697429c03f7f78da57aa.1.tmp
- /data/data/####/4392ef3a496f2af7_0
- /data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
- /data/data/####/459dcdd858275928_0
- /data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
- /data/data/####/4F93F5FBBD2C1A819AC341366515421F
- /data/data/####/4F93F5FBBD2C1A819AC341366515421F.dex
- /data/data/####/4F93F5FBBD2C1A819AC341366515421F.dex.flock (deleted)
- /data/data/####/4F93F5FBBD2C1A819AC341366515421F.jar
- /data/data/####/4F93F5FBBD2C1A819AC341366515421F.temp
- /data/data/####/4a28b66098e1d15e_0
- /data/data/####/4a7e3734c8bce38f_0
- /data/data/####/4a84c60e9a75184e_0
- /data/data/####/4b995c50f36e5ff3_0
- /data/data/####/4c6d7c9ddee65977_0
- /data/data/####/4d362bdc46ad10f1_0
- /data/data/####/4e2bd367a1906312_0
- /data/data/####/4e2bd367a1906312_1
- /data/data/####/4e45bac7838d2deb_0
- /data/data/####/4e45de49dd76c599_0
- /data/data/####/4e80451d362cabcc_0
- /data/data/####/4fba42f66e12330a_0 (deleted)
- /data/data/####/4fe7bd89a01cf83a_0
- /data/data/####/5108ef2d162796b5_0
- /data/data/####/535bb08a7b0fde92_0 (deleted)
- /data/data/####/55862c8f70d63493_0
- /data/data/####/55862c8f70d63493_1
- /data/data/####/55c5b1395cbdde84_0
- /data/data/####/579565eec49cc265_0
- /data/data/####/579565eec49cc265_1
- /data/data/####/57a3b738e43b3198_0
- /data/data/####/57ed28f65ca6e8d6_0
- /data/data/####/5870ea1a43e42ccf_0
- /data/data/####/58d03cf4b9ab9005_0
- /data/data/####/58e1ffad1eaf8445_0
- /data/data/####/58e1ffad1eaf8445_1
- /data/data/####/592meiju_data.xml
- /data/data/####/59506962a686da01_0 (deleted)
- /data/data/####/599d8f58e7422d2a_0
- /data/data/####/599d8f58e7422d2a_1
- /data/data/####/59ad02ddccbe51a8_0
- /data/data/####/5I3j9tyZ4UgWHgkiSqH06A==
- /data/data/####/5bfae7e78834ce50_0
- /data/data/####/5c054f7b9237f926_0
- /data/data/####/5c054f7b9237f926_1
- /data/data/####/5c3997a2304c560c_0
- /data/data/####/5c3997a2304c560c_1
- /data/data/####/5c3f41dedbbab212_0
- /data/data/####/5cb913ff5b30adf8_0
- /data/data/####/5cfd521e12523b29_0
- /data/data/####/5db8c3fb36025ae9_0
- /data/data/####/5db8c3fb36025ae9_1
- /data/data/####/5e8de6d7e0667251_0
- /data/data/####/5e8de6d7e0667251_1
- /data/data/####/5e96da3275a94481_0
- /data/data/####/5e96da3275a94481_1
- /data/data/####/5eca177b72a5020c_0
- /data/data/####/5eca177b72a5020c_1
- /data/data/####/6.dex
- /data/data/####/6.dex.flock (deleted)
- /data/data/####/6.jar
- /data/data/####/63f8cc77b31630b5_0
- /data/data/####/6B2F4FEDB1346F9E3AE1C0D381EEFBC9.dex
- /data/data/####/6B2F4FEDB1346F9E3AE1C0D381EEFBC9.dex.flock (deleted)
- /data/data/####/6a4b178b51105ba2_0
- /data/data/####/6b0046aa35b4ccb58938330566f1083b.0
- /data/data/####/6b0046aa35b4ccb58938330566f1083b.1
- /data/data/####/6c51343ab80c964a_0
- /data/data/####/6cde4ed0f6de1111_0 (deleted)
- /data/data/####/6d4d18fcc28fb9ad_0
- /data/data/####/6d4d18fcc28fb9ad_1
- /data/data/####/6e2f2c0fe5f3cabf_0 (deleted)
- /data/data/####/6e7615e6f54bc6c0_0
- /data/data/####/6f182f23ff9d74e8bc48ee4f8ad28391238807a2c249e7d....0.tmp
- /data/data/####/70f96148d59a2c7e_0
- /data/data/####/70f96148d59a2c7e_1
- /data/data/####/71b9c02202a491c4_0
- /data/data/####/71ea3523cdcca367_0
- /data/data/####/7257bb16f7437bfd_0
- /data/data/####/727367beab4afc59_0 (deleted)
- /data/data/####/72f9b3f988ea4e4a_0
- /data/data/####/7414ce5ce0a6c68b_0
- /data/data/####/74cc40abe940518b_0
- /data/data/####/74ed6723e5557752_0
- /data/data/####/77O_ho0q7gT5rbRQqtw8FQ==
- /data/data/####/77O_ho0q7gT5rbRQqtw8FQ==.new
- /data/data/####/78cfef1a1077ada0_0
- /data/data/####/79683dbd7e65a865_0
- /data/data/####/7a8f11619dc79ad6_0
- /data/data/####/7a9180e0ed6bbe19_0
- /data/data/####/7af93a7247f82521_0
- /data/data/####/7cbf62915c2bf508_0
- /data/data/####/7dca6c1494b17a04_0 (deleted)
- /data/data/####/808a59ad114c6b8d_0
- /data/data/####/828624456f9b3e04_0
- /data/data/####/835e9871f050e833_0
- /data/data/####/83c9e1e5cdba70f6_0
- /data/data/####/85212b09bf2ce564_0
- /data/data/####/85d67f99e81b7178_0
- /data/data/####/87236ad5fabafe74_0
- /data/data/####/87236ad5fabafe74_1
- /data/data/####/874173224350e7df_0
- /data/data/####/88f6de071897c941_0
- /data/data/####/8EAD111D030291821E19A80E344C340A.xml
- /data/data/####/8cb9fc596ece5fde_0
- /data/data/####/8cb9fc596ece5fde_1
- /data/data/####/8ce41d4a62525a51_0
- /data/data/####/8ce41d4a62525a51_1
- /data/data/####/8e926e49204b543d_0
- /data/data/####/8ef5c1eb66272e22_0
- /data/data/####/8f109a3c9a0a4559_0
- /data/data/####/8f68072f4836b4b4_0
- /data/data/####/8f68b92eb8d59c6c_0
- /data/data/####/8fd202430b8f7da6_0 (deleted)
- /data/data/####/8fdee3376617689d_0
- /data/data/####/90744d569e428ab4_0
- /data/data/####/91b308d83f06b9b514556df25aeb6473289db7fc56e1c1d....0.tmp
- /data/data/####/91c0612f7cba5c37_0
- /data/data/####/9310664247258bc6_0
- /data/data/####/93a34fe8d0bdbc1425e88dd745161a17.db
- /data/data/####/94c319328bd8eb2f_0
- /data/data/####/9618302918.xml
- /data/data/####/9618302918.xml.bak
- /data/data/####/96D363AD4F05B0EF5EE8D629DB6A972D
- /data/data/####/96D363AD4F05B0EF5EE8D629DB6A972D.dex
- /data/data/####/96D363AD4F05B0EF5EE8D629DB6A972D.dex.flock (deleted)
- /data/data/####/96D363AD4F05B0EF5EE8D629DB6A972D.jar
- /data/data/####/96D363AD4F05B0EF5EE8D629DB6A972D.temp
- /data/data/####/98b282db5507489d_0
- /data/data/####/98b282db5507489d_0 (deleted)
- /data/data/####/98b696c0d9f50b9a_0
- /data/data/####/9c346ccdcdbd5cc184e0806d2dc0876177a7123a6837d03....0.tmp
- /data/data/####/9c89656d9f671353_0
- /data/data/####/9c89656d9f671353_1
- /data/data/####/9d33be9aaa5f4963_0
- /data/data/####/9dd9feff6037e0cd_0
- /data/data/####/9f849b7688d69a1a_0
- /data/data/####/9fae228ab1a6d0b1_0 (deleted)
- /data/data/####/AQOKA2Zp3SoZQcr94KB-2cqn-0o7c2JZ5RuJB6fbLpI=_RT...ournal
- /data/data/####/BuvlDo92o8gBuP-KFRTYRK4WGl4=.new
- /data/data/####/Cookies-journal
- /data/data/####/D2427043CED95DECD73FFF1C7EC45B8A.dex
- /data/data/####/D2427043CED95DECD73FFF1C7EC45B8A.dex.flock (deleted)
- /data/data/####/FjFvVXje8HRK0Ono-qlRe1E5uY4=.new
- /data/data/####/HRELYyrFc0BgdDWYEgbL9Q==
- /data/data/####/HttpDNSConstantsJson.xml
- /data/data/####/RB5SZ6T1mBn9zj_sWR913nGFSLLUaiI4.new
- /data/data/####/TqxyPDATQGTChogB6sgFNg==.new
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/WOpVBaI6MYSdxfys
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/XkdjsIx132mM356507059351895comm.xml
- /data/data/####/XkdjsIx132mM356507059351895tasks.xml
- /data/data/####/XkdjsIx132mMskey1.xml
- /data/data/####/_p.xml
- /data/data/####/_pn
- /data/data/####/_sh.xml
- /data/data/####/_shn
- /data/data/####/a0983770d23c04e1_0
- /data/data/####/a0983770d23c04e1_1
- /data/data/####/a0bb8befca0fcf21_0
- /data/data/####/a0f6fc587f296f2a_0
- /data/data/####/a1345af851b5d4e46e74031fc7d536c8bc80f66ddf25a90....0.tmp
- /data/data/####/a28edfaf40b02e2b_0 (deleted)
- /data/data/####/a312df86a805dd82_0
- /data/data/####/a362057c1da65063_0
- /data/data/####/a362057c1da65063_1
- /data/data/####/a408a1faaedc8a1a_0
- /data/data/####/a60813a98041e5e4_0 (deleted)
- /data/data/####/a6c5eaa8005184f0_0
- /data/data/####/a6eb3c56c645d45b_0
- /data/data/####/a888b2ce5d18a925_0
- /data/data/####/a888b2ce5d18a925_1
- /data/data/####/a92ad92f2ef39c93_0 (deleted)
- /data/data/####/aVscrkeEMlp-yYXQ.dex
- /data/data/####/aVscrkeEMlp-yYXQ.dex.flock (deleted)
- /data/data/####/aVscrkeEMlp-yYXQ.zip
- /data/data/####/ab1bd208a4d64dcd_0 (deleted)
- /data/data/####/ab9f03d66e586bf5_0
- /data/data/####/ab9f03d66e586bf5_1
- /data/data/####/ae329696409d7540_0
- /data/data/####/af37b48a9b9694a6_0
- /data/data/####/af63f29add6d4605_0
- /data/data/####/af718ea2158bb085_0
- /data/data/####/aff8a7178273a17b_0
- /data/data/####/api.dex
- /data/data/####/api.dex.flock (deleted)
- /data/data/####/api.jar
- /data/data/####/appuserid.xml
- /data/data/####/b07fba3f16212de3_0
- /data/data/####/b3bd7c1b3ae8637c_0
- /data/data/####/b42d1fcac36aca62_0
- /data/data/####/b4e959932f48a7be_0 (deleted)
- /data/data/####/bcad57c0b4d0e6af_0
- /data/data/####/be4b2747ef92f253_0
- /data/data/####/be96d6f46c0dfc2918042841d79d7a4109247f26d1485c7....0.tmp
- /data/data/####/bf24ccecba464cec_0
- /data/data/####/c2a22b733c47aacb_0
- /data/data/####/c31f327a10a74433_0
- /data/data/####/c3b47868d62af47d_0
- /data/data/####/c4fdf3e7223c129f_0
- /data/data/####/c4fdf3e7223c129f_1
- /data/data/####/c6c1bac454cfa761_0
- /data/data/####/c7cb58f4f157ed0e_0
- /data/data/####/c7cb58f4f157ed0e_1
- /data/data/####/c8f155e1cee529f6_0
- /data/data/####/ca4de3401177e4c2_0 (deleted)
- /data/data/####/ca8659303b80258c_0
- /data/data/####/cab57953a57a6a43_0
- /data/data/####/cc633ed5f0dcc538_0 (deleted)
- /data/data/####/cd2f502e69eb22bc_0
- /data/data/####/cdaeb425fe344e29_0
- /data/data/####/cdfb191e22a2beb4_0
- /data/data/####/ce0cd02b9cc2c463_0 (deleted)
- /data/data/####/ce818a1f2604843e_0
- /data/data/####/cee8f60ed9dccde6_0 (deleted)
- /data/data/####/cf8a2f03668824f5_0
- /data/data/####/cff2b98c52e67c73_0 (deleted)
- /data/data/####/classes.dex
- /data/data/####/classes.dex.flock (deleted)
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/com.meiju592.zhaohuiyou_preferences.xml
- /data/data/####/combmiewgjire.xml
- /data/data/####/commzucnbixgj.xml
- /data/data/####/comngensjkweof.xml
- /data/data/####/d044d44896450e5b_0
- /data/data/####/d0ae53e6af01cc63_0
- /data/data/####/d436382dfb5d1b6b66e8d7b096aaf84bb9496f675c343eb....0.tmp
- /data/data/####/d740b989b3edd19f_0
- /data/data/####/d740b989b3edd19f_1
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTg5NTM0MDkyNjIx;
- /data/data/####/db1079d0268380b1_0
- /data/data/####/db64144592e6c02b040383ecdf104e9c1d3c316f1fc6c34....0.tmp
- /data/data/####/db9d8cc54e9ddc16_0
- /data/data/####/dc501ce2a572962b_0
- /data/data/####/djpcflwx.dex
- /data/data/####/djpcflwx.dex.flock (deleted)
- /data/data/####/djpcflwx.jar
- /data/data/####/dns_ip_info.db
- /data/data/####/dns_ip_info.db-journal
- /data/data/####/downUmeng.dex (deleted)
- /data/data/####/downUmeng.dex.flock (deleted)
- /data/data/####/downUmeng.jar
- /data/data/####/downloader.db-journal
- /data/data/####/dpi
- /data/data/####/e-n1f8zDcGZW_Pe8zHheKw==.new
- /data/data/####/e1e1d51cbea4e071b4a65f44df249e3ffd7aee9d4d4d963....0.tmp
- /data/data/####/e28066ac1657ba6e_0
- /data/data/####/e2be2cad701429a5_0
- /data/data/####/e5863f2edaa7b33a_0
- /data/data/####/e5dd1558bc8e84e6_0
- /data/data/####/e60a1fb2b4146722129ac1d05188cff8119b6fbd77c5b32....0.tmp
- /data/data/####/e78e0b658f697786_0
- /data/data/####/e91fc183dea258c2_0
- /data/data/####/e91fc183dea258c2_1
- /data/data/####/e9ea64d9beca81ba_0
- /data/data/####/ea9ad788d0dc9856_0
- /data/data/####/ea9ad788d0dc9856_1
- /data/data/####/eceabc750a65f3918f7877f9051b5913509585ce1a0fbed...8a8d.0
- /data/data/####/edaabf2cbd78b31b_0
- /data/data/####/edd69b60361b88e1_0
- /data/data/####/eef50418a062bd6e_0
- /data/data/####/ef207aac4b5d1eb0_0
- /data/data/####/efb3cff6584b49b5_0
- /data/data/####/ekI26Y11-Oxz49Hz.new
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f026ef5c8fbda785bdc0f43ad98c9383.db
- /data/data/####/f06ee32aa1eda3a5_0
- /data/data/####/f0e07b0512f189b8_0
- /data/data/####/f1ee2504bdc9041c_0
- /data/data/####/f1ee2504bdc9041c_1
- /data/data/####/f332899b17d542d2_0 (deleted)
- /data/data/####/f50fd18752b98d15_0
- /data/data/####/f50fd18752b98d15_0 (deleted)
- /data/data/####/f528fc03a3cba29f_0
- /data/data/####/f528fc03a3cba29f_0 (deleted)
- /data/data/####/f6a25bd98e0e310f_0
- /data/data/####/fa146c2b9f7c5294_0
- /data/data/####/fa6212d11ca70125_0
- /data/data/####/fa6212d11ca70125_1
- /data/data/####/fa6dd52d8df8f1dd_0
- /data/data/####/fb5ca152b0a2dc04_0
- /data/data/####/fd49456b1b748d98_0
- /data/data/####/gameid
- /data/data/####/gameid.zip
- /data/data/####/geixa_f.dex
- /data/data/####/geixa_f.dex.flock (deleted)
- /data/data/####/geixa_f.zip
- /data/data/####/gjoahhLEl3hv0-BMlR0XV_G6vRw=
- /data/data/####/https_facai.58.com_0.localstorage-journal
- /data/data/####/https_iflow.uc.cn_0.localstorage-journal
- /data/data/####/https_m.sohu.com_0.localstorage-journal
- /data/data/####/https_yz.m.sm.cn_0.localstorage-journal
- /data/data/####/hxdata.xml
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/javasdklog.xml
- /data/data/####/journal.tmp
- /data/data/####/libbqptos.so
- /data/data/####/libbqptos.so-32
- /data/data/####/libbqptos.so-64
- /data/data/####/libjiagu.so
- /data/data/####/libnms.so
- /data/data/####/libnms64.so
- /data/data/####/lijian.dex
- /data/data/####/lijian.dex.flock (deleted)
- /data/data/####/lijian.jar
- /data/data/####/meijuniaoV2.db-journal
- /data/data/####/metrics_guid
- /data/data/####/mok.xml
- /data/data/####/msy.xml
- /data/data/####/nD0ji_azi2jWvTbHg8k7nSODl6M=
- /data/data/####/nD0ji_azi2jWvTbHg8k7nSODl6M=.new
- /data/data/####/okrulp.png
- /data/data/####/proc_auxv
- /data/data/####/qqsz_file.xml
- /data/data/####/qqsz_file.xml.bak
- /data/data/####/rq_file.xml
- /data/data/####/runner_info.prop.new
- /data/data/####/sdk_config.xml
- /data/data/####/sm_test.dex
- /data/data/####/sm_test.dex.flock (deleted)
- /data/data/####/sm_test.jar
- /data/data/####/sp_reward_video_adslot.xml
- /data/data/####/sp_reward_video_adslot_preload.xml
- /data/data/####/sp_reward_video_cache_933669395.xml
- /data/data/####/spu_ti.xml
- /data/data/####/spu_yj.xml
- /data/data/####/t==8.0.0&&zhaohuiyou修改_1589534094312_envelope.log
- /data/data/####/the-real-index
- /data/data/####/tktest503.dex
- /data/data/####/tktest503.dex.flock (deleted)
- /data/data/####/tktest503.jar
- /data/data/####/tt_sdk_settings.xml
- /data/data/####/ttopenadsdk.xml
- /data/data/####/uIyMRXWa9Z5HWmgctFNjVj1m2tQ=.new
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/xdtversion.xml
- /data/data/####/ycb.xml
- /data/data/####/ycb.xml.bak
- /data/data/####/ycb.xml.bak (deleted)
- /data/data/####/yd_config_c.xml
- /data/media/####/.usdis
- /data/media/####/.uunique.new
- /data/media/####/.yoh
- /data/media/####/0D00AF89839982CAA0B2BFEFD9AF6134
- /data/media/####/0D00AF89839982CAA0B2BFEFD9AF6134.temp
- /data/media/####/0D00AF89839982CAA0B2BFEFD9AF6134.zip
- /data/media/####/0f4e1d5ae60f6339bf30f0a3de1b4923.png
- /data/media/####/11ED3EEC089A54E12434EEB2E1FD0D31
- /data/media/####/1e4d8f19e620220681242b071ee17fae.jpg
- /data/media/####/24651B7827BEE1FF264AF705B0C5ACCB
- /data/media/####/2E46116119D6369FFDF3FC0F21D690C3
- /data/media/####/436D56847771BA680E24B7AEE75B16A2
- /data/media/####/4c32c38ff6b804f4630e2ff4f6b93866.tmp
- /data/media/####/4d29639a37e58723b0741a323c76858e.tmp
- /data/media/####/6B2F4FEDB1346F9E3AE1C0D381EEFBC9
- /data/media/####/6B2F4FEDB1346F9E3AE1C0D381EEFBC9.temp
- /data/media/####/6B2F4FEDB1346F9E3AE1C0D381EEFBC9.zip
- /data/media/####/6D8605C6EB52E8C1B47753D805DB7D02
- /data/media/####/D2427043CED95DECD73FFF1C7EC45B8A
- /data/media/####/D2427043CED95DECD73FFF1C7EC45B8A.temp
- /data/media/####/D2427043CED95DECD73FFF1C7EC45B8A.zip
- /data/media/####/D2B044FC2767794301ABFFCC54D830CE
- /data/media/####/_pn
- /data/media/####/da48d872719fbc49bcfb42e7596c9f0c.tmp
- /data/media/####/date40003000700
- /data/media/####/pe
- /data/media/####/pidfile.txt
- /data/media/####/temp_pkg_info.json
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.yqzqa/djpcflwx.jar --oat-fd=84 --oat-location=/data/user/0/<Package>/.yqzqa/djpcflwx.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_cache/.hefbdhsfb/api/api.jar --oat-fd=187 --oat-location=/data/user/0/<Package>/app_cache/.hefbdhsfb/api/api.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_cache/.hefbdhsfb/lijian/lijian.jar --oat-fd=159 --oat-location=/data/user/0/<Package>/app_cache/.hefbdhsfb/lijian/lijian.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_cache/.hefbdhsfb/sm_test/sm_test.jar --oat-fd=167 --oat-location=/data/user/0/<Package>/app_cache/.hefbdhsfb/sm_test/sm_test.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.6173.apk --oat-fd=73 --oat-location=/data/user/0/<Package>/files/.6173.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.666f72627974.apk --oat-fd=73 --oat-location=/data/user/0/<Package>/files/.666f72627974.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.70777777.apk --oat-fd=156 --oat-location=/data/user/0/<Package>/files/.70777777.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_df_file/.765f73646b.apk --oat-fd=73 --oat-location=/data/user/0/<Package>/files/.765f73646b.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/1s.jar --oat-fd=202 --oat-location=/data/user/0/<Package>/app_dex/1s.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng.jar --oat-fd=72 --oat-location=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng/downUmeng.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/hook/classes.dex --oat-fd=33 --oat-location=/data/user/0/<Package>/cache/hook/opt/classes.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/pxj/<Package>/rj/2B578E8EB0EA86FC8E16C06EF7F9F136.jar --oat-fd=85 --oat-location=/data/user/0/<Package>/files/2B578E8EB0EA86FC8E16C06EF7F9F136.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/pxj/<Package>/rj/4F93F5FBBD2C1A819AC341366515421F.jar --oat-fd=69 --oat-location=/data/user/0/<Package>/files/4F93F5FBBD2C1A819AC341366515421F.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/pxj/<Package>/rj/96D363AD4F05B0EF5EE8D629DB6A972D.jar --oat-fd=84 --oat-location=/data/user/0/<Package>/files/96D363AD4F05B0EF5EE8D629DB6A972D.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/Bx5twDyc2x_JqJ3KsuhHLjWcwuAs5-ZJFmx68rcMPHE=/0mmUoDxxcUpmshelAvNR8Q==/aVscrkeEMlp-yYXQ.zip --oat-fd=62 --oat-location=/data/user/0/<Package>/files/Bx5twDyc2x_JqJ3KsuhHLjWcwuAs5-ZJFmx68rcMPHE=/0mmUoDxxcUpmshelAvNR8Q==/aVscrkeEMlp-yYXQ.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/10_2.jar --oat-fd=156 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/10_2.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/3.jar --oat-fd=154 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/3.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/6.jar --oat-fd=157 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/6.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/geixa_d/geixa_f.zip --oat-fd=158 --oat-location=/data/user/0/<Package>/files/geixa_d/geixa_f.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tda/tktest503.jar --oat-fd=62 --oat-location=/data/user/0/<Package>/files/tda/tktest503.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/glj/<Package>/bbm/0D00AF89839982CAA0B2BFEFD9AF6134.zip --oat-fd=154 --oat-location=/data/user/0/<Package>/files/0D00AF89839982CAA0B2BFEFD9AF6134.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/glj/<Package>/bbm/6B2F4FEDB1346F9E3AE1C0D381EEFBC9.zip --oat-fd=40 --oat-location=/data/user/0/<Package>/files/6B2F4FEDB1346F9E3AE1C0D381EEFBC9.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/glj/<Package>/bbm/D2427043CED95DECD73FFF1C7EC45B8A.zip --oat-fd=177 --oat-location=/data/user/0/<Package>/files/D2427043CED95DECD73FFF1C7EC45B8A.dex --compiler-filter=speed
- /system/bin/sh
- cat /proc/version
- cat /sys/class/android_usb/android0/idProduct
- cat /sys/class/android_usb/android0/idVendor
- cat /sys/class/net/wlan0/address
- getprop
- getprop ro.board.platform
- getprop ro.build.display.id
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.letv.release.version
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
- getprop ro.vivo.os.build.display.id
- getprop ro.vivo.os.version
- getprop ro.yunos.version
- ls -l /dev
- ls -l /dev/__properties__
- ls -l /dev/block
- ls -l /dev/block/pci
- ls -l /dev/block/pci/pci0000:00
- ls -l /dev/block/pci/pci0000:00/0000:00:01.1
- ls -l /dev/block/pci/pci0000:00/0000:00:01.1/by-num
- ls -l /dev/block/vold
- ls -l /dev/bus
- ls -l /dev/bus/usb
- ls -l /dev/bus/usb/001
- ls -l /dev/com.android.settings
- ls -l /dev/com.android.settings.daemon
- ls -l /dev/cpuctl
- ls -l /dev/cpuset
- ls -l /dev/cpuset/background
- ls -l /dev/cpuset/foreground
- ls -l /dev/cpuset/system-background
- ls -l /dev/cpuset/top-app
- ls -l /dev/fscklogs
- ls -l /dev/graphics
- ls -l /dev/input
- ls -l /dev/memcg
- ls -l /dev/memcg/apps
- ls -l /dev/pts
- ls -l /dev/snd
- ls -l /dev/socket
- ls -l /dev/stune
- ls -l /dev/stune/background
- ls -l /dev/stune/foreground
- ls -l /dev/stune/top-app
- ls /
- ls /sys/class/thermal
- ps
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- DES
- DESede-CBC-PKCS5Padding
- RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- DES
- DESede-CBC-PKCS5Padding
- RSA-None-PKCS1Padding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
