Resubmissions
21-05-2022 11:43
220521-nv2f6aebg2 10Analysis
-
max time kernel
3873472s -
max time network
21s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
21-05-2022 11:43
Static task
static1
Behavioral task
behavioral1
Sample
f1358f3f898b94b1978adb900614ec29809073d4e6d87ae0d8fcdee9bc2e2e5f.apk
Resource
android-x86-arm-20220310-en
General
-
Target
f1358f3f898b94b1978adb900614ec29809073d4e6d87ae0d8fcdee9bc2e2e5f.apk
-
Size
1.1MB
-
MD5
7d10305381f160edad0e07150adb8476
-
SHA1
9696327cae5915a556274e48ce394dc06b7310eb
-
SHA256
f1358f3f898b94b1978adb900614ec29809073d4e6d87ae0d8fcdee9bc2e2e5f
-
SHA512
07ccebfeaa4d4f897b0b303ada77575aca996694826fbcc80f9743eeca130a211cb0e4c6d8da3fc460ddd6edbc7b6ff1c39861c980b802fa498e101f5a1e1d6d
Malware Config
Signatures
-
Agent smith
Agent smith is a modular adware that installs malicious ADs into legitimate applications.
-
Requests cell location 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
herd.zmwah.tnccjxqdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation herd.zmwah.tnccjxq -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
herd.zmwah.tnccjxq/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/herd.zmwah.tnccjxq/files/one.dex --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/herd.zmwah.tnccjxq/files/oat/x86/one.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/herd.zmwah.tnccjxq/files/one.dex 5196 herd.zmwah.tnccjxq /data/user/0/herd.zmwah.tnccjxq/files/one.dex 5442 /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/herd.zmwah.tnccjxq/files/one.dex --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/herd.zmwah.tnccjxq/files/oat/x86/one.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/herd.zmwah.tnccjxq/files/one.dex 5196 herd.zmwah.tnccjxq -
Reads the content of SMS inbox messages. 1 IoCs
Processes:
herd.zmwah.tnccjxqdescription ioc process URI accessed for read content://sms/inbox herd.zmwah.tnccjxq -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
herd.zmwah.tnccjxqdescription ioc process Framework API call javax.crypto.Cipher.doFinal herd.zmwah.tnccjxq
Processes
-
herd.zmwah.tnccjxq1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/herd.zmwah.tnccjxq/files/one.dex --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/herd.zmwah.tnccjxq/files/oat/x86/one.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/herd.zmwah.tnccjxq/app_jar/lpdf.jarFilesize
35KB
MD5e1ab911d4b585a26aae02d8540575013
SHA1ac148f7bdf95edddc97d9224ff51a771f1070520
SHA2568a71fab57b4a03f0b37095daa2eaa086ec6ed6c1c6166ca67c0e0a9e14cc85ca
SHA512983ec12cde3cbfaffb414b8c8eb17c793bee558eb51b9d5e630f9bd5f312e0ce55622719aad6097a799286c25001212b26d7053e7e110a4918beace33d3bcbc4
-
/data/user/0/herd.zmwah.tnccjxq/app_jar/lpdf.jar.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/app_jar/oat/x86/lpdf.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/app_jar/oat/x86/zdfc.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/app_jar/oat/x86/zdfc.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/app_jar/zdfc.jarFilesize
37KB
MD5d975ba5ae6b7007b97d64b347e64d5a7
SHA1b071799508ba075b7db27c36882cce8a913395af
SHA256868642bd739f6ed6f15a7073c45158eeb4d7fb12b38ddbe8a0133444ffaad9b8
SHA512ad3787c2fad325c27e488f460f9db58d1f0f081fbb5c105ab942cdf942706c28daaa5d6c674ecf5bae5b0e3595a6f7eef8ac95a9d0a35fcc66b370333ab52fb3
-
/data/user/0/herd.zmwah.tnccjxq/app_jar/zdfc.jar.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/CookiesFilesize
64KB
MD5cb7543c4df600f2af58097cce0e334ba
SHA183cc92f38c27fdb4fa519b1ce2f37912f24af1f0
SHA25664c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233
SHA512ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/Cookies-journalFilesize
1KB
MD5a73f2651552cc4b2fae97e569b2cf3e2
SHA191436d49cd8e393a5ff1f8e3f2ca044d70f2d930
SHA2564ee262c565c1001281513484871d3f07e6390290dcbdd6c752ebf1e17aa6a20e
SHA5123c4866aca46293961ab54955bfd8a9a8d2d2c431e941f5dc5d711b00fb6c487ddc622586f6cce465e94284812434d8027155d673c6253898785b792a9911baa1
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/GPUCache/indexFilesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/GPUCache/index-dir/temp-indexFilesize
48B
MD5f7e25ce37cc9016de53ab82a1d4b9c79
SHA138cad3ede57a1e023ad7a9ed73fb0ed28a86146f
SHA256ffe4d448ae6b3a53b7e0fcedaac647f35e405eb8f1349781f91217430895c196
SHA5121dadb361426ffe50ef782c37ac97076630450fa4af4987999ff3824b9b453b84091782caa02eb2d9c773a767b8e44aeee7df3d601692da66116c4884b3431cb1
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/Web DataFilesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/Web Data-journalFilesize
1KB
MD5af3b5ad461e0a36acc7b03067d1f5664
SHA1b70cedad339833861185cf1a6c6183a51d541981
SHA25627ab628bd360b23c9841afa4b669ba9d4bda732b0493383515b0d9d25b80a056
SHA512634c36f653581d220cc7f3827ef2bdbba42a4220008940baa4b66f4450d6f7142ba1f9eaa52eb89d360c0a34c5100cc2e284646f59a5d0015557b536ee71924e
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/metrics_guidMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/metrics_guidFilesize
36B
MD5ab44a27390bcbd7212d00a88da46dac7
SHA1793c19f5ab090799f1072e8ab1d2271779b184e1
SHA25612f7d2086f1b02cb5c32d08b00461dd570499f690a5a266c339a8d26af09a52d
SHA512480f353f08300e5b53654a6775f1a1de762858ed260a935980e9319cb003406dc6b2cd18348e5bdbb7bb754ac95222a28c67713779fdf3d75c71da126ee4eb39
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/variations_seed_newMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/variations_stampMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/app_webview/webview_data.lockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/321b96f4c21f6427_0Filesize
110B
MD567fead22ad18180be95fd6e459d6fb64
SHA165ab97c7fca2fd7ea101525be9ed9f0ebf300785
SHA25674dcfb8e2d02fc5643cb788735a35e76d40ce4b931afb54a06880ab9e6d06efa
SHA5129b898ee6ea67acdd2339a5d6fabc0fc8ac846bd9119dc2e1660dfb2fb0d28c3063c22ab779ba39ed3532e19b8d3e17401f144facc083989b74c383e705774361
-
/data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/5c91c981181bdfa4_0Filesize
40B
MD558440c07bbb93226f9289cdea21c653a
SHA1d33c0697bf814d9ef1f58fd109025df0c74eba7e
SHA256b69cbecd7fbecc85ccfba9f2f601aedf114f4686b6eca48bfeb72af2220f51e7
SHA512a24b4c2529ec7bf3d5a514c90245f68a84a12773ddbd49e444fd84e64131763686ca078d56859a361aeae2b95c9141ab870e611c69034fd5470e22ef12ff51a0
-
/data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/9e3c2dac3550838b_0Filesize
42B
MD5ead91c62fab3ce6e497e8e744d7b5aea
SHA17b8342aa6f60e33b2dde920b508570d5190ccc14
SHA256ed0ee1d89e626b830de0bfd80056bc88c61979e5e1de2caa70b0a5a5aa28fc9b
SHA51297dea420cc38f843418a2d904f0f856417882de8dded41a4d3429a70563e612f7615311c3bf328953ea18c3dd108fff2e9c09e0bdd8d812f1082ce4c8ad30879
-
/data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/db2dbc3b4a572a15_0Filesize
48B
MD5364fb94c1e8e5785c04d3bcd075a068c
SHA180b6eda5217406ed0e5ad7071e22f81939909227
SHA2560a64e9e86a1028d58ca7fd919ee703c6e85d531a3bd2ed21d81ae9d316aa4570
SHA512da9233f9f59dfc3c7f0efbb4e5d24c87a76eccb24531f01c1c838c7821afe2cf2d98994ecbcc3020a911d0653b0b45a727e9c50111fee052407674d55747c632
-
/data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/indexFilesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
/data/user/0/herd.zmwah.tnccjxq/cache/org.chromium.android_webview/index-dir/temp-indexFilesize
48B
MD52941dafdf19ee0cce69cb02ae24ed325
SHA14be18b6806785f3ad9db01f4834845c3e6d92a1a
SHA2565670582f87e5c2a782727ada3f4c89ce3edd8b41d360a02bfb37a24901479afc
SHA512783ffec9f24b47dda06aad12fb8ec098d5b058ab2973b4ca1e97374c2b012ef14e992dca6b4b644bf466d0311350da6b1b34c6500241196b5690fcc2110d223c
-
/data/user/0/herd.zmwah.tnccjxq/files/beacon/comp/1.jarFilesize
71KB
MD5b50ec0cc46b99c26250d1bb787ba2fed
SHA173352ce0e370c1e0e54f8456a5ba4a1996ba3566
SHA256685e1d0de3e1adaec20a531153d2da3724fb53a88d6e4d009b856721a2b8bce6
SHA512272d4ee7d4adb5dc1dc4ae9a0a3ffdecb25d460813040d906151704ece167c4be8654ba936e1716c69a357b84a63a737f2fbebcf223f88ead71b6dc110afa5b6
-
/data/user/0/herd.zmwah.tnccjxq/files/beacon/comp/6.jarFilesize
7KB
MD5740da537d28e32d8d4a97bf500fa2e51
SHA16577926b6ec08ec773c87462388a9683c66126e3
SHA256ba687a019040fbe7b354328d5352504063f75801961c0c4874d73f2189737373
SHA512bd47155786e088ad0b2180e32bfc820cf3888b451c077cc8bcfded921d435f13aad766fc26f93ffb67bb42be82f5f45f117abed4959e24e208ef151186361dc9
-
/data/user/0/herd.zmwah.tnccjxq/files/beacon_cover_check.lockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/files/oat/one.dex.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/files/oat/x86/one.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/files/oat/x86/one.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/herd.zmwah.tnccjxq/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/herd.zmwah.tnccjxq/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/herd.zmwah.tnccjxq/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/herd.zmwah.tnccjxq/files/one.dexFilesize
59KB
MD51b5c4ae7e385db4551ced8c19386abe0
SHA112d4bc9728c4f1deec1b9b8aacbfe71c3ceeb4d4
SHA2568211fa61bdd647dc627a182c4e2a763024252dfd94d14f1f12c9c9b4df045d70
SHA512f56d74aa9a3c150034866b12abf7ed233fcc2bd03d7f34bfdfd61cd054952189311669892e91dfcbf5000f509210d56d094abff99371e4897bf7943ef5a2764b
-
/data/user/0/herd.zmwah.tnccjxq/files/one.dex.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/herd.zmwah.tnccjxq/shared_prefs/WebViewChromiumPrefs.xmlFilesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48