Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    2746510s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    23/12/2023, 20:08

General

  • Target

    85d218721cb31ebe4b2f7e30e48fd72f2fdfe9dd325a71866428e2ab71671afb.apk

  • Size

    6.1MB

  • MD5

    e0e14235309f8e43f2a82d81950f3b8b

  • SHA1

    63ff065ed280282bc9bbf94a3bc0707ccb553793

  • SHA256

    85d218721cb31ebe4b2f7e30e48fd72f2fdfe9dd325a71866428e2ab71671afb

  • SHA512

    3e887572d3823d47eb72d31b876c706e353d6c651bccc5e219406945fcbb601cda4ea804468f2c981150d3d689c120c6006c3fa4261905c09ad2a1e3c57766a3

  • SSDEEP

    196608:S9XE+Dd0gOrfB6YMBDeTEKMpFSlSJHOLHyZybL:SXDOhz9MByWpFSuHFIbL

Score
8/10

Malware Config

Signatures

  • Requests cell location 3 IoCs

    Uses Android APIs to to get current cell location.

  • Queries the unique device ID (IMEI, MEID, IMSI)
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 2 IoCs

Processes

  • com.youyuan.yyhl
    1⤵
    • Requests cell location
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4261
    • sh -c service call iphonesubinfo 1
      2⤵
        PID:4314
      • service call iphonesubinfo 1
        2⤵
          PID:4314
        • sh -c cd /proc/net/ && cat arp
          2⤵
            PID:4380
            • cat arp
              3⤵
                PID:4402
            • sh -c ls /dev/socket
              2⤵
                PID:4423
              • ls /dev/socket
                2⤵
                  PID:4423
                • sh -c which su
                  2⤵
                    PID:4458
                  • which su
                    2⤵
                      PID:4458
                    • sh -c cat /proc/sys/kernel/random/boot_id
                      2⤵
                        PID:4488
                      • cat /proc/sys/kernel/random/boot_id
                        2⤵
                          PID:4488
                        • sh -c cat /proc/sys/kernel/random/uuid
                          2⤵
                            PID:4517
                          • cat /proc/sys/kernel/random/uuid
                            2⤵
                              PID:4517
                            • sh -c cat /proc/sys/kernel/osrelease
                              2⤵
                                PID:4547
                              • cat /proc/sys/kernel/osrelease
                                2⤵
                                  PID:4547
                                • sh -c id
                                  2⤵
                                    PID:4572
                                  • id
                                    2⤵
                                      PID:4572
                                    • sh -c cat
                                      2⤵
                                        PID:4596
                                      • cat
                                        2⤵
                                          PID:4596
                                        • sh -c cd /proc/self/;cat status
                                          2⤵
                                            PID:4622
                                            • cat status
                                              3⤵
                                                PID:4640
                                            • sh -c cat /proc/uptime
                                              2⤵
                                                PID:4663
                                              • cat /proc/uptime
                                                2⤵
                                                  PID:4663
                                                • sh -c cat /proc/uptime
                                                  2⤵
                                                    PID:4688
                                                  • cat /proc/uptime
                                                    2⤵
                                                      PID:4688
                                                    • sh -c date
                                                      2⤵
                                                        PID:4719
                                                      • date
                                                        2⤵
                                                          PID:4719
                                                        • sh -c cat /sys/class/net/eth0/address
                                                          2⤵
                                                            PID:4746
                                                          • cat /sys/class/net/eth0/address
                                                            2⤵
                                                              PID:4746
                                                            • sh -c cat /sys/class/net/eth1/address
                                                              2⤵
                                                                PID:4770
                                                              • cat /sys/class/net/eth1/address
                                                                2⤵
                                                                  PID:4770
                                                                • sh -c cat /sys/class/net/eth2/address
                                                                  2⤵
                                                                    PID:4794
                                                                  • cat /sys/class/net/eth2/address
                                                                    2⤵
                                                                      PID:4794
                                                                    • sh -c ps
                                                                      2⤵
                                                                        PID:4818
                                                                      • ps
                                                                        2⤵
                                                                          PID:4818
                                                                        • sh -c df
                                                                          2⤵
                                                                            PID:4843
                                                                          • df
                                                                            2⤵
                                                                              PID:4843
                                                                            • sh -c ls /system/fonts
                                                                              2⤵
                                                                                PID:4867
                                                                              • ls /system/fonts
                                                                                2⤵
                                                                                  PID:4867
                                                                                • sh -c cat /proc/meminfo
                                                                                  2⤵
                                                                                    PID:4892
                                                                                  • cat /proc/meminfo
                                                                                    2⤵
                                                                                      PID:4892
                                                                                    • sh -c cat /sys/block/mmcblk0/device/cid
                                                                                      2⤵
                                                                                        PID:4916
                                                                                      • cat /sys/block/mmcblk0/device/cid
                                                                                        2⤵
                                                                                          PID:4916
                                                                                        • sh -c cat /sdcard/../../../../../../sdcard/._driver.dat
                                                                                          2⤵
                                                                                            PID:4940
                                                                                          • cat /sdcard/../../../../../../sdcard/._driver.dat
                                                                                            2⤵
                                                                                              PID:4940
                                                                                            • sh -c cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_driver.dat
                                                                                              2⤵
                                                                                                PID:4964
                                                                                              • cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_driver.dat
                                                                                                2⤵
                                                                                                  PID:4964
                                                                                                • sh -c cat /sdcard/../../../../../../sdcard/._system.dat
                                                                                                  2⤵
                                                                                                    PID:4989
                                                                                                  • cat /sdcard/../../../../../../sdcard/._system.dat
                                                                                                    2⤵
                                                                                                      PID:4989
                                                                                                    • sh -c cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_system.dat
                                                                                                      2⤵
                                                                                                        PID:5013
                                                                                                      • cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_system.dat
                                                                                                        2⤵
                                                                                                          PID:5013
                                                                                                        • sh -c cat /sdcard/../../../../../../sdcard/._android.dat
                                                                                                          2⤵
                                                                                                            PID:5038
                                                                                                          • cat /sdcard/../../../../../../sdcard/._android.dat
                                                                                                            2⤵
                                                                                                              PID:5038
                                                                                                            • sh -c cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_android.dat
                                                                                                              2⤵
                                                                                                                PID:5062
                                                                                                              • cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_android.dat
                                                                                                                2⤵
                                                                                                                  PID:5062
                                                                                                                • sh -c cd /sys/class/net/wlan0/ && cat address
                                                                                                                  2⤵
                                                                                                                    PID:5087
                                                                                                                  • sh -c cd /sys/class/net/eth0/ && cat address
                                                                                                                    2⤵
                                                                                                                      PID:5105
                                                                                                                    • sh -c ip link
                                                                                                                      2⤵
                                                                                                                        PID:5123
                                                                                                                      • ip link
                                                                                                                        2⤵
                                                                                                                          PID:5123
                                                                                                                        • sh -c cd /sys/class/net/wlan0/ && cat address
                                                                                                                          2⤵
                                                                                                                            PID:5147
                                                                                                                          • sh -c cd /sys/class/net/eth0/ && cat address
                                                                                                                            2⤵
                                                                                                                              PID:5165
                                                                                                                            • sh -c ip link
                                                                                                                              2⤵
                                                                                                                                PID:5183
                                                                                                                              • ip link
                                                                                                                                2⤵
                                                                                                                                  PID:5183
                                                                                                                                • sh -c mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/
                                                                                                                                  2⤵
                                                                                                                                    PID:5208
                                                                                                                                  • mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/
                                                                                                                                    2⤵
                                                                                                                                      PID:5208
                                                                                                                                    • sh -c echo MkYyOUQwOEIxMURGN0Q2RDgyMjNCQzUwMDU5RDk5M0Y0RjE5RkE6NDU5Q0VCOjgyREI4OQ== > /sdcard/../../../../../../sdcard/Android/Data/System/local/_driver.dat
                                                                                                                                      2⤵
                                                                                                                                        PID:5232
                                                                                                                                      • sh -c echo MkYyOUQwOEIxMURGN0Q2RDgyMjNCQzUwMDU5RDk5M0Y0RjE5RkE6NDU5Q0VCOjgyREI4OQ== > /sdcard/../../../../../../sdcard/._driver.dat
                                                                                                                                        2⤵
                                                                                                                                          PID:5250
                                                                                                                                        • sh -c mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/
                                                                                                                                          2⤵
                                                                                                                                            PID:5268
                                                                                                                                          • mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/
                                                                                                                                            2⤵
                                                                                                                                              PID:5268
                                                                                                                                            • sh -c echo QUQ5QTQxQjQwNEIzMEYyQ0ZDRUUxNUFEQUFGNTIyMUIxNThDQkU6QjEzOERGOjkwNDRGMg== > /sdcard/../../../../../../sdcard/Android/Data/System/local/_system.dat
                                                                                                                                              2⤵
                                                                                                                                                PID:5294
                                                                                                                                              • sh -c echo QUQ5QTQxQjQwNEIzMEYyQ0ZDRUUxNUFEQUFGNTIyMUIxNThDQkU6QjEzOERGOjkwNDRGMg== > /sdcard/../../../../../../sdcard/._system.dat
                                                                                                                                                2⤵
                                                                                                                                                  PID:5312
                                                                                                                                                • sh -c mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5332
                                                                                                                                                  • mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5332
                                                                                                                                                    • sh -c echo MzNERDk2QzE2MDU2NTAxNTc2RTNFNDUwQjcxQTM1QTg0QTFBQjM6ODNFMUFEOjk1QUFGMw== > /sdcard/../../../../../../sdcard/Android/Data/System/local/_android.dat
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5364
                                                                                                                                                      • sh -c echo MzNERDk2QzE2MDU2NTAxNTc2RTNFNDUwQjcxQTM1QTg0QTFBQjM6ODNFMUFEOjk1QUFGMw== > /sdcard/../../../../../../sdcard/._android.dat
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5382
                                                                                                                                                      • com.youyuan.yyhl:remote
                                                                                                                                                        1⤵
                                                                                                                                                        • Requests cell location
                                                                                                                                                        • Listens for changes in the sensor environment (might be used to detect emulation)
                                                                                                                                                        • Uses Crypto APIs (Might try to encrypt user data)
                                                                                                                                                        PID:4341

                                                                                                                                                      Network

                                                                                                                                                      MITRE ATT&CK Matrix

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • /data/data/com.youyuan.yyhl/databases/account.db

                                                                                                                                                        Filesize

                                                                                                                                                        12KB

                                                                                                                                                        MD5

                                                                                                                                                        ac4cf7caff840bbf8fa5c344b2df7d30

                                                                                                                                                        SHA1

                                                                                                                                                        f38f99d4e0533d58abac84c4fe151e4e647649ff

                                                                                                                                                        SHA256

                                                                                                                                                        330f18f6eec4299787e422465f7d7c46c56c839a8d5a7e014fd0278037e93565

                                                                                                                                                        SHA512

                                                                                                                                                        77493f325fe4f3d4d086be8cb517fdc2c587e854ae1c2c5c03a92de57f18afa2b3502575a8505a9ff13ad7abf65cc3aee71c75a8e86cf7aa9ed1febb2408686e

                                                                                                                                                      • /data/data/com.youyuan.yyhl/databases/account.db-journal

                                                                                                                                                        Filesize

                                                                                                                                                        512B

                                                                                                                                                        MD5

                                                                                                                                                        bc8cc5da41f005eff7c56dfa5fbfe7ce

                                                                                                                                                        SHA1

                                                                                                                                                        99799c58564c21b1ae27affb73d90b3603082585

                                                                                                                                                        SHA256

                                                                                                                                                        07aed23c27543a0801df14fdfaa77fb7cdee57bc8434bdc796aa9b9c728b8ca8

                                                                                                                                                        SHA512

                                                                                                                                                        b9d1252906f1895a4fc50329c3f665a1d8306e33a2fd1a1836d4a6c9504d80d7e316730457e80fb19ab3229a31506010c8f0e29a16f47e2483a68b60dd132c60

                                                                                                                                                      • /data/data/com.youyuan.yyhl/databases/account.db-shm

                                                                                                                                                        Filesize

                                                                                                                                                        28KB

                                                                                                                                                        MD5

                                                                                                                                                        cf845a781c107ec1346e849c9dd1b7e8

                                                                                                                                                        SHA1

                                                                                                                                                        b44ccc7f7d519352422e59ee8b0bdbac881768a7

                                                                                                                                                        SHA256

                                                                                                                                                        18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

                                                                                                                                                        SHA512

                                                                                                                                                        4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

                                                                                                                                                      • /data/data/com.youyuan.yyhl/databases/account.db-wal

                                                                                                                                                        Filesize

                                                                                                                                                        20KB

                                                                                                                                                        MD5

                                                                                                                                                        850576599fd33df60bbb2760382ad530

                                                                                                                                                        SHA1

                                                                                                                                                        4e141f51786786a4f11d8ddac93faf030d7a1327

                                                                                                                                                        SHA256

                                                                                                                                                        ff31fcde2a3cd35898fb38d77ce60094139e94d99d5d0387f1841b02fc3ac223

                                                                                                                                                        SHA512

                                                                                                                                                        9f33a4b0508ce194d6aa15d0f31f3438379642564082a0840d535936d193bb886a20e7be821e4cfb06925249d1f9ca06af328268edca5fdb4f53c59bb4ae9231

                                                                                                                                                      • /data/data/com.youyuan.yyhl/databases/account.db-wal

                                                                                                                                                        Filesize

                                                                                                                                                        16KB

                                                                                                                                                        MD5

                                                                                                                                                        bc933d99e1964cf709b2068478e0fbea

                                                                                                                                                        SHA1

                                                                                                                                                        6b15e07cc01f1091d1432643a3eaa3c8a93dbe72

                                                                                                                                                        SHA256

                                                                                                                                                        c2494c167e82b392d4e3ab6f95ddf2b55b1405863b007da990994a5a852e134d

                                                                                                                                                        SHA512

                                                                                                                                                        20ab658f1ea4b5042c787d43d2b3e6eceb95f1b5b0844bee39c6e558091b3923f316c2b04a7ff64fc52af4f9d353b501206d4688c7edee3c013d1da3c7fe7960

                                                                                                                                                      • /data/data/com.youyuan.yyhl/files/libcuid.so

                                                                                                                                                        Filesize

                                                                                                                                                        129B

                                                                                                                                                        MD5

                                                                                                                                                        4bf6fa7f838aefbea2b4f74cceb4980d

                                                                                                                                                        SHA1

                                                                                                                                                        045bc87447b279b6443676ab6717be00a31dc85b

                                                                                                                                                        SHA256

                                                                                                                                                        3d94450a59104aec561401b785969661a283f36b01b88f75af01af146738e060

                                                                                                                                                        SHA512

                                                                                                                                                        8606d9c7a8135be94c608e8c7f5bfb6eb2de3a162001b5dc1b948e727f3940e089208b2b989403a4978d8135cfffc526281bb8070a4040c8cf214346e13b5909

                                                                                                                                                      • /data/data/com.youyuan.yyhl/files/lldt/firll.dat

                                                                                                                                                        Filesize

                                                                                                                                                        76B

                                                                                                                                                        MD5

                                                                                                                                                        dd8090e768fe396775f46497cdc1e103

                                                                                                                                                        SHA1

                                                                                                                                                        9609dae886cf204f4c641a2e293393dbabb04ee8

                                                                                                                                                        SHA256

                                                                                                                                                        a01273cabf6bda39c74416f70412e89ff58335520610c8786e4442281f542799

                                                                                                                                                        SHA512

                                                                                                                                                        a685a0acc265c59f9c37bf374f5e03fcea818db3d192d99f09a368eb126c92bcf75af1d09b88b2eb7cabfb2a31755828ec167974f3cc51052c4a97734ff2f03e

                                                                                                                                                      • /data/data/com.youyuan.yyhl/files/ofld/ofl.config

                                                                                                                                                        Filesize

                                                                                                                                                        235B

                                                                                                                                                        MD5

                                                                                                                                                        11607bf0e98a076088d9240982089d07

                                                                                                                                                        SHA1

                                                                                                                                                        be003f9602e22dfa81cb561c44ef361c0e4ad3a8

                                                                                                                                                        SHA256

                                                                                                                                                        41a88aee4d1c4ae8028e4d44ce0358ccba296c9fce878d7565bb21d51e20f697

                                                                                                                                                        SHA512

                                                                                                                                                        d3b489762ec29d0fbda13927811808d0f4fb5a1cd0a2669d051191fa972fbf7a30db2c2ee47bec1b971e7d6936a2d0311aaa79256e90b8ad43c7026a85b2efc9

                                                                                                                                                      • /data/data/com.youyuan.yyhl/files/ofld/ofl_location.db

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        MD5

                                                                                                                                                        f2b4b0190b9f384ca885f0c8c9b14700

                                                                                                                                                        SHA1

                                                                                                                                                        934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                                                                                                                                                        SHA256

                                                                                                                                                        0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                                                                                                                                                        SHA512

                                                                                                                                                        ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                                                                                                                                                      • /data/data/com.youyuan.yyhl/files/ofld/ofl_location.db-journal

                                                                                                                                                        Filesize

                                                                                                                                                        512B

                                                                                                                                                        MD5

                                                                                                                                                        31530c99beac16a4624718a3064fe497

                                                                                                                                                        SHA1

                                                                                                                                                        2dcbda08f6e85c688abcf4f261bb19cc6cd7e6d7

                                                                                                                                                        SHA256

                                                                                                                                                        3534d191984b96c6dcbdae16e72cf71c4c260ce74fb4b66d398667bca940eda6

                                                                                                                                                        SHA512

                                                                                                                                                        5f0070a2f16c9aa3cf685158099b2369a4f64912eca7530077dfd73f8932786f75e2957cd9129901ba71239ec71e2ef029f021d4b6d4913c827d05b79d78766d

                                                                                                                                                      • /data/data/com.youyuan.yyhl/files/ofld/ofl_location.db-wal

                                                                                                                                                        Filesize

                                                                                                                                                        48KB

                                                                                                                                                        MD5

                                                                                                                                                        6ddd3517bc650066419207c8f5e2d614

                                                                                                                                                        SHA1

                                                                                                                                                        7ace84cafdaa99689cf2a1ece8f2fb9b7a8ec110

                                                                                                                                                        SHA256

                                                                                                                                                        245dcfc284e7a9b6d92334863e4e94456e07cb22abe335a536ae2d43718e42bc

                                                                                                                                                        SHA512

                                                                                                                                                        d35e80007a6267069283a9a703d9e6706db3dcc96fe1c4511a1ed93b622e56bdf56d4987689da27b4ab3f6c2d4ed4d29e6ecc54499ac88cb30730d4d88cd177e

                                                                                                                                                      • /data/data/com.youyuan.yyhl/files/ofld/ofl_statistics.db-journal

                                                                                                                                                        Filesize

                                                                                                                                                        512B

                                                                                                                                                        MD5

                                                                                                                                                        9dbda2b6f0871b001bff7884df3df066

                                                                                                                                                        SHA1

                                                                                                                                                        9b930406e8e7b2285c73dadf825531f2a64b8e3e

                                                                                                                                                        SHA256

                                                                                                                                                        d688575a2a91af41566d24044f694548395b584b726d4dec44b1ec484cabc854

                                                                                                                                                        SHA512

                                                                                                                                                        4212082becf6e27817d1b1dee6fd593091972ad16cb90f7a34350754c30884ce5195991a9963366ae48fa1cb77ab1020f6c0a25a816958b19476b537fec3e6a8

                                                                                                                                                      • /data/data/com.youyuan.yyhl/files/ofld/ofl_statistics.db-wal

                                                                                                                                                        Filesize

                                                                                                                                                        156KB

                                                                                                                                                        MD5

                                                                                                                                                        d85e655ab645717d08aa928cbcc92a2c

                                                                                                                                                        SHA1

                                                                                                                                                        aa18383720cce425d88ba75e96a3e50e0b4c14d2

                                                                                                                                                        SHA256

                                                                                                                                                        10cc009dc23e5cda9cf1a2e713ddd5e0770638016a81982172c8a54c8d495822

                                                                                                                                                        SHA512

                                                                                                                                                        7af7ce72620a51778860468f7b9b6cabc464fc63c105cab8308c26b8029281660c2c49b2bbc549429699dd0bba0837cd0c9d493617855b2afb7f3eebf860539d

                                                                                                                                                      • /data/data/com.youyuan.yyhl/files/shuzilm.db

                                                                                                                                                        Filesize

                                                                                                                                                        181KB

                                                                                                                                                        MD5

                                                                                                                                                        cfdf755172ff1c524ee2ac7ec16abc19

                                                                                                                                                        SHA1

                                                                                                                                                        b3072d320e7bd8c17dd5af42f22fb268a809b015

                                                                                                                                                        SHA256

                                                                                                                                                        0718c88c7e9d885fd790121e0de362d5fccd3ea85ba4e75a3d72f15946fd37a2

                                                                                                                                                        SHA512

                                                                                                                                                        a933e6fe625da8002ea08d3a4fd0d402ebee5df6ba62a755359adb50c0984c7f1994cd0270d148a424b78b3901aaf12876e580b6221e4745e9ae830c1c3e23ae

                                                                                                                                                      • /storage/emulated/0/Android/data/com.youyuan.yyhl/files/baidu/tempdata/conlts.dat

                                                                                                                                                        Filesize

                                                                                                                                                        12B

                                                                                                                                                        MD5

                                                                                                                                                        8d80bc8ea90e9cac010d3ddf97bda5f5

                                                                                                                                                        SHA1

                                                                                                                                                        f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07

                                                                                                                                                        SHA256

                                                                                                                                                        f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93

                                                                                                                                                        SHA512

                                                                                                                                                        9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7

                                                                                                                                                      • /storage/emulated/0/Android/data/com.youyuan.yyhl/files/baidu/tempdata/conlts.dat

                                                                                                                                                        Filesize

                                                                                                                                                        153B

                                                                                                                                                        MD5

                                                                                                                                                        7d12bf7e1a6777458b4661cf836a37db

                                                                                                                                                        SHA1

                                                                                                                                                        661234855394879077249b6e3e9987abb335a235

                                                                                                                                                        SHA256

                                                                                                                                                        14c52766985d99d623e5bfe4e7c0d4831389eab066282578966a9e03b2d987cf

                                                                                                                                                        SHA512

                                                                                                                                                        01d1983b3ee61a7ed1874dd070ab6c4a776500f4d63f9eddb7c62465fc8a4cf9a8e90c1c382a6a479ecb84634fe21557de2ea323411ccc8033aa0e854970f9c9

                                                                                                                                                      • /storage/emulated/0/Android/data/com.youyuan.yyhl/files/baidu/tempdata/llg.dat

                                                                                                                                                        Filesize

                                                                                                                                                        24B

                                                                                                                                                        MD5

                                                                                                                                                        161557b06b4a4d3ce095528dea370eb7

                                                                                                                                                        SHA1

                                                                                                                                                        8bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f

                                                                                                                                                        SHA256

                                                                                                                                                        f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4

                                                                                                                                                        SHA512

                                                                                                                                                        96ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449

                                                                                                                                                      • /storage/emulated/0/Android/data/com.youyuan.yyhl/files/baidu/tempdata/llg.dat

                                                                                                                                                        Filesize

                                                                                                                                                        494B

                                                                                                                                                        MD5

                                                                                                                                                        4bf20180e444851c409fb99659fdd3b1

                                                                                                                                                        SHA1

                                                                                                                                                        85e4ea31f7a0a19b4b404a6e9751b034899e2251

                                                                                                                                                        SHA256

                                                                                                                                                        26ab11496fe2c8ad567020c9903dfa9f6289684f48ad5f3080026413111bf9f9

                                                                                                                                                        SHA512

                                                                                                                                                        2e5aad68f549e48192b2d9c4db834f7334d45a7372be1e58a17b7a1b1817a1bda3b98b8720c3d3c41ca4c4c37161808e9c24f47e4f88f3aeec889f1c7c7c91d2

                                                                                                                                                      • /storage/emulated/0/Android/data/com.youyuan.yyhl/files/baidu/tempdata/yoh.dat

                                                                                                                                                        Filesize

                                                                                                                                                        24B

                                                                                                                                                        MD5

                                                                                                                                                        a936690571e9104e1922dda4a0ba5bd1

                                                                                                                                                        SHA1

                                                                                                                                                        65f49c57edde2f96be2a1dbdfc3f7351f1e66554

                                                                                                                                                        SHA256

                                                                                                                                                        f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412

                                                                                                                                                        SHA512

                                                                                                                                                        3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

                                                                                                                                                      • /storage/emulated/0/Android/data/com.youyuan.yyhl/files/baidu/tempdata/yoh.dat

                                                                                                                                                        Filesize

                                                                                                                                                        24B

                                                                                                                                                        MD5

                                                                                                                                                        1681ffc6e046c7af98c9e6c232a3fe0a

                                                                                                                                                        SHA1

                                                                                                                                                        d3399b7262fb56cb9ed053d68db9291c410839c4

                                                                                                                                                        SHA256

                                                                                                                                                        9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

                                                                                                                                                        SHA512

                                                                                                                                                        11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

                                                                                                                                                      • /storage/emulated/0/backups/.SystemConfig/.cuid

                                                                                                                                                        Filesize

                                                                                                                                                        89B

                                                                                                                                                        MD5

                                                                                                                                                        e8659f993b6fba488c8d97a3a86c55ec

                                                                                                                                                        SHA1

                                                                                                                                                        9f51c0ffdec4fc3f2ed45f7166b077b1ce201d6f

                                                                                                                                                        SHA256

                                                                                                                                                        ff8de379f5601e63aef5118b2cfa591b18d8618320655e4f8df368bf4e6be116

                                                                                                                                                        SHA512

                                                                                                                                                        f79b098ebd4814993b59a3a7742b8470abfb0b45ee05869c298e963d107452c4b1947d94742aa2bf3fd08eebb857ae16dda285422a54e0862641ba9e39f04cf7

                                                                                                                                                      • /storage/emulated/0/baidu/tempdata/lcvif.dat

                                                                                                                                                        Filesize

                                                                                                                                                        96B

                                                                                                                                                        MD5

                                                                                                                                                        2e81f73d888b18e6f1fcf21f1bb64f40

                                                                                                                                                        SHA1

                                                                                                                                                        c1b5bc978bf726ee0a6e4b8c22c4753563ab944c

                                                                                                                                                        SHA256

                                                                                                                                                        5d4864bfcffefea06b59ae5b905af1821587d4779f8a513cbb1378aa4a0b586a

                                                                                                                                                        SHA512

                                                                                                                                                        c3b05c2d1e52de4cc7a1bb18c2d019adaa5499cd9193df413f3ff9ff8b552e9b85b2786f486b57791b78ec841d42b71861a8a26f88df88526a836e336c63e6d3

                                                                                                                                                      • /storage/emulated/0/baidu/tempdata/lcvif.dat

                                                                                                                                                        Filesize

                                                                                                                                                        96B

                                                                                                                                                        MD5

                                                                                                                                                        22eed40325381f858d4112105abc1a48

                                                                                                                                                        SHA1

                                                                                                                                                        5a473dbb488db57b0fad9cb2e9990d6f92589ac0

                                                                                                                                                        SHA256

                                                                                                                                                        3f87044629db901fd99fbe1b3033e118e5726961601a64b3fd160751d43a2fb3

                                                                                                                                                        SHA512

                                                                                                                                                        54e76ffd383120c50d7e1a4a6a427762069b587787e341734df9e986f168b6ee24c4b1655741a2c1e4204a8ce1fe509fffbd5d1f5ae281855188776ae098143a

                                                                                                                                                      • /storage/emulated/0/baidu/tempdata/ls.db

                                                                                                                                                        Filesize

                                                                                                                                                        28KB

                                                                                                                                                        MD5

                                                                                                                                                        0d3e99204c6401ea499fe9e6d9855497

                                                                                                                                                        SHA1

                                                                                                                                                        09829f00ca458eab7374d5079393a2cd69a2348a

                                                                                                                                                        SHA256

                                                                                                                                                        63ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca

                                                                                                                                                        SHA512

                                                                                                                                                        8d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68

                                                                                                                                                      • /storage/emulated/0/baidu/tempdata/ls.db-journal

                                                                                                                                                        Filesize

                                                                                                                                                        12KB

                                                                                                                                                        MD5

                                                                                                                                                        6e4955f23868c2cbe8136c5750208698

                                                                                                                                                        SHA1

                                                                                                                                                        4af80c31a0eed99c00704cac327db9e7352510f4

                                                                                                                                                        SHA256

                                                                                                                                                        db0d95d81567b67fb89d862fef154bb17e482f9b68873f020a8e0fb2baa3754c

                                                                                                                                                        SHA512

                                                                                                                                                        c0cb1208d0a57c9d0b7944d7ee54c942c20617fe2f8a6fb7b62da3d4186e5a19f61df695b41d06090e9b49702284e1dab45e6b2dfda7c62f7ce1e5882199e170

                                                                                                                                                      • /storage/emulated/0/baidu/tempdata/ls.db-wal

                                                                                                                                                        Filesize

                                                                                                                                                        52KB

                                                                                                                                                        MD5

                                                                                                                                                        dd765bac2f7a4fe33d8c49635e1c1a33

                                                                                                                                                        SHA1

                                                                                                                                                        24850a466f67e22c8a3c43ec592be36ce0818b25

                                                                                                                                                        SHA256

                                                                                                                                                        8b32b956eea3441bf62f85c9ad85a115e98d386038287c5642732fa749fcd0b3

                                                                                                                                                        SHA512

                                                                                                                                                        b501976ec5aa7f8adb07ee89cec348e3c6d0e48624a2e2c37f8476a15d69cbc833858032a200c032c95964526c0cdb25ea54b8ed169302fe2139b894473c8e79

                                                                                                                                                      • /storage/emulated/0/mobclick_agent_cached_com.youyuan.yyhl/1703553429171

                                                                                                                                                        Filesize

                                                                                                                                                        105B

                                                                                                                                                        MD5

                                                                                                                                                        ce80805bcaab0b82ecf0bdf7169b026e

                                                                                                                                                        SHA1

                                                                                                                                                        53e0b8ffdfe071cf5315598159d79a1d76942f95

                                                                                                                                                        SHA256

                                                                                                                                                        52d9fd1fdf3d0b67fcbc3f2be21b3ef0583bf852185fe01c235258f508365997

                                                                                                                                                        SHA512

                                                                                                                                                        70f2ee5797316a779fe413ca8708dad1fe1326c8b611a45575151687146e7f94f691beed0d3b9f4b2a3efa959f9e9c41b1dd6417fb66cc9ce3b869f3267f4343

                                                                                                                                                      • /storage/emulated/0/mobclick_agent_cached_com.youyuan.yyhl/1703553431662

                                                                                                                                                        Filesize

                                                                                                                                                        105B

                                                                                                                                                        MD5

                                                                                                                                                        9b0a79646f7d4247593fca876008b456

                                                                                                                                                        SHA1

                                                                                                                                                        dfac4ce256f8d59be88a98451b99643d29371fc9

                                                                                                                                                        SHA256

                                                                                                                                                        46046a2200e4b4a64e4a88d77625a3b0c6fb8305e3b097c014a1691b3ac6dad7

                                                                                                                                                        SHA512

                                                                                                                                                        3fd9cc3a1aa58408cf20f374bd6ad3e3ab1392965c19fcedd2aea1b54abf7f61d4c2490fced8a6505b29cf8e49a2bc9c56d06bb6170283b5833aa931d1fa5ac3