Malware Analysis Report

2024-09-09 19:09

Sample ID 240428-afy6labh3x
Target 03f138980d666f1c8a915978c1432497_JaffaCakes118
SHA256 48b2f3b117cad1ba76ee0d8cb04db6418e84c20be1ec3411dc01633c0e360fed
Tags
discovery evasion impact privilege_escalation
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

48b2f3b117cad1ba76ee0d8cb04db6418e84c20be1ec3411dc01633c0e360fed

Threat Level: Shows suspicious behavior

The file 03f138980d666f1c8a915978c1432497_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion impact privilege_escalation

Queries the phone number (MSISDN for GSM devices)

Loads dropped Dex/Jar

Tries to add a device administrator.

Reads information about phone network operator.

Queries the unique device ID (IMEI, MEID, IMSI)

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-04-28 00:09

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-28 00:09

Reported

2024-04-28 00:15

Platform

android-x86-arm-20240221-en

Max time kernel

18s

Max time network

130s

Command Line

com.yxhoandw.rtkwext

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar N/A N/A
N/A /data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Reads information about phone network operator.

discovery

Processes

com.yxhoandw.rtkwext

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.yxhoandw.rtkwext/app_khgegsx/oat/x86/eywvxam.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
US 1.1.1.1:53 zepeb10.com udp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp

Files

/data/data/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar

MD5 0cf390161e48fbd7f179aec30d5f458f
SHA1 1e3e40a4c903e0261d216b4847565666eb823f85
SHA256 e9c140f302cae2ae048bb751cb8b3d624d9b1921e165822bbdc79a3521f270af
SHA512 130a74a5ebe02596ec37dc30759fe35b83edcae426b264c11be83ca23e87da47887a29463f648b1c100de3a6794a2959a6d9b83cb2454766e4dc105e65731920

/data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar

MD5 dcffe5ea86d188e5b54b29b5516c3ced
SHA1 58ceae1e00da5803f01eb76657e0f6017c65aeb9
SHA256 5fcadb0f007273beb6fdbd28668b076441cbf12a4630b6fb4ff7daf0160fcece
SHA512 4c8b35386f8ad401db49914b3bf2c12be9d6ccdc31223e736dbceea3b3b01a169f770fa051f15f40e7e8410d1bd936481f42b62ad2ad10541a2e77bdaa54b5eb

/data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar

MD5 6f7e4b16b4d0a304eaa64bc6daa822e4
SHA1 42a5f12341e315cad1b445545b26d147ae5435b7
SHA256 13240dbb94c43824882e51db3b9a4f0e1a1ca989cd203a720df909785e0a1343
SHA512 6d605c7e6c8c4ce780392fb41ac2d2fa61567d6f9c5028aa9b7ed52abd8bfc1606fd8284f176a4de49b33806362282a6f7c1f3975caa9c0035e68294a1b26e29

/data/data/com.yxhoandw.rtkwext/databases/a-journal

MD5 ffe27a5f5cacb4810d3dcce090c1f7b2
SHA1 9db4963ea8b79390a22fa3daffada97d35ad2958
SHA256 c6ff09928a95ff7a86b1a288eb7b50a7974aaedb4f1b0c4d72c1cd5aef32fcce
SHA512 15af05b08442ec5f0500ffc368a02e59504e6835d662dc8acafab16eeef1e56434cb4a9e35d6bcd46b10322ca627f6590bbc369caa53aea9358f66ceca28c3b4

/data/data/com.yxhoandw.rtkwext/databases/a

MD5 56c3b883b89768a572d72d5e24f6037b
SHA1 eb6296d234fbe5bb3958bdcca8d1d21cbf6798b9
SHA256 fe7f7123a850794ea84998f7e6142199110607005384120c337577517c664501
SHA512 0c3f233673b2156194623d3326291337d9c108badc29edee2ac1d4faa4bf6f6d7a73ab8659f676092c144fd510195f663e6dd1ab1edcd04a7b35332da6bdfa9f

/data/data/com.yxhoandw.rtkwext/databases/a-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.yxhoandw.rtkwext/databases/a-wal

MD5 5e84a49fc09ddbe675321400f196bed0
SHA1 6a02a69a86cea77386349f18b25629a36ce11c07
SHA256 3451c71d009786e6a065a172acd59f4add2bf7efb9987c55ea2cf2ed0f217cd8
SHA512 89daefbb16561070a3ce980ef6fea7d684d71302ef73b1dc7eb6ded9849655bba35b577ee813630ade598fa97e04b4b9beae220ca76aa1efefd10d875769ee24

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-journal

MD5 e68ae89b857e3596c81057f6561c4ecb
SHA1 b87a18a2281d71d9fc9cea6c926d17f397796ef1
SHA256 cf0e48c3a3483efb66f42709552bb3651783c0bba3b3a23e942e594da0d3d9eb
SHA512 e89b2857d57cb2e4c132aae8d31406180c30b817ca97eeec6b3c373b5d89274b914acd6aeb68707aa1ad6da82a57ac96fd90b1ab7440133cb4e76fc6751823e8

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd

MD5 ecdbb0ead41cdc5ded3a2c649bc89f4f
SHA1 9aade2f16c640b0941de330b745db9b8a971b72a
SHA256 31c51d9ca8d74e3b0b4448b8fb6a58324db9be40e71616a35179009a819b2547
SHA512 64d14a269e8d9afd2b49720dd15d5c9926c1157cab6937af3c88a6bf2a84df29bef552f97c8cb3788dc68f811f07c6321d2079b6ab02973161b2df0211cb46ce

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-wal

MD5 0474b27ac894f8916c91810210328cff
SHA1 68cedd5acae57175a1d8a7ae3f97fd8ea6415e0f
SHA256 6375f3ba7c647092038e0b1dd27d7646147ea2b0659d86071d6eec7d3108e257
SHA512 cefd0e4ad2589ff31f4c9e7a8eafe12af367e597cb5f831c5f323972870ada0a39b46d6b388036f04cc86b34e702a963d3b58f12b52669401f270844fea8b9d8

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-wal

MD5 0d4f89dde76c70b03d59c0e3322fc499
SHA1 d9fd75ea8876526c7c12ffe6378ac1f679f6dc7a
SHA256 1fd7af6faf92c2260dad39831503ab913eb9c068a50f9a407794bea801bca814
SHA512 0e534d3a3f10dbcb39847cdb2583f2e5ad1e2a4c05918972b80ee21f5e326d87c8eed4597c17b95dca999f7204c74bb7fc0ca7ac602fa1003d5a755122c8fbee

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd

MD5 68c6a6a3d071676ce6db3391ecb54310
SHA1 2ad4857fdd58fb39cbf74f140cc6a247ecaa7992
SHA256 31416d30bf37f7f82816707a1db9b54b9cc6d2862e39a1f11c8e24a2125c4443
SHA512 1884ff33ed08c257f169662600021a92d8fe86bedf3e0f4cfe7a69a62ca903346aeeca4281436fa1f36f166dc6a4c0db015e2bed0907b3b11638c20257bc5f41

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-28 00:09

Reported

2024-04-28 00:15

Platform

android-x64-20240221-en

Max time kernel

49s

Max time network

155s

Command Line

com.yxhoandw.rtkwext

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Processes

com.yxhoandw.rtkwext

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.200:443 ssl.google-analytics.com tcp
GB 142.250.187.195:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
US 1.1.1.1:53 zepeb10.com udp
GB 142.250.187.238:443 tcp
GB 172.217.169.34:443 tcp

Files

/data/data/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar

MD5 0cf390161e48fbd7f179aec30d5f458f
SHA1 1e3e40a4c903e0261d216b4847565666eb823f85
SHA256 e9c140f302cae2ae048bb751cb8b3d624d9b1921e165822bbdc79a3521f270af
SHA512 130a74a5ebe02596ec37dc30759fe35b83edcae426b264c11be83ca23e87da47887a29463f648b1c100de3a6794a2959a6d9b83cb2454766e4dc105e65731920

/data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar

MD5 dcffe5ea86d188e5b54b29b5516c3ced
SHA1 58ceae1e00da5803f01eb76657e0f6017c65aeb9
SHA256 5fcadb0f007273beb6fdbd28668b076441cbf12a4630b6fb4ff7daf0160fcece
SHA512 4c8b35386f8ad401db49914b3bf2c12be9d6ccdc31223e736dbceea3b3b01a169f770fa051f15f40e7e8410d1bd936481f42b62ad2ad10541a2e77bdaa54b5eb

/data/data/com.yxhoandw.rtkwext/databases/a-journal

MD5 31efac112111d48a9a506b0f8f13ca9b
SHA1 3216d0d34e3911b8313a798747df31ce1392f0dc
SHA256 21a81970e19a213e06dbdd17bfef43788a443499f8c32b6ac9e5d13820e25880
SHA512 98c429d5c3c5f98f8ef69f547920e8d0e2457da671995a1077b4a7a3d94e01fe88852be0d82cb3c754725db290932db45651b9949fec76884f9cb74f9a2a278a

/data/data/com.yxhoandw.rtkwext/databases/a

MD5 c69ef7005c3f91851e4e6fbc49e01083
SHA1 ad90dfc9ee0a554d6698dcd1d5c057c2f585effe
SHA256 fcb8a9d175b007f341481140c4a4ca394656864a3938d8c0e15ccf18888aa776
SHA512 7bf02687ffec137b03b6f646c0db6f9ad5feff73ec5fccfb903a37e0e59c3b9cd1211d8038506fc1abdef6e65eccd1ce6634d3d699f2d0fc636b31648a17716a

/data/data/com.yxhoandw.rtkwext/databases/a-journal

MD5 8da10d432a195cd6698804c0a9f7eaf8
SHA1 879de96aa4663757ae2d11f917e027d9667cc789
SHA256 50184f4cd98ae63ad96900c7a1d04fe2db79a51452e6f2fc0cfa75fca6bbee66
SHA512 7958cc5534aa86d7ce1a5b6811a665f6334f7391d0efff42710c82e89bd02e2156d4447e568c547e7f5852b9edbc0eb810ca9815b6787b80be6a2fe220419291

/data/data/com.yxhoandw.rtkwext/databases/a-journal

MD5 9f0f89cc2fd7fa26ef6b33cb91c82789
SHA1 6ad81e06c83743efe3c9101e43403cc61d87954c
SHA256 39188b838e9f40cd2127af3dab30f39a71ce36ad642fe8c929807d2441f8b40e
SHA512 e7ce567027d3ee32fc6aeec7cdfe89ba923dc3ab66b4e59c322b72ea2a80db2e636d5c6bb3506750d719d8367c6fccc37a93a7ad86c8eec9e42e98b4b572f32c

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-journal

MD5 a0008714b2cd75eedaf1a83fcc9c7284
SHA1 2bebb3d28f23d85f71f769e1deeafc6ae652b8ee
SHA256 6858d59fc9f0f69927226c9806e0bdd5da3f3db85b694523f34fdf2eb6220fc5
SHA512 b9872d59400b8745732003cc9acf5b8e55dce65dd6ed677c7ac0e577b22009974f79f565109d55dda42a47a5f61b0cb82358f72ace1deabb35a9d236137665ab

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd

MD5 005079797833d415d2da822fdfc21442
SHA1 77d4200b43708a55501adfee8cb484e53955883e
SHA256 a71094954fcd138cba05c219221c6f18cfeb41dc91254fca2d34c49b2a5e4961
SHA512 bd6e3fad579cac1fe719fc40b2730b145cd12143d4c672150adb6030c9c355f487c6bf0c4c5f661077a3d7b91a52a6fb54e675777466e63f71ca50e8a9424dd7

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-journal

MD5 42539983e0bfdf802f59f9896f414248
SHA1 e28166095ba8357a39d702cd373efda7b9cd5ccf
SHA256 2cbc9c375119d4d476efca5141c18b1286103429da06586576b5094549b231ec
SHA512 6a4ecc1d852d4eac19a838ca0dac08da7e3f58a1a07f99e1854a20aaf3c5fd3b858b20f969d8230b1894f92a228fb7af05d3dabe00cc1a01fe668a96ffa23b2f

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-journal

MD5 e5a3061e0888b403d843bfe19a120bd6
SHA1 68071aefc26b646029588c8e034da4cfa42f4197
SHA256 f81cee5c06d73afd8a4f305940f975256ea0d88570005216f91c9beaec874296
SHA512 acd82a97c6565d3ef44a265ef48237348d00320dc4037b1d01faea50a61ffb500931b76fd930a6a5db92fdafbfa12f740a459fbdaab1db85d8e2b8b6500c6268

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-journal

MD5 856660a9e6d276a816f3d94816a025e9
SHA1 90fd022b7afc3aed7663909765fd3a257615325f
SHA256 c2e2d3cac43817815c26c6f4dbb933802012d72d3163c6d20749b854db304108
SHA512 c75d8cce634c3d03778bec6029c7145e67f59af0762093d2ef900862cd43fcd266c5414e201c2891ed515c9bd6b66541e3182be2220e90a7f3fb7eb2c113d2f9

/data/data/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd

MD5 962c28f4e4a49663c855a87e3727ddb6
SHA1 5a37949182c0ea257b9cccaca24ab8e68f2b0a1e
SHA256 7b461271783c4be3d911038e385dc51d273c2dfdc05639cce6ca54ea6fbfa7d1
SHA512 a7afa17d83542aab0ed1cab09bc459009109cf5fb882850a953878f3b1b07ce91e23f8513004a9b4f437ac6170363680acd68c0fe53501902f81feccb5cb1043

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-28 00:09

Reported

2024-04-28 00:15

Platform

android-x64-arm64-20240221-en

Max time kernel

14s

Max time network

132s

Command Line

com.yxhoandw.rtkwext

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Reads information about phone network operator.

discovery

Processes

com.yxhoandw.rtkwext

Network

Country Destination Domain Proto
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 udp
GB 142.250.200.46:443 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 zepeb10.com udp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp

Files

/data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar

MD5 0cf390161e48fbd7f179aec30d5f458f
SHA1 1e3e40a4c903e0261d216b4847565666eb823f85
SHA256 e9c140f302cae2ae048bb751cb8b3d624d9b1921e165822bbdc79a3521f270af
SHA512 130a74a5ebe02596ec37dc30759fe35b83edcae426b264c11be83ca23e87da47887a29463f648b1c100de3a6794a2959a6d9b83cb2454766e4dc105e65731920

/data/user/0/com.yxhoandw.rtkwext/app_khgegsx/eywvxam.jar

MD5 dcffe5ea86d188e5b54b29b5516c3ced
SHA1 58ceae1e00da5803f01eb76657e0f6017c65aeb9
SHA256 5fcadb0f007273beb6fdbd28668b076441cbf12a4630b6fb4ff7daf0160fcece
SHA512 4c8b35386f8ad401db49914b3bf2c12be9d6ccdc31223e736dbceea3b3b01a169f770fa051f15f40e7e8410d1bd936481f42b62ad2ad10541a2e77bdaa54b5eb

/data/user/0/com.yxhoandw.rtkwext/databases/a-journal

MD5 870743a98f7f052c1d20b89de3671f4c
SHA1 68318a83a7b420dc26f6672cf1791516dc950790
SHA256 33eaeb4277f769f75d1ff04029582eb243dcd1b4f03502f3c504f96a5e59f31a
SHA512 35dd9fd2b4ab283b3d7fbfc6d4103cfc0f5533d5dd0e144b307f687b5ac85d099cacb9248f901f25e4cf73d222ecfeaf9c2df21a2b21989519937289e3f63c21

/data/user/0/com.yxhoandw.rtkwext/databases/a

MD5 09a1c65be08d5478432c8a2c4c699a06
SHA1 19f8db07639eab80eb0b3d757112bd47076bfb96
SHA256 e4f66f1058ded1727a16c604ec745de9f81950e9b1d79d937ae3f12be2023b2f
SHA512 1703e390f1b373cf02f9ba92cf6e22b7ed4cc4e553e13278e36eb30aae43b28211d1b3c76ae690e8a972dbbf6d7e634c98d8bfc7333258a19950c30d82aec429

/data/user/0/com.yxhoandw.rtkwext/databases/a-journal

MD5 cb59b3447608676e752b6aab6c69ba95
SHA1 9c101e25dda3c3c79a34f78e875dab6d1273fe97
SHA256 e630865f09630a0df17086eea516befe6710aa395e11e9c1a387908ce44423c6
SHA512 81af79773aa4bd662a7cebb171c305222a38d2f502136cb0a54f6082c77dac5e4018318d2fd2de20ca2ba53655bc9f7c829218d97f57287f89644a5713646e7a

/data/user/0/com.yxhoandw.rtkwext/databases/a-journal

MD5 53a230955116ae89a25ff4becbf8527b
SHA1 c695a98ded768793dbc347b6b8bf0cae1bab0a93
SHA256 5d0157b29c7c907b39522421091e0e80121db43cf3298cd4834bdc3bb7864ba9
SHA512 1a9e34e813ff4a6acd6785c5fbac62cdf7e537c41ba9312f4c394cd091eb01ec5808ca2be103b3baf635adbf1e6bd4a15372dd2370eddaa5d85731daee76ad8d

/data/user/0/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-journal

MD5 fbef6a8b5af9a7cb09731b9fd7c75f8c
SHA1 86d5b20fb5df44af1f95d1e8554af9c383e68403
SHA256 faa19949a95ba3f292f9869e60aa5b02fed26377213be0b77109afc05e550081
SHA512 594ae059538f170840667f130a94e73dec64494ceb05c90bc7a69c336c8f0f4201f3f6dde20ecd55c526b453514d7186ce340a558677136762426ff6bd038ed9

/data/user/0/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd

MD5 a2545a13e0e02c2a595b93a4ad524f83
SHA1 8dfe7cef12f7303d5b5079bb9382bd8c51178fbf
SHA256 fd1c0c9c6c887d7a97d6a007077ed29e92f3bfa08bbec02b918bec9c75574cae
SHA512 6057f45e90f2969166642e3c9ab09f0b31d0fcef2464ebd0c33a5350d729b499ccf95100b9c1d09dce5bbab4d23ad18a5fc2d3dca484a805d032a927dbb1e63b

/data/user/0/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-journal

MD5 869461ed8d9b912037c3472119d3bfaa
SHA1 ce1206532e94a0e602514744148ecddba5fb2937
SHA256 7c816551d9d9b09f5ded17a0777c6d739eb20d4ea38d6478d0e3c2d579eca982
SHA512 5782316f2b6714178e99619881f5e47e49b52aada3a8922d7f41e5c17a16423003b67926e8b7e6a6da763704675f60b5e91ef32d910ada1b856d1dcc47452174

/data/user/0/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-journal

MD5 ab6a873684dde109e93f552bbc4bd536
SHA1 3a87ffdc242e0a44cf51df0a2ea93f204fdd532d
SHA256 ed3cdf87602f5789cb7e9d4fd382548ca038e62908ae8db8176c444d0e675469
SHA512 f403b13cc2ce6d11b4714fcfd5b570cbc85947b0b9a805ce95d1dfb6eb78d25c62d443219329575e4a10d187101de572c4d361bcf65afb3ef20454dcc823bd5c

/data/user/0/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd-journal

MD5 b419a5b416de70fca02ce6a3601760c1
SHA1 a71370f5000440ec6c1eee370f67018110d62f10
SHA256 e19cfd30d4d4af56b5f0b510a0b75fefe80e11cd2289d1c54893d2435a938f3f
SHA512 572069d666867ae72a7dce2e665239047f0c5202c1c98d347cae1a21cd19a940499cc7a034d247f0fb418bfceb6bdcb1e84155c9bf2027092441b253e8c5a745

/data/user/0/com.yxhoandw.rtkwext/databases/sdffsfdsfdsfsd

MD5 0b06c6a1c8ef6fd7a9ed22fd52d4af62
SHA1 11376ac020b2ae76dd31103d365d26456604bff9
SHA256 aafcb370dd991facbb248a7784a222a5396414534585c7feb3a73b8fca23ed1d
SHA512 4dab05496ce72a3ef9e4a21ed9f74102911da36a17816a8f4dad5f61cde812592f6edee44eec61ccb5f733ca0b21ce74590468a99a9ab00b5bec2f0d2ec9fa5b