Analysis

  • max time kernel
    175s
  • max time network
    184s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    17/05/2024, 16:16

General

  • Target

    505d3aa00380f5f2159034b6fc05623b_JaffaCakes118.apk

  • Size

    19.1MB

  • MD5

    505d3aa00380f5f2159034b6fc05623b

  • SHA1

    6f167439332e26efed29363ac553cbc12bf0183f

  • SHA256

    c097a30fcd775e00136aa26c5992a0616246f84dc7494337ee48be518820ff11

  • SHA512

    63fbac551fe627330e27b674b740bfd94ceef825c16751431eef3c02cdc3cd75c07af42c7fb3e8916c2a83bef770910f32c09927e5773874899518a0a0935fff

  • SSDEEP

    393216:WVTaHD64tJwvnlet7JmiY7bLL9XXZXmiEb60U9sxnO8EEqxq:WVM64tInmVmiY7bTX4U9sxnQTg

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 16 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 1 TTPs 4 IoCs

    Uses Android APIs to to get current cell information.

  • Checks CPU information 2 TTPs 2 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 2 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 2 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.vip.zb
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Reads the content of photos stored on the user's device.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4334
  • com.vip.zb:pushcore
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4459
    • cat /sys/class/net/wlan0/address
      2⤵
        PID:4705

    Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/data/com.vip.zb/.jiagu/classes.dex

            Filesize

            6.3MB

            MD5

            3ff16058471dc51e596a8832a772b9ac

            SHA1

            f21e4c55390f0930b511957a37d6155e47bdeacf

            SHA256

            9b1d06fe5c2d26b23dee9e34f0aae607e940bd99b500cf1191a6112a52793dc4

            SHA512

            ffcd25e905598114c5a2ff6147da4fbea324573737aef303dd9f5943486ce88791bb9302a2fb7e784cea413292af9867c3773557ca739ca540618c40c174d3ec

          • /data/data/com.vip.zb/.jiagu/classes.dex!classes2.dex

            Filesize

            6.2MB

            MD5

            ab96f0b54beb7d5deec1fd91a3dff33e

            SHA1

            e3734b5f908c134e0d27ffa6ba2f01eae7bfa1bd

            SHA256

            55751143689f888d1fc257194481175e3dd8ae4fc28860516854fbbd235e86a3

            SHA512

            f48738b1963cc6939aa0f6b312c8eab2dee532c4e0ce88bcf3595008ea7c5c1095fa622f586186ad36ac678dc9bf30b49d541b50018516501bd4458d0c6e959e

          • /data/data/com.vip.zb/.jiagu/classes.dex!classes3.dex

            Filesize

            5.4MB

            MD5

            47fc1e2dc062c8d55e36250211b2bef2

            SHA1

            4cd7692200ca48347f3e0e685d24d26c3b403569

            SHA256

            d05b980381765dbed5e2ff49dd44950ce447a10619f71b94623b8a4846fb5cea

            SHA512

            ff096cc4fe344301b1554f61e40c42261b39d64e81596c7bbb4cdfe0d0daa5d29d22d455b3fc29c127b2913496f663c031bcacbe3669728b47d96e334e7137b2

          • /data/data/com.vip.zb/.jiagu/libjiagu.so

            Filesize

            475KB

            MD5

            5aea02f4e4c77fbf2e7a27f7ca9cc06b

            SHA1

            522db1748608e9173547b29b7aa82ddc3542c534

            SHA256

            5a1c513b347e2a929769e2be67552c1d591704f08f7b5590282b66cc2c7d7bd2

            SHA512

            5c979a11f5e896829db906f533756efc1cf3c5a7e35ecc9e376a0aae818f2dada013441649feac2e188bd51affbbf35156e32fdc6552e185bddbc547f3850316

          • /data/data/com.vip.zb/databases/ThrowalbeLog.db

            Filesize

            4KB

            MD5

            f2b4b0190b9f384ca885f0c8c9b14700

            SHA1

            934ff2646757b5b6e7f20f6a0aa76c7f995d9361

            SHA256

            0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

            SHA512

            ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

          • /data/data/com.vip.zb/databases/ThrowalbeLog.db-journal

            Filesize

            512B

            MD5

            5c8ae8bf390058509c9268a10624df76

            SHA1

            fda05eff222822ecb2f4f88af087d0cef186192d

            SHA256

            341908a1913d3ed3677437211111fc39f14c79f47b10349c9f8bbc7e74049f39

            SHA512

            b231671d704f0e17bffed35652ea781ec79b52272a7dedf1b8552beaf74e0bf735b4cafa7b395025adc73560e4ec6dace360a3ff6977db2abd842d138edfb75f

          • /data/data/com.vip.zb/databases/ThrowalbeLog.db-shm

            Filesize

            32KB

            MD5

            bb7df04e1b0a2570657527a7e108ae23

            SHA1

            5188431849b4613152fd7bdba6a3ff0a4fd6424b

            SHA256

            c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

            SHA512

            768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

          • /data/data/com.vip.zb/databases/ThrowalbeLog.db-wal

            Filesize

            32KB

            MD5

            72d2e3ffaadf6c9970d6b174d8c2b018

            SHA1

            4521868a461544fd89562b6fb44cfbcfc1f437ee

            SHA256

            abad4b251a2e86a887449ed41585186a7635672d3e82182bd8c5bbbcbc4aac9d

            SHA512

            f5364839b1ce0fe1a184f9552dcd41a547acd171233f944f1971b2f42eca9d8539a2b806548b007c127e54674b0b46a90313fd70e3ccb0cf18c280c6764a397c

          • /data/data/com.vip.zb/files/.jglogs/.jg.ac

            Filesize

            32B

            MD5

            f23c5784bbb90a8e546f559118b8c0d2

            SHA1

            46bb5bd5ff6864c3b063f05fa14c540d05ac1403

            SHA256

            d7360305c279fa3d2fd6d8b336abf1a6ee1394df5e78d07a9c9e4125dc4995bc

            SHA512

            a1bdb86ce763ac4a0bf0a53b91498a9a35de874b8b0227747daf0fcd74c914170200ddbc7b19835d2cc3781780ea6da4a4bd7dd3168451451dfc148ba6088468

          • /data/data/com.vip.zb/files/.jglogs/.jg.ic

            Filesize

            32B

            MD5

            9a79d431a359a2b98cf9a609a88f3aaa

            SHA1

            62cd4c0b30b865683be5bc025f3089e0f50404cc

            SHA256

            db623b36d76563c8b4f55d7dddc0c78d313c049d375c5fe9820ce04b0c8919d0

            SHA512

            6783cb7f9dc566a62e53e4b5e0745db85c068eefeb0f9525b5777ddc52cc474d34a608a67160afce7c30ec6d068a4ae3d569b6fe8617cbc7b3f4ad09b67a71fd

          • /data/data/com.vip.zb/files/.jglogs/.jg.rd

            Filesize

            73B

            MD5

            9f3b754d349062249442309bdaacdb22

            SHA1

            bcaeefde635dfc9dc635f01bdda979dc268e10fb

            SHA256

            bf6e244d54ef9b53b5253a09ba5baacfe6cf9c7dca8212acd039fd81f14db9ed

            SHA512

            7aea9608ba026d7ee7f307d0543687c278aff99a5ede883df553c3646ea2f6a5d7dd391e3a378f70e6bb6dc9626c3fbd6081ddb7be4f3d4de1d462047c48be62

          • /data/data/com.vip.zb/files/.jglogs/.jg.ri

            Filesize

            307B

            MD5

            31cd684fc23b0af2796afa0190e8eca3

            SHA1

            47e3f57054d20105e1d6577a415e07fc15edfa7e

            SHA256

            979fa0d83a123d80ea126a472db788fe91628fb768ce2a21c66a6cd777417fe3

            SHA512

            61945b0041ee8fcbc7796ca300979ae6692a4e1cc9754b2774473841f7a5029953175c8fffcba3795f7001faaf2cb5f5527d249245a73c632c0f7a4b9207ea3c

          • /data/data/com.vip.zb/files/.jglogs/.jg.ri

            Filesize

            314B

            MD5

            982a8e96d19e06de92bba46db03d6cf5

            SHA1

            018e7b4e338b3b3216128da3155e3e796ab8fb89

            SHA256

            09a45a012a80bcb8638476ef5950a287236d808a6b8e7ffa38f6898d16018721

            SHA512

            e4383fe2528ac4ae176e65a4fcabf3f3747adb62922a44fe7969435334cb9aa13094317efbea721dbc79e959d39e59d5cd89a1eef69772a695fd71cb8557e541

          • /data/data/com.vip.zb/files/.jglogs/.jg.store.report_pid

            Filesize

            32B

            MD5

            55c8820fc91cbff0146f6b40b438cd82

            SHA1

            04f843830754125be15af12c087187537f72c5d9

            SHA256

            73148f0c6d93dde91bffa865faca6ad32cf1ee381b5749003e195b2024fcd45c

            SHA512

            d4f76f1a0380b24d641545295ff66fda2238daa073e7aa1afd03521116327d40088fcc313df5380f21261533809806ad269957cd87890a728794370e46df9cc1

          • /data/data/com.vip.zb/files/.jiagu.lock

            Filesize

            27B

            MD5

            b12015ddabe7a9395fe034c2923ff3b6

            SHA1

            064f8480b1974ff3213cbf214cd604383be632f2

            SHA256

            3e53f20d466e5fca490fd85ab267d8950340549bb5a340f76fd8ed92a40c79a1

            SHA512

            1b31036bdae93f38e06c374fc97668d43773c5adf7ff9065df5c58367fd2401c3f312f22b936804cccd6a30574524579e0cf7bce77e1fb75c39a1b808db008e6

          • /data/data/com.vip.zb/files/Archimedes_p5

            Filesize

            14B

            MD5

            d43282b01626d2d45337cedc1b1ed449

            SHA1

            6946b7a2c14a8de62ad141e8768796ac267d35f0

            SHA256

            489c5cf4f75941cd600b598580be8edea2511c53ae10847e6c397307a07f5cae

            SHA512

            c5cdfcb031ca7b4e9dd8b5ed77fd7d3eca04ec00b7b69dbf52db5e5cbcde0250ccb11a1e21fbbeae96fdd20060c5d18f90d353418aefcc26ff8cdf69a72330c5

          • /data/data/com.vip.zb/files/Mob/comm/dbs/.duid

            Filesize

            132B

            MD5

            68cf32583e943c905e8129f8e3502ef4

            SHA1

            df037fae428040dd014057493fa94a822a2a2a84

            SHA256

            35f443a4a23622fb685b820ad5bf7c3e86258222d93b063f1d9d642d83fba460

            SHA512

            7eeda5ae182cab5d9ab5c0af3222ac86f1a2a1f88eb0bdc172f6bd7d1695800b82be04620321f6aef002c4357e2db5132979e54bf9f7a715ba80dbed130ba408

          • /data/data/com.vip.zb/files/Mob/share_sdk_1

            Filesize

            23B

            MD5

            8e24e79baab91c4d0604eaa9006a0cb3

            SHA1

            e427afc94a4b957a7096f73e395a10ea404c076b

            SHA256

            65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d

            SHA512

            45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae

          • /data/data/com.vip.zb/files/TDAntiCheating_Switch_Value

            Filesize

            1B

            MD5

            55a54008ad1ba589aa210d2629c1df41

            SHA1

            bf8b4530d8d246dd74ac53a13471bba17941dff7

            SHA256

            4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

            SHA512

            7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

          • /data/data/com.vip.zb/files/TDCloud_Control_Cache_Param1

            Filesize

            2B

            MD5

            99914b932bd37a50b983c5e7c90ae93b

            SHA1

            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

            SHA256

            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

            SHA512

            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

          • /data/data/com.vip.zb/files/_Ladder_Project/Archimedes_p1

            Filesize

            10KB

            MD5

            a839d554712f65f487b90a6c9d0513be

            SHA1

            3b9b8a459faee30dde4f63c435aa6c6c838766a1

            SHA256

            8ff0738b3d9b8039541c13838e71af94be3b9bfed185c22d0cc01c06e39c12f0

            SHA512

            27d8537ba4a7922a546d3b227b049e2fa658d4ff48da50019f11184117a7f12326f1c41291d9248a0a5ba665b1debc4fb19c87235d48d5058a7878aa4e95fb7e

          • /data/data/com.vip.zb/files/_Ladder_Project/Archimedes_p2

            Filesize

            57B

            MD5

            70a42cba408700f9a6c01c7941a8829e

            SHA1

            eab01cc2c0671538795fb0b1146017dc099d0984

            SHA256

            499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

            SHA512

            8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

          • /data/data/com.vip.zb/files/_Ladder_Project/Archimedes_p3

            Filesize

            13B

            MD5

            9e8f946a2ee94027999f903cf8952072

            SHA1

            129af943d7262d52164875bf58f70bf74e972d1e

            SHA256

            210f06568f4c0e8de33387e2b48fd74cc320daa034bd0bae649f6e6594201be8

            SHA512

            fc025e4765b67e7af7906fad98527f0a3e621a6b24d648e88cdc9995fdc34103b8548a74f366867e2ca19361d0586904d161c88b887864f65d895ab9dff50965

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database0SaaS/1715962645012_4334

            Filesize

            2KB

            MD5

            d8be236926be370c2da8ec59a1d1e35e

            SHA1

            0e9bd8df4c6bee41f57681384371dd7353188a88

            SHA256

            0f15ee1f48b7ca4e9b2ff580ee8f4abcf5f45f6738e60e717dbb2b5c4c39dded

            SHA512

            fb23c51fd1079f0399f49ce23ea4b849c00a9e1558c73102b5eec8d9b83ebc20ac7683ad61754955247ed7333098a213cdd1faeb10ecc8c06e7d1620f35816bf

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database0SaaS/1715962648780_4459

            Filesize

            2KB

            MD5

            0b7434580a98a61868568935fdeef25a

            SHA1

            9261c4e20f250e3e33d5e28010cb7c266a2c3ddf

            SHA256

            c59f4b8a6ade511ab37c64c2d112b2a2e4a69f386fef01689c7bf955fe7db849

            SHA512

            0dab975a075500ed44c122b939264fb4d081440cce7a3e0aaf1fb59258f9d07a7b0b98fa0d4894390ed6dc8ec6e93cec4b5baf244d4b385d372fd3e3a801a9e0

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database0SaaS/1715962656486_4334

            Filesize

            2KB

            MD5

            913e92ff80a5e6aaf558e4b125d986b1

            SHA1

            f89e8007f7fe70a84dd8db9b9fc8f4b84bc98b56

            SHA256

            9f0bcdce35d3c15a6b830e222638ac25d8f4ad8c745a7b1d293588eb30ed6c7f

            SHA512

            fdf434e5a7c714816365c187b2d364af233fa7330ada6bf1812ef36a8561cc7b439b5e7facb6ecc09db258c3d1856e2e9ef3066336efb90e57b97f288a238300

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962644419_4334

            Filesize

            3KB

            MD5

            010edbf5671fded52163ceeb69b52c39

            SHA1

            dba4a96a8cd2b09b2d0448af641fae2b1b8b1438

            SHA256

            40a0f88ed458ae72e92a00c22d19ff65c611a876c611da9287217284efb770be

            SHA512

            db81379b4b14056fb53196420cd26c73388f93430b0563c35b1ba57cb020bdc077799e4075c855d2822dbd3f33c54b0a16976e568f1e3cd24919c0b0fba4c503

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962644788_4334

            Filesize

            2KB

            MD5

            ec24fd0513132d247a5fe1bc1fdbf3ba

            SHA1

            59326723c671ec91de01ccc35b3aaf12eb73a309

            SHA256

            ad70982acc5a5d4a67ba68955073463fa7e4dd6bd9e1a9b28fd22e7910097c2b

            SHA512

            c84b273d59e23487c0b5e84667fda79e262741cfd3b189ef7fe9b2849400e5450072b808affa663788be95379103e2c5ccd3419a1852a7edacf17023a4b516d5

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962645722_4334

            Filesize

            7KB

            MD5

            cc21f48b32c1e852f69e72bd6f1025dd

            SHA1

            e7be065e69dc0a0d8a3335e31a7bf953cd7c6959

            SHA256

            b2a479b5a2c6a0c486dae58f6a9f559e37a6beb070b59120e5ec76436702cff9

            SHA512

            77497e83fdb286282880184ac5b3e907f4ef49442fba6ca24ed466a930fbdcbe17be50ab7468cb2de8d629e827e2b149b22010c520e403f26cc82eff607b29ea

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962648892_4459

            Filesize

            2KB

            MD5

            fd0948e019eecb4ac3b51e51e63c7554

            SHA1

            f74c71c1c03956b86defc6eecc7c4266976afd21

            SHA256

            f2408724c20cff3823776639c12c0b3223a15412d73fe9872570d5a6742cfd4f

            SHA512

            74d5f9b799b5a4ef65ac89eece0cfe9c259006b6985db530b9f15faccde5e0606531036833287e22767fe6827b5f5c2127571401346f3f302781d0a34d49052d

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962649022_4459

            Filesize

            2KB

            MD5

            c32505de8f16a3055ca3ce4307a43895

            SHA1

            5ae19c6a1201eeb20de3eac2aa4acb87e100c081

            SHA256

            0767f426174ec824b3b57ed6f393755b90eafd396a974954a43be291b1c31fef

            SHA512

            960fca4850e3819b53980255a3fa0498959c119bbb1733390a81ba55507a99ac925e9ec7ddc0455fb1b2d3cf6b3ba88dd90f21500a6fa58ada92f77e513e6b42

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962650549_4459

            Filesize

            10KB

            MD5

            8914e46561435269382ad4bd82392271

            SHA1

            653494a325e655496cae019c17d1fd74a808f3f7

            SHA256

            8526cd4626148987b1830e1ed08e24b50e234c17137cc77a6fa6384f284a3847

            SHA512

            a87a8d98c3c63895f26d72b57af8736104033b208eb24ac31384218b0d266021939bd6572ff995186df3d210c3512a7fef8f68c15bed659569e515f196f7e957

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962656245_4334

            Filesize

            2KB

            MD5

            f791492e9b1dc9d881c10ccb1a783544

            SHA1

            9ab551bc9f41f4dfd96858a22b1620db87ca4716

            SHA256

            d8aab06c6c2d0639783b4be095482e2f0c6c32c48d75b1dbf51a25a208f013c2

            SHA512

            b39f9f89042ca3de0172979ddbc8af9569dc1679cf36236c786f3f5c59b911d892a52e6ab19b207b56c69556ca091ea46dc32a4949362d95fe6d444e0cdad636

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962705708_4459

            Filesize

            4KB

            MD5

            49e81763b4eec549a2d9c97a505693a5

            SHA1

            abdc0431d325383a106f91778a63f62d179fbd14

            SHA256

            fa5d3c408a1203fa205d075c2a0bb400693085f9b43836ca7ff5ee99f1c42085

            SHA512

            360d0922ca6c3ce7cd715407bbd98c4d029de65a12e15fc7f626b66ae1fda46d26984620856c1d2a39141b6dddbfe37f94ad81dd18375896f8c8139b38c6d093

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962710907_4459

            Filesize

            3KB

            MD5

            7b0c04a38c662ed5513da02284c29c94

            SHA1

            94353dcdd1e129dd694eece34966d908bbebd5bd

            SHA256

            28c269aafa71d1af1a03003174374d0f8f5df6367b0fefdbee4d909dcecd61d0

            SHA512

            9e800e904f924ad757ad2e10ef81474ac5761639d750cf053856548a7c0c2298d9e57f8666d6bbee089b83a1b0c9f6205b7405942dddbc0f28d8b8adecfcb589

          • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962716246_4459

            Filesize

            10KB

            MD5

            8d415b7e676c0bbfb60997e6adc2bc77

            SHA1

            38b799b9bfff7aa3158817b27f2d2940de0efe6f

            SHA256

            c9b637239c94c277fde954cddc7d8ea60516a8a43dd94861fc2a3a8dcac86dbe

            SHA512

            9138965e44060562f3c561e7ac1ce926032b4d8c4a3e3d86ad1ca90eac7fc4354645acd2194afdf2f455f37eeaf9cbb6b3d202e6e211dbaa713e8102b98b9163

          • /data/data/com.vip.zb/files/jpush_stat_history_pushcore/75618535c33b4a987b501ed6/normal/nowrap/45251722-ef1f-40d1-80e3-c19d00b74565

            Filesize

            202B

            MD5

            0495d0a7d10991ee8a6e6307a82a79d1

            SHA1

            74fff2970fec0c18aad7985d15be41fc0c662415

            SHA256

            d65a323bebe1edba8316e1b630d5d4413e10f2a0270a9e1a4fdc33da2c84da10

            SHA512

            457cf5ccda96b51590a749cd16d263f90a2550b71b137e3276fcd8d0b1403c15722304341466723f94e261a084f1bbe94ad0701cb39ac5e3b91e04678c48c09c

          • /data/data/com.vip.zb/files/mPBE/iv

            Filesize

            58B

            MD5

            c42f89c3c05a5737cdf46d33870d0b15

            SHA1

            27e5807647760c8e7e1b50742c29143b19e4f1d4

            SHA256

            399d22b2e1fc6bdd57bd0941da25c52b46cb593fd87f9ce457ff3d835c9294cf

            SHA512

            6b69d86d3e88308c243e27cb3f3aaae3f0b625925489faf83546d110a0ce08927a244c21ef403ac37ac288424387fbbecd745fdb81c4d77ec387897083d8e852

          • /data/data/com.vip.zb/files/mPBE/salt

            Filesize

            121B

            MD5

            4ba59e4fe8f8aabc07bf15d1a920efe5

            SHA1

            016b38ab11a69edfdb9f425d13a75d0cf324f89a

            SHA256

            1b0edb1a8ade2fdcd5b3af9e7a37c08385fb9866740c6f97977943f8564f63ef

            SHA512

            2e431a9f8e46c4a6d17f97e528d7c7a2698f58397cf6b2a30959d1a281886d4e8485f7369989cfe76244c13270c3948ae9890227efdda3446c5280eeb553be20

          • /data/data/com.vip.zb/files/push_stat_cache.json

            Filesize

            119B

            MD5

            189fde82b2adf7bf42f5c17858fc2b08

            SHA1

            82d465c6d5a10d4f17867b67cf8854aac1dedcdd

            SHA256

            e5050363bf45d2a7a3c02cd0f3d17a1a7c4494d07a1c83d3a833f1504252a303

            SHA512

            63bcd51a7076eb898109b9be42ad4a462ded520fc914f15b0bb944153958d0117cb2c05ce6636fb504a557a0efcb3cc5c68a5e68924e5770da7f48c44cca16ee

          • /data/data/com.vip.zb/files/realm-object-server/io.realm.object-server-utility/metadata/sync_metadata.realm

            Filesize

            159B

            MD5

            69148f6990bb05187c0b20d3c3f29d32

            SHA1

            fad7a01411d40ec0eda4de13f62e5754063e7d70

            SHA256

            5aa22ce0e56d87dd57eea0a3672f751037a515f870f4f68cf0e388ec4ae01c68

            SHA512

            e19fef28dcbcc814b8b61055a69c8dd05b3b95da47fcf92cfd4271363b8bf4c55a098c1fde483e4b57210b573a0aa8015a2d00e4a6e8aa1934de457959102e99

          • /data/data/com.vip.zb/files/zb.realm

            Filesize

            24B

            MD5

            a6574431b943e0bf47642c666f3fbbe7

            SHA1

            79191cabd86accd903f27c523c95ef19933c64d1

            SHA256

            60692d3a39b5fa2c7ea60c7be7014c2069f7c0a3fedafa269addd8143ec15f6d

            SHA512

            c438e1cda3bce0de04a34e3f53f17f7cdd235e80c656c31e43a21b37e77dfd90de14c17a5c6719b84a14899ff41107a75790b35306c7ecb1674d6f60de9bbbef

          • /storage/emulated/0/.mn_410185822

            Filesize

            194B

            MD5

            06f532cd45a0f317215f13653f720eb7

            SHA1

            4487cbc8670b3a060cca9379f04aa5028c92ee9a

            SHA256

            001f07eddc5ebbbb098021fd455828bbc25f5e4c3f7ad22df74822a59a704164

            SHA512

            a6c8e34f11d11291cc0ce168df73548dfbbb80ac76776240d28ab6bfd352db26d6f38dd35ad5cb0db8e9e7433555a1b03dccd4bbf6a44bdd069ec54d4b093219

          • /storage/emulated/0/Android/data/.mn_410185822

            Filesize

            130B

            MD5

            f321656a466363e5192773d92000e401

            SHA1

            3a6abe9be1a6f4deffaa98fd27f3449c888d3c4a

            SHA256

            53efd5207de6ed80429ec3c7865eed2b64023a0ed66e0fd29e7f45b708a1751c

            SHA512

            fcf6884bf5ce8d10b3a3dd461fad96cb6cf0bc4129e01788de112551230fbc4d8ea6961b04411d1c7816e248437c4560277069d9c544e5450612abc0e2c0171d

          • /storage/emulated/0/Android/data/.mn_410185822

            Filesize

            146B

            MD5

            d695c26bbe4655315fd012b28d764d0d

            SHA1

            a819e7d619d2873c512df511e9d6a92dd6451416

            SHA256

            3f52b784cf3314e1dd17f36cc612e7c9bc7080df6ba2589422bcbded1732b06a

            SHA512

            b3ef2f675904b687a72da02f28351187b970d7d1baad56be5484863294b886c6538c61f8cfc16dcd28c9b903fda1abbe13c6ca9966d88b2cd969be692af4aa58

          • /storage/emulated/0/Mob/comm/.di

            Filesize

            57B

            MD5

            acc2a2f5cb76c41d2e97e0d409b53bdd

            SHA1

            ed06f22ff10e0912f50d53bc775ed2ae70f85d5a

            SHA256

            12ee2ab25175281fd1efab755eb5a5b442e91d263646c52118e6b1e97856f448

            SHA512

            faed72411dfb1546a82a302b6aadf921bf66a09aa4641a6d1d523e5b58c063d5210089ca2d7dec8aadbe1efec4748a8abb36ab9fe1ab18539a92b76730b85419

          • /storage/emulated/0/data/.push_deviceid

            Filesize

            32B

            MD5

            4136992c4a278a8e492e00d131254a4d

            SHA1

            b16081d111fc330ffa664dacf64341decf80c38e

            SHA256

            d1ceac24ff9cee5a7a67ee4029a02f9c2c7bffe9eaff8345f818ba98f1249f68

            SHA512

            749ad1dce0c2b074254fdfa385aac553d81dabde32f9a6bbd51556ecfb60e2fff542c5f6c7213fae296268d9c5da869264c247167689ae7a0429d35148966629