Analysis

  • max time kernel
    177s
  • max time network
    184s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    17/05/2024, 16:16

General

  • Target

    505d3aa00380f5f2159034b6fc05623b_JaffaCakes118.apk

  • Size

    19.1MB

  • MD5

    505d3aa00380f5f2159034b6fc05623b

  • SHA1

    6f167439332e26efed29363ac553cbc12bf0183f

  • SHA256

    c097a30fcd775e00136aa26c5992a0616246f84dc7494337ee48be518820ff11

  • SHA512

    63fbac551fe627330e27b674b740bfd94ceef825c16751431eef3c02cdc3cd75c07af42c7fb3e8916c2a83bef770910f32c09927e5773874899518a0a0935fff

  • SSDEEP

    393216:WVTaHD64tJwvnlet7JmiY7bLL9XXZXmiEb60U9sxnO8EEqxq:WVM64tInmVmiY7bTX4U9sxnQTg

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 16 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 2 TTPs 4 IoCs

    Uses Android APIs to to get current cell location.

  • Checks CPU information 2 TTPs 2 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 2 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the mobile country code (MCC) 1 TTPs 2 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.vip.zb
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Reads the content of photos stored on the user's device.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5149
  • com.vip.zb:pushcore
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5358

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.vip.zb/.jiagu/classes.dex

          Filesize

          6.3MB

          MD5

          3ff16058471dc51e596a8832a772b9ac

          SHA1

          f21e4c55390f0930b511957a37d6155e47bdeacf

          SHA256

          9b1d06fe5c2d26b23dee9e34f0aae607e940bd99b500cf1191a6112a52793dc4

          SHA512

          ffcd25e905598114c5a2ff6147da4fbea324573737aef303dd9f5943486ce88791bb9302a2fb7e784cea413292af9867c3773557ca739ca540618c40c174d3ec

        • /data/data/com.vip.zb/.jiagu/classes.dex!classes2.dex

          Filesize

          6.2MB

          MD5

          ab96f0b54beb7d5deec1fd91a3dff33e

          SHA1

          e3734b5f908c134e0d27ffa6ba2f01eae7bfa1bd

          SHA256

          55751143689f888d1fc257194481175e3dd8ae4fc28860516854fbbd235e86a3

          SHA512

          f48738b1963cc6939aa0f6b312c8eab2dee532c4e0ce88bcf3595008ea7c5c1095fa622f586186ad36ac678dc9bf30b49d541b50018516501bd4458d0c6e959e

        • /data/data/com.vip.zb/.jiagu/classes.dex!classes3.dex

          Filesize

          5.4MB

          MD5

          47fc1e2dc062c8d55e36250211b2bef2

          SHA1

          4cd7692200ca48347f3e0e685d24d26c3b403569

          SHA256

          d05b980381765dbed5e2ff49dd44950ce447a10619f71b94623b8a4846fb5cea

          SHA512

          ff096cc4fe344301b1554f61e40c42261b39d64e81596c7bbb4cdfe0d0daa5d29d22d455b3fc29c127b2913496f663c031bcacbe3669728b47d96e334e7137b2

        • /data/data/com.vip.zb/.jiagu/libjiagu.so

          Filesize

          475KB

          MD5

          5aea02f4e4c77fbf2e7a27f7ca9cc06b

          SHA1

          522db1748608e9173547b29b7aa82ddc3542c534

          SHA256

          5a1c513b347e2a929769e2be67552c1d591704f08f7b5590282b66cc2c7d7bd2

          SHA512

          5c979a11f5e896829db906f533756efc1cf3c5a7e35ecc9e376a0aae818f2dada013441649feac2e188bd51affbbf35156e32fdc6552e185bddbc547f3850316

        • /data/data/com.vip.zb/databases/ThrowalbeLog.db

          Filesize

          20KB

          MD5

          039b2565db7951681ae6d9438fe7d551

          SHA1

          f988485105f90d2dc00f117d03e633c7c52adf21

          SHA256

          dfa22072524232d9e071e9cda23720719a246e86f0924a9628c919e7c40c33d7

          SHA512

          012e65357286f1eedb5c3de24d8c269b9c2f0b9522807de007529ed4246a147e3d1bdf8903da11451b66e131467114fcaa08940cbf4cd93801455cc4ad3fe9be

        • /data/data/com.vip.zb/databases/ThrowalbeLog.db-journal

          Filesize

          512B

          MD5

          d8e38cb32abb07ebaae0d69892a1673b

          SHA1

          724d49137464a0c017e8ef06769c0b483ff770a2

          SHA256

          bdd5acfb775aee7a1820baf1789421224a9175586b33a3a290e713f570217aea

          SHA512

          f0d26cb241e3fd7ac31da6d20dcd9ff5c5b912be67fec0a3e5f445c57f20ceb9e65518cbfbecda0b772ffd06b955a2955fd288dcb6f4858b2c33053e3b9f845b

        • /data/data/com.vip.zb/databases/ThrowalbeLog.db-journal

          Filesize

          8KB

          MD5

          75962cb17b17c8190b4889b63012a916

          SHA1

          87273596ca2f8b6496d0793749e067806afb5c5c

          SHA256

          36ddd4ae75083dae4e1cc291a505dc5efff4221b17d9da044d11535a5ca5e346

          SHA512

          a79fb2fa752b9c66fadef2e8b85cc4433b6d486db4c7630beff1b35541026b392224439d49b0c14489a125335b054b7f19957950b0ce9b7a30aea7513f3868f3

        • /data/data/com.vip.zb/databases/ThrowalbeLog.db-journal

          Filesize

          8KB

          MD5

          a09eb4ef066c69f3a85bf4e89e9598b6

          SHA1

          0e3a5b8409720735df2aef38d5be7428a8440e39

          SHA256

          d3fca20afe98265ee3699f356fe4d82428a9ca0f0c74332c5b8bb98a1a2492d3

          SHA512

          237d4c31e96a79051095078acae1eef037b75e5da2608acb58c4ef7ab1be747b36c377bf99bec0895aadcd96efe9453c4097a42fc1387bd14500f193bc55ffd1

        • /data/data/com.vip.zb/files/.jglogs/.jg.ac

          Filesize

          40B

          MD5

          689bd3db375377e66d61515b422e7d7c

          SHA1

          e9a6c46ef149a607f1009fdaae2e51ebe94dcccf

          SHA256

          c9927aa4416b1880bf6cb1f092f3812276cff70a6acbd0f13af67ba80811860b

          SHA512

          85b8ad4fec790b346a6ac5edd22ff563c543556b87babd4576208e4bf1c6648ca132036119876257a5d783d001941c4f346596cf7ed53fe8cc9f481b15499fdf

        • /data/data/com.vip.zb/files/.jglogs/.jg.ac

          Filesize

          32B

          MD5

          f23c5784bbb90a8e546f559118b8c0d2

          SHA1

          46bb5bd5ff6864c3b063f05fa14c540d05ac1403

          SHA256

          d7360305c279fa3d2fd6d8b336abf1a6ee1394df5e78d07a9c9e4125dc4995bc

          SHA512

          a1bdb86ce763ac4a0bf0a53b91498a9a35de874b8b0227747daf0fcd74c914170200ddbc7b19835d2cc3781780ea6da4a4bd7dd3168451451dfc148ba6088468

        • /data/data/com.vip.zb/files/.jglogs/.jg.ic

          Filesize

          32B

          MD5

          9a79d431a359a2b98cf9a609a88f3aaa

          SHA1

          62cd4c0b30b865683be5bc025f3089e0f50404cc

          SHA256

          db623b36d76563c8b4f55d7dddc0c78d313c049d375c5fe9820ce04b0c8919d0

          SHA512

          6783cb7f9dc566a62e53e4b5e0745db85c068eefeb0f9525b5777ddc52cc474d34a608a67160afce7c30ec6d068a4ae3d569b6fe8617cbc7b3f4ad09b67a71fd

        • /data/data/com.vip.zb/files/.jglogs/.jg.rd

          Filesize

          32B

          MD5

          c030858f271431051f41a8da2b14b4f8

          SHA1

          387b6c3845dc4c8864fd977c6b1b5863c0b0d691

          SHA256

          c55dbbf491eafe2818578083a45767eac51c97f8a1451141541224d6d983f1c0

          SHA512

          c6083943a28f55be2f43719c663e35b8664288ad3c93729c6f5ed2414dbd14915c4d1adb0207eabd3472d230b9471fa1700a078506c9acd6004489c8b48a6f6d

        • /data/data/com.vip.zb/files/.jglogs/.jg.ri

          Filesize

          307B

          MD5

          045c2fb0bb212eeacef1e2c92200eaaa

          SHA1

          1ec3afcf27658a6aabd65abcf61d5667d653079e

          SHA256

          e5ea8352bf7e3f8ba0abe3aa3a76a7b887ce7ea3b702b59924d025aa2f82bb44

          SHA512

          4b25d9e8710be6e2f2fa3965b0229513a552bb1d9995c8ce20bc7917327b8eacac723211476c4ed44fa51cdb1450a7161dd30f4d6a260f56d1a361b83a2d141b

        • /data/data/com.vip.zb/files/.jglogs/.jg.ri

          Filesize

          314B

          MD5

          c2f2b2592e6bff8b43c527953ae66516

          SHA1

          4c5ff9cb26c97acb1ff5d74e76cf90e763fd5e7a

          SHA256

          4c29abea73298e1969ec336678678e027322b2ca3d70369403e61c80abfb38a1

          SHA512

          b2400aafc15040438fad7b8c70826490fd86d1b31a58ec2e6984f748e21f20b988f15074daf1da758069dab80b5bd68c831acdfb1da49fcb7d588dce5bc2f422

        • /data/data/com.vip.zb/files/.jglogs/.jg.store.report_pid

          Filesize

          32B

          MD5

          55c8820fc91cbff0146f6b40b438cd82

          SHA1

          04f843830754125be15af12c087187537f72c5d9

          SHA256

          73148f0c6d93dde91bffa865faca6ad32cf1ee381b5749003e195b2024fcd45c

          SHA512

          d4f76f1a0380b24d641545295ff66fda2238daa073e7aa1afd03521116327d40088fcc313df5380f21261533809806ad269957cd87890a728794370e46df9cc1

        • /data/data/com.vip.zb/files/.jiagu.lock

          Filesize

          27B

          MD5

          291a3c45b74be59a32c336604c9a3831

          SHA1

          388e0afd22d7c29f3fc45b2ca1871fb524266151

          SHA256

          efb0668bdbd0e57fd78f26811e673f243103377ec2ca67294d92d1d3f6d417eb

          SHA512

          2f7c3443882ba1e32f794450d5b2d4b248bffd9032e0881b4e5887a094b8efa1c12408291f24725ba73f4a3daa208ae140722a51b4264301bc5c77085414185d

        • /data/data/com.vip.zb/files/Archimedes_p4

          Filesize

          13B

          MD5

          43da3a83d4efbbe37f89003d2e839b60

          SHA1

          f456ca6139581ab62f9dc2a914b26fdf6318f12f

          SHA256

          91f6d8d0f2bfc8e7e9fe7859b0a60a97dffc9d1eb9d5309fe9c0186229fb6f13

          SHA512

          c49676e7e922bb5eae98ab2636d7cb37943051792de454bdede7c0fb35f93a7fef6b6d462ea50af6bee74cac7b0cd8aec6e39091093bfad46b41e26f9365b6db

        • /data/data/com.vip.zb/files/Archimedes_p5

          Filesize

          13B

          MD5

          4e42fb88e002962fe2705a034376a792

          SHA1

          c568f17fc133169b29d6c85ed5343f4ca38129cd

          SHA256

          4426b93e17842b78b44140758560b8de8d3df7f4e8f16b9d1bbd93a0d0b95153

          SHA512

          7406f5bd527b7e071f282905bff20fd79159d666c54d305ae668520ae0bbea2ae926fc24be19e4ed85941a306eaaac1ba578bb2a6e57f259bf8e55f0a70f3eeb

        • /data/data/com.vip.zb/files/Mob/mob_commons_1

          Filesize

          8KB

          MD5

          f944288925cca8eae141e9531c796148

          SHA1

          d79b7321214a90489d24d8a0cf9ad203171b8fa5

          SHA256

          1f551670e6fc94fb5002dc28ee995dbee68bd0fe858f54a0c73980f092d587e6

          SHA512

          c6a9a8891003e486271ea4534d5c642b716ffafa550ec161162faf393bb714cd7950ecd14d5ecfac80ff8ed7e530c36b9a8a80b0c61b3fe15e0417577e530ed6

        • /data/data/com.vip.zb/files/Mob/share_sdk_1

          Filesize

          23B

          MD5

          8e24e79baab91c4d0604eaa9006a0cb3

          SHA1

          e427afc94a4b957a7096f73e395a10ea404c076b

          SHA256

          65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d

          SHA512

          45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae

        • /data/data/com.vip.zb/files/TDAntiCheating_Switch_Value

          Filesize

          1B

          MD5

          55a54008ad1ba589aa210d2629c1df41

          SHA1

          bf8b4530d8d246dd74ac53a13471bba17941dff7

          SHA256

          4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

          SHA512

          7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

        • /data/data/com.vip.zb/files/TDCloud_Control_Cache_Param1

          Filesize

          2B

          MD5

          99914b932bd37a50b983c5e7c90ae93b

          SHA1

          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

          SHA256

          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

          SHA512

          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

        • /data/data/com.vip.zb/files/_Ladder_Project/Archimedes_p1

          Filesize

          2KB

          MD5

          da17c253afe38acdeebb08451d0a9ec7

          SHA1

          86872da68753c115092ca5ddb2791cde92b2ce80

          SHA256

          d30de5649995c5b6d8b90f25cc9e26193bcac9da98e7272091e610c39f20feb9

          SHA512

          7a84048344cc247dfa84d9f188c4e14aaee7aca96a7d5561454ba598e8d94b3845b90fcf3af4133d92b818a5edcd237e1003752f119fb10e90ab4fa900ae99d5

        • /data/data/com.vip.zb/files/_Ladder_Project/Archimedes_p2

          Filesize

          12B

          MD5

          251fc0ab3cfd7c5fb5169d380c4d7125

          SHA1

          3ca106ad156b038a0de9eb462e06671bfdbd6451

          SHA256

          1646cc678179554c5b64d609ecedd690d6f91b816a233073545478482a6667a4

          SHA512

          f3645f761af401f2cff175c85e40d7def2005cedd68b8718a4af6bce05391c91aa4647b1638075e7374f615a164b932c3246eb87a17899f74fc0719affbbd859

        • /data/data/com.vip.zb/files/_Ladder_Project/Archimedes_p3

          Filesize

          13B

          MD5

          3be7c8d134ed2d627ff124d1b1f6beb9

          SHA1

          dcb7003551427610d9613c020cfc8675af0ed1e8

          SHA256

          7fd68ebf3a2895cfb0cc9a47230888a9b27fbde5ddf52a025f065d308cbc5ece

          SHA512

          cf883fd7f3d87aa0e65d17a2de5cf9a822696f7bba4054ea966cdf2c4151297f801847374cd07ef65e75aaccdd6a3c0b255058aa0f63e862404c97a0da02c7eb

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database0SaaS/1715962648244_5149

          Filesize

          4KB

          MD5

          f8d697eb24c029f56c8f0537947f3b99

          SHA1

          2449480f02ef6d317aeea7feee091f67dab6dc18

          SHA256

          0f506949604deb21da35017666a4bb3e305057d6d2f319355a97742810b7e38a

          SHA512

          739fab1027d1e194b8b31937b90599c63d5cf3a697058d6eacecf19a0219e33625eb979b8da93c4fbf8d054d4f56d5738110ad8fcd45a6403b4f6aa9d161d616

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database0SaaS/1715962651361_5358

          Filesize

          2KB

          MD5

          5c8eec7615777e74f978e481704778b7

          SHA1

          2073802b76add0c19dfe4a627bd169716e651687

          SHA256

          94b09c5964d6771131869d2d90fa82f4c13fdfc33dd93cc32d4901580c1372f2

          SHA512

          ec460d1cf3e4c60515aea22b1f3197ee158769f02b47283b3156fc39fef9da0e18762958a50118513e08511cdfa27ee38d5fa806e861c8c62b68a492565603e2

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database0SaaS/1715962652000_5149

          Filesize

          2KB

          MD5

          a280abffab8524ea6b1f5d2213c3da8c

          SHA1

          d28e588169b44fa6397015df61c2307988bcd1a1

          SHA256

          cee5c98a51cab6309435c9674207e7c6c336952a84ac385e4e34afe9d537d13f

          SHA512

          b18766d320ff95213c58220438a4d240bb38ba3a90c2a3f94ff9e9738f103722e305bdff41861bc83598e51a135977c79da95b8b8de27088fd3f0bbba231ec18

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962647407_5149

          Filesize

          2KB

          MD5

          db92fecaa7b7a8694403c6f977630db7

          SHA1

          faea3360cc23ae2705333b541b8c5bf8993321fe

          SHA256

          a5c2bf2065a734d8d7c65877dcc0f1055c691922ffbc0e3af04048d17824cb57

          SHA512

          6cf24af7cecfa60521d8f1bb6f8613d38ecc69a89c0d6c9877effbafdd7f8e471772d8f799cc624ca482d06678c99d6ac6ede74c3ff972dbb6f84bd871eefb3d

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962647820_5149

          Filesize

          12KB

          MD5

          f9332dd2b03e5a50c44dd5afac2e34d6

          SHA1

          1114a1b3247e5879cbebc7851f8138fe2e4ddac5

          SHA256

          2b11c01269bd6c156965c4d93d1654be58366cddc6023e3d7595287b39d49400

          SHA512

          6e26d84e7121b766490abd0a8d7f841bda7c0dd93cc4f20de9b524cd81c33a7343b5056b0387b4bb9218d908603a2732b01dffc95ec33d39243544c397a35641

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962649714_5149

          Filesize

          2KB

          MD5

          4654f5c197c6f6a2d5ac9cb964ff200e

          SHA1

          d757f00bacabf6a99c05029d18ff4a055e2571df

          SHA256

          6cf5e7e6d75f7d76a3a4bb6d6bb33fb83fb862c5d1ec1dc68a1551be3d9af136

          SHA512

          07f01ad5ed4e08f837038be5f7243410501e595245f59cae858f821818949dda1b00be8a15e288db34f8a5a9da6c6845e3b564e99286d7c7373681c421202d93

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962650232_5149

          Filesize

          2KB

          MD5

          ca8ef9e108eaea5570663e599c7f802d

          SHA1

          36df35f21b05a416b97bb61e1f1767ecc08c7d9f

          SHA256

          ae1863e2641714a5ed8a9c63939ccbb5b6396890cac15ed7d018bee8d4f12b7c

          SHA512

          79bd7b9e4c2411cbb8e6b2eaf1a19bbb1ee85eeb9b7182042693fbfc55b7ecb9151f5ecc1750ea94528f002094b3f0cb295fe57de74c1a545fe73daf90f63b68

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962651640_5149

          Filesize

          14KB

          MD5

          626e620acc92d3ecb3b73ed0007537b8

          SHA1

          13004189e280b2753b1928e1bcc02e3330489bd5

          SHA256

          567ece827f773ef10ea5863d288f828c548102356c8a388bcc55cfafb8b797d9

          SHA512

          8da6b81d0240600d3e3032e818a97c0ab4cecf1c887dc2655c93206d886501be0b1459bb6d5c4907c2dd715ba6f130c0ed08d6e4f6e8447a7d21d7410486b1ab

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962651789_5358

          Filesize

          2KB

          MD5

          e15861e394b22fa82998ab3b5c06b870

          SHA1

          ce976ee9175d7b37f34ac2cae107c6d6d804d777

          SHA256

          14b4218f6280d25e2a486ee2577b8cb6de776c1ece579dd5d78065cf44100e4b

          SHA512

          dd9c7ba4bda819f954a1f180ea59faf43408108a3d4bfe21050da8e70d0f404aa8c9a92a3f359056a1d1f44386633a053c0f19e25df05274db66e35685167406

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962652170_5358

          Filesize

          2KB

          MD5

          8ac3dfa091bc0ecf8c5060ef28faf9e2

          SHA1

          29f2493d82a26aac7390a0b7f26903be2af4e22f

          SHA256

          b25a207e571263c530b1544713bc67ac8e763c1287f3567c399a63b0139c0a0a

          SHA512

          d855bdd2270b0210fe09e96109e95f0f27f9198695ccab34685c534fbeeb4c7a16cbf10e1184d6004a83954cc1f7341f65511bcf9537dbcd4a545aa974ab80d3

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962699888_5149

          Filesize

          4KB

          MD5

          2828fdf7c880f9af649c98e9e41891d5

          SHA1

          e4eb86ae0ba411d119a22ddc8af645c4904679ab

          SHA256

          c18a44c1a0bce0e43dd2b0b57f1d5f2ebeeb06462137d09b2cc340fd54e871c3

          SHA512

          e47ba4b2753d97822bca831849bd688909347cacdd12a90642e907eb4de8ff48528696073e2a4ac626d46724307f9839c15dd7a480fd6febe55a5f076c19be55

        • /data/data/com.vip.zb/files/__database_reborn_January_one__/td_database2SaaS/1715962700480_5149

          Filesize

          4KB

          MD5

          dfc162f0dda31fbb8143ef33fc0d7664

          SHA1

          1b4b459c4957ebef6bf098d8e8048f82f9d1d750

          SHA256

          26b05d12307d5bfa18df26abc4abc59fe632e92cb6f1f0481aa16fa103db3865

          SHA512

          08bd46a3fb6e96149a853313aa21cac09b8e5b46399a9126114de2ef013fbac975784e917fac57ca96bdd69f547d224b1d1ccf00d83bc2a297293fa988945da1

        • /data/data/com.vip.zb/files/jpush_stat_history_pushcore/75618535c33b4a987b501ed6/normal/nowrap/a247a326-35d8-4ef9-acef-7be3ccac9f67

          Filesize

          187B

          MD5

          097db6ed6891c0b18281e51ece92246e

          SHA1

          786f45464a5edf90f486b182182bbeb1d0c2370d

          SHA256

          581d7b2defe7dadc7539e03ea7d1775d67b99c4e220672a928986c24cc9784fa

          SHA512

          dcc4ce2b98c733aa2a7ff0447e51d1547eddff07de02c5a8ca87f7db59b87aaad3fa65a7d55db8306d5afa140dd4e7a6df6b692ecd748caa200413057538df6c

        • /data/data/com.vip.zb/files/mPBE/iv

          Filesize

          62B

          MD5

          28265735ec2f0207461c6a263512c106

          SHA1

          29f340aeedeed062084df0b3ad717f6523db0f43

          SHA256

          dbab41df183b1199a18f908bf4544d068e4556142f86aca1da2913aa0604cc92

          SHA512

          d5bfed7e89ba5f24b1bffc4e765ea8b29dcb9a3e2fb2156ba8d0872de476a2bc4e2fc7099c5578ad86c150fa68121f70760097be49e2fc2da4995755596baf5e

        • /data/data/com.vip.zb/files/mPBE/salt

          Filesize

          120B

          MD5

          b3a7511b45476a39cbf593e80bb06c9e

          SHA1

          c1983bbffb8e9d83e7dce1be562234edc1e693d2

          SHA256

          05047b8e2296e9cfdeb211179689c34926c2548010e665c7a7d18209d0db036f

          SHA512

          3347e61e6a32f010bc9b35a5b036beba4bda10e298195fcc44f485a686196834ef2c6d5a18efbb20a6693f829e59ef21628f9bea3a8f65a8be724bd94b0ac786

        • /data/data/com.vip.zb/files/push_stat_cache.json

          Filesize

          2KB

          MD5

          20789d502da5bae9037ecc1796885925

          SHA1

          927443dc215309e06bfc7ae80be8aa95c451799c

          SHA256

          28a5696cde2a7a950a94c65ac7367d85960ed28e70df7511084df24b49d4b893

          SHA512

          bc7ea782a1d4387486931dd05e139b0a4770ce531036a306d72ba18cd63951a7436fe16af55377c2343fbebbc6e40642d691463bd5ce8b896ab2e7331368dc88

        • /data/data/com.vip.zb/files/realm-object-server/io.realm.object-server-utility/metadata/sync_metadata.realm

          Filesize

          159B

          MD5

          de96a2b9ecb30abca5752b4b6785cee4

          SHA1

          9609e4b587fc92b3962c0792241a813d45eda72b

          SHA256

          c3805cf082d3966fea1a8f39d4e88c854fe1baec2a77689ee2047bf580513830

          SHA512

          6e523a026f6b29fe34d36d8e494735ce64033af6401b0c7094c7de9cd5060b09e11cf37f187976f25f25f8d8b5220bf8d36b5aa382298a7849d2de06ac247ca5

        • /data/data/com.vip.zb/files/zb.realm

          Filesize

          24B

          MD5

          a6574431b943e0bf47642c666f3fbbe7

          SHA1

          79191cabd86accd903f27c523c95ef19933c64d1

          SHA256

          60692d3a39b5fa2c7ea60c7be7014c2069f7c0a3fedafa269addd8143ec15f6d

          SHA512

          c438e1cda3bce0de04a34e3f53f17f7cdd235e80c656c31e43a21b37e77dfd90de14c17a5c6719b84a14899ff41107a75790b35306c7ecb1674d6f60de9bbbef

        • /storage/emulated/0/.mn_410185822

          Filesize

          4KB

          MD5

          015e10ffe4fe7f13f3a25d9175f56749

          SHA1

          72fea77417b9ab3f09ee2aaac38f3fccc974907b

          SHA256

          c71d91c2179380b43f9a3d352bd21255191ab9107885d1054a8f55abc59e366c

          SHA512

          3b5d35b25ff5d431e712436571a58b0a9728ed90447ca48fe45bf949f571d01c43fb519299c4c85a342d3a566e3c4846595446075bc527c8bf3292300969708a

        • /storage/emulated/0/Android/data/.mn_410185822

          Filesize

          130B

          MD5

          e4eebe8f4133f395ec1431bf6eb4a7af

          SHA1

          d8ac4d55468a6615893c9c9b90bf2c021cb579d7

          SHA256

          1db273f2294ec00273e8fb93c2f296219bfcf02a2fd29f75171178a0d90e47d6

          SHA512

          ee25716fb1ee28d8e12b8f25511e24df2482cf9383b1ec24fb7b9a216776d31dfa437d9af8bb46418aab3195de4d863dfcbbf03e5d29505765990dddacf39573

        • /storage/emulated/0/Android/data/.mn_410185822

          Filesize

          178B

          MD5

          12726a42d91218ddd285d792f26bf5cf

          SHA1

          290343199bc9c03ca42a0d7fb9ef45675f47cd02

          SHA256

          012cd7b07fce2cf6488a00bc231f6faf4854a5b30e46ccad9c214e74d878f074

          SHA512

          c1d13ebd7bb04fbbc89069c15328d8aee56725275eaec614894dc2a55894e783a2c1495ff5358ac6890b44e478e0a58cf9dd7245835a2aa37e403a9e63cd628b

        • /storage/emulated/0/Mob/.mcw

          Filesize

          80B

          MD5

          01659fcf5061c146ecd9c121348aa4f8

          SHA1

          23674ea838fc78b866e5d85a131adba94608056b

          SHA256

          31be49a3fc53e6dca445fdfccf8621b65c90a73f6f1ab0b0a2a95ebe0e571736

          SHA512

          01b91f8fb99d1230181ac4d1a604ea61070cf536763ec0ee56af5aebfb9727363ef36d59d346d72279a9e9e945dd530cbe727a88985029ac01faad0b5a2a278c

        • /storage/emulated/0/Mob/comm/dbs/.duid

          Filesize

          132B

          MD5

          276c3560af1d2b667e561e413a5a94e2

          SHA1

          e1d7d4012d7b2f12186cbf6ef519b6e9d0e4a146

          SHA256

          531500bd29c0bae0c386851e72c5c55a265b71910e70b8d50a967e227403f6c0

          SHA512

          efe3319c9ad02b132b487c9890034145f478b08ef944c9a17a982e2eb05e5c14acdeb3d53567f709905347eb0dd3719df24384d9f555787f90bd0d23ed5e576e

        • /storage/emulated/0/data/.push_deviceid

          Filesize

          32B

          MD5

          3e1d353db6ba138aa7c21bad92db9a28

          SHA1

          37fe701c9b9b7355268c5f1255a56f39ddcb8af8

          SHA256

          8657ab93f0bcd34ba3a4a4b7d413c4a400e0d36afca4a407b77fa5337e8b8bd7

          SHA512

          5c303227c8181de0ec952fdf6fc9f818236806782b1eb51c8580dbd3b3298cd2d8df83e2fdc5d489b78ec5ff44e583f59002956e359b3af13eb0277bf0587d97