Analysis

  • max time kernel
    177s
  • max time network
    188s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    22-05-2024 10:38

General

  • Target

    66f8e21a5d2ef7b1f5c83f0ef34391f4_JaffaCakes118.apk

  • Size

    15.7MB

  • MD5

    66f8e21a5d2ef7b1f5c83f0ef34391f4

  • SHA1

    4686f1cbeef6d07223c103a2978896bac1408d34

  • SHA256

    f1c7b692c4d696e4883f9a82ff4926cc59c94c3f6ddda5fc6d1ec13045e86669

  • SHA512

    5a7644cf50e9536e391b4c41c6cbe4492b8b0c59bddcd54d0c2c5377f0438b648f93d56b83236109280cc83a7dcc5538b426656dee2ff4c97a573a77d4245001

  • SSDEEP

    393216:x3kGTMbb1ANML98Ijq0+WLBkEBnxgBSVxNOQ7W72XC4C:x37Ub1ANMLKI1kE3gWxgQvE

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 11 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests dangerous framework permissions 6 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.esbook.reader
    1⤵
    • Checks if the Android device is rooted.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4274
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.esbook.reader/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.esbook.reader/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4310
    • sh -c ps
      2⤵
        PID:4533
      • ps
        2⤵
          PID:4533
        • ps
          2⤵
            PID:4584
          • cat /sys/class/net/wlan0/address
            2⤵
              PID:4773
          • com.esbook.reader:GuardService
            1⤵
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            • Checks if the internet connection is available
            PID:4337

          Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/data/com.esbook.reader/.jiagu/classes.dex
            Filesize

            6.7MB

            MD5

            56f60eb918b2c9db7a751e2561453b6d

            SHA1

            83817ce49a224b75ad8dc572de1939671e4e0d19

            SHA256

            c62d19cb6dfa5b183b6717f801211f2d15ceff1b2dee1c1f5283ceccda034a6f

            SHA512

            afc416b0a17f54e2ac6664e45d711b8d0d61975cc2a44d9d0a695e61b46ee5f3c5347a193762c33d5c047e3d0183af5c5e91dc2fabca01288fb52ec49a75139e

          • /data/data/com.esbook.reader/.jiagu/classes.dex!classes2.dex
            Filesize

            7.0MB

            MD5

            9753d3241c64a5b7e5b7f520b68ac0e3

            SHA1

            dd6cdff41e0f7dd9d937bc43b0de69502ed6f061

            SHA256

            230c4ccf2be9ef1c3b37ee5359f965db68fb81fa0c69586d2974f05263662aa5

            SHA512

            242b75975d82049bf08bd4f57fa7466b7e0a52daef88899156fc65e441538960d99a93a07a657855e8f7b511b11c30ee09dda4df4fd5d66d5c4ec98d46b269e9

          • /data/data/com.esbook.reader/.jiagu/classes.dex!classes3.dex
            Filesize

            2.1MB

            MD5

            a92a2b91cdd7b3ed8e8665f93e7502c4

            SHA1

            86f52ddae820f2c2bf9d16cdedeccfd4ac46bea7

            SHA256

            94b40360243444a0757c6b20a7890934ec172980f092373268edab58dd2450ca

            SHA512

            2133785674326fd7b4d99fb497ad3f26fdb5b389f07aa3525b2fdb6a3c4107256d2a1b9785c5d8802b05746dce3a5bc5250c4c2330b5c99098a7009809ac0d4a

          • /data/data/com.esbook.reader/.jiagu/libjiagu.so
            Filesize

            480KB

            MD5

            6e8ea47d2d8500b7fb8855394fdf0526

            SHA1

            d3c719bda605cd787c4acf30507edb76b7fb6070

            SHA256

            cc3b55086867ed7136d474a21b1359f49e6afed3b74fbb4ba5f11b36ce1f4d46

            SHA512

            385241f905c46ead517e4e0bcaf2fe00160ba0f7f40c6926ba288bf41d46e77a8bd63ec0a97d57a5b65cf6fb1f93b5f86f51d9cb24809ae934ebdb2fd49c0b70

          • /data/data/com.esbook.reader/.jiagu/tmp.dex
            Filesize

            284B

            MD5

            f1771b68f5f9b168b79ff59ae2daabe4

            SHA1

            0df6a835559f5c99670214a12700e7d8c28e5a42

            SHA256

            9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

            SHA512

            dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

          • /data/data/com.esbook.reader/databases/btechainh.db
            Filesize

            4KB

            MD5

            f2b4b0190b9f384ca885f0c8c9b14700

            SHA1

            934ff2646757b5b6e7f20f6a0aa76c7f995d9361

            SHA256

            0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

            SHA512

            ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

          • /data/data/com.esbook.reader/databases/btechainh.db-journal
            Filesize

            512B

            MD5

            9332572fe3f107ce75f5fbd8c5248300

            SHA1

            8848f5082cd0bb943731eeea6f8e40353c0047fb

            SHA256

            54685ff6504f254cd2379750d92e7ba6cfe436d93a0e2dfce2e35df2825d7ecf

            SHA512

            5f4404dfa1a7e498006dda8ab4562495f305399775eab7d74b07e6bfb7e5abbaf329056540ae29cda06f35e729d276fa34e5212ab3fd00eb5b6ec5fe1b5e447b

          • /data/data/com.esbook.reader/databases/btechainh.db-wal
            Filesize

            32KB

            MD5

            c11a9c3f1df6613064a38112a666db53

            SHA1

            e8e9c9da28e4ff3a54332ae1a490d83413ecda28

            SHA256

            f794e616e1e15cd827a6ea3d1f77b456a10279edd9c23473c5400eae37f364eb

            SHA512

            f37c4dfe41633840375257aaff0a2c390325af03f15be6066193225bda7e36c347b9dc76f6e53ec18f12bfc2660d5d249aa19c88882fc2b500b2f55dcc16db06

          • /data/data/com.esbook.reader/databases/easouBook.db
            Filesize

            36KB

            MD5

            ed5a7a63b573eae86d0b77e60a263626

            SHA1

            18fcd8d46d0d1ed2aaf402b8fe6b3e949f4aee4a

            SHA256

            574b34f8bd3f8fe2b2e1ce4f7dbc3f04e0ec96404bc9d64e236188d897ca77a7

            SHA512

            ae02380483581e44886b3a250c4a0718dfc73ed3922f1afe494cfd16b735b1e0a8e594fcc791d08175f9292dea1f0249face83807c5de3b13d2aace6ee6a6a79

          • /data/data/com.esbook.reader/databases/easouBook.db-journal
            Filesize

            512B

            MD5

            0425c0f6755ea53529e0240906f53f47

            SHA1

            b0d3c9ea9d0799452a9a753c0367fb2733adba48

            SHA256

            ecec04144b271eb6d77f85a8deb056f1103dbd0ee658059d4720212294a88cd5

            SHA512

            85cfb83a469420b757c984116708b18d6fdc45f823daf5db1d44cd3b50cd1cc0d397f1926046a45930fd22413c33bc7caddfc47fde37a08cb556c997efd22e6c

          • /data/data/com.esbook.reader/databases/easouBook.db-shm
            Filesize

            32KB

            MD5

            bb7df04e1b0a2570657527a7e108ae23

            SHA1

            5188431849b4613152fd7bdba6a3ff0a4fd6424b

            SHA256

            c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

            SHA512

            768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

          • /data/data/com.esbook.reader/databases/easouBook.db-wal
            Filesize

            48KB

            MD5

            febc03cf6b26867ecf9c927436293d8b

            SHA1

            2fc8bdc4104cc039ab901aa8c449307c54e8b848

            SHA256

            385c167dd447c65e857df56256a0da52c3a5d1f3a4940904e8cfb6416e7cdde2

            SHA512

            e7d679077eba45df649611152af827048491b762749b34e11812b4a2ec0ef21875766306f74040c82f3261be6979445fd90f862df58b1037ea5f353737854047

          • /data/data/com.esbook.reader/databases/es.db
            Filesize

            20KB

            MD5

            ea3aa6fb8d9973497ece1f2cb4bb7878

            SHA1

            a0578081d82c1e833a8d73d0ba90372cdfc7ac4f

            SHA256

            61d50595229cf66b791bbcc066ab175098f745c66700361957c8b974a194789f

            SHA512

            587da63d14dd7a4ce3992d92e2774d1b4e5e207bb4f51d095f1030d863a029e60ffcc6add7ed320291f009e75bd13334fbb075f3aa5352c5ba46cddf57fba315

          • /data/data/com.esbook.reader/databases/es.db-journal
            Filesize

            512B

            MD5

            c480ea168111783b56441c63cd576085

            SHA1

            1cd9eb015ca7eb3f6bab48aa1dd994e276b51df4

            SHA256

            5cca723bd130e6241565e79a0e03e56dc9168e725fd23599789f377ea9370bc8

            SHA512

            173e10f4430383d9767a4a01c1b75b3057eff8e55a66ab48809fd334774377add2dbe3300eac55d07652e9606bf40f4191b66773fa8146dc532ffda7511fffe5

          • /data/data/com.esbook.reader/databases/es.db-wal
            Filesize

            32KB

            MD5

            89c983399438de1beb1e2ea7eb0aa18c

            SHA1

            5669d7cc9a6909974b0b95674bb5c5f8fa9a1052

            SHA256

            ab71fdc721cb20af8e2558c256cf5569b504ada0a9423f6c3760c61a3451faca

            SHA512

            61f534dbecd1a193d4192465adad4170955138e1d7db68d178c2ed2e089b068ef2ffa8bc51cd84ca50c3ed5ee92e28b5d517672dda9839eae75ef81adfb69112

          • /data/data/com.esbook.reader/databases/local.db
            Filesize

            20KB

            MD5

            0886e1e4e9e13ad467fed5e6387bbc20

            SHA1

            a1ea02f457dfb31c0bd183092ab9ef53b860b848

            SHA256

            78d8f689718e894f087e56dffdf565f70587d96db83daf31e326698f4f463766

            SHA512

            d705041d9a8a7a8838330511bffc5d8523c5b0efa062d1f0034aa36887f7d34bb8d6270ee093fc03a274672dd961f70dd35e7d5cb2ae30c0414429b8ff837a14

          • /data/data/com.esbook.reader/databases/local.db-journal
            Filesize

            512B

            MD5

            a2541da1a0e75aba66ff6f5a379585be

            SHA1

            655fd2c04dc3159ce936a3ab7a11a0dab2c3083d

            SHA256

            5c336d8611a9e0078204c2d014175ac6479f29d389e8f575956706a79483ad24

            SHA512

            e8ebe9eb6cf05466627bdd3905ef20473ab7109a909f707e2d3b778ea6fd5867e345a23bde0019727bd720fffab01f0660bf5bf1d27ea280c7423b9d80635c74

          • /data/data/com.esbook.reader/databases/local.db-wal
            Filesize

            32KB

            MD5

            48d0e8819bf6e456e3c9f48805c309f1

            SHA1

            f24b186ffe70cbd3cb653ad73454e02003abea6a

            SHA256

            a6dd9da22c30f146ce9e9621b69f13583e8620c54d921ec921266f570aea6f34

            SHA512

            cbfae9a45eb8bb96dc90c5aab68a9c6b58f872af7bc64f5f8993ab1e8c3195731c20cc3776f742806245fb23dba1865c0f4b292478c7fa877eb0480fde910145

          • /data/data/com.esbook.reader/databases/localEasouBook.db
            Filesize

            24KB

            MD5

            a2803d106194a082003b0f5d7038f9cd

            SHA1

            3940a183cff3bd6365f1c9f46802c07c89033ddd

            SHA256

            999154a4ad6c28534b577705b3d26bae32cddafc4f2e599c164e549bd4c1a8dd

            SHA512

            ea73b2f9cad170d7766a83be81f10763f494262ff5efadeccffa128bc7e4f49a56cb109d6808b534155475637dcf328aa24f89a8943461afd5046215215e3076

          • /data/data/com.esbook.reader/databases/localEasouBook.db-journal
            Filesize

            512B

            MD5

            d8bc9770508ba424b9f90849bce52f41

            SHA1

            8596949309ceb614664ffe1f6a0bad8880608315

            SHA256

            8369257573b641782d9d32f89c8ae3e998180bbe8111c9c4552ce32ff96d04a4

            SHA512

            d3b2e2311812ec945f197e70ff271b4488486bb8c923dc66207eeefa768543daa11f815143745344d488d7e881e226190ff2aba262eb65f6b1a1273c48d2010b

          • /data/data/com.esbook.reader/databases/localEasouBook.db-wal
            Filesize

            36KB

            MD5

            15f1813e9ec791c36018e21390e7fa6b

            SHA1

            c6cdbcdb8a2f81f4d2642b4b4f008a7e7ee3eb49

            SHA256

            d9ce0c5737a8a2156ede41b42af489d71c56e6efcf942f5ca8f8af0450130817

            SHA512

            6d76f4fc4973f9d1bdff431c21cda855a09269e6e553c9cbf4a95016b28efb29657a30f8053dd969a6a41041ad8096992bc3f1f1c2fe8ed3d708cd2e35b95996

          • /data/data/com.esbook.reader/databases/techain_d.db-journal
            Filesize

            512B

            MD5

            fa74a3cf86ce4cda391a6741faea0ca1

            SHA1

            1d9fa23a5169430eecc1c18e4287f9e55aad8a0c

            SHA256

            8820c3d09c72446474ca59f003485bc53052af7a2b7047f2a2aa076e373ce326

            SHA512

            8bf662965afb7418b6a71324e38a6cb8223c7b5ecc1dfb83a277f1be0e92433a600b7ddd0d3393bbbe534c1bc4397651887ee0ca876c9cf0042672782adac332

          • /data/data/com.esbook.reader/databases/techain_d.db-wal
            Filesize

            68KB

            MD5

            d650b47daca0433f74bd97a034cca5ac

            SHA1

            f6d622cf098f2327bd38a8310a935b83ad82d94b

            SHA256

            2ca90228f4c21989c732f69ede7558f8d3dcf94e0dd8bbcdb3834a05eb217764

            SHA512

            6402002ec3e77a26bc098a3570d1a509a5715971a7034669af49d2b0f8fc99f387f95a3e13b773e5860d512866b73753488e5a0189b1168a83bc206d09f246e8

          • /data/data/com.esbook.reader/databases/u.dbv5
            Filesize

            52KB

            MD5

            6f65be7054d5c6b04f623205dcca67b3

            SHA1

            0443fd4b0d0ebe5bb82ec5b692bf1e21a40e09c5

            SHA256

            e590b3cc477db0878f57377c72015120554bc5048d033b818ee53505fb2be7c0

            SHA512

            b733f6556ad37d44f27c108a9291969a2376965db7ef77d8496c4767b327e59fddd5e11ae605b00ced82e99f1a509f80620bdf7ed9af48768e7c4682ef72ff7f

          • /data/data/com.esbook.reader/databases/u.dbv5-journal
            Filesize

            512B

            MD5

            018eb2c4a76afb805804a129747ac72c

            SHA1

            7986d20190be10ad066b250cf2b6ea352b5300bb

            SHA256

            6fc2118ef6ea929d276a7a47054220629da5eab671a930e6c4d2de7f2366bad3

            SHA512

            c94e4200396b61c6cd177c772c4f5fa6982164ab200d0cbd161aadb4f185319e0b78dfb55a4baba8edd4100d9ab6ff4213aca0b6b089ad3d89465041ea4f0f7b

          • /data/data/com.esbook.reader/databases/u.dbv5-wal
            Filesize

            72KB

            MD5

            d81b0d1afe54329a54b0db5f43c88dee

            SHA1

            000033609a10c00ea714a9c2e6c5b967163f1860

            SHA256

            e5346f73719bd23a2c630df2613a5f83082629c8cc5c12313cb024bdcad06924

            SHA512

            457cb7af8aa24ec6a99db4938510b82fdba2e8d870c769e8de7a04784fdaa10d8ddaeb12751e3826959573eaa7539227ed7efa085fb7c3f51ab9e1116ca588c2

          • /data/data/com.esbook.reader/files/.jglogs/.jg.ac
            Filesize

            40B

            MD5

            42978adc5a0eb1a561891cfbb16938e8

            SHA1

            ad2e6b2c8480f18720ef4e598edddd0a383e05cd

            SHA256

            79922c09f27cfca7138e0e628392038d58809ed33700c01681172b3a92d1d7cf

            SHA512

            f9e87dadfeb956ff5755ea741afd72d8bb3ba9e559c8b417408248586df0006c5901c2046d8a95d85db625ef297287b282140cf4c661b851da30633269ee5123

          • /data/data/com.esbook.reader/files/.jglogs/.jg.ac
            Filesize

            40B

            MD5

            4070f23ad271aacdc37e31d67e98ef43

            SHA1

            e9f7c4b765a5356846535e43f9a7c5bbd599881e

            SHA256

            22ccf0117497fb2b57af231f230fbe5989fbc5e7c7930366ac9fb451069789cd

            SHA512

            0c855b92162174555941878996b72d0eac5a1a1e0abbe056b5a3f5b5a40130650969063e7f482386adbc9d5dbe5ab114088ea24cb28af8fbc9d478f1fe470225

          • /data/data/com.esbook.reader/files/.jglogs/.jg.di
            Filesize

            340B

            MD5

            eb1795952dffd773b179777a0af4a9d6

            SHA1

            9234715e0d25f0331e8da7cf6f76fdfc34056e76

            SHA256

            ae649026f452867d665110a25c0184496167ffba538bdff085bd557d5d81b715

            SHA512

            b8ab74617b16d3a59974bdb5a17a31325bedf0171d34958736133c843006df3a90b3ea40a188b56647144a1807ab09c7cace977554af13001f8c3e0da2e25644

          • /data/data/com.esbook.reader/files/.jglogs/.jg.di
            Filesize

            340B

            MD5

            cc9b4ee585d87fe188f9d994cecf567f

            SHA1

            70226d682811c29cae69aa6e624e2a31a1447656

            SHA256

            7d5a89f7d64a80ec6e4268a965a357b9fe5258ba001c5766c2e2ce9d80a44549

            SHA512

            c8552844bb496ef656be0b3acb822627d8f0e9a334dcccef2e9249597bafc4359a828ebdcf1b59e565e16e208cbefd58200bedb7e97f75788a1b14c0ce4521f2

          • /data/data/com.esbook.reader/files/.jglogs/.jg.ic
            Filesize

            40B

            MD5

            9120aa0777d5de29f1dc2dc1af12938c

            SHA1

            077378eb40e9ff7e10cc515c9fdd00eb39bf9cf1

            SHA256

            db4bffb7027b5d958983d3ebaa16d3bc71f35b74eb84d8f9f982805f706de4f6

            SHA512

            7030c3269e6bfc5821c005462e09df2f13ad3281dd483f5210b16625b1e69672ca64b477e8b79ec76b178fe11830caf6107d781a0cc0c766a7ac28acafd6b639

          • /data/data/com.esbook.reader/files/.jglogs/.jg.rd
            Filesize

            73B

            MD5

            ba6690c32808f3e8a9150ec9494a2948

            SHA1

            ecde8d2a63e743e741e59baf0a978e017ab2e7a7

            SHA256

            70adf54c69a2b3ee7267aa1496e892cf3f7ad6359d44aadc203ad41eec545f00

            SHA512

            112c1b6c417221a11a7ab2530dbf4f816f5579e5e8f185494982185f64632b78d95a837598ff5f61ddfe9aafa0b0e27ab89ebf2fbbede2324931ac105d33cde2

          • /data/data/com.esbook.reader/files/.jglogs/.jg.ri
            Filesize

            314B

            MD5

            5bd2b2ecaa9b6de4772f711d1b4202d5

            SHA1

            bc5c7eac348bdc6097ec3ee5078fe8158e913f3a

            SHA256

            6b0167b77138c0be8472571a84d8b17c9f3a24e5a6dbd072c25535199f3873df

            SHA512

            19c79c12a962999953f728b6a41259f42f1546cdcadee5b0f0b2f09cac417408216b7cb94b2e4d2c0d56320ac50d9a69cef52904d7277b61ab50eb6eccc2a69b

          • /data/data/com.esbook.reader/files/.jglogs/.jg.store
            Filesize

            127B

            MD5

            138fd377fc6ced599d2be26fa772ee46

            SHA1

            2b7dc8e6175f5e6000968265c17b988a00a0d838

            SHA256

            25623b856a634a48c1df3f074743b7b5b625867d42bbb9dac59f6248b87576ea

            SHA512

            2b99ada8408e8fe69131369ce27453b118bcc73c13c4603735fee4107f79c2695b7e03e5e8d4c99cd4a804ebe21d478a2868771c5eb905e72a5c7a66567ef333

          • /data/data/com.esbook.reader/files/.jglogs/.jg.store
            Filesize

            32B

            MD5

            448e391c59eef34ee1defbe4dee4c41f

            SHA1

            df1f890987371d7d8e6963c68b787856e42bc146

            SHA256

            55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549

            SHA512

            ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

          • /data/data/com.esbook.reader/files/.jiagu.lock
            Filesize

            27B

            MD5

            dacdacbb05293875b95723c9f0ec78e6

            SHA1

            60f2febbd8bdcec2b6fcc13a1efcb791e3d1a9da

            SHA256

            e5d05f182064d1055de3bd3816e68c7bdff7d777d9072fa2e9e6cbdf721bd719

            SHA512

            c9c988893c144e26c79ffd4ebc4d3f93430981ee7d521f3dca9976c2ab985b6e4461f3952c5fc206d9ad531207ab64ea35b4a2f745b7f08358430d81ee5fee72

          • /data/data/com.esbook.reader/files/__local_ap_info_cache.json
            Filesize

            2B

            MD5

            d751713988987e9331980363e24189ce

            SHA1

            97d170e1550eee4afc0af065b78cda302a97674c

            SHA256

            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

            SHA512

            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

          • /data/data/com.esbook.reader/files/__local_last_session.json
            Filesize

            112B

            MD5

            bf9b03428e014bc066c76c146d8d3e58

            SHA1

            2f529c235fcf387ff8937db18c006c84cbd82d26

            SHA256

            1420623de679dfc8a69cf25cd1d809f940db14197d389cffabf7bde40a0a940d

            SHA512

            afdc944b122e1d6cec0ea232be3a8e6a1cc9556f2e39d9ac46394f25365417ee10cf8d31061eecd563df46cff4493bee3d378ff96be091bb337eab4fe7b0fadd

          • /data/data/com.esbook.reader/files/__local_stat_cache.json
            Filesize

            508B

            MD5

            05c0cdd9babef8ef40d2b5bfa785c642

            SHA1

            e379490052284bf4df85bd9ce35cbcfb66cc9586

            SHA256

            4143a51efe4ca1b0b5d7999feb0410c6afdc60d5da6e472f024b2c4dc07d2a91

            SHA512

            e08c7ba752ac3a083b4d377a55562470c757d182842d66915a32c6fa9433d489e0a445b47ab5dc32ad9b5a5c07074d8b3e363af7e69b503d06b2e259cdd6ad22

          • /data/data/com.esbook.reader/files/__send_data_1716374341665
            Filesize

            544B

            MD5

            17506dfe911017bf0500b7482bb1af09

            SHA1

            d0b6b747287b6e85434710e6fa59957370d0480b

            SHA256

            920995cebdf05471e92f066ae690ec24c40b9763c1c9ed50c79d06c6a7b5b37a

            SHA512

            42010a1073d9361c23788b0a5d7035a7d85cf0b2c26aa59ee901dfe5ac82d9bfb75b65380ab39d5caa708a1a2f474097376e45f97e71bc2702747838250e206a

          • /data/data/com.esbook.reader/files/jpush_stat_cache.json
            Filesize

            119B

            MD5

            76ec2512a35780d30b30757899fc1155

            SHA1

            41ca1ed9fa5da57e0c649a983f6a2a3605b40028

            SHA256

            70151934e619c05865e03a1ada7033c1928431a408638808bad380ae1a3efef4

            SHA512

            b71bfa0c0b5df4204bf2034a5cf33a8da0f15e9d29ac0a9e327962644187381c982c4e3e642d234b7cc51b53cb28b361dac558c38a40d2c93a196ec850e30845

          • /data/data/com.esbook.reader/files/jpush_stat_history/active_user/nowrap/4df9915c-f47c-4128-80c0-fecdc307b0e6
            Filesize

            159B

            MD5

            3a24317cfc9136ff96018e3ea6093935

            SHA1

            3da99a9769e670014c340eb3e82cb2bb2144ef50

            SHA256

            5806385206455ca90c4dd5f6bb06fdc27aae25ed391d8c4520acf663105356e7

            SHA512

            8a411106303c6d2a359d14c8249ac1259f22fe31c24b3d44d642e901fc85ce19202ff655243b19bc4b9dcf514dda713b86bb35ec8b0db7187d77326911dfe436

          • /data/data/com.esbook.reader/files/jpush_stat_history/normal/nowrap/933e4bc9-1c0b-464e-bbbe-d1b4e137eab6
            Filesize

            202B

            MD5

            848d3b99df0812bbb751f58727a31846

            SHA1

            5c3e81fba7b026b7bdfe9cf619031217bb88f688

            SHA256

            c653ef15ba8da5f46c2853907e32b27ab2497d86db9f6d43bb266a3e5603bb1b

            SHA512

            fbd1f5a039478f554f40be496ba094c21496c67126f4272f01f24f72584683735ca25b1ea09ca9e534e36d060339f9889640f3286cc85a631c1d2b03c1cacdad

          • /data/data/com.esbook.reader/files/user_log_0_78b9e_1716374469159
            Filesize

            454B

            MD5

            775f29a76e6f1186bef5e0821f1baa21

            SHA1

            12bcd8b053584815b724ab7e4558fdc35b2d1c0c

            SHA256

            e484ca8381ec8aca878b1021f683314962dadafd785d7cfb4daa481b27934c08

            SHA512

            58eff122d9a922da6ca4609fa030072d7bd2322c1d8a029be949beb875bb3c24a3d37d367b97fe7059f18f1d831e858fc13ee8503f22bcaad1eab33804d074b2

          • /storage/emulated/0/.zp/.icosc
            Filesize

            34B

            MD5

            c43fea3f986db45db475dad7e0f8b4f1

            SHA1

            a833fc94296644e25d2e4b680d5ae798118bc420

            SHA256

            27a0ac64e05ca96ea99414d79466da2a66f6e0f754f7360447b79a5288506743

            SHA512

            69727c7d4eebbc87701b5455d8424dc1ec9d302b8a48ea8491e74291a51a3f6c811aa687c34ddd77214908f8e388716ee6d6284685102d87b913db87a612a36c

          • /storage/emulated/0/360/.deviceId
            Filesize

            48B

            MD5

            1d8d16c4e3b19ebf18988530d9b9a757

            SHA1

            bc94c1cce05cd848a53271ecb9c5311e27ffebf5

            SHA256

            abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

            SHA512

            4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

          • /storage/emulated/0/360/.iddata
            Filesize

            32B

            MD5

            74d1eaf17209eb59e6750398fdd54e05

            SHA1

            427489b4dd2a854326e9059666c2d316c390e444

            SHA256

            c02d3d42c275418400c8eee369d8ca57937d430248b3179af4b026a59e972d91

            SHA512

            d59d75ac552e7574975edc62de73d3bd0003acc1ea08d52c1e2dde5369bc3895710ad02814d33049ecf06b05e066f61e0bef688156ec801fd7da6b3aaae5c51d

          • /storage/emulated/0/backups/.SystemConfig/.cuid2
            Filesize

            129B

            MD5

            3d54e3eee1b38d69a60bdaa07996d7e6

            SHA1

            0023c6cffe4818f9e4e2aae831d3ccb1f08f00a2

            SHA256

            c7457c35a7cc570df0751fedb3416605174d92acd4b211e142556d30feee3df6

            SHA512

            832f9095a3e1edd0553642d9e20c9a8a5e2db90ca07457d82b7964e23204ae1678374dc885b3de34d1664fd1902f7a9d805e8c5ed8c4b3f7d2cbd3ef031150c4

          • /storage/emulated/0/backups/system/.confd
            Filesize

            20KB

            MD5

            048c73f536f234f0ad0d2fa8bdbda899

            SHA1

            dba2e666721e0b0988807b8bb3ce0452dad3448c

            SHA256

            f1a64586ce75e770e2f36a7ef6f7419e26ebb9e9e786df3c5adce50a196d2d07

            SHA512

            6ae398c682724f0008ce47cfc790a7ad3dd7cc801fb3a8a692d28da5533ea7ed830ea36933bd3e3219fc8cbade90f073c2c418611921bc7d6877d94b6745c4f0

          • /storage/emulated/0/backups/system/.confd
            Filesize

            24KB

            MD5

            20b4c5a4e7944c6575524b67929456e8

            SHA1

            8c00624e72d53734b11bbd36d92523e4d80ed5b1

            SHA256

            269e0fdb977c639320baa5a0f88db814d17c1058fe5aaffdfb723764e5029f69

            SHA512

            c4d54bdd070a8c6b8e8be330700b75c278cbebe6f2325337dbd958b2604b81f9d23e27a537352abf1c628e35a88818efa0c37b6b796b16619754db62f9481cfa

          • /storage/emulated/0/backups/system/.confd
            Filesize

            24KB

            MD5

            cee6a50d3ca88abb98fce887af094f8a

            SHA1

            30dd54544effb63357ba159a87ff8b1b7d3c91de

            SHA256

            6bf3a1592b18a3f88b8440fe1b09625a70deebf6df5ff4b4c2d732fda0b0c34d

            SHA512

            ce2c7d382e6d7aba0260788a935e80f26fbeb586f05f7dd9a1039488ad1a217ce1de544922c16c22b80904fa47296651f22f2f2703d1c5c96eeeaaabfe90a656

          • /storage/emulated/0/backups/system/.confd
            Filesize

            28KB

            MD5

            41a730a44e0f46290136add470807850

            SHA1

            cb78ebce124e7a319be40c9bd98278eb785d60dd

            SHA256

            16eb10988b9a8dca5c1b42a74921fbdab6abe378b016e3c967ffaba43465e30e

            SHA512

            04e8e28e01a7b48e7579651e8cb840172b1c048bb2cd7b94a1713f5165a6f2ae7eb3367c61f648d5130b5831e15f93fb52fc6a43197f240e271259e6edcf038e

          • /storage/emulated/0/backups/system/.confd
            Filesize

            36KB

            MD5

            31d785c6dbbc10a618d754f35f71adf1

            SHA1

            f3466cfbbad3ecc1e8534032dd2fbe75ff330888

            SHA256

            7157a2cefed8b7ec084199457c3125882a55ae593c1cf44b69c7ec1a352ba13c

            SHA512

            d5f871caf4a591585866a2c3dcd79e9112821b28fa4804ceb12aadeaf8341e7a23863cbd299bcf6e86797bbd2f3f9635c0b71e9d07a5db581d5f6ee4bae276d5

          • /storage/emulated/0/backups/system/.confd-journal
            Filesize

            512B

            MD5

            c8e7ea5e4aafb9a093c50abbcadbabb7

            SHA1

            5aca174b6ae1a4753306c908ac1ffd52de4a5bc3

            SHA256

            efcf7a45fc348dc302bc20e8727b3cc283e6036d93fa43a143542158a3011f9c

            SHA512

            08fcf7f9a46033cd995d6feda081711c0801fe78cf00ed7f1482c47d0a4038401f3e6403995c3896f5078db909e477ae6f6534807da2801aaea65d9ee633404d

          • /storage/emulated/0/backups/system/.confd-wal
            Filesize

            36KB

            MD5

            1dad9d04d0486a935efabd3547cabaa6

            SHA1

            490acde90815805e825d9e7557900d67798d1464

            SHA256

            40667b23e3cac19ad3b2f1db7ba53a271003c18bbebea63e618ea0419128a9e6

            SHA512

            3d072f8b9f95694a8802903600ce2def99378af6273dd5e4f107648d1c814110359aa497c6fe282a9393e1991d2df3d4e51e168f40de180142d9ffc1102f0baf

          • /storage/emulated/0/backups/system/.confd-wal
            Filesize

            12KB

            MD5

            bd94d29b21a793c2b205619ae6c1d5e1

            SHA1

            43f2dd9bd33d805f5acc97ead8de78b42d2139fb

            SHA256

            3c3217770b279f225f3b7e8be4f17e3b99373a759b5725945d1b7636a3dcc422

            SHA512

            a834ec513db1e36afd525ef316be426ca1dc62c431185241b84e7876188c55a5c6d47d66baf32ca740b6de8fd9e039008f41e051bff87e814d171a90dd6fc678

          • /storage/emulated/0/backups/system/.confd-wal
            Filesize

            8KB

            MD5

            f3fd829ad90aafab34b9e548feb4323f

            SHA1

            5ac97ff0d46d8e8b761637c7082fedd94f28e724

            SHA256

            3c3bf656d064067b702898c7cc785f1a9a25fa0ff4f516c8dea413b698392b43

            SHA512

            f8d871cf2896c083571e2c9a5f3f0fd4b16ad23c7731d46c21149a2d831b282275a42bf5489f23749c3065b8217e5b71e07ccca12112a2a8da5a73848b590d25

          • /storage/emulated/0/backups/system/.confd-wal
            Filesize

            20KB

            MD5

            1dbdee15201f6d1cc86726b43a733117

            SHA1

            6070fe4abd04d722a758dbea18e3474ac0da8334

            SHA256

            c6b967a765c304827cf8e15d37ff7b21b72c03ab10379d73571f352d26c9d465

            SHA512

            f731496e24dd247493db473e561781d101c316387e58c1b72a611c67598265ad9a04cf425b5c48c9a926e51c68f894aaf8c0be98f3b22d594ef31efed55a9529

          • /storage/emulated/0/backups/system/.confd-wal
            Filesize

            20KB

            MD5

            8a5157df06b2566228201c2ee6114bfb

            SHA1

            0991fbc53ebe893dd0edb13da439408fdce9c134

            SHA256

            aab2428ef8eba705497c1a1260ac7db7052b01f0a0d23b84cb788608940f080b

            SHA512

            01ffb6f964784915d2ddea6f697868d58b52f3a06cbd908473645d0132533a9ad304db8e19246bb9e1c56068e9c35ea56513ddbe668771db832481da74621115

          • /storage/emulated/0/backups/system/.confd-wal
            Filesize

            8KB

            MD5

            3bfd2522a5076ceeb2cb3fb541ae7d10

            SHA1

            1c53f14f2d5370c734f26b3098ee33b1ab63bf58

            SHA256

            e3f232a8d20a5f285cc55be2c5ab6acd1c836a4639f39555d9e645b92c410416

            SHA512

            907b2ba01fef143d1e511bd4a70117fe1a29404ed2ce8226c8da9b2499e386103e36d9efb679350986dfc663f6ff042d1e9781eee6efdcd203e8ab9b61d46e84

          • /storage/emulated/0/backups/system/.confd-wal
            Filesize

            20KB

            MD5

            9594628d1a6795acaac1ed9b2d29608b

            SHA1

            1eb601e5c9f7e9b85d1d49829c3a90b7c4639750

            SHA256

            7ba1374a9809db9138946043cc8de0f5907219d159c7441f1539d9332e77c3e0

            SHA512

            2061930d2b745378f98258f99fdc75cc110cad340b798482c66706b44e871faa3c25accb5c429518541c73384fd5ca8775cdbd486aa3d148f4111bf0350bb659

          • /storage/emulated/0/backups/system/.confd-wal
            Filesize

            8KB

            MD5

            5060d814f268e190d95e410f50603d9c

            SHA1

            10914143d663168c50f28ce0e672956d121e794a

            SHA256

            1f3e097c3d207fb47c0d1284c2aa9bf8d676dfa701af5a1c2377f296089708c1

            SHA512

            4a74b5c1db0200cc4d4ff0534098e50f0776b99c69b6627e964f115dd26d7493293ee9ef8761eb0cafb4376581ae1dfa082eacc1d18bb048cd73a5a5e4057a63

          • /storage/emulated/0/backups/system/.timestamp
            Filesize

            25B

            MD5

            29ad9accfa92319e2c2451cce4c4c368

            SHA1

            88bcd314de273ddbb3a2fcaa46c2bade6c662f08

            SHA256

            b5a342d06ab0526d700531627e52ad92b9ab031e4fd9ec71af45b91b0bd769ba

            SHA512

            5ec0b92f130553fcfaaf58245c67d4035b71dc45e79fff3551b971bd0b6d082a78d760f400ab0f1e41e213eef37280e8af0ba99aa3b3939fa8ffb2ef6e53dec4

          • /storage/emulated/0/backups/system/.timestamp
            Filesize

            55B

            MD5

            0b3910f6ee68d8343221d5c4a48e6f4b

            SHA1

            95c340ceee9f92fdb894d8660234ca74ef7087bc

            SHA256

            01ebb9661447941e8776947462cf1e37f05c23c390be0e957b5eeef3238914bd

            SHA512

            bbed7e4b837a9b38ebcc18946de1f485bcd5d163e457273c5831b846678386c5ec64e5564773df56ccff86431afac489a0413b6f7a8566cdc82c42ccc3136186

          • /storage/emulated/0/backups/system/.timestamp
            Filesize

            84B

            MD5

            71d4e5a649699fb12668a47190b43583

            SHA1

            9ee1bccbb4b391311fe3a7cf11fc8286e67f1b69

            SHA256

            09c4a0fbdedaefc63a017a66897bc3809ecbf4d0234ac4d4b44490daf6978096

            SHA512

            d7b7c2cf709b4f9cdc2f7de9be5f8411262cd4d852f1e37c118cc1872ff235b4cedd1cf79e59a3c767c118e3b3d416d2fc453bb8f5a6e08e4809119b47af28d6

          • /storage/emulated/0/backups/system/.timestamp
            Filesize

            114B

            MD5

            ba4dc9ee85220d205c9518b31d730c60

            SHA1

            fff1c6172cd326217931ad8de75323ddec8eb8ec

            SHA256

            e6b4546d4de0a560d4f0b0e4928811ad56dd058f2fc86784faae034e94b481f9

            SHA512

            de8a2a788f9530b518cc09aa66eb173bb44be543c3de0f1b388bfef31b8e4ea88e1c67589c03f5efaf03d3025178af0901dcfdeccd6a697dcdbf49581b873f2c

          • /storage/emulated/0/backups/system/.timestamp
            Filesize

            138B

            MD5

            14e7d46f906c10c28442cc3ed9e74a36

            SHA1

            b9908193e001e37093aebb8070b33f96b33342de

            SHA256

            999516bf4627c187ff28d37a6832726448b63e6fe8b1675502dc0470a99e1ba8

            SHA512

            698a7a4e1f5aec795914d6b0374961a8b75a30dbab6d0404a89f520855874178e27d5e49cdadc9be3fc3a7690d67627307e816ced42f3e02373d7fc9acba8e20

          • /storage/emulated/0/data/.push_deviceid
            Filesize

            32B

            MD5

            8fa8e9b019bca06f4c28f48f9eb70c45

            SHA1

            76ea721aaeade9062b60a8288b460ae8d1979c80

            SHA256

            b0975732bf931ab4bf96b7781bf2e918e38b41190becba00d1ec008dc4af84d9

            SHA512

            c699f9bdd994277fa15d1323dcf4615ac87ab8eac4e1f975ea8761cc0afef0ebaabccb985bbb9662b358d2df179f7c8ab0730f17fe471b27bd311951882dc4dd

          • /storage/emulated/0/easou_book/cache/alipay_msp.apk
            Filesize

            748KB

            MD5

            d06ea38e4210a87d6b96f8b0491df677

            SHA1

            3ba573396398757088e559a9d372049a377eb05a

            SHA256

            76a24f83ad15586ff9a2081e420a707be9ddb0b5047e5b6de5974c41624ff2c1

            SHA512

            3d43e5bfad2b703a804a53048b6a88228a11fb80ac641d6594f774cc07f6c7367e0ee80b29966d02c9206542f467f55b0f1ddbbfef0ec372256314a7d1071f30