Analysis

  • max time kernel
    176s
  • max time network
    182s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    22-05-2024 14:27

General

  • Target

    6792f5413c7f5be270f6d9e1c1a06d9c_JaffaCakes118.apk

  • Size

    12.1MB

  • MD5

    6792f5413c7f5be270f6d9e1c1a06d9c

  • SHA1

    15dc21506ab8df5ca4936473d915d8e387e2b241

  • SHA256

    07ad7c183edb9938d9befc5c7065775e96ff387ceefd5de0d7e293557e7c4e5e

  • SHA512

    80e8067e1205973c73eb172118946ae72c1068983a7de72cdbef5f4d6207751e483c568d79d83988b8885a27959fcbf9f29d61f58668ece14785cb3cb42f0f64

  • SSDEEP

    196608:J3M12CxWlT8gUUTBgYmLS3iV8bpe/0/UCllVjcbPUOaZ4nYav3XA/HtF4:J3MkWcIgxe5Vb/0sU3OrYavAlF4

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 9 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests dangerous framework permissions 6 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.qbmfkdxs.reader
    1⤵
    • Checks Android system properties for emulator presence.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4289
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.qbmfkdxs.reader/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.qbmfkdxs.reader/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4322
    • sh -c ps
      2⤵
        PID:4634
      • ps
        2⤵
          PID:4634
        • cat /sys/class/net/wlan0/address
          2⤵
            PID:4755
        • com.qbmfkdxs.reader:GuardService
          1⤵
          • Loads dropped Dex/Jar
          • Queries information about running processes on the device
          • Registers a broadcast receiver at runtime (usually for listening for system events)
          • Checks if the internet connection is available
          PID:4366

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.qbmfkdxs.reader/.jiagu/classes.dex
          Filesize

          6.2MB

          MD5

          f424737b943e421503c0b5e2bcd695bc

          SHA1

          0546f13c07c173b2a54c13523332cc2b2984ca44

          SHA256

          41ca8e3d2559eed7b936154970e13c2d9729b9ff2a86e8dc17d7372ad84fcca4

          SHA512

          44f936c5e9a11062a4192ef50da57d99c53047ba6ed6dfe73765f679ef8e1142f3137a4f43f2481d0f52db54c70e94593932b4bd1808d153345e935517840ed3

        • /data/data/com.qbmfkdxs.reader/.jiagu/classes.dex!classes2.dex
          Filesize

          4.9MB

          MD5

          a23704f6c2dfbdd280c4039cf36954e1

          SHA1

          35973c957b36e0526bfe1ceb8df3ee92853a5812

          SHA256

          d4034e009f172cb4c84eb5dff906a9fb370d2e02641b658d5579e28dda1928c5

          SHA512

          c4ae898dc83a14f1b85e3d21e085b03e48ed0f2029c12fc08ce5209b79f6fce93857e110a2be834d64213723614f45d68f927acfd123ebc902919a885b6d1318

        • /data/data/com.qbmfkdxs.reader/.jiagu/libjiagu.so
          Filesize

          482KB

          MD5

          f380717bd1e3916c7b697fab8d46c5d8

          SHA1

          04f51f0d16097214e38be517d93be44cb0603a88

          SHA256

          8455632be7bacb221468c4daab2f9b5ee33739f08b22244ff81a36a02bec36cc

          SHA512

          b78fe11f77d2c0ec5b36850e8cc3b955661b31641405233c8842b91205e44dc16a30d7fc1ef18dde1b066c1b98959ae9c18be5472413d2b398b7ab6a6b52c07e

        • /data/data/com.qbmfkdxs.reader/.jiagu/tmp.dex
          Filesize

          284B

          MD5

          f1771b68f5f9b168b79ff59ae2daabe4

          SHA1

          0df6a835559f5c99670214a12700e7d8c28e5a42

          SHA256

          9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

          SHA512

          dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

        • /data/data/com.qbmfkdxs.reader/databases/btechainh.db
          Filesize

          4KB

          MD5

          f2b4b0190b9f384ca885f0c8c9b14700

          SHA1

          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

          SHA256

          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

          SHA512

          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

        • /data/data/com.qbmfkdxs.reader/databases/btechainh.db-journal
          Filesize

          512B

          MD5

          2f36724d09f930810d72992e69838bea

          SHA1

          9aac27dd27825f98a67ea20242742a57b87489d6

          SHA256

          8cc1c83382d543c3e95f0f0ef8b5cf23c6b03a79bc523ad6b2c9578e4317705e

          SHA512

          a0eb67fd78da8c8830fd62f64e5cf3c8c77dc46fa70776e51dc70050f8bdb076d4d7461fb87e764b534211803041ec0ccadd932a4cf321d4d42afc32fe5fbd75

        • /data/data/com.qbmfkdxs.reader/databases/btechainh.db-wal
          Filesize

          32KB

          MD5

          a7d5824f867865767a5290c3a8536ce0

          SHA1

          a49efe98bcc8aee2e919fc4692a58948fbbe6b24

          SHA256

          fd8de6b87a6878d6aad55b961636cdc68714010990e7a9805c44f9060640bf35

          SHA512

          e0eb94ac52341a70803e29760696987218b788c19c130348e00b212a641c3a6a2ea197cb9eeb4f504b13ce515dfbfc551aa09f8c4ec346deefa63f287a22c8fa

        • /data/data/com.qbmfkdxs.reader/databases/easouBook.db
          Filesize

          36KB

          MD5

          ed5a7a63b573eae86d0b77e60a263626

          SHA1

          18fcd8d46d0d1ed2aaf402b8fe6b3e949f4aee4a

          SHA256

          574b34f8bd3f8fe2b2e1ce4f7dbc3f04e0ec96404bc9d64e236188d897ca77a7

          SHA512

          ae02380483581e44886b3a250c4a0718dfc73ed3922f1afe494cfd16b735b1e0a8e594fcc791d08175f9292dea1f0249face83807c5de3b13d2aace6ee6a6a79

        • /data/data/com.qbmfkdxs.reader/databases/easouBook.db-journal
          Filesize

          512B

          MD5

          a3d8b04b805863ee95f06f48fa14756e

          SHA1

          b4027365fa3eb8f164c963edb1ee6344e57167cc

          SHA256

          e8a10080c09eb76a77d51d4899e00076a19a6049d23f686bfa14a1f80993d5c4

          SHA512

          0c62138a17f7dd5da82d46507231cc9da9a015562c4a6afbd786d5983205a79f48128742d834898b9585edb42bb39f9dcc55cc4437f5a4396af04fdbca342e0a

        • /data/data/com.qbmfkdxs.reader/databases/easouBook.db-shm
          Filesize

          32KB

          MD5

          bb7df04e1b0a2570657527a7e108ae23

          SHA1

          5188431849b4613152fd7bdba6a3ff0a4fd6424b

          SHA256

          c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

          SHA512

          768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

        • /data/data/com.qbmfkdxs.reader/databases/easouBook.db-wal
          Filesize

          48KB

          MD5

          61f72ffa4fe02cfb2d84410996fa56b1

          SHA1

          8c1bc850664d5ba64f51b7beadae1f78d8b90ec8

          SHA256

          687574e997bf7b1253fb3cbaeeb1b05cdfb1212379ec97e83039dd60c109d4d5

          SHA512

          8d153652c16598bf5f1ada592f9466a3922c76fa2ef55476b1850c042b74b3c7c89fceec9ca4d6894f5f3553ee397bf4ebc0d1328d114f69ddf9df72f775c242

        • /data/data/com.qbmfkdxs.reader/databases/es.db
          Filesize

          20KB

          MD5

          ea3aa6fb8d9973497ece1f2cb4bb7878

          SHA1

          a0578081d82c1e833a8d73d0ba90372cdfc7ac4f

          SHA256

          61d50595229cf66b791bbcc066ab175098f745c66700361957c8b974a194789f

          SHA512

          587da63d14dd7a4ce3992d92e2774d1b4e5e207bb4f51d095f1030d863a029e60ffcc6add7ed320291f009e75bd13334fbb075f3aa5352c5ba46cddf57fba315

        • /data/data/com.qbmfkdxs.reader/databases/es.db-journal
          Filesize

          512B

          MD5

          d60e0c1a4da3f5283a54971572321260

          SHA1

          b60edc2033d8784b4f5ac3a32894e6694a7223ac

          SHA256

          eca6d41e29be85c773fff1d0cc8d12f85c9909127bc125d3b0c7a30149a7a741

          SHA512

          9d6541854b773b87a2ab86d220b887c0bc559a9a9c1f4f8659144798d8d3e825e88c3860743dd8bc96c5e3cfb7a3cb6dc0cb2f498b08d09c4c473029a2a20d2c

        • /data/data/com.qbmfkdxs.reader/databases/es.db-wal
          Filesize

          32KB

          MD5

          42ce7c277d3e4ce9c9c08af7ba88bb01

          SHA1

          8fcfd752a2126539354417b5bc1f49c446cd19d1

          SHA256

          339cee46cf370b3b48c962a42473e503bbd2a2c9aff4e1138d86082047d211e1

          SHA512

          02c1bc108e4301c3a10b73347c5da12882045b7a6d0a57ededbf5910b9feee76b5e63106874619f8dbc971be91e38d9074bcb546810d38d5b3f0c183e5686a40

        • /data/data/com.qbmfkdxs.reader/databases/eventInfo.db
          Filesize

          20KB

          MD5

          772112fe048c0dcccd1440ad546190f7

          SHA1

          250048d8810962caadd0d63c3d082e8d60082952

          SHA256

          83907449b9ca5958181a1d17b7c59f0569cc9bf5877714dfd0707f789cef1a38

          SHA512

          4be09e12933da1e369f8874edd601a86c722ee944bd5f85a628d3867f7162921b1f28b1ceec27b249ed27fb942fb00fdeccb2e0cbb416433217e86c21deda967

        • /data/data/com.qbmfkdxs.reader/databases/eventInfo.db-journal
          Filesize

          512B

          MD5

          0571adceb5e8b7d01ea2df4a9f9ab0e4

          SHA1

          3e423ef0cd79cd54589aebbbf4336c774defa31f

          SHA256

          fd761712337f45868df86818d860040f7cb3d90149f7218bc395ff8b72d82a66

          SHA512

          756d6a12798b83ee9a02dc8429fc0f4be074acce68b5d3a2c18dc3f522514fc58e6ee4df76c0a7179ff1d326959e3a8e76046f1598e79584de4dcf7db97afd00

        • /data/data/com.qbmfkdxs.reader/databases/eventInfo.db-wal
          Filesize

          32KB

          MD5

          fe64494a56bcdf1aed81997e37bc6b4b

          SHA1

          0171727a45936f7e45dcd0e2d925e55bdef2758d

          SHA256

          92a4d64197102dc68bb0452427ee88ec67b7ea831ff122e62a867c2bf373fd8d

          SHA512

          0c84ca15016cdb153a9bcdb1b3ec8d461b0a8a847cf53343efef01a480583cadaef10e75be3d4ad04b446e840dadbd03fd74a89160e4adb29cecaf3f5ce5e661

        • /data/data/com.qbmfkdxs.reader/databases/local.db
          Filesize

          20KB

          MD5

          0886e1e4e9e13ad467fed5e6387bbc20

          SHA1

          a1ea02f457dfb31c0bd183092ab9ef53b860b848

          SHA256

          78d8f689718e894f087e56dffdf565f70587d96db83daf31e326698f4f463766

          SHA512

          d705041d9a8a7a8838330511bffc5d8523c5b0efa062d1f0034aa36887f7d34bb8d6270ee093fc03a274672dd961f70dd35e7d5cb2ae30c0414429b8ff837a14

        • /data/data/com.qbmfkdxs.reader/databases/local.db-journal
          Filesize

          512B

          MD5

          4f74ccf914653bd72809181acf4679c2

          SHA1

          4ad3dd9dab138d24276b085484c914527ee31b1d

          SHA256

          3c77dd7a6ce99660f59ba0c72bfa4cd3054668512aea9e42187a6a2cb03e2547

          SHA512

          96e4a55513d8a72a22a8ea51b005e343f7b7d3eb847e28d874bab262b8edb8d1685425eb1ee70d6f3e26dc659576988f0a6aea308ca9c3837f4f68d594508fa2

        • /data/data/com.qbmfkdxs.reader/databases/local.db-wal
          Filesize

          32KB

          MD5

          95d741ff951e64c7a4617fb0cc398432

          SHA1

          6142d5225b1d0cb30022f80a8906055a61726e32

          SHA256

          c195ec307a11e57aa2acc0efc65d7052d9af336ce2f92162025b489c84823a17

          SHA512

          6ffff27d95c960ecda427a0c109fe8f682c3f630f531ffab8013828cdeab406fabed4937d557e46805d65996dc4f5c41fb9f6a84fae306885d63bf54575c5ce5

        • /data/data/com.qbmfkdxs.reader/databases/localEasouBook.db
          Filesize

          24KB

          MD5

          a2803d106194a082003b0f5d7038f9cd

          SHA1

          3940a183cff3bd6365f1c9f46802c07c89033ddd

          SHA256

          999154a4ad6c28534b577705b3d26bae32cddafc4f2e599c164e549bd4c1a8dd

          SHA512

          ea73b2f9cad170d7766a83be81f10763f494262ff5efadeccffa128bc7e4f49a56cb109d6808b534155475637dcf328aa24f89a8943461afd5046215215e3076

        • /data/data/com.qbmfkdxs.reader/databases/localEasouBook.db-journal
          Filesize

          512B

          MD5

          f1471a6631f405068ed94a5d42a3ac97

          SHA1

          dab3ace26b0d7043a5a8452d21822981dc4ded08

          SHA256

          39cbb5d9274ce3f8584a781eed04aaa0f773f6e47659288c7374ea9076c7d57a

          SHA512

          e80993657652b00e6f61a6e3262e5a50b7b2924085cc6916dc40aa1dd97ef94ff54aac4ac836968b0f478046f967dc30bc11ff791c0fa87fe7a03ed2b6ad97a5

        • /data/data/com.qbmfkdxs.reader/databases/localEasouBook.db-wal
          Filesize

          36KB

          MD5

          fd653ca12a31c7d97f1acbc1f1c19205

          SHA1

          dfd956d7bad34b4c3412b613390d8476ee0c0a4c

          SHA256

          2d5d8f436e596f991785d44c373235aa783269b45dd1533f4764fa2d279d0c5f

          SHA512

          4b518cbf372d50c5476731d41911a7fa8b3624af411a95d115dc4d9b8722d0e766b2316fee47211e870e90f0f908eaf7023b15ffb24963f836a0f8fc2cb1a872

        • /data/data/com.qbmfkdxs.reader/databases/techain_d.db-journal
          Filesize

          512B

          MD5

          8a15094da4b745c00e751b3cc60ed883

          SHA1

          9a33003939ad3102c00d2279816d14b1a56056e9

          SHA256

          831be3ebe5a662a1ae4d9efb110d29df717e53e71a8ef0d62c130ab9cdf5f703

          SHA512

          7e4f30f887736efd81101ef119e1e6682b3b8498959fdaf34a1ef08526d75e50ad14fe5095b34e0a6a870b89bb1774b84c0f587a7803830d426cd427cc9d1ed7

        • /data/data/com.qbmfkdxs.reader/databases/techain_d.db-wal
          Filesize

          68KB

          MD5

          ca658babc20f7ea14e0dd3714adc23b7

          SHA1

          4715be8a8224e3707d39196fa4c5f515ef22d49e

          SHA256

          5eba6f123d418f6c735eb53bf834314977a68dbafbcbc120ef56081476b9842c

          SHA512

          d1398a4770ab5565d3b14a3aa69e83e874893a81040c837b28fe43d3a17f5efbf65262f4805d34be3a4f734c27ef8808b168cfc7fe03bd96a6db2a010e78ba99

        • /data/data/com.qbmfkdxs.reader/databases/u.dbv5
          Filesize

          56KB

          MD5

          052408af514797857cd8b4857fe26e83

          SHA1

          cfce54700884e7988f58b1027c9789a909acf2f9

          SHA256

          7b844e801b9b3cde731dbe905579b79e8239399ab57a0812267e8254c925c4b0

          SHA512

          3411cbed6c0cab77968fb569d257b07c0a2d6134b77c20fb392a8e560cb1455ab293d33714d90d60f677fd631e8827e21ddd549cc885c6059b8f8b3eb6acd04c

        • /data/data/com.qbmfkdxs.reader/databases/u.dbv5
          Filesize

          20KB

          MD5

          1b9699233938343af880a8e5e8ea6219

          SHA1

          b4b5731f34e884a5cee55291db3fce1f68c39f79

          SHA256

          889214219b04f6f365f9f341d9d19ab1fff0a716bd515b6af284dd0de92b0c13

          SHA512

          841e51a3d701c767f45af1c6172e567b8c745075f2de90c5fac29a661e88b1471e84227d1c3e3715d05664a46aba4bd246c23a101f8c50cc9bb0d192363bbece

        • /data/data/com.qbmfkdxs.reader/databases/u.dbv5-journal
          Filesize

          512B

          MD5

          3b7e7d9cdcad083cf2d7a86aedc62218

          SHA1

          e344ad98f849ce40c7e11b969e37f7e7b7af53d1

          SHA256

          9688f07fdaf1ee80f4538ae7722560db01a0b4fe20b053100577ea4a3b1bcc03

          SHA512

          3a7b7d2a4e4f17aee097e9ac3a85a144b67640d9470129ae5f392c05608c4e2efca1411d66123730fbfab6bfacd14699963581c81392a9960170361dac4d0a31

        • /data/data/com.qbmfkdxs.reader/databases/u.dbv5-wal
          Filesize

          76KB

          MD5

          c03a4c0d810977427eac040b136c2799

          SHA1

          b7dba5d2ee616a5ef16bf6e6ef81c97b7bf862ed

          SHA256

          af54b147522ed62702fd7c8d9813d75f4325f758c8706f20afea6c61c8ae0e9b

          SHA512

          97a992180795433a5ecdb1cff28e19fae84ab94b9a4c24510a7ab3b6e85b1a1f7d1dd9a1a7aa85c58a4608e576ee0fb19fe82dd3fb3e0c784c1d650cc94c8912

        • /data/data/com.qbmfkdxs.reader/databases/u.dbv5-wal
          Filesize

          8KB

          MD5

          5f516aeb5ff90833add02613c1a51335

          SHA1

          fe2a3b6964009384e86b29448631be2440df646b

          SHA256

          b85d2566ba3ea37943001d2c4be923e67016720c5e7289007ce2bf2cc8926413

          SHA512

          778ccaeb796ff75086311f4667cb358de0a2f0c89186001cb4787c293ec20f7b94bfb9e84289f5f0954e8925e302966365b60b7c1178bd0eeb71ab7767ff9e65

        • /data/data/com.qbmfkdxs.reader/files/.jglogs/.jg.ac
          Filesize

          40B

          MD5

          9796230336f6fa2d70f7941beeb33567

          SHA1

          29feb3d48e04074f8a37599387902d3cc710c344

          SHA256

          81c8af7fa10ddfca031216462a434672040bd9a8164409847b7925685ad3cba0

          SHA512

          23fd256e3ecbb10902d5be4572fc22d8ac1a2c390355468c6c86a9fc7783be4467699f2c6c02accfee6020422815f8b922bc811ed0fb3d79cf08588c6af2897c

        • /data/data/com.qbmfkdxs.reader/files/.jglogs/.jg.ac
          Filesize

          40B

          MD5

          1593100f410a3dbe3f36e55afe90f9bb

          SHA1

          826ffe8dfc9bb32176a6394624dd5ebe555b1daf

          SHA256

          e03be6bbdc79049d9e3db25f5b19c88f2693ce6fcfc0bd21aa3fafc6ceae0abf

          SHA512

          5c372b32db79237252f340688bcb7e008cfbdaffa4cacf264e1dca77d594e25c15e478d7a24f4e1aae12041d9acebaef4e6be57d36dfca61e8b0e75ed1095cfa

        • /data/data/com.qbmfkdxs.reader/files/.jglogs/.jg.di
          Filesize

          340B

          MD5

          a471bab2a168d8b962752b0837d9c581

          SHA1

          eb8b22e841e89612ff2f9656dff020717c86fcd4

          SHA256

          cd86fb778f97197f384caf268724a5b75fe91544be2baec63bfb1b376a2496b4

          SHA512

          462b0222c188495328a9ef352137edf49099ea6b47ff375a0d0165cddb3517983ec742b8828c0af94b14d5f4bbf0020b4692b01352ba6060f5ed067fc0315bfb

        • /data/data/com.qbmfkdxs.reader/files/.jglogs/.jg.di
          Filesize

          340B

          MD5

          0f5a365215382537c0735424a1121393

          SHA1

          1cfe30f3bc89c29cfc380e25b15215c116ee81ae

          SHA256

          55a11737f11465bee6953dc385a9cb9d5123f16553c3dcdc1bc709ee834de843

          SHA512

          7c6dded21a6448509341d00938970b059b577229141c39db0a11cd21e2c7254699ffd670c59c130457dfaebdd736f80f0aba6cd71768b5ad377ec8b75085e5fc

        • /data/data/com.qbmfkdxs.reader/files/.jglogs/.jg.ic
          Filesize

          40B

          MD5

          1d46b6d9920c2aed6b4df325743f857f

          SHA1

          14843aa39bc41ce569b2447a833324c8a100684d

          SHA256

          d33e6c68f5c226ca787922aa685f651831af511ed13dc67d8a1fbacff5da23a8

          SHA512

          9085fbdc181985e9972b5a1986095512cc9ea9f8c18efb438f0da91426920c130ae13f088c0af1019ba2938fa6b8fbbff0d00e2231c5e38c5edcca385b26282a

        • /data/data/com.qbmfkdxs.reader/files/.jglogs/.jg.rd
          Filesize

          73B

          MD5

          7f4befd88ba65dd703250f91db1ecdd4

          SHA1

          0841f17d8bc0d1b4223a6adbef266cfc9b0ae3ab

          SHA256

          ccb4e212641f01ccfcc3401c8e045f662f1e876856c9525d03fc189e6d2f76fc

          SHA512

          d76006bdfb64edec6e1454ca2df642dbd73212a6ef6d802a8476461872f98bf31fdeef941ec8dbc93debc3eaf540428104e7e7f66f2ee9ece838856c7dc87cee

        • /data/data/com.qbmfkdxs.reader/files/.jglogs/.jg.ri
          Filesize

          314B

          MD5

          9138266c70dbb62aee9e36c3d68f8846

          SHA1

          d2a65adac82d1efc8e4c5b2435d12e91b701212d

          SHA256

          71070b8dda3d10ceb9a64a08c0e2e969d79839e63ec7a67841c2bc0bd0beb8a8

          SHA512

          900822c5e1ec93560dcc8946a0a05dac8145e8dd7a1762f2e30a0b88b9285041cfeb5926cd808776fb99595cf762f3c3b169674dc31c350caad0d8141df69539

        • /data/data/com.qbmfkdxs.reader/files/.jglogs/.jg.store
          Filesize

          127B

          MD5

          9ed62b20167b4b9acb100b9d1e070f82

          SHA1

          d1a560bc538e2053d420fd6416ac2565f4219dc1

          SHA256

          f618ecd756b8a12aa4a7e2236381171762d7f916241abe82a0485f2a2ad83288

          SHA512

          a910a1bd04ceedd8ac9986b443e45af6546f1fd46a8443b4b29511b983c55a2362830aaca1dba2b9d7cd2f840c7741b9091ab202b0db0881146c4688dcc9b1bc

        • /data/data/com.qbmfkdxs.reader/files/.jglogs/.jg.store
          Filesize

          32B

          MD5

          448e391c59eef34ee1defbe4dee4c41f

          SHA1

          df1f890987371d7d8e6963c68b787856e42bc146

          SHA256

          55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549

          SHA512

          ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

        • /data/data/com.qbmfkdxs.reader/files/.jiagu.lock
          Filesize

          27B

          MD5

          dcfa2c057879dcd1b68ab083bfe2d39e

          SHA1

          5e47d063539f36504447ee2fb758a681afdc0439

          SHA256

          2c0797b3f8631e7678b6127d3f4d734cd0944913c966225a31fdbd8c6f20f8ab

          SHA512

          b768c57f9d1059af263f26cc65f9b1d777f5b7ecb403e2d2408be96e784d5b37c9fcf77367895a1d36317007a81006620391a188cc5fef2320036f1ee86878dc

        • /data/data/com.qbmfkdxs.reader/files/__local_ap_info_cache.json
          Filesize

          2B

          MD5

          d751713988987e9331980363e24189ce

          SHA1

          97d170e1550eee4afc0af065b78cda302a97674c

          SHA256

          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

          SHA512

          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

        • /data/data/com.qbmfkdxs.reader/files/__local_last_session.json
          Filesize

          130B

          MD5

          9b71a54f10297442f46edef7a9b2f941

          SHA1

          2aa3fe1a708f8de52cf1943f96042897024e6c96

          SHA256

          8b2e380d57a5e7bd348ae8cc40391871ecf6b491a8877ebd619e66dbba5a4b52

          SHA512

          5ffeb788be0b5090b194aef2e6181cedbee209e1722ca359b6c4cac1da2f89bb29700248c0d6287054947aac78e3bd32372f888ba79e3a831afc56c708b9d133

        • /data/data/com.qbmfkdxs.reader/files/__local_stat_cache.json
          Filesize

          511B

          MD5

          8ea33dd921a1872f813d184833671974

          SHA1

          0b9d3e8cd8b7bf77416b3014be5fe80a66330d07

          SHA256

          256eda8694747a5de4db7a37ab9f9949ea8e22d20c55003a6abbc99f14ba2b05

          SHA512

          e36218d6323f41654a344f6970c8c59b12375a977e150e2448db0bb801af16ece537499928a19215e33cdffd4295a34b0121269eb3808ee8da5abd49df153a36

        • /data/data/com.qbmfkdxs.reader/files/__send_data_1716388095892
          Filesize

          547B

          MD5

          34b0aa59e8c30eeafafdaf8e25090857

          SHA1

          15c9df7d39de54c3b2b6fe5341aa3f29ec10d4fc

          SHA256

          7ef1112f7504be8d35e829b5fb7f09bcddfea083779c0cc44924c29de77672d1

          SHA512

          204544a613d869a2d9d6ebe8e24514c9a94f973fdda5fa2874f5f3fd953bb0eb0c3ba0253befff8192f874395e5dd0450b86883627797b344b60b292c3fa5f1d

        • /data/data/com.qbmfkdxs.reader/files/jpush_stat_cache.json
          Filesize

          119B

          MD5

          1927daf7b604c497873c6786efb675f3

          SHA1

          a14c2b6708f1414830677005b68b86a4d21a92be

          SHA256

          808b2d1ac16e87e80745d06faa97cc04f6e562184d8bc1fcb9c37d18c874208b

          SHA512

          ebc97600e00ebe07a69b4845888a332a6dbecb70eeacb04dbef38da5b1d9bba4474ef2f37d4c65d7e18ea3abd457a57e069d2ce19e1f8ee88ecbb8d3f6c3e8ff

        • /data/data/com.qbmfkdxs.reader/files/jpush_stat_history/active_user/nowrap/e0581328-7897-4e70-8089-45fea2366224
          Filesize

          159B

          MD5

          b7dc92da994c57a520c639a7821552e8

          SHA1

          5db47691c90963eaa5705d6d27a399391bf28ec5

          SHA256

          28910267f75f282e5596cbd9d0eeab3cb7ddd64b4d622c583a97408c719d1106

          SHA512

          f2426cf42ae77cdcfd5f15a9e35324bef9948dcd314d146a001cc3bc8998d818076396376a9654b7e3b22f2096f969da56fe6084fb0217589be7b913c22f97d0

        • /data/data/com.qbmfkdxs.reader/files/jpush_stat_history/normal/nowrap/2eb8e39b-f593-467d-b087-de19ecc292ef
          Filesize

          202B

          MD5

          d759ec0638645a35200d81c1861f92b2

          SHA1

          7313b897e06cd30efb1252f9f07909fff2e668ed

          SHA256

          7557e9c4a5b0c32b593f99af3d8efa937075b69e1169636904fd763abbb41219

          SHA512

          caf21d95e1b03718c756139f6243f240680eacb78782e0497709bacca14f89f0090a28798a242f9c3de1f2fac2706a1a34975fe4c2859ea6ca96e5d2d9b738c5

        • /data/data/com.qbmfkdxs.reader/files/user_log_0_aaeb0_1716388224590
          Filesize

          464B

          MD5

          1e9c172b6cfc27765aabafa557e1465e

          SHA1

          6b0d336370e3f3e2842f67c66acecb96193dc94d

          SHA256

          eac87b7a7274803d98121d047145b947caeef6dafbb63e9377b6c8d1aab66fff

          SHA512

          43b6e3ea94520794910fe9b51f933178da4a529934d46b65742b68cc641d9c9a85296a47601f41d1f769dced2017ac8d57b51fb21844f86e479d1aaee56dbe9d

        • /storage/emulated/0/.zp/.icosc
          Filesize

          34B

          MD5

          c43fea3f986db45db475dad7e0f8b4f1

          SHA1

          a833fc94296644e25d2e4b680d5ae798118bc420

          SHA256

          27a0ac64e05ca96ea99414d79466da2a66f6e0f754f7360447b79a5288506743

          SHA512

          69727c7d4eebbc87701b5455d8424dc1ec9d302b8a48ea8491e74291a51a3f6c811aa687c34ddd77214908f8e388716ee6d6284685102d87b913db87a612a36c

        • /storage/emulated/0/360/.deviceId
          Filesize

          48B

          MD5

          1d8d16c4e3b19ebf18988530d9b9a757

          SHA1

          bc94c1cce05cd848a53271ecb9c5311e27ffebf5

          SHA256

          abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

          SHA512

          4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

        • /storage/emulated/0/360/.iddata
          Filesize

          32B

          MD5

          74d1eaf17209eb59e6750398fdd54e05

          SHA1

          427489b4dd2a854326e9059666c2d316c390e444

          SHA256

          c02d3d42c275418400c8eee369d8ca57937d430248b3179af4b026a59e972d91

          SHA512

          d59d75ac552e7574975edc62de73d3bd0003acc1ea08d52c1e2dde5369bc3895710ad02814d33049ecf06b05e066f61e0bef688156ec801fd7da6b3aaae5c51d

        • /storage/emulated/0/backups/.SystemConfig/.cuid2
          Filesize

          129B

          MD5

          3d54e3eee1b38d69a60bdaa07996d7e6

          SHA1

          0023c6cffe4818f9e4e2aae831d3ccb1f08f00a2

          SHA256

          c7457c35a7cc570df0751fedb3416605174d92acd4b211e142556d30feee3df6

          SHA512

          832f9095a3e1edd0553642d9e20c9a8a5e2db90ca07457d82b7964e23204ae1678374dc885b3de34d1664fd1902f7a9d805e8c5ed8c4b3f7d2cbd3ef031150c4

        • /storage/emulated/0/backups/system/.confd
          Filesize

          20KB

          MD5

          048c73f536f234f0ad0d2fa8bdbda899

          SHA1

          dba2e666721e0b0988807b8bb3ce0452dad3448c

          SHA256

          f1a64586ce75e770e2f36a7ef6f7419e26ebb9e9e786df3c5adce50a196d2d07

          SHA512

          6ae398c682724f0008ce47cfc790a7ad3dd7cc801fb3a8a692d28da5533ea7ed830ea36933bd3e3219fc8cbade90f073c2c418611921bc7d6877d94b6745c4f0

        • /storage/emulated/0/backups/system/.confd
          Filesize

          24KB

          MD5

          20b4c5a4e7944c6575524b67929456e8

          SHA1

          8c00624e72d53734b11bbd36d92523e4d80ed5b1

          SHA256

          269e0fdb977c639320baa5a0f88db814d17c1058fe5aaffdfb723764e5029f69

          SHA512

          c4d54bdd070a8c6b8e8be330700b75c278cbebe6f2325337dbd958b2604b81f9d23e27a537352abf1c628e35a88818efa0c37b6b796b16619754db62f9481cfa

        • /storage/emulated/0/backups/system/.confd
          Filesize

          24KB

          MD5

          5405ced75eff998ecd4a4aea2cb3b294

          SHA1

          30c885fadc910f3316952d5a9a5c78afc1e9015c

          SHA256

          fcde66d88c7be4631e3a25911f8ac5c6432f8c55d0b385b3a5d7a9962ed1f8a6

          SHA512

          3c8c337e6eb8d01942789572255a0b9e9c1adb49fb24c076d655e7e470c113e086a8e0ae68d496b6a07cc5f34f1b0e03fc19d11a18543296f12bf0352720a7b6

        • /storage/emulated/0/backups/system/.confd
          Filesize

          28KB

          MD5

          a1f511d882fb35d752eb912126ec9ba4

          SHA1

          474f58e2f66a0631c0c51b78fe38d53828d05470

          SHA256

          849ef511d21b2443930b4c3fc671c88f31cea5eb5c7313e899ee39bfd799ff60

          SHA512

          25922e7406241ba6ee8a56916286f5870f6c1547465d9e5913dce7a925de77c23aa295268469eef037f300d03c650c11b72286e434c32b3b25e4c6afaf9b3fbd

        • /storage/emulated/0/backups/system/.confd
          Filesize

          36KB

          MD5

          a63fde45808e28fb62399ad04823f9fe

          SHA1

          9827e8bd66596a56a3176619e71f86044340c144

          SHA256

          097bdc4a1a2ffb14ebe89a10b2bac33188068d7acaea417aae0cbbc4af58b440

          SHA512

          6e66eed151219a06d31769bd764da2d298a15a4fca31714b997f21a0f126692a3cbefaf65e071f92176b16ef6a9479bff9ce80e9e8f52376f8e21febadc9f074

        • /storage/emulated/0/backups/system/.confd-journal
          Filesize

          512B

          MD5

          e68597deb20777104c0537798f8633ba

          SHA1

          20fbf5348a3d7194f0d0ed772c9d222111d3a207

          SHA256

          32fde69100361811f1b7a3625220a3472fed88ed5b7e597f1ce9693934fa3f3e

          SHA512

          a16f8d2b7d5fe0f474c4db62e339e25192fdaf0ef167be17af44f21fa9620d467dd063c81905fcabbcaefeea81421dfa2462281092ec3e4d2d0a82a446dba60e

        • /storage/emulated/0/backups/system/.confd-wal
          Filesize

          36KB

          MD5

          f5687c908c167eace709076d876f65a3

          SHA1

          058ec72d3ba183a7e3902d5384175f1b9ab5a2f1

          SHA256

          1627f19168a228fc65d94d7c3384598035cebcdb8c28ca073699b7a11de74bf2

          SHA512

          9172e8ce520723003b398982b0e0a75032f09951a94d35c2d6146be9233e4f2418ee8c644151bca9f2e8c6334af9c37a1b923db754fabde2aacae3e341e6c507

        • /storage/emulated/0/backups/system/.confd-wal
          Filesize

          12KB

          MD5

          7f22eed8797ecdb904b555dd01c6a1f0

          SHA1

          dd21d8257c9cc46a2100db328d2a1f3faa86948f

          SHA256

          46074ace1cefb9b61a14f9eee70140ed6d87be3ba46001975ecfc99a2778f629

          SHA512

          a0776cb84f1bf2fe5c74f97c78e27434b3d96fceccbfe3ee098fa12efaf295e8f54e408d8207bae84913d0338a06c409b07040c3ed186cb2984733040da4f562

        • /storage/emulated/0/backups/system/.confd-wal
          Filesize

          8KB

          MD5

          2a5e45fe95112216a99f853cdf56f48d

          SHA1

          849e69b8e35b758bd990b7546f952df4358b28e6

          SHA256

          3f776ca3f6665fa04ab3616cb9db7df5f2ebeaa13404af4b1f1fc824ab73edab

          SHA512

          e9d81a07cde501b81923ff50c318a96f34220fc8c382ae6325f604040c9235e1853edd5f30ebb689a65db49d7fde7fcdd1143605e578ba70674542014fcd285b

        • /storage/emulated/0/backups/system/.confd-wal
          Filesize

          20KB

          MD5

          75ee2f5b9c79744fe4771f60a72b0c51

          SHA1

          a11b32e11e0f9436b6bbca00d828a4b834af0fac

          SHA256

          ab658560bf21f387c7b888b8dfcdf45e153254fccebfc07e0952bbbd0e5cd87a

          SHA512

          21c64bb117eba4d5d6ceb0a9e05b1fb68497b10945d2e681fb6f700524829023f1c1c0b09f404e3013cc753e9f58bdb9284f2c0802ef2816a75d1f587a34f325

        • /storage/emulated/0/backups/system/.confd-wal
          Filesize

          20KB

          MD5

          fc05b05713750bff24b88db2bab66870

          SHA1

          0acb087a16eeed0860f46a7f351e68928989a94f

          SHA256

          29eee0a7b71616cf9cbfeff51db2617bb60879fed6ed3dfa67b681686e4d39bc

          SHA512

          fe1cdd9cce75e8b1ff1d00560292582dd365623cd3b153b3934393bc764b00d7e3671f8b5cb8f3069ab9d788e0c2dc72a55a2b84700cd4a14483086ff61e3968

        • /storage/emulated/0/backups/system/.confd-wal
          Filesize

          8KB

          MD5

          1fd6605ac146d864593dd3b7afcbffb9

          SHA1

          12be7e033efd14ecd402dcd6c420b2e9b2e36fa9

          SHA256

          7b60d76311f92ade583127811ca65fe8d37f5bdd4996f4969c83b69e17b958fe

          SHA512

          98443b84b52f04c21c912b860fb54ae30885d227278e8cf7e4256849381c9df5baaddf139de85d42ed423202c61136e744177db762d31be02e64125f96855c62

        • /storage/emulated/0/backups/system/.confd-wal
          Filesize

          20KB

          MD5

          c57484d4b28d2f8aeca159b4c9efe36a

          SHA1

          a458cad2bb7fa233cd7dbb948183cabd62bb3604

          SHA256

          c64e8b02294038d7b6511b61769e6676d8bc02bfa927e26e95c5a7cdb852815e

          SHA512

          7f3bb136427fcbe9ff0d708c2d5577cf8fc2a8dca2fefa56066452dec4615c7a026bac76df78c960a1847a5c2e1f6e128f2b0d336978568e87af37b1431e6ded

        • /storage/emulated/0/backups/system/.confd-wal
          Filesize

          8KB

          MD5

          bd40af6b740f770102555fd366003f70

          SHA1

          305c62f3a9305b3f772afc3d89f814896f0daa28

          SHA256

          f1958061edb76e6957191764668b5d6bd04aea1311975a84f0f4c626a93ee3ea

          SHA512

          225a11736089ae6b1214a7e758933e851764ec0643b24899b5eb17803ca6d6abc623c688ad4b00499c593ec897f401136b30f52be4fd1ef23daed86141b69a0b

        • /storage/emulated/0/backups/system/.timestamp
          Filesize

          25B

          MD5

          2f535ffe221204cba1bc6e431d620523

          SHA1

          01c99e2f95290eb85014e9967c5313417a4ca8e3

          SHA256

          cf8039fade35149e28202679d4933d571b6ee355cf7f404e27bc5fea1be9d592

          SHA512

          f0eb1bd9a1c9ed4a9629fcc6415f99f104df4501af538026b6db6c3e5042c462a1f7cd403d953b580f45a6bce5b63526b84434fd5d3aa3fe892cd302b45f6d9f

        • /storage/emulated/0/backups/system/.timestamp
          Filesize

          55B

          MD5

          56ee38c16f71b7c4d5383c2bfd26584e

          SHA1

          480ff572ae2e0a8e40f3e98f2c87460842ead3bd

          SHA256

          d7fd9004d979fc88cb36c306e73093cb1320a42d758a84358e266ddccbcd3403

          SHA512

          657c9f3a1aa63e31682400faea1562b22dfd4d63a2136c17469cfa95014bbb209a40d45b6d23cc3b1d375037705ec5b4fa425c7c8f43564981b2afcca4f38271

        • /storage/emulated/0/backups/system/.timestamp
          Filesize

          84B

          MD5

          8dd8f98694ccc6c1ce18612014e74c14

          SHA1

          93240c3ea82ebdc8286872474fdc85e984a4ca0d

          SHA256

          32197ec0e42097c0d0c5f4d65d44cc56cc0076448f3960a9012b052f3df20c41

          SHA512

          99f8978b9331f81786c0207200776c0c2565a22163ccb17cc3806cb2c7dcbc39f6275fe8ea86e392b81621cf32ed2961191c104d320c6607bd7f01ceb041aa3f

        • /storage/emulated/0/backups/system/.timestamp
          Filesize

          114B

          MD5

          5e32f11710ff01168987a2e0dbd033c7

          SHA1

          f7e92be70592c4ef8946c29c70ee89d50ebcf403

          SHA256

          b2223038986b641d0178d752045b6d975edb15f2e9d35faf53d5df277a70a2ec

          SHA512

          81822992004598952d015ecd6b4c372712da46e9766f56946d877d80236c7bf1d600852fe095ed9e2d2b1251cb33fb2d4e416d46440f0be99f3a09984eb64869

        • /storage/emulated/0/backups/system/.timestamp
          Filesize

          138B

          MD5

          0fe179f6439026c491054a630add7ca3

          SHA1

          f61a768852d6c60378d768d306bb684805dd93c7

          SHA256

          9354fd080c61f30b2b642a770956597977b01a807ee232ae7d5702c3e51924d1

          SHA512

          769639da2edc2caa313a345b0a3dd3d6164b80ee87bdc4e47fa1d097e97859cacb088726e749a7532e82873f0a1f09de1b52202b04b65730dffa1896940abac2

        • /storage/emulated/0/data/.push_deviceid
          Filesize

          32B

          MD5

          30e086e4a30a691f6995065c7d81f254

          SHA1

          2ba5aa3c2867f4d9a50729d3d2f64a8357f942f0

          SHA256

          82f3d0ad6f79dcadebc291cc78bd625ee6bce927163ec9bfa56d09191d1f2737

          SHA512

          614ce100db06cd1ac08564bf35aa429a567ceb9009a8fe4b3c1ea5d26e98cb35b976dc3c87a639705331a5b64a31e98720a06fdcc8113438e04513104afc8c61

        • /storage/emulated/0/qbmfkdxs/cache/alipay_msp.apk
          Filesize

          748KB

          MD5

          d06ea38e4210a87d6b96f8b0491df677

          SHA1

          3ba573396398757088e559a9d372049a377eb05a

          SHA256

          76a24f83ad15586ff9a2081e420a707be9ddb0b5047e5b6de5974c41624ff2c1

          SHA512

          3d43e5bfad2b703a804a53048b6a88228a11fb80ac641d6594f774cc07f6c7367e0ee80b29966d02c9206542f467f55b0f1ddbbfef0ec372256314a7d1071f30