Analysis

  • max time kernel
    157s
  • max time network
    185s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    22-05-2024 15:18

General

  • Target

    67b3da4333c15d86a96f4b096e71e8c8_JaffaCakes118.apk

  • Size

    19.5MB

  • MD5

    67b3da4333c15d86a96f4b096e71e8c8

  • SHA1

    fc42cd155be570fd5de12f3acfd52f39a24ac237

  • SHA256

    331328c804ed688a302f6ad4872652a227b6d5a7b1d633f0af598f8b0aa95000

  • SHA512

    0c7e57f6cc5d8339bcf2d79a9cd433e7407e552be9e3db5127955d80513987970da274928a7bfec5c40ce07e2cb40af04ab9c528a7eefe5cac2ef20814d72dff

  • SSDEEP

    393216:rRjNOEKVx6ENtAZoaZXPqw0ipeII4ZvZHPWf5igLvbAkazPg7:V5OHuSw0eeII49pWf57LvbAbg7

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 1 TTPs 8 IoCs

    Uses Android APIs to to get current cell information.

  • Checks Android system properties for emulator presence. 1 TTPs 7 IoCs
  • Checks CPU information 2 TTPs 4 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks Qemu related system properties. 1 TTPs 7 IoCs

    Checks for Android system properties related to Qemu for Emulator detection.

  • Checks memory information 2 TTPs 4 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 17 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 4 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 4 IoCs
  • Checks if the internet connection is available 1 TTPs 4 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 3 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 4 IoCs

Processes

  • com.jiayinghudong.xiaoban
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks Android system properties for emulator presence.
    • Checks CPU information
    • Checks Qemu related system properties.
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4274
    • chmod 755 /data/data/com.jiayinghudong.xiaoban/.jiagu/libjiagu.so
      2⤵
        PID:4302
      • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.jiayinghudong.xiaoban/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
        2⤵
        • Loads dropped Dex/Jar
        PID:4329
      • /system/bin/dex2oat --instruction-set=x86 --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dex --oat-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/oat/x86/classes.odex --inline-max-code-units=0 --compiler-filter=speed
        2⤵
          PID:4589
        • sh -c ps
          2⤵
            PID:4755
          • ps
            2⤵
              PID:4755
            • ps daemonsu
              2⤵
                PID:4809
              • ps | grep su
                2⤵
                  PID:4828
              • com.jiayinghudong.xiaoban:pushcore
                1⤵
                • Requests cell location
                • Checks CPU information
                • Checks memory information
                • Loads dropped Dex/Jar
                • Queries information about running processes on the device
                • Queries the mobile country code (MCC)
                • Registers a broadcast receiver at runtime (usually for listening for system events)
                • Checks if the internet connection is available
                • Listens for changes in the sensor environment (might be used to detect emulation)
                • Uses Crypto APIs (Might try to encrypt user data)
                PID:4380
              • com.jiayinghudong.xiaoban:core
                1⤵
                • Requests cell location
                • Checks CPU information
                • Checks memory information
                • Loads dropped Dex/Jar
                • Queries information about running processes on the device
                • Queries the mobile country code (MCC)
                • Registers a broadcast receiver at runtime (usually for listening for system events)
                • Checks if the internet connection is available
                • Uses Crypto APIs (Might try to encrypt user data)
                PID:4428
              • com.jiayinghudong.xiaoban:pushcore
                1⤵
                • Requests cell location
                • Checks CPU information
                • Checks memory information
                • Loads dropped Dex/Jar
                • Queries information about running processes on the device
                • Queries the mobile country code (MCC)
                • Registers a broadcast receiver at runtime (usually for listening for system events)
                • Checks if the internet connection is available
                • Listens for changes in the sensor environment (might be used to detect emulation)
                • Uses Crypto APIs (Might try to encrypt user data)
                PID:4768
                • /system/bin/dex2oat --instruction-set=x86 --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dex --oat-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/oat/x86/classes.odex --inline-max-code-units=0 --compiler-filter=speed
                  2⤵
                    PID:4904

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/data/com.jiayinghudong.xiaoban/.jiagu/.jgck
                  Filesize

                  4B

                  MD5

                  3e8e8c0aea0d05e0dbf5236e8186f294

                  SHA1

                  87bc410695a39c91ae2d7a33bdbbe47c00818722

                  SHA256

                  8fb0aa528572733da3f52e4c39e956b2519f148643142a93f1188131c8d4b1c6

                  SHA512

                  900432e8dfd1960a2290f8ce47d16d5172d10984d4e6ce903c498234ea5b5799475803de65c084779a4727bad167b76251632b1ef4ec0f09606c061ce12bfdd9

                • /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex
                  Filesize

                  6.2MB

                  MD5

                  a9ccd0e4cb87c87b72e2c76a1e620f37

                  SHA1

                  3209932929539a3838cf14b748f4d0e836b50e19

                  SHA256

                  799597bb3558881d1c8c846888c4cc432889039a103673ac7182ab108a466740

                  SHA512

                  5090acf459a00dbdda721d032c85c287e5ee2ca14674215a31152eab52d802533e2047adea386990b868ec614502f27a74d2c8d1875c9c21e595e42b13687d76

                • /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dex
                  Filesize

                  4.7MB

                  MD5

                  b2f543e8e981d2967328aebd7fd332e7

                  SHA1

                  cb5f879cd3871648a6c760fd948265204b1a57e9

                  SHA256

                  56461b9ccdfdea0250d2691c87732ac362c35d89954da68af65a5c0be632e2a6

                  SHA512

                  b80f05e8e7e19d5e418686191094a4230a96a041080236b01b00951295ef197d4dff3045306b183d9d737fff072dbf562de1b15278099e08fb93a80bd801cafd

                • /data/data/com.jiayinghudong.xiaoban/.jiagu/libjiagu.so
                  Filesize

                  5.2MB

                  MD5

                  30a464291665e86c6258ade4b98e6ba3

                  SHA1

                  17fe02ddc3c7d620217d11dda68a8d478879e945

                  SHA256

                  376d6b262553e1cc215d6f3ea5754ef57d9133460851cbcf069bcbd27ba6b97a

                  SHA512

                  b6177ad4987c1a902e111f1c098782a5865994fe7b9e8f57e4143574e6d69d9beca644b7482427bb67782b30a90b76a845b17274828c6bd6a9e5c5548c9f4cdb

                • /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex
                  Filesize

                  284B

                  MD5

                  f1771b68f5f9b168b79ff59ae2daabe4

                  SHA1

                  0df6a835559f5c99670214a12700e7d8c28e5a42

                  SHA256

                  9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

                  SHA512

                  dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

                • /data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.ac
                  Filesize

                  45B

                  MD5

                  fca85154a18cd13ef8021ab51d4b6cd5

                  SHA1

                  a9e94af510b15a790ad23ee8e9012cd16fe38b19

                  SHA256

                  5e4dde14598bdbbeb325ab1ef90fd6c4ae1461643706baa804246bbf904fb546

                  SHA512

                  df6e7b33641564cf7bb974e736393c54b4b37f3389695432cbff9f0a5f06b5002a8a99514a08ad19389f80368dd53a0554bc76f4edafd4379be347919308f52f

                • /data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.ac
                  Filesize

                  40B

                  MD5

                  e904ab3df160e53994f1bbc26f077003

                  SHA1

                  ef87cfb02b3d0f32bc6ef651e4e61cd3001a9968

                  SHA256

                  1264ebea4cc0087b3c585613e559fa1baf0f9ecab2445144d3f6193d7a7fd63d

                  SHA512

                  c3d0241bf06f59237722ad9a3f11e1400d0c78adc45242ecd099c4dcb948c32a3741cfe170667148596c295ced03150cb4487609542440118752ea8209ea3421

                • /data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.di
                  Filesize

                  340B

                  MD5

                  2508940b11f728c657b71e02476de9ad

                  SHA1

                  6b65b4dda956f58a671e05b46e699ef80e4d2f5f

                  SHA256

                  a3b87ce19f02b453d5cb73e29d4212bcb0da70b0e6ebf56544eec7524207eb71

                  SHA512

                  51628bf1d1fff748913816cd3f7346f5b568511e1cfb5755c20a5b74183494eec249287c33232f345f62b5f01c4db24ed18715dcf9bf4b694c1485f03121fc91

                • /data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.di
                  Filesize

                  340B

                  MD5

                  a0bafbb7baa42615134e60a6580ea8d5

                  SHA1

                  91df10fde712f62b94fe1f4b14ee35d06bf2e195

                  SHA256

                  f732dbb12d851952921231d14491fa98e458b7da47cc05ea9a510ba276782579

                  SHA512

                  7036d767b3b0c0c2db7245de0bb81c4daf3996d487416287f63eb06f1830de74242c64f8ae763b86993d06ab96ca82e7b4d27aec1384aa3b5c44e732761d173e

                • /data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.ic
                  Filesize

                  95B

                  MD5

                  25698041991606c38315c18160110cfb

                  SHA1

                  8065c98360d08e494918fb197fb44b1c176bae31

                  SHA256

                  4713e0c8ee9d586355c93fba7a2b6d6c474aec7bb1af8aa7e6bb0392fa0f93ac

                  SHA512

                  4a8b3b700d3787d3e40212c4ccd8d1aa9b37042018a5967e73024d9691454d62339b07bed8b7b4fcdbc8c3e27e783f4e565dff1e87834856c909f8faa0831809

                • /data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.ri
                  Filesize

                  314B

                  MD5

                  d88d28066deb90f52b29126b48bd1524

                  SHA1

                  d4183da0f5fc68723d620ac0a6f6e6aceceaaf6e

                  SHA256

                  fe90632d22b7b0f0e1b90724067d85534ed76bc2d2a928ee54d5dfd341ca16e2

                  SHA512

                  8b7e82e1c5140fe3e4afdafcfe2eb79d8aea9a364df22b094ffbed0718517fd4aa47c72ab39daf754d1ff62d5105b495dd46f6f7ce838be2f92378dbb5f84f36

                • /data/data/com.jiayinghudong.xiaoban/files/.jiagu.lock
                  Filesize

                  58B

                  MD5

                  a42eae54337dfa8e06a922d8020cece1

                  SHA1

                  ee6ddf4ed6cc4f6c9589195f227154c097427cac

                  SHA256

                  a3c3a88e80a3b5d5622657026b5badcf37eff1cd84c80fcfc4511e10df2ff3be

                  SHA512

                  e7d0f96b03f9c15bdffa1447ba5e171eedc5bd77043a2514784fc1637a3651f7faa08a733547f02605c9278d69575d9ba263b107aa628f04f41a880c8b4f227d

                • /data/data/com.jiayinghudong.xiaoban/files/Archimedes_p4
                  Filesize

                  13B

                  MD5

                  a297fbfaf743b13a418b65f1ea8e1084

                  SHA1

                  9670897c9f8d2464be2cb7b6354c2af053a1acbf

                  SHA256

                  0b3ad5d2392545ed261f7594b5b92d03c33e9eeca76c129107a7fba45802f6e8

                  SHA512

                  3f4c35407c621c97a389aa7f5490b6e6b7f576079e06b9bf2d3afb1d9572a5d293e0e2dacb66f6cdf98a3314a9e64554f7a8c7ef194969c9e072da7661d1f126

                • /data/data/com.jiayinghudong.xiaoban/files/Archimedes_p5
                  Filesize

                  13B

                  MD5

                  4da989cd49c4964995070503ff4b56a1

                  SHA1

                  aa22d831f51576325eac3234c3d6241bed90df59

                  SHA256

                  5a11901189dedc611e2015802518a9e33a953b88726fb7fddb3f1a9ed6042695

                  SHA512

                  7bf74247a4822a8ce8c26efa545381b31637ad13d3343eded39819b6b80fe2955ef08f0ee8b2e92c1af9538133208cccc255b7d702a4edab1039742fe67c5499

                • /data/data/com.jiayinghudong.xiaoban/files/TDAntiCheating_Switch_Value
                  Filesize

                  2KB

                  MD5

                  eecccd85a7801b99704064b61915cc0e

                  SHA1

                  4e39b4c55b73b5cf0902de1c5087ca47d3f64fd5

                  SHA256

                  5ec465894b164b45e2686ab3445a5f522dad6b90946c341eb3507da6c290d942

                  SHA512

                  4a7c71b3a4154b87d43cad8473f2a9236a4dd9d19f1b2066c3f8352bc1829d9fc6debe6105b46c8297669e45faf423d7304ba398ff3002a09160cfa71f56701c

                • /data/data/com.jiayinghudong.xiaoban/files/TDCloud_Control_Cache_Param1
                  Filesize

                  2KB

                  MD5

                  6c95c267805278bf366e38456ace7d03

                  SHA1

                  56ebf49a12961cc20bc51c586cc16511d2766a99

                  SHA256

                  0017dbee4c7f3fd1c317126e865f43927bc22faa0c890b948efce16d4414cd1c

                  SHA512

                  e3acb7057b07f68313b96782223a05540bc0efae6a31e247a9fd0c4225d420f1134fc89250adf4bc8397b685cef520bc62e27e070f50cd7dc4ebd2bc7887ea92

                • /data/data/com.jiayinghudong.xiaoban/files/TDCloud_Control_Cache_Param1
                  Filesize

                  2B

                  MD5

                  99914b932bd37a50b983c5e7c90ae93b

                  SHA1

                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                  SHA256

                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                  SHA512

                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                • /data/data/com.jiayinghudong.xiaoban/files/_Ladder_Project/Archimedes_p1
                  Filesize

                  13B

                  MD5

                  fdb205bb1a517f190dc4011b4b9ae06d

                  SHA1

                  929669a839bdedcf2758ec9b3af54d81d0c52908

                  SHA256

                  42379e91dfa0a7f33a18e7c2e77eeabdaed0a72e840967430ad7ef7fd8aa2668

                  SHA512

                  f406aa79994c80834ef32f9b86f44d628d642c760aac262bae655af99fc5268776de0ee8eb0af1220453999f2bc3a5b45c632495e4a3c9410ffc927ed8fd5aec

                • /data/data/com.jiayinghudong.xiaoban/files/_Ladder_Project/Archimedes_p2
                  Filesize

                  13B

                  MD5

                  e953419a8f70912e6302766ebc20b8c2

                  SHA1

                  a638d5bf49e07bc011d56cc7ad8f1bb786beb6c7

                  SHA256

                  258716239c224097e57394da56d6475606f15ec647589d7dbc8032c63cfad92b

                  SHA512

                  b1b9637578e00e597991222e118818f12993b45e64b88b71e74efb65b10d2fac53b98e9a3258339b7a9a09805fec088c6dff3dc1e8dc07f74551bd1ea38d8686

                • /data/data/com.jiayinghudong.xiaoban/files/_Ladder_Project/Archimedes_p3
                  Filesize

                  13B

                  MD5

                  ac241ebd3440e73ffd6f3554b9ad6863

                  SHA1

                  3b5c748e65e9e52664205bddf2a6b69528e2856b

                  SHA256

                  9193b9c539efc6b3b7e429123d90949afef8a1107f7c58fff0ec329ce2537000

                  SHA512

                  caea467532e2906dfe8a0898987bfaa731ee5d9a62e5fe33af1dbd507dc70c1393d3a0cedebb4085ea47ebd19f503b946d49571d3379d9de617ecbd9d9268640

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database0SaaS/1716391190590_4274
                  Filesize

                  2KB

                  MD5

                  7d616596512e77f5d1e983c25206e76d

                  SHA1

                  93d1bb9794c9100a03c0f22acde9757a5689e50f

                  SHA256

                  311e19675826e652bc7874d761b7895f7b0850d301ac27cc20aa72452b87b883

                  SHA512

                  f88cf6fb70a8e3ad67f113118066d5722c18467bb87d3bac23013de65042b819562ae4ceb46db3f74eb31dec1afda32174c227591bc551990951161543ea9a09

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database0SaaS/1716391192608_4274
                  Filesize

                  2KB

                  MD5

                  d86fbe79c568310fe8870a5e07dae627

                  SHA1

                  0f5d16eee15f8a037b8a404afff5b2090cb4ed73

                  SHA256

                  280e63cb15a070963a78d7a31eef97803ff4c50de297af0a61a1f2ab78942364

                  SHA512

                  228292a43e5b1f32d6d87404283adc52fdb4900221f794263e868818a84203200a868b05889aeafd60104d4e8b9e826a350f26beafb528a33613737a1b77d6a3

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391186388_4274
                  Filesize

                  2KB

                  MD5

                  24d5fb572b4af20c664d0b479d0df465

                  SHA1

                  0dd16e3375bc188f931955115a9ad9d88148fbd4

                  SHA256

                  14541c29f54d3d6e8d600bc61d4656d9bbf129698387616f7a5a78143e9e4896

                  SHA512

                  525e471cee9edba4582f3793d4437047c8c35446f2a69cc6f23b90a91a7c04d8a8ce14ee1ea25ce9d283a74d258989eab4ec51dec7b05a8d02772eccfc84018c

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391187173_4274
                  Filesize

                  3KB

                  MD5

                  0a8623190c5782c5af50cdeac9b8dc7a

                  SHA1

                  c2553bf8e7937caf6e554196fb0fe5cf4f0b6dd6

                  SHA256

                  01a034fc4afe15c7c1e3f24641af340bff1e7347d2fbec56647590d602073d9d

                  SHA512

                  d4297aca4c929f7f5e001cac04b385047bb69fa5c91843625358b47cd0f47cdc482eaf45bebd27d9a5b61406fe52113fc5924cc48d79920d52d1f517b90f8ad3

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391187824_4274
                  Filesize

                  3KB

                  MD5

                  34c80461782df64ed22a46979a5dd26b

                  SHA1

                  290dfd4f60a29f80d14defacea47323a6ce1a705

                  SHA256

                  2d54591e62b95b03ae67dbeee19f3ac8ecd504ca3f218a1f59eec07732908d6c

                  SHA512

                  81fe77735847362b5960dda1ec1159c7b0b2b097500809d3b41bcda1ae9396c0967344b57e38785f15ab066b67652bf474863421b80fd876795b412bc80f9be8

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391188270_4380
                  Filesize

                  2KB

                  MD5

                  d2c89087fbcb869542e7d1bd60b9ceb2

                  SHA1

                  6d6369c4b98579f535ee7c959f6b304bea8b8eff

                  SHA256

                  c6e547d5ebe598fa54fe93df553fdc0975b999903a1d9779f9d646807e7ca2d1

                  SHA512

                  0a63d4d65c6a197ab9b5c7d245665528336683f6d254cc3126ab5611dd0085e73d9e8ce8f6f0cdffd57466ff45df5797fbe27583fb4565314ad4bba8e720ab0f

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391188774_4274
                  Filesize

                  3KB

                  MD5

                  53a6f3cac21895f99dfe60432d82a50f

                  SHA1

                  84cb3aaf7f6a424787bced6f77e37a605aa15dc5

                  SHA256

                  9f3d2aae60c3b78aceb74f35b9b3e9b0ba831b8d678f81ead058fabd5506a3a6

                  SHA512

                  79f0b811c7fd889a78b52a7944806624077452571d3a75f44ed3b4804a8ba3d3528a4a7de306057fabe72aa41a62e871c11df1c5f1d49f9adb3ae96fe655469a

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391189641_4274
                  Filesize

                  3KB

                  MD5

                  6742aaa21da7e17e98ab2aa21a109ec8

                  SHA1

                  004de192762c4604a840ca3da3f5620b53cc67fd

                  SHA256

                  fffe5701a15985fcc673c5df266f2ce2637965bfd6e70a5e78388a8ac182439d

                  SHA512

                  6fcc267f1933aee9a2bcb1e3514ed634eddc3c957bafec18f9dea40d8fff7146744982ee1d4b8614e7079b583cf70a0b784d175a80392f4840ff9e45c2e6c954

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391191886_4274
                  Filesize

                  2KB

                  MD5

                  e32522d8d56eab5015ce05c4bb2594f7

                  SHA1

                  869a3ba0fdc1b5ce8eca54951e05c8adffd9ca7d

                  SHA256

                  80b02dfe5794316cbeb36c800265b9f8fa7a18a7b4be65a9ab640282b8965d1b

                  SHA512

                  0bb00f27322d9199424fdb5ea802debb3eb03ee5682b772b3fb0310a7d0f4d6df2bebd57c1068fdc2f5084e1ef908595403a013a486704f1fcbe268674f76c0a

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391214709_4768
                  Filesize

                  3KB

                  MD5

                  ec1e1d12d78208bf0cd52cd2ac4eb3d8

                  SHA1

                  dce02ddd75473febd4dac83c98a62b7fe2e32f86

                  SHA256

                  527ab3494d76fbed3d33a029457be12385905f36e6b01ab1afbe22521959dce4

                  SHA512

                  810315833dae59deadc25d4e9f2f690872537215b1dbeaf1986f4844e2f8aa7f80aab23603c6082f0463135a644b70fa82e9934a1e321c96d2f3fe8795b99727

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391215391_4768
                  Filesize

                  3KB

                  MD5

                  cdccdec3e5f64ad4430df9235fcd8513

                  SHA1

                  c65072d404b848812504f67a8c640b9d5a6a4393

                  SHA256

                  3f69cbfae77dc96bfb88ead59317480e6e8526f06652962f14372fc7c5bcf5a4

                  SHA512

                  7f51b85d9a5200afcfcd8622af15f2406e836d3ee26d00f953577d22a71162a686ebb52fe070392b6c33023ba5c8a2ff7cb240eff228a97a13e480d60885e537

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391229708_4274
                  Filesize

                  4KB

                  MD5

                  8f2395f8e4666b11e61a2de045cafcb1

                  SHA1

                  64c15c78bcef21838e210987dd873fdc0cf92d77

                  SHA256

                  46caacbb2ca9a5be3374ae10c9bfc39bf3d5e4ee174a6c1457dbb17317791b27

                  SHA512

                  45eb6f513649a9beacc64b2f8911174e34145f53677ef71a3a0e49856ba39fdb9e556da0acfd4d223f54bc18e2a8b924e78b0e630ff345f1cba7e1dab87ce988

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391234676_4274
                  Filesize

                  4KB

                  MD5

                  cf906337707c0bc5864764936c3b0381

                  SHA1

                  8ff6404c8a6b98e8b75d2b8591142339bd422e0d

                  SHA256

                  6179c522eb91a3d8560b395292a66f8bb4ac9fbfd8fd85be6fd2e302f0896781

                  SHA512

                  c22821574d363a82208c2fa3b99d44e9031a572e716770d01a4b6962edb04a967d8a901ab7b7bff484b402a7ef6fbe5d83832a9d096ea467ee1623ca0e3fd3ce

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391270723_4768
                  Filesize

                  4KB

                  MD5

                  97f3b3ceecab1f75a5086c8a610a2d6f

                  SHA1

                  07d31e0329ffa6b38718a8f4407b5a3af79f7ecd

                  SHA256

                  3f668f2bae4514c3fdd33eca16416249c3198c3d1402d2d6137f77593f692d8d

                  SHA512

                  2ff051669b61d1df00d7c23c29d33d63cbe8fd96b721de352979cbf69f99da4790d2f753880a4d3901fe5e87266fd4a021678ac877b7c178f269da15cf4a5212

                • /data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391275977_4768
                  Filesize

                  4KB

                  MD5

                  0e0225d20b9a996c701ded748855215d

                  SHA1

                  26ddc7d563276412fdf3d0cbbe4bd15cd6a01584

                  SHA256

                  38cf19881c3e4a7dee6c92810ab4b54dc15476bb8b7550d4c10a1ec54ae20ecb

                  SHA512

                  96223882cf860dcefd5876cd527a8479396155e96dae5ee0c750ac15c1192133a683ba08077037c59e22c55d4b76a8f4f43763b73b5b44db0311fbdb7cb1bfe3

                • /data/data/com.jiayinghudong.xiaoban/files/jpush_stat_history/normal/nowrap/377620e3-b1b4-47fb-a516-e8b03804bb86
                  Filesize

                  159B

                  MD5

                  a3c2342a4ef63b225b9a206b15d42ee0

                  SHA1

                  f9c044e7d23f66ac7798f9309db1931def485097

                  SHA256

                  61418b2298984c511baf6bfc4738330533dd703e1fb1c25cb90cfd6e7b48fda3

                  SHA512

                  3a7b711e77d4139716a6ce4059a2cd8aaa113e60f368254c9e70e9e898e4826bacdc447c5ed95216c3c474b7789971cde28b822b510cad73c608fcf4ab348849

                • /data/data/com.jiayinghudong.xiaoban/files/mPBE/iv
                  Filesize

                  56B

                  MD5

                  7499f81b9542b8107aa511584b6cc655

                  SHA1

                  449d7ae1d042b7065de2aeaa87dd74d9bce478b6

                  SHA256

                  c2319bdf41e6f334344e5293d93a6466e85da982dfbcc06644aafb552b11d8e8

                  SHA512

                  582e34e509d756ac9773644688da5ac78242b1c452394e78f5621fbb7d929bb58d217c75170dd925a9e32b2382d4a60782d5029a481bea96794665f94dd6cea5

                • /data/data/com.jiayinghudong.xiaoban/files/mPBE/salt
                  Filesize

                  120B

                  MD5

                  a452e50589f98dc3720cef907a40fe86

                  SHA1

                  97cf069ba3718a049beb6d988640ffb055f51087

                  SHA256

                  ed83fe1adf80bb8d7d4a1f145fcf56dae88db89d0ab87679eaa7202b38ba7ceb

                  SHA512

                  34cda092d7766c8acdd9d00fe47906ae7ce3481187010e684d9887120132b17bd25739e5622803525b99f47b18e792dc55d8cd361b69f2bc84abf7e21a0b3739

                • /data/data/com.jiayinghudong.xiaoban/files/objectbox/objectbox/data.mdb
                  Filesize

                  12KB

                  MD5

                  0580c5cb7b97b3598c96785262a4fdfc

                  SHA1

                  8a595dc8d8bf34127ad2adc38956d74fdf61d19a

                  SHA256

                  0b639d63696e9e330bb0959300cf25c98a33dc4be3b8d7b8db1ec965894472f3

                  SHA512

                  cd53af9c418aa67365552d9b66f32fdb0a33ac7449f0a1a74da6ecf456efeb90ddb139076d87cbb9a7b0049f782acd8790e9a75ca892e92fb868b7f55bcd1aad

                • /storage/emulated/0/.tcookieid
                  Filesize

                  3KB

                  MD5

                  7c29f51784ee61391c234d6d178f370e

                  SHA1

                  eb5817ff5fcff4ce7c503d11fa3532c2657d00a1

                  SHA256

                  f3d79d7d113ac64db9fe0aa3355836a5ced045f9521fec514c09c8fecf5db0a0

                  SHA512

                  bd89837503cdf640735e3b9b110e74ef931852c8002df62eb74bf76802f959d2372166c9cdaa50e97bca0b46cf5debff03f183c5692a52dce6b274a885ffb435

                • /storage/emulated/0/360/.deviceId
                  Filesize

                  48B

                  MD5

                  1d8d16c4e3b19ebf18988530d9b9a757

                  SHA1

                  bc94c1cce05cd848a53271ecb9c5311e27ffebf5

                  SHA256

                  abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

                  SHA512

                  4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

                • /storage/emulated/0/360/.iddata
                  Filesize

                  32B

                  MD5

                  7c3f0bae0adeaef5b6c0a81123b6a80c

                  SHA1

                  86ec4736f8518d868aa0800491e6c0741ed5e248

                  SHA256

                  a1887a2c2f16142aec6ca48a316dc94c2e4c17b7681b692db35db909e5d0341a

                  SHA512

                  12853e041ff02921467850bd4a42985e6b4598cb16275fa7edddbdcc1df6f4a5d8f9d7984e9722dd94e9fb0dbb6da8df6b6a91753b775a97f47389589a11fb2c

                • /storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/app/log/demo_20240522.log
                  Filesize

                  4KB

                  MD5

                  bd84b705a59ff0f7affc873933a32ee0

                  SHA1

                  32556a949a154efdd93fddc4448906680eeb8f2a

                  SHA256

                  ae6da60b69a64795baef8b1dd40c27a21e1da43fe4e5c4c7d100a2df0ac5dbf9

                  SHA512

                  f3a29dda3c98b0b21b74b4ec75ae3383dbedcde995e0c700bf1465332eb79cef84c06920376393023a73c111ee62e3593dbcd35cdf01cfef48ea2efbdaf81ed4

                • /storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/app/log/demo_20240522.log
                  Filesize

                  45B

                  MD5

                  154519022d1d8639964da4b4022e5615

                  SHA1

                  860f9f666e78a9fbf20a6a896ef9d70a7f70ab0c

                  SHA256

                  632a59dba7354220008043dd9061d99415f5e538ce45fba190179d282d2f9a9c

                  SHA512

                  898cd2cc7642ef296beead6e511c9113b65083f58be8e81690b2a44941a97fc147c2e9a9ce86036db839657c77dc821876b63c8b62958e37aedc8d2330f61f41

                • /storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.log
                  Filesize

                  3KB

                  MD5

                  1c19d2946107142901b79e5d19e90a4d

                  SHA1

                  fb87a5dbd58ad4042017d09f3676cb8ea3b8ed50

                  SHA256

                  329f616a44c2c1c9c27a13240fa8b6c629a56b34a75dca2b5e4ac6395988428b

                  SHA512

                  eb31e2f277d55798ea14c8aa80ecefca91ab626c4ed50bcefff6f3c788ea376f0a0f90c2ad73d9dcc94c7a3e248761bd32c8a4cff3b8f6b88d79c50a40e0d55c

                • /storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.log
                  Filesize

                  218B

                  MD5

                  2ceb3f3f02b57776639a71d7de2bc58c

                  SHA1

                  f04e57a5f980bdd15ce67403e810bb6f8d95bdd9

                  SHA256

                  55cb3b546aff36a6f7af18fb71891d6793e9312606564994f97f300abb0f04a3

                  SHA512

                  7e344498494daf5a682581de55fdbcba74e5f5dda993d6a20b59eb41f2d6244adec2cee8cadfb54324a8471efa0918bb457e234930d51c006e41df5305cf7f79

                • /storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.log
                  Filesize

                  3KB

                  MD5

                  f7aea276fc63f2d12573efb7072bab5a

                  SHA1

                  9d7c273778bf066e7e19aa308ae5ddc2cf9dffb5

                  SHA256

                  342b26c32033bf914aa40c41da58e47cae155cfc6c0f07ae449fd21ba91351ef

                  SHA512

                  d22991831cd51ff8abb74065335ff0c20937348383714fccf7f2d5d26687ad948e9a91e1bb162014bba26090ccca5b674bbb29d5865af82d7e919e60e10ad53d

                • /storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.log
                  Filesize

                  94B

                  MD5

                  cd71bf6d03dbe6b9404e733fe9f3a085

                  SHA1

                  d09888daa123bb3e0a691e6648e8ee274558eaea

                  SHA256

                  d46164de485fd52d1b3d69093cb8402811b8def888227a7bbd03ef6e812cb86a

                  SHA512

                  53e6a4087a57083e8d2e07d80ece7ebe6d48f95329748995dbf69f0f639bf9fa60b68c4b0bd1f1f82f7adf2be2a986a31f3fa8a86b2a9e3814719fcd66cd5a97

                • /storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.log
                  Filesize

                  79B

                  MD5

                  ab6c9f5e021084fcce48677aaeb141e7

                  SHA1

                  dcf5733446a1dcbe575e2d5d3d3406aa5ed598e9

                  SHA256

                  c3178d6ae24a4e3e06a22829cf7b6b0532bc758380a1efb08648b2066efd4bc6

                  SHA512

                  00cf684a90ba563181bf74cbf76426ce1faff3e37424478d423ed61fd6bd7ff5e359aac5b2bb011236ac8a7a5ab313fcdc62173fd6a5f65665a94896dca40d0a

                • /storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.log
                  Filesize

                  2KB

                  MD5

                  ae683075f59780d17054c3d0efc5503d

                  SHA1

                  76e1e8ec876602df0b17e4cf0a00d0836a842776

                  SHA256

                  6f71cc8070dacd8c484eeffc740715272bb11a47b1a7be57515b3fa4f0387fb9

                  SHA512

                  284ac9fe8eeb53f9de282b175d72c80b53998917b2a3a26d95b4785b339c32107375c80ae52ec63636af213239b017d1e09a28f3dc3b26b2bc9b2aa0ac680e46

                • /storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.log
                  Filesize

                  65B

                  MD5

                  e21ea477c4ceec42f076a7d920060dd5

                  SHA1

                  edf3fb6a944cc6febce2dea8599190884e172fc6

                  SHA256

                  cfae639f47ba448a5bc923ae5ffe1e2274384328647667d5c6fef5e160378beb

                  SHA512

                  78425e29e3ff33e83e773568712c4be78c4c97fd2ef53231e43c7c8557a3650ab6e266a26255c4c794ba6a3850642ebeb49edda5b8f016459638dfb1c6840931

                • /storage/emulated/0/data/.push_deviceid
                  Filesize

                  32B

                  MD5

                  5f7407eff7f1efbbb0ff755f2ef0f100

                  SHA1

                  5aed937a1f5041544351d89961f8255e1fe2158a

                  SHA256

                  08cf83a0cd13f8122562216d361ea0c2a2561682e686d2c7ab15a0d482465662

                  SHA512

                  db574da934cfc8dc4af30ece0e4c74fc8b194da6833bfcfbc5e7a28e9ab2394a95acd83e338b8358751516713cd8f5e22a298b84ae4a206b3aacea04ea8fde6e