Analysis
-
max time kernel
157s -
max time network
185s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
22-05-2024 15:18
Static task
static1
Behavioral task
behavioral1
Sample
67b3da4333c15d86a96f4b096e71e8c8_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
67b3da4333c15d86a96f4b096e71e8c8_JaffaCakes118.apk
Resource
android-33-x64-arm64-20240514-en
General
-
Target
67b3da4333c15d86a96f4b096e71e8c8_JaffaCakes118.apk
-
Size
19.5MB
-
MD5
67b3da4333c15d86a96f4b096e71e8c8
-
SHA1
fc42cd155be570fd5de12f3acfd52f39a24ac237
-
SHA256
331328c804ed688a302f6ad4872652a227b6d5a7b1d633f0af598f8b0aa95000
-
SHA512
0c7e57f6cc5d8339bcf2d79a9cd433e7407e552be9e3db5127955d80513987970da274928a7bfec5c40ce07e2cb40af04ab9c528a7eefe5cac2ef20814d72dff
-
SSDEEP
393216:rRjNOEKVx6ENtAZoaZXPqw0ipeII4ZvZHPWf5igLvbAkazPg7:V5OHuSw0eeII49pWf57LvbAbg7
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
Processes:
com.jiayinghudong.xiaobanioc process /data/local/xbin/su com.jiayinghudong.xiaoban /sbin/su com.jiayinghudong.xiaoban /data/local/su com.jiayinghudong.xiaoban /data/local/bin/su com.jiayinghudong.xiaoban -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests cell location 1 TTPs 8 IoCs
Uses Android APIs to to get current cell information.
Processes:
com.jiayinghudong.xiaobancom.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaoban:corecom.jiayinghudong.xiaoban:pushcoredescription ioc process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.jiayinghudong.xiaoban Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.jiayinghudong.xiaoban:pushcore Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.jiayinghudong.xiaoban:core Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.jiayinghudong.xiaoban:pushcore Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.jiayinghudong.xiaoban Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.jiayinghudong.xiaoban:pushcore Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.jiayinghudong.xiaoban:core Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.jiayinghudong.xiaoban:pushcore -
Checks Android system properties for emulator presence. 1 TTPs 7 IoCs
Processes:
com.jiayinghudong.xiaobandescription ioc process Accessed system property key: ro.hardware com.jiayinghudong.xiaoban Accessed system property key: ro.product.device com.jiayinghudong.xiaoban Accessed system property key: ro.product.model com.jiayinghudong.xiaoban Accessed system property key: ro.product.name com.jiayinghudong.xiaoban Accessed system property key: ro.serialno com.jiayinghudong.xiaoban Accessed system property key: ro.bootloader com.jiayinghudong.xiaoban Accessed system property key: ro.bootmode com.jiayinghudong.xiaoban -
Checks CPU information 2 TTPs 4 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.jiayinghudong.xiaoban:corecom.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaobancom.jiayinghudong.xiaoban:pushcoredescription ioc process File opened for read /proc/cpuinfo com.jiayinghudong.xiaoban:core File opened for read /proc/cpuinfo com.jiayinghudong.xiaoban:pushcore File opened for read /proc/cpuinfo com.jiayinghudong.xiaoban File opened for read /proc/cpuinfo com.jiayinghudong.xiaoban:pushcore -
Checks Qemu related system properties. 1 TTPs 7 IoCs
Checks for Android system properties related to Qemu for Emulator detection.
Processes:
com.jiayinghudong.xiaobandescription ioc process Accessed system property key: ro.kernel.android.qemud com.jiayinghudong.xiaoban Accessed system property key: ro.kernel.qemu.gles com.jiayinghudong.xiaoban Accessed system property key: ro.kernel.qemu com.jiayinghudong.xiaoban Accessed system property key: init.svc.qemud com.jiayinghudong.xiaoban Accessed system property key: init.svc.qemu-props com.jiayinghudong.xiaoban Accessed system property key: qemu.hw.mainkeys com.jiayinghudong.xiaoban Accessed system property key: qemu.sf.fake_camera com.jiayinghudong.xiaoban -
Checks memory information 2 TTPs 4 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaoban:corecom.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaobandescription ioc process File opened for read /proc/meminfo com.jiayinghudong.xiaoban:pushcore File opened for read /proc/meminfo com.jiayinghudong.xiaoban:core File opened for read /proc/meminfo com.jiayinghudong.xiaoban:pushcore File opened for read /proc/meminfo com.jiayinghudong.xiaoban -
Loads dropped Dex/Jar 1 TTPs 17 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.jiayinghudong.xiaoban/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.jiayinghudong.xiaoban/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&com.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaoban:corecom.jiayinghudong.xiaoban:pushcoreioc pid process /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex 4274 com.jiayinghudong.xiaoban /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dex 4274 com.jiayinghudong.xiaoban /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex 4274 com.jiayinghudong.xiaoban /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex 4329 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.jiayinghudong.xiaoban/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex 4274 com.jiayinghudong.xiaoban /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex 4380 com.jiayinghudong.xiaoban:pushcore /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex 4428 com.jiayinghudong.xiaoban:core /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dex 4380 com.jiayinghudong.xiaoban:pushcore /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex 4380 com.jiayinghudong.xiaoban:pushcore /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex 4380 com.jiayinghudong.xiaoban:pushcore /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dex 4428 com.jiayinghudong.xiaoban:core /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex 4428 com.jiayinghudong.xiaoban:core /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex 4428 com.jiayinghudong.xiaoban:core /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex 4768 com.jiayinghudong.xiaoban:pushcore /data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dex 4768 com.jiayinghudong.xiaoban:pushcore /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex 4768 com.jiayinghudong.xiaoban:pushcore /data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex 4768 com.jiayinghudong.xiaoban:pushcore -
Queries information about running processes on the device 1 TTPs 4 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.jiayinghudong.xiaobancom.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaoban:corecom.jiayinghudong.xiaoban:pushcoredescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.jiayinghudong.xiaoban Framework service call android.app.IActivityManager.getRunningAppProcesses com.jiayinghudong.xiaoban:pushcore Framework service call android.app.IActivityManager.getRunningAppProcesses com.jiayinghudong.xiaoban:core Framework service call android.app.IActivityManager.getRunningAppProcesses com.jiayinghudong.xiaoban:pushcore -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.jiayinghudong.xiaobandescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.jiayinghudong.xiaoban -
Queries the mobile country code (MCC) 1 TTPs 4 IoCs
Processes:
com.jiayinghudong.xiaobancom.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaoban:corecom.jiayinghudong.xiaoban:pushcoredescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.jiayinghudong.xiaoban Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.jiayinghudong.xiaoban:pushcore Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.jiayinghudong.xiaoban:core Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.jiayinghudong.xiaoban:pushcore -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 4 IoCs
Processes:
com.jiayinghudong.xiaobancom.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaoban:corecom.jiayinghudong.xiaoban:pushcoredescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.jiayinghudong.xiaoban Framework service call android.app.IActivityManager.registerReceiver com.jiayinghudong.xiaoban:pushcore Framework service call android.app.IActivityManager.registerReceiver com.jiayinghudong.xiaoban:core Framework service call android.app.IActivityManager.registerReceiver com.jiayinghudong.xiaoban:pushcore -
Checks if the internet connection is available 1 TTPs 4 IoCs
Processes:
com.jiayinghudong.xiaobancom.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaoban:corecom.jiayinghudong.xiaoban:pushcoredescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.jiayinghudong.xiaoban Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.jiayinghudong.xiaoban:pushcore Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.jiayinghudong.xiaoban:core Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.jiayinghudong.xiaoban:pushcore -
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 3 IoCs
Processes:
com.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaobancom.jiayinghudong.xiaoban:pushcoredescription ioc process Framework API call android.hardware.SensorManager.registerListener com.jiayinghudong.xiaoban:pushcore Framework API call android.hardware.SensorManager.registerListener com.jiayinghudong.xiaoban Framework API call android.hardware.SensorManager.registerListener com.jiayinghudong.xiaoban:pushcore -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 4 IoCs
Processes:
com.jiayinghudong.xiaoban:corecom.jiayinghudong.xiaoban:pushcorecom.jiayinghudong.xiaobancom.jiayinghudong.xiaoban:pushcoredescription ioc process Framework API call javax.crypto.Cipher.doFinal com.jiayinghudong.xiaoban:core Framework API call javax.crypto.Cipher.doFinal com.jiayinghudong.xiaoban:pushcore Framework API call javax.crypto.Cipher.doFinal com.jiayinghudong.xiaoban Framework API call javax.crypto.Cipher.doFinal com.jiayinghudong.xiaoban:pushcore
Processes
-
com.jiayinghudong.xiaoban1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks Qemu related system properties.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
chmod 755 /data/data/com.jiayinghudong.xiaoban/.jiagu/libjiagu.so2⤵
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.jiayinghudong.xiaoban/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dex --oat-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/oat/x86/classes.odex --inline-max-code-units=0 --compiler-filter=speed2⤵
-
sh -c ps2⤵
-
ps2⤵
-
ps daemonsu2⤵
-
ps | grep su2⤵
-
com.jiayinghudong.xiaoban:pushcore1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
com.jiayinghudong.xiaoban:core1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.jiayinghudong.xiaoban:pushcore1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex --dex-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dex --oat-file=/data/data/com.jiayinghudong.xiaoban/.jiagu/oat/x86/classes.odex --inline-max-code-units=0 --compiler-filter=speed2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.jiayinghudong.xiaoban/.jiagu/.jgckFilesize
4B
MD53e8e8c0aea0d05e0dbf5236e8186f294
SHA187bc410695a39c91ae2d7a33bdbbe47c00818722
SHA2568fb0aa528572733da3f52e4c39e956b2519f148643142a93f1188131c8d4b1c6
SHA512900432e8dfd1960a2290f8ce47d16d5172d10984d4e6ce903c498234ea5b5799475803de65c084779a4727bad167b76251632b1ef4ec0f09606c061ce12bfdd9
-
/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dexFilesize
6.2MB
MD5a9ccd0e4cb87c87b72e2c76a1e620f37
SHA13209932929539a3838cf14b748f4d0e836b50e19
SHA256799597bb3558881d1c8c846888c4cc432889039a103673ac7182ab108a466740
SHA5125090acf459a00dbdda721d032c85c287e5ee2ca14674215a31152eab52d802533e2047adea386990b868ec614502f27a74d2c8d1875c9c21e595e42b13687d76
-
/data/data/com.jiayinghudong.xiaoban/.jiagu/classes.dex!classes2.dexFilesize
4.7MB
MD5b2f543e8e981d2967328aebd7fd332e7
SHA1cb5f879cd3871648a6c760fd948265204b1a57e9
SHA25656461b9ccdfdea0250d2691c87732ac362c35d89954da68af65a5c0be632e2a6
SHA512b80f05e8e7e19d5e418686191094a4230a96a041080236b01b00951295ef197d4dff3045306b183d9d737fff072dbf562de1b15278099e08fb93a80bd801cafd
-
/data/data/com.jiayinghudong.xiaoban/.jiagu/libjiagu.soFilesize
5.2MB
MD530a464291665e86c6258ade4b98e6ba3
SHA117fe02ddc3c7d620217d11dda68a8d478879e945
SHA256376d6b262553e1cc215d6f3ea5754ef57d9133460851cbcf069bcbd27ba6b97a
SHA512b6177ad4987c1a902e111f1c098782a5865994fe7b9e8f57e4143574e6d69d9beca644b7482427bb67782b30a90b76a845b17274828c6bd6a9e5c5548c9f4cdb
-
/data/data/com.jiayinghudong.xiaoban/.jiagu/tmp.dexFilesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
/data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.acFilesize
45B
MD5fca85154a18cd13ef8021ab51d4b6cd5
SHA1a9e94af510b15a790ad23ee8e9012cd16fe38b19
SHA2565e4dde14598bdbbeb325ab1ef90fd6c4ae1461643706baa804246bbf904fb546
SHA512df6e7b33641564cf7bb974e736393c54b4b37f3389695432cbff9f0a5f06b5002a8a99514a08ad19389f80368dd53a0554bc76f4edafd4379be347919308f52f
-
/data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.acFilesize
40B
MD5e904ab3df160e53994f1bbc26f077003
SHA1ef87cfb02b3d0f32bc6ef651e4e61cd3001a9968
SHA2561264ebea4cc0087b3c585613e559fa1baf0f9ecab2445144d3f6193d7a7fd63d
SHA512c3d0241bf06f59237722ad9a3f11e1400d0c78adc45242ecd099c4dcb948c32a3741cfe170667148596c295ced03150cb4487609542440118752ea8209ea3421
-
/data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.diFilesize
340B
MD52508940b11f728c657b71e02476de9ad
SHA16b65b4dda956f58a671e05b46e699ef80e4d2f5f
SHA256a3b87ce19f02b453d5cb73e29d4212bcb0da70b0e6ebf56544eec7524207eb71
SHA51251628bf1d1fff748913816cd3f7346f5b568511e1cfb5755c20a5b74183494eec249287c33232f345f62b5f01c4db24ed18715dcf9bf4b694c1485f03121fc91
-
/data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.diFilesize
340B
MD5a0bafbb7baa42615134e60a6580ea8d5
SHA191df10fde712f62b94fe1f4b14ee35d06bf2e195
SHA256f732dbb12d851952921231d14491fa98e458b7da47cc05ea9a510ba276782579
SHA5127036d767b3b0c0c2db7245de0bb81c4daf3996d487416287f63eb06f1830de74242c64f8ae763b86993d06ab96ca82e7b4d27aec1384aa3b5c44e732761d173e
-
/data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.icFilesize
95B
MD525698041991606c38315c18160110cfb
SHA18065c98360d08e494918fb197fb44b1c176bae31
SHA2564713e0c8ee9d586355c93fba7a2b6d6c474aec7bb1af8aa7e6bb0392fa0f93ac
SHA5124a8b3b700d3787d3e40212c4ccd8d1aa9b37042018a5967e73024d9691454d62339b07bed8b7b4fcdbc8c3e27e783f4e565dff1e87834856c909f8faa0831809
-
/data/data/com.jiayinghudong.xiaoban/files/.jglogs/.jg.riFilesize
314B
MD5d88d28066deb90f52b29126b48bd1524
SHA1d4183da0f5fc68723d620ac0a6f6e6aceceaaf6e
SHA256fe90632d22b7b0f0e1b90724067d85534ed76bc2d2a928ee54d5dfd341ca16e2
SHA5128b7e82e1c5140fe3e4afdafcfe2eb79d8aea9a364df22b094ffbed0718517fd4aa47c72ab39daf754d1ff62d5105b495dd46f6f7ce838be2f92378dbb5f84f36
-
/data/data/com.jiayinghudong.xiaoban/files/.jiagu.lockFilesize
58B
MD5a42eae54337dfa8e06a922d8020cece1
SHA1ee6ddf4ed6cc4f6c9589195f227154c097427cac
SHA256a3c3a88e80a3b5d5622657026b5badcf37eff1cd84c80fcfc4511e10df2ff3be
SHA512e7d0f96b03f9c15bdffa1447ba5e171eedc5bd77043a2514784fc1637a3651f7faa08a733547f02605c9278d69575d9ba263b107aa628f04f41a880c8b4f227d
-
/data/data/com.jiayinghudong.xiaoban/files/Archimedes_p4Filesize
13B
MD5a297fbfaf743b13a418b65f1ea8e1084
SHA19670897c9f8d2464be2cb7b6354c2af053a1acbf
SHA2560b3ad5d2392545ed261f7594b5b92d03c33e9eeca76c129107a7fba45802f6e8
SHA5123f4c35407c621c97a389aa7f5490b6e6b7f576079e06b9bf2d3afb1d9572a5d293e0e2dacb66f6cdf98a3314a9e64554f7a8c7ef194969c9e072da7661d1f126
-
/data/data/com.jiayinghudong.xiaoban/files/Archimedes_p5Filesize
13B
MD54da989cd49c4964995070503ff4b56a1
SHA1aa22d831f51576325eac3234c3d6241bed90df59
SHA2565a11901189dedc611e2015802518a9e33a953b88726fb7fddb3f1a9ed6042695
SHA5127bf74247a4822a8ce8c26efa545381b31637ad13d3343eded39819b6b80fe2955ef08f0ee8b2e92c1af9538133208cccc255b7d702a4edab1039742fe67c5499
-
/data/data/com.jiayinghudong.xiaoban/files/TDAntiCheating_Switch_ValueFilesize
2KB
MD5eecccd85a7801b99704064b61915cc0e
SHA14e39b4c55b73b5cf0902de1c5087ca47d3f64fd5
SHA2565ec465894b164b45e2686ab3445a5f522dad6b90946c341eb3507da6c290d942
SHA5124a7c71b3a4154b87d43cad8473f2a9236a4dd9d19f1b2066c3f8352bc1829d9fc6debe6105b46c8297669e45faf423d7304ba398ff3002a09160cfa71f56701c
-
/data/data/com.jiayinghudong.xiaoban/files/TDCloud_Control_Cache_Param1Filesize
2KB
MD56c95c267805278bf366e38456ace7d03
SHA156ebf49a12961cc20bc51c586cc16511d2766a99
SHA2560017dbee4c7f3fd1c317126e865f43927bc22faa0c890b948efce16d4414cd1c
SHA512e3acb7057b07f68313b96782223a05540bc0efae6a31e247a9fd0c4225d420f1134fc89250adf4bc8397b685cef520bc62e27e070f50cd7dc4ebd2bc7887ea92
-
/data/data/com.jiayinghudong.xiaoban/files/TDCloud_Control_Cache_Param1Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
/data/data/com.jiayinghudong.xiaoban/files/_Ladder_Project/Archimedes_p1Filesize
13B
MD5fdb205bb1a517f190dc4011b4b9ae06d
SHA1929669a839bdedcf2758ec9b3af54d81d0c52908
SHA25642379e91dfa0a7f33a18e7c2e77eeabdaed0a72e840967430ad7ef7fd8aa2668
SHA512f406aa79994c80834ef32f9b86f44d628d642c760aac262bae655af99fc5268776de0ee8eb0af1220453999f2bc3a5b45c632495e4a3c9410ffc927ed8fd5aec
-
/data/data/com.jiayinghudong.xiaoban/files/_Ladder_Project/Archimedes_p2Filesize
13B
MD5e953419a8f70912e6302766ebc20b8c2
SHA1a638d5bf49e07bc011d56cc7ad8f1bb786beb6c7
SHA256258716239c224097e57394da56d6475606f15ec647589d7dbc8032c63cfad92b
SHA512b1b9637578e00e597991222e118818f12993b45e64b88b71e74efb65b10d2fac53b98e9a3258339b7a9a09805fec088c6dff3dc1e8dc07f74551bd1ea38d8686
-
/data/data/com.jiayinghudong.xiaoban/files/_Ladder_Project/Archimedes_p3Filesize
13B
MD5ac241ebd3440e73ffd6f3554b9ad6863
SHA13b5c748e65e9e52664205bddf2a6b69528e2856b
SHA2569193b9c539efc6b3b7e429123d90949afef8a1107f7c58fff0ec329ce2537000
SHA512caea467532e2906dfe8a0898987bfaa731ee5d9a62e5fe33af1dbd507dc70c1393d3a0cedebb4085ea47ebd19f503b946d49571d3379d9de617ecbd9d9268640
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database0SaaS/1716391190590_4274Filesize
2KB
MD57d616596512e77f5d1e983c25206e76d
SHA193d1bb9794c9100a03c0f22acde9757a5689e50f
SHA256311e19675826e652bc7874d761b7895f7b0850d301ac27cc20aa72452b87b883
SHA512f88cf6fb70a8e3ad67f113118066d5722c18467bb87d3bac23013de65042b819562ae4ceb46db3f74eb31dec1afda32174c227591bc551990951161543ea9a09
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database0SaaS/1716391192608_4274Filesize
2KB
MD5d86fbe79c568310fe8870a5e07dae627
SHA10f5d16eee15f8a037b8a404afff5b2090cb4ed73
SHA256280e63cb15a070963a78d7a31eef97803ff4c50de297af0a61a1f2ab78942364
SHA512228292a43e5b1f32d6d87404283adc52fdb4900221f794263e868818a84203200a868b05889aeafd60104d4e8b9e826a350f26beafb528a33613737a1b77d6a3
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391186388_4274Filesize
2KB
MD524d5fb572b4af20c664d0b479d0df465
SHA10dd16e3375bc188f931955115a9ad9d88148fbd4
SHA25614541c29f54d3d6e8d600bc61d4656d9bbf129698387616f7a5a78143e9e4896
SHA512525e471cee9edba4582f3793d4437047c8c35446f2a69cc6f23b90a91a7c04d8a8ce14ee1ea25ce9d283a74d258989eab4ec51dec7b05a8d02772eccfc84018c
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391187173_4274Filesize
3KB
MD50a8623190c5782c5af50cdeac9b8dc7a
SHA1c2553bf8e7937caf6e554196fb0fe5cf4f0b6dd6
SHA25601a034fc4afe15c7c1e3f24641af340bff1e7347d2fbec56647590d602073d9d
SHA512d4297aca4c929f7f5e001cac04b385047bb69fa5c91843625358b47cd0f47cdc482eaf45bebd27d9a5b61406fe52113fc5924cc48d79920d52d1f517b90f8ad3
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391187824_4274Filesize
3KB
MD534c80461782df64ed22a46979a5dd26b
SHA1290dfd4f60a29f80d14defacea47323a6ce1a705
SHA2562d54591e62b95b03ae67dbeee19f3ac8ecd504ca3f218a1f59eec07732908d6c
SHA51281fe77735847362b5960dda1ec1159c7b0b2b097500809d3b41bcda1ae9396c0967344b57e38785f15ab066b67652bf474863421b80fd876795b412bc80f9be8
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391188270_4380Filesize
2KB
MD5d2c89087fbcb869542e7d1bd60b9ceb2
SHA16d6369c4b98579f535ee7c959f6b304bea8b8eff
SHA256c6e547d5ebe598fa54fe93df553fdc0975b999903a1d9779f9d646807e7ca2d1
SHA5120a63d4d65c6a197ab9b5c7d245665528336683f6d254cc3126ab5611dd0085e73d9e8ce8f6f0cdffd57466ff45df5797fbe27583fb4565314ad4bba8e720ab0f
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391188774_4274Filesize
3KB
MD553a6f3cac21895f99dfe60432d82a50f
SHA184cb3aaf7f6a424787bced6f77e37a605aa15dc5
SHA2569f3d2aae60c3b78aceb74f35b9b3e9b0ba831b8d678f81ead058fabd5506a3a6
SHA51279f0b811c7fd889a78b52a7944806624077452571d3a75f44ed3b4804a8ba3d3528a4a7de306057fabe72aa41a62e871c11df1c5f1d49f9adb3ae96fe655469a
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391189641_4274Filesize
3KB
MD56742aaa21da7e17e98ab2aa21a109ec8
SHA1004de192762c4604a840ca3da3f5620b53cc67fd
SHA256fffe5701a15985fcc673c5df266f2ce2637965bfd6e70a5e78388a8ac182439d
SHA5126fcc267f1933aee9a2bcb1e3514ed634eddc3c957bafec18f9dea40d8fff7146744982ee1d4b8614e7079b583cf70a0b784d175a80392f4840ff9e45c2e6c954
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391191886_4274Filesize
2KB
MD5e32522d8d56eab5015ce05c4bb2594f7
SHA1869a3ba0fdc1b5ce8eca54951e05c8adffd9ca7d
SHA25680b02dfe5794316cbeb36c800265b9f8fa7a18a7b4be65a9ab640282b8965d1b
SHA5120bb00f27322d9199424fdb5ea802debb3eb03ee5682b772b3fb0310a7d0f4d6df2bebd57c1068fdc2f5084e1ef908595403a013a486704f1fcbe268674f76c0a
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391214709_4768Filesize
3KB
MD5ec1e1d12d78208bf0cd52cd2ac4eb3d8
SHA1dce02ddd75473febd4dac83c98a62b7fe2e32f86
SHA256527ab3494d76fbed3d33a029457be12385905f36e6b01ab1afbe22521959dce4
SHA512810315833dae59deadc25d4e9f2f690872537215b1dbeaf1986f4844e2f8aa7f80aab23603c6082f0463135a644b70fa82e9934a1e321c96d2f3fe8795b99727
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391215391_4768Filesize
3KB
MD5cdccdec3e5f64ad4430df9235fcd8513
SHA1c65072d404b848812504f67a8c640b9d5a6a4393
SHA2563f69cbfae77dc96bfb88ead59317480e6e8526f06652962f14372fc7c5bcf5a4
SHA5127f51b85d9a5200afcfcd8622af15f2406e836d3ee26d00f953577d22a71162a686ebb52fe070392b6c33023ba5c8a2ff7cb240eff228a97a13e480d60885e537
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391229708_4274Filesize
4KB
MD58f2395f8e4666b11e61a2de045cafcb1
SHA164c15c78bcef21838e210987dd873fdc0cf92d77
SHA25646caacbb2ca9a5be3374ae10c9bfc39bf3d5e4ee174a6c1457dbb17317791b27
SHA51245eb6f513649a9beacc64b2f8911174e34145f53677ef71a3a0e49856ba39fdb9e556da0acfd4d223f54bc18e2a8b924e78b0e630ff345f1cba7e1dab87ce988
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391234676_4274Filesize
4KB
MD5cf906337707c0bc5864764936c3b0381
SHA18ff6404c8a6b98e8b75d2b8591142339bd422e0d
SHA2566179c522eb91a3d8560b395292a66f8bb4ac9fbfd8fd85be6fd2e302f0896781
SHA512c22821574d363a82208c2fa3b99d44e9031a572e716770d01a4b6962edb04a967d8a901ab7b7bff484b402a7ef6fbe5d83832a9d096ea467ee1623ca0e3fd3ce
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391270723_4768Filesize
4KB
MD597f3b3ceecab1f75a5086c8a610a2d6f
SHA107d31e0329ffa6b38718a8f4407b5a3af79f7ecd
SHA2563f668f2bae4514c3fdd33eca16416249c3198c3d1402d2d6137f77593f692d8d
SHA5122ff051669b61d1df00d7c23c29d33d63cbe8fd96b721de352979cbf69f99da4790d2f753880a4d3901fe5e87266fd4a021678ac877b7c178f269da15cf4a5212
-
/data/data/com.jiayinghudong.xiaoban/files/__database_reborn_January_one__/td_database2SaaS/1716391275977_4768Filesize
4KB
MD50e0225d20b9a996c701ded748855215d
SHA126ddc7d563276412fdf3d0cbbe4bd15cd6a01584
SHA25638cf19881c3e4a7dee6c92810ab4b54dc15476bb8b7550d4c10a1ec54ae20ecb
SHA51296223882cf860dcefd5876cd527a8479396155e96dae5ee0c750ac15c1192133a683ba08077037c59e22c55d4b76a8f4f43763b73b5b44db0311fbdb7cb1bfe3
-
/data/data/com.jiayinghudong.xiaoban/files/jpush_stat_history/normal/nowrap/377620e3-b1b4-47fb-a516-e8b03804bb86Filesize
159B
MD5a3c2342a4ef63b225b9a206b15d42ee0
SHA1f9c044e7d23f66ac7798f9309db1931def485097
SHA25661418b2298984c511baf6bfc4738330533dd703e1fb1c25cb90cfd6e7b48fda3
SHA5123a7b711e77d4139716a6ce4059a2cd8aaa113e60f368254c9e70e9e898e4826bacdc447c5ed95216c3c474b7789971cde28b822b510cad73c608fcf4ab348849
-
/data/data/com.jiayinghudong.xiaoban/files/mPBE/ivFilesize
56B
MD57499f81b9542b8107aa511584b6cc655
SHA1449d7ae1d042b7065de2aeaa87dd74d9bce478b6
SHA256c2319bdf41e6f334344e5293d93a6466e85da982dfbcc06644aafb552b11d8e8
SHA512582e34e509d756ac9773644688da5ac78242b1c452394e78f5621fbb7d929bb58d217c75170dd925a9e32b2382d4a60782d5029a481bea96794665f94dd6cea5
-
/data/data/com.jiayinghudong.xiaoban/files/mPBE/saltFilesize
120B
MD5a452e50589f98dc3720cef907a40fe86
SHA197cf069ba3718a049beb6d988640ffb055f51087
SHA256ed83fe1adf80bb8d7d4a1f145fcf56dae88db89d0ab87679eaa7202b38ba7ceb
SHA51234cda092d7766c8acdd9d00fe47906ae7ce3481187010e684d9887120132b17bd25739e5622803525b99f47b18e792dc55d8cd361b69f2bc84abf7e21a0b3739
-
/data/data/com.jiayinghudong.xiaoban/files/objectbox/objectbox/data.mdbFilesize
12KB
MD50580c5cb7b97b3598c96785262a4fdfc
SHA18a595dc8d8bf34127ad2adc38956d74fdf61d19a
SHA2560b639d63696e9e330bb0959300cf25c98a33dc4be3b8d7b8db1ec965894472f3
SHA512cd53af9c418aa67365552d9b66f32fdb0a33ac7449f0a1a74da6ecf456efeb90ddb139076d87cbb9a7b0049f782acd8790e9a75ca892e92fb868b7f55bcd1aad
-
/storage/emulated/0/.tcookieidFilesize
3KB
MD57c29f51784ee61391c234d6d178f370e
SHA1eb5817ff5fcff4ce7c503d11fa3532c2657d00a1
SHA256f3d79d7d113ac64db9fe0aa3355836a5ced045f9521fec514c09c8fecf5db0a0
SHA512bd89837503cdf640735e3b9b110e74ef931852c8002df62eb74bf76802f959d2372166c9cdaa50e97bca0b46cf5debff03f183c5692a52dce6b274a885ffb435
-
/storage/emulated/0/360/.deviceIdFilesize
48B
MD51d8d16c4e3b19ebf18988530d9b9a757
SHA1bc94c1cce05cd848a53271ecb9c5311e27ffebf5
SHA256abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7
SHA5124562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82
-
/storage/emulated/0/360/.iddataFilesize
32B
MD57c3f0bae0adeaef5b6c0a81123b6a80c
SHA186ec4736f8518d868aa0800491e6c0741ed5e248
SHA256a1887a2c2f16142aec6ca48a316dc94c2e4c17b7681b692db35db909e5d0341a
SHA51212853e041ff02921467850bd4a42985e6b4598cb16275fa7edddbdcc1df6f4a5d8f9d7984e9722dd94e9fb0dbb6da8df6b6a91753b775a97f47389589a11fb2c
-
/storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/app/log/demo_20240522.logFilesize
4KB
MD5bd84b705a59ff0f7affc873933a32ee0
SHA132556a949a154efdd93fddc4448906680eeb8f2a
SHA256ae6da60b69a64795baef8b1dd40c27a21e1da43fe4e5c4c7d100a2df0ac5dbf9
SHA512f3a29dda3c98b0b21b74b4ec75ae3383dbedcde995e0c700bf1465332eb79cef84c06920376393023a73c111ee62e3593dbcd35cdf01cfef48ea2efbdaf81ed4
-
/storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/app/log/demo_20240522.logFilesize
45B
MD5154519022d1d8639964da4b4022e5615
SHA1860f9f666e78a9fbf20a6a896ef9d70a7f70ab0c
SHA256632a59dba7354220008043dd9061d99415f5e538ce45fba190179d282d2f9a9c
SHA512898cd2cc7642ef296beead6e511c9113b65083f58be8e81690b2a44941a97fc147c2e9a9ce86036db839657c77dc821876b63c8b62958e37aedc8d2330f61f41
-
/storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.logFilesize
3KB
MD51c19d2946107142901b79e5d19e90a4d
SHA1fb87a5dbd58ad4042017d09f3676cb8ea3b8ed50
SHA256329f616a44c2c1c9c27a13240fa8b6c629a56b34a75dca2b5e4ac6395988428b
SHA512eb31e2f277d55798ea14c8aa80ecefca91ab626c4ed50bcefff6f3c788ea376f0a0f90c2ad73d9dcc94c7a3e248761bd32c8a4cff3b8f6b88d79c50a40e0d55c
-
/storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.logFilesize
218B
MD52ceb3f3f02b57776639a71d7de2bc58c
SHA1f04e57a5f980bdd15ce67403e810bb6f8d95bdd9
SHA25655cb3b546aff36a6f7af18fb71891d6793e9312606564994f97f300abb0f04a3
SHA5127e344498494daf5a682581de55fdbcba74e5f5dda993d6a20b59eb41f2d6244adec2cee8cadfb54324a8471efa0918bb457e234930d51c006e41df5305cf7f79
-
/storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.logFilesize
3KB
MD5f7aea276fc63f2d12573efb7072bab5a
SHA19d7c273778bf066e7e19aa308ae5ddc2cf9dffb5
SHA256342b26c32033bf914aa40c41da58e47cae155cfc6c0f07ae449fd21ba91351ef
SHA512d22991831cd51ff8abb74065335ff0c20937348383714fccf7f2d5d26687ad948e9a91e1bb162014bba26090ccca5b674bbb29d5865af82d7e919e60e10ad53d
-
/storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.logFilesize
94B
MD5cd71bf6d03dbe6b9404e733fe9f3a085
SHA1d09888daa123bb3e0a691e6648e8ee274558eaea
SHA256d46164de485fd52d1b3d69093cb8402811b8def888227a7bbd03ef6e812cb86a
SHA51253e6a4087a57083e8d2e07d80ece7ebe6d48f95329748995dbf69f0f639bf9fa60b68c4b0bd1f1f82f7adf2be2a986a31f3fa8a86b2a9e3814719fcd66cd5a97
-
/storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.logFilesize
79B
MD5ab6c9f5e021084fcce48677aaeb141e7
SHA1dcf5733446a1dcbe575e2d5d3d3406aa5ed598e9
SHA256c3178d6ae24a4e3e06a22829cf7b6b0532bc758380a1efb08648b2066efd4bc6
SHA51200cf684a90ba563181bf74cbf76426ce1faff3e37424478d423ed61fd6bd7ff5e359aac5b2bb011236ac8a7a5ab313fcdc62173fd6a5f65665a94896dca40d0a
-
/storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.logFilesize
2KB
MD5ae683075f59780d17054c3d0efc5503d
SHA176e1e8ec876602df0b17e4cf0a00d0836a842776
SHA2566f71cc8070dacd8c484eeffc740715272bb11a47b1a7be57515b3fa4f0387fb9
SHA512284ac9fe8eeb53f9de282b175d72c80b53998917b2a3a26d95b4785b339c32107375c80ae52ec63636af213239b017d1e09a28f3dc3b26b2bc9b2aa0ac680e46
-
/storage/emulated/0/Android/data/com.jiayinghudong.xiaoban/cache/nim/log/nim_sdk.logFilesize
65B
MD5e21ea477c4ceec42f076a7d920060dd5
SHA1edf3fb6a944cc6febce2dea8599190884e172fc6
SHA256cfae639f47ba448a5bc923ae5ffe1e2274384328647667d5c6fef5e160378beb
SHA51278425e29e3ff33e83e773568712c4be78c4c97fd2ef53231e43c7c8557a3650ab6e266a26255c4c794ba6a3850642ebeb49edda5b8f016459638dfb1c6840931
-
/storage/emulated/0/data/.push_deviceidFilesize
32B
MD55f7407eff7f1efbbb0ff755f2ef0f100
SHA15aed937a1f5041544351d89961f8255e1fe2158a
SHA25608cf83a0cd13f8122562216d361ea0c2a2561682e686d2c7ab15a0d482465662
SHA512db574da934cfc8dc4af30ece0e4c74fc8b194da6833bfcfbc5e7a28e9ab2394a95acd83e338b8358751516713cd8f5e22a298b84ae4a206b3aacea04ea8fde6e