Malware Analysis Report

2025-01-19 06:55

Sample ID 240523-rapteade2v
Target 6b2b06dd4a7a54a382115a8ab7717d64_JaffaCakes118
SHA256 4495fbbd10e073de7ef78abee8941b916738175c7e4e78f38b4c8af3fe4cf04f
Tags
banker collection discovery evasion impact persistence credential_access
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

4495fbbd10e073de7ef78abee8941b916738175c7e4e78f38b4c8af3fe4cf04f

Threat Level: Likely malicious

The file 6b2b06dd4a7a54a382115a8ab7717d64_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker collection discovery evasion impact persistence credential_access

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks if the Android device is rooted.

Registers a broadcast receiver at runtime (usually for listening for system events)

Queries information about running processes on the device

Checks memory information

Checks CPU information

Queries the mobile country code (MCC)

Obtains sensitive information copied to the device clipboard

Queries the phone number (MSISDN for GSM devices)

Loads dropped Dex/Jar

Queries account information for other applications stored on the device

Requests dangerous framework permissions

Queries the unique device ID (IMEI, MEID, IMSI)

Checks if the internet connection is available

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-23 13:59

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-23 13:59

Reported

2024-05-23 14:04

Platform

android-x86-arm-20240514-en

Max time kernel

162s

Max time network

183s

Command Line

ru.samiy

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A
N/A /system/app/Superuser.apk N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/ru.samiy/app_working/facebook.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/facebook.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/flurry.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/flurry.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/startapp.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/yandex.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/startapp.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/yandex.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/adcolony.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/adcolony.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/vungle.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/vungle.dex N/A N/A
N/A /data/user/0/ru.samiy/cache/1582435991586.jar N/A N/A

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccounts N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

ru.samiy

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 stats.unity3d.com udp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
US 1.1.1.1:53 api.appodeal.com udp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
US 1.1.1.1:53 googleads.g.doubleclick.net udp
GB 172.217.169.34:443 googleads.g.doubleclick.net tcp
US 1.1.1.1:53 impact.applifier.com udp
US 130.211.33.175:443 impact.applifier.com tcp
GB 172.217.169.34:443 googleads.g.doubleclick.net tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.204.72:443 ssl.google-analytics.com tcp
GB 172.217.169.34:443 googleads.g.doubleclick.net tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp

Files

/data/data/ru.samiy/files/gaClientId

MD5 beab4f31b6f884555ccedaeb7ce027fc
SHA1 3dd470020405e59bde7f754bad2e7c5534d6559f
SHA256 f84133f0a310dc8e6464c7d5c0dab5cdebead3c0a7c391d0d57292632cf0969d
SHA512 f97d2b7436dec12beea19168f7b09326b73019963b29ab6f5e6a558d53b01f701398990213a3af10142845f3ebd88f6eb437d4616b9c99579439046abd713a0a

/storage/emulated/0/.appodeal

MD5 88278dd6f1c310e699905218a9161893
SHA1 616e70e35b2ce06b150fb71911606ea34fa100b6
SHA256 469abedf5797bb56f1afa35a227eba1d8f7b3e22c99426e527da4b0d839dde15
SHA512 86b75a46ffbd2c5f9d3dc8c3a3ab8c52a5a93ae22c669c3f20b7a715be6875af0fdbe25e7899e6b4c8ec9d328b634d2674d5749c2174ad3af0e95b3483fbb106

/data/data/ru.samiy/app_working/flurry.dex

MD5 323bc8808355cb3f103ddd69bdc68827
SHA1 a1562b4b5a3d93315a56506c5b82448c9c711220
SHA256 063d9bb14b2f8c90d9b876e6756e10d1bde67bff000224ddcc076f20555db1dd
SHA512 452c4b8db3cddb33d56dee3460969addced4382ace85275b414f2276a7f04e05ac82e61548d6a3075c1b7e731f9114a2e95f053e6ef0d4fcac3705df83cb300d

/data/data/ru.samiy/app_working/facebook.dex

MD5 bded5ff06b05d91bc98fa8444b9035e9
SHA1 a55da71119c6c2ebac9c0b635c112900292cc2d3
SHA256 c39d0a1069340803fd36de4e679ec864f8e5b15b3c3f114e3d0ccf105a9a2ba5
SHA512 b0fb71452b2a98390af7c09f9a2a1f894d171a8c10d20efd88d4b0297f3918e7733bfe3c0880c346aba235bcec0bc824499472b84c554aa2909fa6f67cdcd917

/data/data/ru.samiy/app_working/startapp.dex

MD5 458a8f63830e30d8a81ea5985ce36c16
SHA1 a4390ba097aab62274be43c783ef1133cf01d133
SHA256 a9a2aa5882fe44d7f26cdb0b85008601cbefb514277a63e42a98350a4f5c4cfa
SHA512 b89963f7ce3db75fbefa61ba630471747b61772628ce724c4ff81ab378767ece0d8bcd7ba9ec861ec6ed6d31414e0fb4c93525b20fd7446a64b88a306a2fdf91

/data/data/ru.samiy/app_working/yandex.dex

MD5 6212fbe3065327953a1318a687ab02a6
SHA1 d82e7d7398958dec5cedd78d7807045fc6e030c1
SHA256 8c88aee708cdb9f46abb80d671c043470a9540e628d28e2b9a64a6de4f709070
SHA512 4c6fff8722bb458f4d33bf064d28b6775c4b0123d35784fdd8146cbe74f0aa3b0d6446a47a6beebfaf4163fba83f9d3351d7ec1573b88d970b6bfa052f28a84f

/data/data/ru.samiy/app_working/adcolony.dex

MD5 256cc19df120ca7656151cb749990a8a
SHA1 a87a5dba2eacf71ba631e9e10475fc6854a19019
SHA256 69be503bc8e9ddef4e7262f81ad12d069544bda6756f10d59c4f8061f68b581c
SHA512 c17d8ff43e06fa593cb9aea46977178fc6c5eed8438d244fc96c1771edf35169fef6c3eab6d344cf5c8ac46d9fe41da89b17d479be9c41ee492d3fe20fca11df

/data/data/ru.samiy/app_working/vungle.dex

MD5 037372059a90ea133b7fd0e740df3e04
SHA1 122bc2f30bae8043f5c68af95a6c898313f5b74c
SHA256 a6ecab5c3c0e321c565894ff3a08bdc0355540fea4fc0621ce16f7fbbd9b763b
SHA512 e2e911f16ec4d9dae4b0ab98514929efa8c6993d626e51c127364eebfeddeaffbaeb2aa5981190bbb315065ea3eba970d5909c769fbe5c34c92ba5774f6daf3d

/data/data/ru.samiy/cache/1582435991586.jar

MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

/data/user/0/ru.samiy/cache/1582435991586.jar

MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

/data/data/ru.samiy/databases/vungle-journal

MD5 c154b4720ab380424b9643942b48daa8
SHA1 15623a848ed72d0a9d948499900ffe448bba5978
SHA256 1691060dd1750b69abf720bd2ea954963dddfc2063d96d094c4fc576ae245c29
SHA512 f6c50be722ccfa8e2f553ec1ab0c24a6cc03aa9788bcd9be02631f4773b1a0f03a0285e292a8c00059e5424a3657261f76d902e889b9383662581c14b9de15e4

/data/data/ru.samiy/databases/vungle

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/ru.samiy/databases/vungle-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/ru.samiy/databases/vungle-wal

MD5 bc39416633bcaff5fb6c8ba8b1d9b6b8
SHA1 3a491c71b3f745880ef6e0902a9e7f69ec830a33
SHA256 155296ecb631c80390e07c276bc75e4db58a55158fb2d928f4e84fe2666b77ab
SHA512 71d7dee168ae9fc0c14d8f7c16958d5f374fdb9b736327f7b9a04674bbd687de3ef00be81f0a852c2fae69ff185d7812e504f89b6204b78fee4af022e77373cd

/data/data/ru.samiy/app_working/oat/vungle.dex.cur.prof

MD5 34c9f0e27e810b10624cebe2d995c17e
SHA1 a197553d8f8adf1ff563ea0e8b24ff9a34977d6a
SHA256 b651094d9d6b0e60baca18dafdaa9a6c1720df50bc4157a6fafebf81b6b5b9c4
SHA512 bb6b92fb9ed060a7af2ffa84b1fb7acdb8723263a993fe7fee8ba291666cfe329ae4f67fc7f86a2eebd5d1559014a43b67acfcf1a11cc1b4f0b969a83405f8d8

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-23 13:59

Reported

2024-05-23 14:03

Platform

android-x64-20240514-en

Max time kernel

165s

Max time network

189s

Command Line

ru.samiy

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A
N/A /system/app/Superuser.apk N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/ru.samiy/app_working/yandex.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/yandex.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/facebook.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/facebook.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/vungle.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/vungle.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/adcolony.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/adcolony.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/startapp.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/startapp.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/flurry.dex N/A N/A
N/A /data/user/0/ru.samiy/app_working/flurry.dex N/A N/A
N/A /data/user/0/ru.samiy/cache/1582435991586.jar N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccounts N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

ru.samiy

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.10:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 stats.unity3d.com udp
US 1.1.1.1:53 api.appodeal.com udp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
US 1.1.1.1:53 googleads.g.doubleclick.net udp
GB 142.250.200.2:443 googleads.g.doubleclick.net tcp
GB 172.217.169.14:443 tcp
GB 172.217.16.226:443 tcp
US 1.1.1.1:53 impact.applifier.com udp
US 130.211.33.175:443 impact.applifier.com tcp
GB 142.250.200.2:443 googleads.g.doubleclick.net tcp
GB 142.250.200.2:443 googleads.g.doubleclick.net tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp
NL 213.196.45.156:443 api.appodeal.com tcp

Files

/data/data/ru.samiy/files/gaClientId

MD5 21c42e33ab1edeab2f21f6f02c9e341e
SHA1 6edce5d383a6563f55e128ff98ca16fc8b5a1977
SHA256 880c36e7d72fe4cf7573a7538eaa4524c951a4853a28548264feb15eee8cce35
SHA512 7432d4b338c7c849a34a3c5cffc4398fb3dce82aae407e030365ea6d0c7bda13a4e3d1565aa0b47bc32cb49360107b93bae5a7f077196f2d3b81cf37e0ed160d

/storage/emulated/0/.appodeal

MD5 88278dd6f1c310e699905218a9161893
SHA1 616e70e35b2ce06b150fb71911606ea34fa100b6
SHA256 469abedf5797bb56f1afa35a227eba1d8f7b3e22c99426e527da4b0d839dde15
SHA512 86b75a46ffbd2c5f9d3dc8c3a3ab8c52a5a93ae22c669c3f20b7a715be6875af0fdbe25e7899e6b4c8ec9d328b634d2674d5749c2174ad3af0e95b3483fbb106

/data/data/ru.samiy/app_working/startapp.dex

MD5 458a8f63830e30d8a81ea5985ce36c16
SHA1 a4390ba097aab62274be43c783ef1133cf01d133
SHA256 a9a2aa5882fe44d7f26cdb0b85008601cbefb514277a63e42a98350a4f5c4cfa
SHA512 b89963f7ce3db75fbefa61ba630471747b61772628ce724c4ff81ab378767ece0d8bcd7ba9ec861ec6ed6d31414e0fb4c93525b20fd7446a64b88a306a2fdf91

/data/data/ru.samiy/app_working/vungle.dex

MD5 037372059a90ea133b7fd0e740df3e04
SHA1 122bc2f30bae8043f5c68af95a6c898313f5b74c
SHA256 a6ecab5c3c0e321c565894ff3a08bdc0355540fea4fc0621ce16f7fbbd9b763b
SHA512 e2e911f16ec4d9dae4b0ab98514929efa8c6993d626e51c127364eebfeddeaffbaeb2aa5981190bbb315065ea3eba970d5909c769fbe5c34c92ba5774f6daf3d

/data/data/ru.samiy/app_working/flurry.dex

MD5 323bc8808355cb3f103ddd69bdc68827
SHA1 a1562b4b5a3d93315a56506c5b82448c9c711220
SHA256 063d9bb14b2f8c90d9b876e6756e10d1bde67bff000224ddcc076f20555db1dd
SHA512 452c4b8db3cddb33d56dee3460969addced4382ace85275b414f2276a7f04e05ac82e61548d6a3075c1b7e731f9114a2e95f053e6ef0d4fcac3705df83cb300d

/data/data/ru.samiy/app_working/adcolony.dex

MD5 256cc19df120ca7656151cb749990a8a
SHA1 a87a5dba2eacf71ba631e9e10475fc6854a19019
SHA256 69be503bc8e9ddef4e7262f81ad12d069544bda6756f10d59c4f8061f68b581c
SHA512 c17d8ff43e06fa593cb9aea46977178fc6c5eed8438d244fc96c1771edf35169fef6c3eab6d344cf5c8ac46d9fe41da89b17d479be9c41ee492d3fe20fca11df

/data/data/ru.samiy/app_working/facebook.dex

MD5 bded5ff06b05d91bc98fa8444b9035e9
SHA1 a55da71119c6c2ebac9c0b635c112900292cc2d3
SHA256 c39d0a1069340803fd36de4e679ec864f8e5b15b3c3f114e3d0ccf105a9a2ba5
SHA512 b0fb71452b2a98390af7c09f9a2a1f894d171a8c10d20efd88d4b0297f3918e7733bfe3c0880c346aba235bcec0bc824499472b84c554aa2909fa6f67cdcd917

/data/data/ru.samiy/app_working/yandex.dex

MD5 6212fbe3065327953a1318a687ab02a6
SHA1 d82e7d7398958dec5cedd78d7807045fc6e030c1
SHA256 8c88aee708cdb9f46abb80d671c043470a9540e628d28e2b9a64a6de4f709070
SHA512 4c6fff8722bb458f4d33bf064d28b6775c4b0123d35784fdd8146cbe74f0aa3b0d6446a47a6beebfaf4163fba83f9d3351d7ec1573b88d970b6bfa052f28a84f

/data/data/ru.samiy/cache/1582435991586.jar

MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

/data/user/0/ru.samiy/cache/1582435991586.jar

MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

/data/data/ru.samiy/databases/vungle-journal

MD5 b0893c26b36ccb2bbdd750b097d2c8b4
SHA1 d74c1367477717c8d2ba302c2c9ff158b1bcd4cc
SHA256 0ec1aa613a20b5fd29421131794f6dbc6c8e774c2571384c5bead4fc45d7ce0f
SHA512 d3e611ac4eb587810c41d783fde0cd9a1af5d10c638e6be8413670d5ef98eabc233d2be6836209dc4b1ad8bc6a718bdf5cbb9050bc501d88c68e874515b78513

/data/data/ru.samiy/databases/vungle

MD5 54948bf83f90406e346548a23b9fc9ea
SHA1 1b1af4eaee489be6b127d47c927fc191bc94efee
SHA256 f2e99dbe4416a9852863f57132f5b7ba030924c591dae87d0ce9660cab6f767c
SHA512 a2a7e3a015c3bcf8653f189fc17014d40406f57cb6e385a490d4214b5cca4584f77d9d263c612d3ce09744ea9721a5f527589192e4c660a894619080ac02215a

/data/data/ru.samiy/databases/vungle-journal

MD5 b2684f063b9015d9bfef192020f67802
SHA1 2e76b62a93ee5fab1371d215341eb9c9143bb0e3
SHA256 7e57dfb7475c1eb90ab5ef9cad8584aeaac30f8ca0df38cfaca7a3faed431671
SHA512 7c9ee01e2c245ee8e7ecab668c67ed4c4b1de901177407e9aa896f8fe3279436715590fc39aedbe92503ce84e3f8bb38bb166083125ad2bbdaf42e28d9673a3c

/data/data/ru.samiy/databases/vungle-journal

MD5 90bc13b173b4f7261e0ed28fa4c42c02
SHA1 f963cca6b20b7ee6624923d366cad706607f80db
SHA256 a7b178ad94b413d5d20c73fa3d4ad1601875356b5102a942cda6d395d1f5d9cf
SHA512 7cc9ca4de4b8928f82ec533e93397c5bbf800d12dd19c9a8c531061060d3a177f5573de9c5b0cf44877ca2208b86638fbe3ef90fd35fc306cc35d843a6cb6331