Analysis

  • max time kernel
    174s
  • max time network
    186s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    24-05-2024 02:30

General

  • Target

    6d1090475dfafb583e9906e39e2bdac1_JaffaCakes118.apk

  • Size

    31.2MB

  • MD5

    6d1090475dfafb583e9906e39e2bdac1

  • SHA1

    e7653db3659220ae12faf35d9787ba42b23ff2ca

  • SHA256

    816aa0e670012ff7a9e91fbdd65c56754c32ca54ea1793b9bb6921fc19ad98fc

  • SHA512

    a7b9c63e6acd7c983aebb111890d4c648ad4452d551b12c4e8a53450fbbc0a95b68d75516b97edaede4a0acf9c7c91bd47f950573230baf942e8592f47a80108

  • SSDEEP

    786432:e99WT2BhtlANLzRGMHnS2a6oczh1Bvhsfs75JV:e99WT2sJtHvHockfslJV

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Checks Android system properties for emulator presence. 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 2 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 13 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 3 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about running processes on the device 1 TTPs 6 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
  • Checks if the internet connection is available 1 TTPs 5 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.hlys.hljjddz.vivo
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4293
    • /system/bin/sh -c getprop
      2⤵
        PID:4968
      • getprop
        2⤵
          PID:4968
        • ls /sys/class/thermal
          2⤵
            PID:5184
          • ls /
            2⤵
              PID:5218
          • com.hlys.hljjddz.vivo:lebian.base
            1⤵
            • Loads dropped Dex/Jar
            • Makes use of the framework's foreground persistence service
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            PID:4366
            • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/lbmust.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/oat/x86/lbmust.odex --compiler-filter=quicken --class-loader-context=&
              2⤵
              • Loads dropped Dex/Jar
              PID:4406
          • com.hlys.hljjddz.vivo:lebian.dns
            1⤵
            • Checks Android system properties for emulator presence.
            • Checks memory information
            • Loads dropped Dex/Jar
            • Makes use of the framework's foreground persistence service
            • Queries information about running processes on the device
            • Queries information about the current Wi-Fi connection
            • Checks if the internet connection is available
            PID:4485
            • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/lbsdk.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/oat/x86/lbsdk.odex --compiler-filter=quicken --class-loader-context=&
              2⤵
              • Loads dropped Dex/Jar
              PID:4527
            • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/lbui.jar --output-vdex-fd=46 --oat-fd=48 --oat-location=/data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/oat/x86/lbui.odex --compiler-filter=quicken --class-loader-context=&
              2⤵
              • Loads dropped Dex/Jar
              PID:4775
          • com.hlys.hljjddz.vivo:mbx
            1⤵
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            • Checks if the internet connection is available
            • Schedules tasks to execute at a specified time
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:4587
          • com.hlys.hljjddz.vivo:channel
            1⤵
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            • Checks if the internet connection is available
            • Schedules tasks to execute at a specified time
            PID:5037
          • com.hlys.hljjddz.vivo:lebian.dns
            1⤵
            • Loads dropped Dex/Jar
            • Makes use of the framework's foreground persistence service
            • Queries information about running processes on the device
            PID:5340

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/data/com.hlys.hljjddz.vivo/.lebiansdk/lbmust.jar.ext
            Filesize

            69KB

            MD5

            993b627501769474ddf9105ce850fd27

            SHA1

            1a99da904131ae38cc30230bd7a6b775e9f3de90

            SHA256

            bc5a1168b0ff68c224878929d0c552900597980c36352bb095afa17af25ff687

            SHA512

            1906c545ec165fc99d980bec54ea172499a0994ed6deea6454a19b3151ed162b914dd3d61a24e216f67454d0e3f7cd51020a646cc0f1a0988bd7d1690d2fd4d3

          • /data/data/com.hlys.hljjddz.vivo/.lebiansdk/lbsdk.jar.ext
            Filesize

            729KB

            MD5

            ba540ab3ea6f424314afd43cdcaa3eae

            SHA1

            734fbcf1bc5d1dc6b0c841e5cc3c3456d7d4cddf

            SHA256

            c3cfd57c42a8f7ebb21e0826ca43143acfc4c0528420cdb8a36027c53157c6e7

            SHA512

            3b78bf1b0a91999f93e5479692210cefc5bb31d4cc9a002e9704b59c5114ad0ee8d231a30be308782dca1c0e892f69070dc7c0784ef5323b5e087ae3f13b1d27

          • /data/data/com.hlys.hljjddz.vivo/.lebiansdk/lbui.jar.ext
            Filesize

            218KB

            MD5

            9ada0cbcf358b4e7546b164cefa7fc63

            SHA1

            6ff73278d5e013a66743808aa336588fe68f3b0b

            SHA256

            1d7e1dfe450a7586e0858cb0f8d0bd0a129659f293831568660907902e08004d

            SHA512

            fc8a5f5cf38cbe62f3f7808fa78124ec1ca242579b0b0fc911f8ca503e5d7fedc057a01bbcee1467f4a8e4a470399ab61e266b0aafea6ccc2578f25a972c340b

          • /data/data/com.hlys.hljjddz.vivo/.lebiansdk/lbvmrt.jar.ext
            Filesize

            1.4MB

            MD5

            0b0fb5c2f3e522c699dd244e53052674

            SHA1

            cd40c8305edd8899921a7fa5f0cc63f76cb19466

            SHA256

            4cf176c284aabe500128cf91144f6ddb61f2fd890306ec91666275d12b963576

            SHA512

            5fa2d6d41a8146853b07fa17bd1b44317f719ef37f9809de4c885f819cdbd6eb7b9e07f99aa527084db89ddaf52524b04c944086ae8278d1acb7b5a1b5524669

          • /data/data/com.hlys.hljjddz.vivo/app_06851326-179e-4f06-8472-d5e78a1ab259/be7b7b05-7ca6-433e-b4b8-e26585aa3a9b
            Filesize

            94B

            MD5

            ac66d58ddabc53ccd1525b8f0d289d0d

            SHA1

            9e2185a6c12f88bb10443202b73cd3f2c41f7005

            SHA256

            ad9558493bba19053823079b3ba169d3dece407e2e8d9f959f512ac36d2ef1e6

            SHA512

            98416daab37637a35deffe2aff7fb08c3d155f3a8e945f4d7aab4cb385928c688897b4837618554a2c9bc59782d79688673fe8484b69bd98d2dcd9e66ed22878

          • /data/data/com.hlys.hljjddz.vivo/app_crashrecord/1004
            Filesize

            232B

            MD5

            932a451ae79287ad46192a2b3050af69

            SHA1

            85a174bf51c42a3bc7b670951b038386923d0af9

            SHA256

            3a75ae7b7e1d0660f6c1a1ff8eb34394c48cf91e6a002a49367475ef33013b22

            SHA512

            b80de134b6c3df1f6d3dd061e294a42dce218c45dcf4b3ccbb3601623b92994d472e2e3e972c6f5a4a8882bcfe48a68418bad34412f08927cb8e099f3e5612fc

          • /data/data/com.hlys.hljjddz.vivo/app_crashrecord/1004
            Filesize

            58B

            MD5

            0d210bfb2a0e1f1b4c082a6a0f79de07

            SHA1

            bb8ed9e364db79d1d9f2fcde3f15091893222faa

            SHA256

            988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

            SHA512

            536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

          • /data/data/com.hlys.hljjddz.vivo/databases/MessageStore.db
            Filesize

            4KB

            MD5

            f2b4b0190b9f384ca885f0c8c9b14700

            SHA1

            934ff2646757b5b6e7f20f6a0aa76c7f995d9361

            SHA256

            0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

            SHA512

            ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

          • /data/data/com.hlys.hljjddz.vivo/databases/MessageStore.db-journal
            Filesize

            48KB

            MD5

            d59327f52f79d9abed295706bdc5f4bb

            SHA1

            122c3435343293eca1b17717c9269e0784d77e5f

            SHA256

            4ec1d405ac869cfccd26f15badc83da35d6dc611598b925a150ee29a1c305f8c

            SHA512

            23d2fbee7686aced9c9f2cf01d318bb1686b8fc2fbca1e0460956050d0645a1943cc9af1b7b584e6ee03de03105d4f5c7d7d5ea762f8dc9587c97a45d7ad1393

          • /data/data/com.hlys.hljjddz.vivo/databases/MessageStore.db-shm
            Filesize

            32KB

            MD5

            74bdd31a075afb0c7b9bb0696a1a3931

            SHA1

            8540a56b8fbe27625ede1439579ef4177ecfaed2

            SHA256

            962f10bbefa74681caa44b35f24dfa260fde03b6df14a38048e94d39740d5f5f

            SHA512

            de86c6a81305d8d672458d7ad99fb17ebb192854dbf5013a4dd77c3626d59e8d82fb032218881e12e144c418f9e6ed89d3c41dd21afc2fed70355f97678ffbbf

          • /data/data/com.hlys.hljjddz.vivo/databases/MessageStore.db-wal
            Filesize

            48KB

            MD5

            322e3af25346413111db477d1849af8b

            SHA1

            f74276dfce5c0ddd8f3fe68f44b3f26eb87d7662

            SHA256

            18e654cc266c775cb4f55dc23a83e2549306f90551c0e7f03731b17fac0aa6ec

            SHA512

            2b3febba6e97aa39d77f3bd293e50539085519b11097d3443e594c244a1282be5561de7b045826689fbd187a8bdafc326930f377deffde41dd7f5f11914c94c5

          • /data/data/com.hlys.hljjddz.vivo/databases/MsgLogStore.db-journal
            Filesize

            512B

            MD5

            9ce0d8e854b0ce5b0c67ce255834c35c

            SHA1

            89a769c51083cd34019722686d386fe198ea4837

            SHA256

            d494d04669ec11c84357f32bbbdc1ef1d0f24be2780e5430f398f895e8935464

            SHA512

            af84522bc8bc992906979131f10c4828457e7be058529086194fe0a9fe5566ef2aba149ed1a4b4015424dc8e7934e0c85d544a62276133695acfd32e6ec1eeb5

          • /data/data/com.hlys.hljjddz.vivo/databases/MsgLogStore.db-shm
            Filesize

            32KB

            MD5

            bb7df04e1b0a2570657527a7e108ae23

            SHA1

            5188431849b4613152fd7bdba6a3ff0a4fd6424b

            SHA256

            c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

            SHA512

            768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

          • /data/data/com.hlys.hljjddz.vivo/databases/MsgLogStore.db-wal
            Filesize

            68KB

            MD5

            c08b7b721231539083c00506fc87b97a

            SHA1

            11557bf91cdfa953e2e8c0f2ddc88f19cfa692f4

            SHA256

            47402f9b98f96bf0a4e537571dfec8be7e434ebb63ccc8c958f9f17de65601c2

            SHA512

            59416b153a99368945ddc0b82178944cf41c7f8c01bba79afee19ffff0ca7753d3c994aef8f115b3fdfc7825e3a7906fd341cfc5a7749fb8c6e95aa022353ddf

          • /data/data/com.hlys.hljjddz.vivo/databases/accs.db-journal
            Filesize

            512B

            MD5

            5f5d3d94d43bcdc83bc2b1f7234fd9c8

            SHA1

            08a8098406c12b4f9ab36610e28931a5c2b90507

            SHA256

            a045b9b501039e0c988088ebe02633cb0773593c68b08f37e67aff7dfb83a2b0

            SHA512

            d1059fffd735fde5a0122e6cf589743333dfd573e8b6dcd262777b1d30b3475fc812b15729c74967677cac3c3d466696c0f4ddedd1938d27ba4d80ee330b0930

          • /data/data/com.hlys.hljjddz.vivo/databases/accs.db-wal
            Filesize

            32KB

            MD5

            7ea4390ac0e181c490782efdf4cec75c

            SHA1

            24bd18179a1378facd94b50bb20f4d1bd2957e50

            SHA256

            e59bfed08cb92c8a8c91a1c4b6c8292583b920733c49934ad9a1ba33d1d5bd62

            SHA512

            b3fc5fd05fe5d5a957272c66edc2d796f27618402e08296ace2989ecbfa7e47c0ad2c7979db7bb4d0db4504ec0e83e84f719c35c80fc320aa5f7580e82df39b7

          • /data/data/com.hlys.hljjddz.vivo/databases/bugly_db_-journal
            Filesize

            512B

            MD5

            c0e681155e30f4ac0abc36662ad6645a

            SHA1

            446e25b234cf0d8ededb05ff491d655a470acd5d

            SHA256

            d130424c082eb293d5562ed95216750895b8ed4fb82a21d7b6741db910d129bb

            SHA512

            929bcec018baf3fc5385a5c115fab436eed47ad86a136492970b32e59411a3397b8d885f3d5d193c43e337e775c613e8c4f97fd2b9726666bd93dcdd3a0cad9c

          • /data/data/com.hlys.hljjddz.vivo/databases/bugly_db_-wal
            Filesize

            68KB

            MD5

            9dabd0e7b5b1c656b8de48580272b371

            SHA1

            e551414b4b250de7065b704b07705e4d5523919a

            SHA256

            56a0d8a12df485f35d29e80316e6f85f0ef7ab549b2886541238bee83fc6eb27

            SHA512

            b5a742fe31eff9c249cdcfbf1f5114fd8878b8fd7e728af9c8151b57dee2c0358c6c61ee757cd214d19762b8d7da000f4cde4163248910fb0f6f743021a51688

          • /data/data/com.hlys.hljjddz.vivo/databases/lebian.db
            Filesize

            4KB

            MD5

            b7326a866472961a43df7c94843901b8

            SHA1

            c211c54490586d8598583901843fb80cd4d83de5

            SHA256

            40c028c26ec26542ba3fd5989d7b2cd1a8f3ff7e791761f63343b72716a0cf4d

            SHA512

            5df6b1515fdc46b457aa8ca7ccfb4c7815c0c8f2a2d400e249463ecf994e4a6f72126d2ccc6d763f09253b453a35dca8bf0f43cca307a93d508a49c978b59934

          • /data/data/com.hlys.hljjddz.vivo/databases/lebian.db-journal
            Filesize

            48KB

            MD5

            9be0e72c00385157f0122c19d7a3270c

            SHA1

            1d3943a62b4f9279ec88d72ba94d151413a47a08

            SHA256

            1aae48d8649848373fd1cafff83eac247609dcdc598d73688a49d04f2ce24c16

            SHA512

            99ff37cb6aa8d1a4634c4534c49d74bdffc0728ef82d4c62d9b929854311202f08dc8ef4cee0bceeee1aa743b02ba7bb3a00fe536841984d6718b4c83b987e08

          • /data/data/com.hlys.hljjddz.vivo/databases/lebian.db-shm
            Filesize

            32KB

            MD5

            1e3a3ba30e59611ed0962943ebc656f3

            SHA1

            d816a2066fd153938c37f6776928e9d439d84912

            SHA256

            5fa0c75094c26fcde769d3a23624d1a13d3eacf168df95737ad87626196cff18

            SHA512

            3cd86f76145696c097be95292750011f15d9d6e0b540c968c75a66e8691d367de2fbff6c3a9d4b0f846cea09bcabf7a7eb71f1f4056bc2d4e023e61f57c78305

          • /data/data/com.hlys.hljjddz.vivo/databases/lebian.db-wal
            Filesize

            193KB

            MD5

            817988166a46f49d6a6e2d4394c3ae7d

            SHA1

            ea14a73c32c986ba60d7541fb17e943ca332cdc2

            SHA256

            8815d9689b8e668945d38260ab30cb13ed5d4edf637b0ee6f2e4d2b9956d3268

            SHA512

            a7b9d0efbc28f5617399274122156630d4532b4640e0385a0b3d4686dd7da126a2a7d115f562be4abb1e0c3a3aef2572349759444b336eba9c621dbc4f1ad01a

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db
            Filesize

            40KB

            MD5

            a2c8ea957c4597e5db4c0a0d8e0c5ed9

            SHA1

            60e20b2855a3cf0725332849c7717c6d98875e1e

            SHA256

            c821fbe5f760f9087a3e1618936eab77433afb71558cffc0624ba2999bb33866

            SHA512

            780de46a7729ff1aad53afb51388c1cea55a8bb2f8a9de6e76c979c4bae0f9d58c83e772c443a2cb8b8e507a9aa399f0ad1400bcdcdb916d17f6c73061172b36

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db
            Filesize

            24KB

            MD5

            63ae4c943d3b681d3c681c7934713934

            SHA1

            24343eeecf2d39ad6bc38a647bc3e99070045824

            SHA256

            940e4d3928c87afbfe35a2437d15a50cc77861797b604fbb69dc7c0952bbdaf1

            SHA512

            05534fdd6f40e04eb5011e538d9349e73b1203b4107f0ad61f28e899ce49f903f525fc2c71861d0e696b5de453bf98ee66741b9ba112e00858a2485b08ba9955

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db
            Filesize

            32KB

            MD5

            517b00eef3e0f2a46735c8aaf1a0f93d

            SHA1

            41a4421619bf1332dee66dbc0228d53c055204a3

            SHA256

            1d142d6dab339c38f566449a77c24571983a70391aa6f4131bda6fe4f5034ac9

            SHA512

            57f888c595ef95be9b70de0dc84a4d2bfc99ae4da2a01cbdce475db624b53b0ac507969b75a230c05bf2c6fa541c7c3d4c3818765aa6815e87d308216998e669

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db
            Filesize

            32KB

            MD5

            a53420389774cc6c145cb2ae098c8cb0

            SHA1

            6a6eb369b1a3d2a7911eb770e61e273950a79b15

            SHA256

            808be418b2c045e2a16cba4c4898ced88e305a29c7ba56047a5a5d78dc1be084

            SHA512

            351c2c8def799a0ac06c1973292c800f21f07368e5dd8009ebfd716e63e954b9bc3d2da04ff7d4a187de76f7258d91a537a823df7dfed6f54440e742f3f9564f

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db
            Filesize

            16KB

            MD5

            9eebd851a3457d4c0bd7b134c1860891

            SHA1

            4eb93eb598fb27ffe82d4318236335d763760465

            SHA256

            4910f4b7e8df7da1d0c14bdd905b03db61b87df396782818c27af7770e55db45

            SHA512

            4269e4cba6acbc2d5f3daf77eb15b28beae5b57150be066e7c8ff0628a7829bdf57d3b96a0a016475b53f4ebf31d5b9550e792b5ae8db990acea63473bde7656

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db
            Filesize

            36KB

            MD5

            501b0ed1a67e8485daeccbc4aa7d3a36

            SHA1

            086f0aeabb36a9bb6fe3dc3384b70959b9175d26

            SHA256

            aad586e662dac1b3b9508bb7c26e610a448fdf7e9b91a296c24ffd628b318ca5

            SHA512

            512dff240e11544429412a9725ab7bff5b59876ceb31f9c9a735b098a4df02e33fcc382b7cd050fd9373f1624ed942a5cd67f06acc8138a9106f45d2935e1819

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db-journal
            Filesize

            512B

            MD5

            858011f45ccccce2f96f6ec7f81a632e

            SHA1

            566a11310aa488157485f5f00b1da6b1b387f884

            SHA256

            9ce717abf4e7480fd4159d32e4227805cc79014bedc3ced2522e606facbfe3e0

            SHA512

            a3cd93fbbedb47d7079185a249052c6053e4d6d36ac4472e4f42514105f260142f5f08c0cbb2f63e34c70a3d3dafcc52427df22aee4224bf16e84f8f1ec9e1a0

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db-wal
            Filesize

            52KB

            MD5

            7a8a49db3d76e5c57313be7e33feeb3e

            SHA1

            2419dc843e0dff6ef477c9561000f5bfb634e636

            SHA256

            20a3f317cdc61af21096908d7833c2116caa2fceb50abd318333d9e5289727be

            SHA512

            43317588cdbbbbb70e31120128748d6d38842b796f8bf9a423ec8e7562f79d337cba5a91179dee5ebbabe17be1d6891268d13624a2a278ed5016fe29e8b17788

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db-wal
            Filesize

            12KB

            MD5

            17e9a3f44ad1fd77876f57f3c8620660

            SHA1

            94d4234abf98b1dcc80bc5b9d19830175e336214

            SHA256

            4ff31714dc1c37b33167a3173848e82efbf2efdfde9db6c5efac66229068125f

            SHA512

            247d8c6ddfc1706443f9e9fbebcb3a584d159e9394fd16d3137c7e59f76b6fbc7f6143c0ff80d19bdca781f2325a917a58029975ab93ba230c2bd959309dfc5a

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db-wal
            Filesize

            12KB

            MD5

            3ffb82d84263b0c8f98b36ff5d88f133

            SHA1

            469dfaec7f59a85b7cc06cdeb3e1d76c33e85741

            SHA256

            c684df9a308681e0183e13a2843cb24c69ea16f7560b33672c30be96382c3970

            SHA512

            761483baa6b2bc09146683fa4bd024ad8476129efbcf93dce658e998603c87966758f46ad01086021d11c014007beadec6adf7ed033ee52f00232a8c57f68c7a

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db-wal
            Filesize

            8KB

            MD5

            e2249c11bda958398f41d28d97a85244

            SHA1

            428fee2d78c7abab3e1f13fbc2886bd2f2d1f2b3

            SHA256

            e8b272d82e2f4663cb3c209ff2ac76d1ee4d4afc0810904f662f4bc808df4bc7

            SHA512

            7095248ac288ef68bee3ede1b25a365d36b8d478b64d46bd32908a0f7874e5ad9dfb4e3ee6f061c4cff1c1d91d396c2651428f586ec1ba560105712b99a99523

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db-wal
            Filesize

            4KB

            MD5

            eacb7ac663c0c2cd51405b429e64f68e

            SHA1

            2c1529467f30b3f56ddffec8c2c5b1528b85509f

            SHA256

            ea1a2fdd33866865620f360a6a062df258c7e7c1bb1ab443a783404319672aeb

            SHA512

            cf691730c833861c16d2ab9cd11d4f7b6bdea579ed2745f31777a9077d5daae6c55d2c5eec647049b52eea602e2207cf59b2db58381ff08a8b1d1055e992cfa9

          • /data/data/com.hlys.hljjddz.vivo/databases/ua.db-wal
            Filesize

            8KB

            MD5

            41aeeb6a8e0a797c7bad4c313cb38351

            SHA1

            b4d9bcdd5477b9c3607f3a19999e4bd63a44dab5

            SHA256

            ce4a4877d6eef201929c3d8041d3237cee8023f93b6fae016093cbdb196f8dd3

            SHA512

            91611d9eaae95aeb97298f7ca829700dd9f583912b4964a2845b2a348d66e5197eed13c47ad07fa2ba97b7f0d7286e5d6e024e2545f49b318b33d8e4a54af020

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db
            Filesize

            20KB

            MD5

            38616785cca0600a03205f84fe330b4b

            SHA1

            6ac41a6bdcae297d56dac5fdde70be5faccf0832

            SHA256

            b05c698d5827005da5e04b4fbdcac53cfc83405247353f8e9e145969a820a4e8

            SHA512

            7ff2901c032607f5fa1f24a48056ae85fe8d67b6c5649233fdad7b66950d359b2fb933344bf1e2fe6255a00c593de7bcf959d201fe8b6ad214249bb31f855a08

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db
            Filesize

            20KB

            MD5

            cc929d416dd0e357598dd42cc6d5b942

            SHA1

            6eedeaac573ff8af39375e8c69b478811faf4df4

            SHA256

            2aaf5ca8419675e037b078663fed5d35a6479f4af052028b452e73a41718547f

            SHA512

            6a2f8b20cde21298549d79f515fc448dd115e3d8714da0fc4cceb158218ed476b1c4cc54b1589b62156de13c2ed64e6ff9df89c96f3cb3429877d87bd20b7463

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db
            Filesize

            20KB

            MD5

            468fb52bddd5b0e9409da3cc9629925f

            SHA1

            0a1b22d42cb092b2661afc6ee9c070250eca9a9f

            SHA256

            a52505398a74af319c799bb789e35ce823e849adfe1d0efd8d7482df701f001c

            SHA512

            c8b6ce2a4b2fe8395aa1acc9cc4b0d9c6b6fbb74d620d87cb4ea8b78fafffbe6651c6f10d731d46b621dff686bf3e42394312e07c1349fd5dd23d98f4dff41af

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db
            Filesize

            20KB

            MD5

            513d9a014bd553b7ccfe0bc3ff6cc31d

            SHA1

            fede19cbec1e92a70ba9d3ac9f0873276029495d

            SHA256

            a7efd6f8bb2d2c046bbf84930fa69132fc3937251820477783e572c0649452bb

            SHA512

            94c491cf6e8a0a6a0690ff2c023bea02ab70b3b8cd363d8e8eb815da04f2997554bfaab87db0949196d1c06611af67ee74c65ac3867dbeed4b06c1b547703ae6

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db
            Filesize

            28KB

            MD5

            a07a4b1c43a4112f52e3a6ba4e334a9f

            SHA1

            e6f99d4d84422c3f58cb5cbbf3146b406f83912d

            SHA256

            847fa23efe0b9a27886647528390e701072935b6eafd2afc9dfb7bcc96ca61ed

            SHA512

            5079901308cd33b659529787d0c65441017da082706d5ee3b322bacc40cc0b7a81b8847b263b3507af1a5cab50e2a1b0e271a4b9803467a97af8b6174cbdc62e

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db-journal
            Filesize

            512B

            MD5

            001194ff8de25b1bd5038e49ed9887dd

            SHA1

            bcee0e90e31b9378347e60cb0fd0c1d02893de0c

            SHA256

            80472b736b40d9cb57654e07f55460863b6abd7cf8e030be15b42e8534b88d03

            SHA512

            2a08307d38e7be3e7ce6c39f31facb5d51235de60cc4846f57cca9b0f51b273862e38c6a97e7e990a5cf636498a9ccc4de6a4179aed9a769ea82b65abe83d497

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db-wal
            Filesize

            32KB

            MD5

            7847e56dcbff7fa5b495c64c493f4d72

            SHA1

            230274481e1bfa9918a4882d2c9e5d562124d073

            SHA256

            8d9bec771d54b0585a62a065aae10f732c024dd22ce28429d5ef3a13c1b60df1

            SHA512

            d7af292833a33f6f658741cd78bd6912cb0ba241c972f14ffc4b06c5e3e77e275438138eb3ddb00941d0d7f0f6897a6e6bf88e19decd37eac05a7357e1d2ae21

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db-wal
            Filesize

            8KB

            MD5

            4f596ca3f9c5f8257ecc75e1fe8a0bad

            SHA1

            4bbb6c829217808f48e92c68311c921e614022a0

            SHA256

            f1b75889477adee6e61bff36e5fafd03bac4d804690d0e7719a235cc4d1ee110

            SHA512

            f18d61148c00602c3b38becf89dd7c409926124f09eebd45452d4a0427bae812fdd58ffd007e350d9faf3aa0223b0e3aa7c8483fda89ed31a1a851d6c4855e17

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db-wal
            Filesize

            8KB

            MD5

            246f76617077bb4a1516228f8ed601d2

            SHA1

            e112baaf675037bc41dfeaedd4c3d81ba57a51d0

            SHA256

            6754d3a22bbea18030b8aeeb11bd7c973fbf8007e6e18140685da422c2b79e2c

            SHA512

            5adf249cbebf492d443abe46acd903fa070c29d69723668cf170ecc6bd52c21310b6206026d17e6d11d57e892f0a378f9277991b07f6cda7a920bf0036d9e38a

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db-wal
            Filesize

            8KB

            MD5

            fba8e1ec26cbe5e5894356a0dfde80ba

            SHA1

            2c9f91d886aae39b04c6926b5b0e1b24876fe35e

            SHA256

            6b2602b8ee8cd71283710e768492d1dc379a86270577b6744700942cb8c2d10a

            SHA512

            c1ea382af289cbd7c7bc790d60942797fe64fdbde37db5cacc2bc6ab729af8d6a68025615f1cd0afb8db097873b6d66de78988e468e6aaa793b2eef5876c9023

          • /data/data/com.hlys.hljjddz.vivo/databases/ut.db-wal
            Filesize

            24KB

            MD5

            818c137e7e87fc1367704a9311bb0fa4

            SHA1

            f979b839fb4d1963846ee79da61c3d96509b7528

            SHA256

            10daf45b2284b5b670a68600efee5b875ef78ba49ecceee50435191758b2a647

            SHA512

            2e87c6f07bb48496d7d239d25e300220f5687703323af999d7b42d12b314da194f441e218b5b84a3526dceca6b3461b41c86ab3e1b38df3b7b67ef9456f7960e

          • /data/data/com.hlys.hljjddz.vivo/files/.envelope/t==8.0.2+G&&9.8.0.0_1716517913985_envelope.log
            Filesize

            1KB

            MD5

            c93a7dbc695e025cba82305f2ffccfc1

            SHA1

            c9d154aa10dfb967dedb77a4de71fa2864440dd0

            SHA256

            9ae4fad73c26f1e0b4557fbee51936ecf75d2abb44e65776ca0932be8e73f56b

            SHA512

            909609218829fe6848fe336a8a7cdcebe92ef6d8ac0483606612b0f66ec85225906cfa7c065f08bad434afbbc985837e5162e15d115b415abb2378481b8ff559

          • /data/data/com.hlys.hljjddz.vivo/files/.umeng/exchangeIdentity.json
            Filesize

            162B

            MD5

            e97141343d09e90feda1971279271fcb

            SHA1

            6951fdf24366729eeaa5f2590b92137d61974ebe

            SHA256

            fd85a6b3ae629f588c4559c490e107eaa29fb47d3170f69c4de6d6be5bcc7ef7

            SHA512

            190bdc65d1b355a1c774b78d275ea0db521e0d70ac16ccf293ce5725e7cd8d21adfbd63c6cace3fc299705ef64dad7fce78b6480b59e16322df0efe49f0a3fd3

          • /data/data/com.hlys.hljjddz.vivo/files/com_alibaba_aliyun_crash_defend_sdk_info
            Filesize

            226B

            MD5

            5ca278b72c5d90c6f627ee361e929aba

            SHA1

            a8edb7be61c3839281574cdc40dc2df2d3d04ec6

            SHA256

            c15c81dd514671c533c9c4def861583af2ef032ee2b0fd38870f80bdde5e6a90

            SHA512

            26bc1d60ed8d376a57b4c5f64d19b76789c8d479d1e436bc8f82f8e88694748e8fea49b86fc526d11ca5a95b6c2c35b49bbaf1fa65922520ece14dd123ea95ae

          • /data/data/com.hlys.hljjddz.vivo/files/com_alibaba_aliyun_crash_defend_sdk_info
            Filesize

            226B

            MD5

            7da3b52924041fb577626c4f0876021a

            SHA1

            f9c015034d08707d5dd45ce76c1312fd71169052

            SHA256

            128cf38024e37f00d8af07e42f87b348cecbe1d65ec5ee1a0f0da5cc4d2f1adf

            SHA512

            d478e5d717ef2c4724d95d46225fce2b2a477372368ffa4d436b1c82598be4e0ce680f972e20fadbf0e439633ee8796d7de7f004df6364db0464f0fd6e3d1050

          • /data/data/com.hlys.hljjddz.vivo/files/exid.dat
            Filesize

            57B

            MD5

            1660b611bc078903b6f3855bbbe75e93

            SHA1

            ec3e2460c4417ab505ef566092e457f4070f6dde

            SHA256

            c7876c375e1383beea961efec468b280981b7f271801a569b9c51efbffa92ccd

            SHA512

            229730b8944577a4507dc0376890e7124ee6a56b4892f926330df289e33784d9aa4dc3e58b5c66e93944a30000b24f64ec72aabd2c93dd4182e4f2755e2cfd98

          • /data/data/com.hlys.hljjddz.vivo/files/singleplayer/data.bin
            Filesize

            3KB

            MD5

            06bcd4518c57d7973c0282aaa142d42d

            SHA1

            809e8f8362b693b125f139f66b6756cc15624491

            SHA256

            5d4252f87eb42662c460398272045a48dcb85c95c0f0012d66c155bfa8e7dfa0

            SHA512

            89b2b57e84f6ffe039b4eb609622eb89452aa3bf1c6592f74094f9dbe986e5e289b2a4c8faf5afff34a81d4686bc23a274f95f7211d26c887898608005ad71a9

          • /data/data/com.hlys.hljjddz.vivo/files/singleplayer/data.bin
            Filesize

            3KB

            MD5

            3f514dd67020d5e3caad8654bae5c335

            SHA1

            ae2ed067356491f34630a135f582ea95d43e22df

            SHA256

            f2df1d85c7783b7c37a7ca8508cab47304a22fb15658f87eb044deede7a09b19

            SHA512

            f5acfbdc0c2bd43a98c85dc79b716af810fb48250196c05d7b5794e9a42d24a155968f6c45740085421a079951dfc29c9861a7e8f05b760a38ae54ab2d31c2c1

          • /data/data/com.hlys.hljjddz.vivo/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2NTE3OTM5NjI0
            Filesize

            1KB

            MD5

            7c81c61e0e2c5bb132f3aac00cf4d3bb

            SHA1

            da4a854447a8ecac36c26a72b51ee49040ac045f

            SHA256

            dc842db6641b968e3ce2a89eabc7873db9ec7bd23d8624b784077f33dc3d72c6

            SHA512

            bb6c092324f137fe2809766d759843a2b7cc6e8edce3f936c13a9e0a45a2ad304e2529a6146c72e9d9305a9e1c31e50b50f326ed901c81561b0fd2eac6c75e2a

          • /data/data/com.hlys.hljjddz.vivo/files/umeng_it.cache
            Filesize

            498B

            MD5

            1c106913387d5918d111ecb140ed129d

            SHA1

            932f4a9be43f4507d227289f4bea07a3e5264c8c

            SHA256

            b037c205d231a5725eda7f0ba8e3921cb61ae2841f8fd298d214b5b599d48f83

            SHA512

            a96e0ea8c16a528f3f671c2a3bce5e37f0b8c3bf6ec6166cbd7d003ab77ddf7292b6fe92a7e49c48432c818a8d34f574aeef8ddc8861048dfbd8bc54240ea2da

          • /data/data/com.hlys.hljjddz.vivo/files/vivounionsdk/vivounionsdk.res
            Filesize

            29KB

            MD5

            7a92466708fa1ae45c5585a5b986f5aa

            SHA1

            e9e8e0dc60208b7a8b64a65550442a73f1166c30

            SHA256

            cc8416f87003538f2c8ea5280a7eaebfb40597b6ebdcc33c4fa64b0cf08d3b73

            SHA512

            026dec17ed60d89257c8cb7873a0ccc0de910aad6706f1bbb7936229d7074b9542b7b80a2040f466c64e6cf8896e8531ee01ed7acbfa6a7ed90637a5fe2d477d

          • /data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/lbmust.jar
            Filesize

            139KB

            MD5

            bc5e487e49e219bd372b7313dc189a69

            SHA1

            b45efd572f16a8bbd439c4369c4ca5ce5f3bc9bb

            SHA256

            1ab102c85676392eec3b2f2c9c0bb95f2b5a9c2c1735e52825fdee63a51f22fe

            SHA512

            09d4d7033e3c608a2af4c5c5eecd9867ecb446190d8f3268a8e9dffe8b2cd105bf25a6c82483637a760c433eca69b6cfdc3c421c63b7cd4ba4bf5017826d2942

          • /data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/lbmust.jar
            Filesize

            139KB

            MD5

            3951db3f620a919f01c34233fbd31b86

            SHA1

            c62dca68952b751fc6d3889ec6b0f1775e26aa0d

            SHA256

            ac945e86d947fc7f55df3674426401137a22cc8c0916b3cd513891c7ecd205be

            SHA512

            cba5ec8881f63ac0deca2adbeb532e22e9fb4707629e8c9c4db5cc46f4424d270dfdcb1bd74771230c125946e00d4c8dd22681ecc7b2db06adea6887d93e988f

          • /data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/lbsdk.jar
            Filesize

            352KB

            MD5

            4037bf73bfd825634a03cd421d1cd341

            SHA1

            169313e53620883bcde9d5495d7d94b3f81a6fb8

            SHA256

            c49b28a08d0cee0675f807714d1e94978a466419ede7e5862a46ada7c15f86be

            SHA512

            bb24bd81b66c193a2b6e7dd12ccde24108b04088dcadf63a8db6d018bd1ef3656ad6245bfc18d7be189c6ffec593f63bc8eaf2366300fab9e17c605d9a1c1e40

          • /data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/lbsdk.jar
            Filesize

            352KB

            MD5

            58637520da713ade6effef653bcdd6e1

            SHA1

            d21ab6d649ba3b69b9d26ae7863a63feb7029870

            SHA256

            48545f00a4fdbb71a05e05cc9e25dc9ff3537f117680b244f85bc5c94a3d1b5f

            SHA512

            6065bf9a3f7565aff1769a390f69a800654333d2b4e49f7eb4de5ff4e9ccc2f5ef292c7b883445fc9641468917892c56c3267773254c14aee01a61acc21bb9d1

          • /data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/lbui.jar
            Filesize

            117KB

            MD5

            542632ba2702d7366e4cbe7e5703332c

            SHA1

            4fffe87ed0c838f3709f25b2152a8285533cb2fd

            SHA256

            9f0aaff4040e26283a4999952cab7aa903e63ba91194d9e6208ad3dbdb15cbf3

            SHA512

            e60bc55b1c4eb8a44e8a6ea3a994855c03ecbf50a9183d686320003ff55e917e8b87d94fa15bfb325ac746dc2584241d37d6ee953e80ea1765467ccae32c1c4e

          • /data/user/0/com.hlys.hljjddz.vivo/.lebiansdk/lbui.jar
            Filesize

            117KB

            MD5

            1b2b275d32dba0acc210b02137890786

            SHA1

            13ddc06850b4f19d8b353d95e7d88d4d57bb6f3c

            SHA256

            0ad55cf94fb64a1609bb48dab748531782580695399f6231d8998d4552064e44

            SHA512

            d08d2cc97d838bde5fe78dcef8de79e4053f3e0ac4de7200a34aec7334e57fa274730f3b0264562848b780ea8bc8736788a4d2c1e24c98a838cf094244424af8

          • /storage/emulated/0/.DataStorage/ContextData.xml
            Filesize

            111B

            MD5

            49dc010c87b576609c17e6e05007a2d1

            SHA1

            ed4fa1159f9501ed0fb46fa35d77663355a2203c

            SHA256

            3d5a78b47c6548821497d2e5306b84f4edd1e6ebb0692c97d0cd64242d3cfa10

            SHA512

            15c59cbbd6b4244a33cad2fdbccda1610fb2b7405340ac6f3ae03e944089eae5f1d555637e417a21426ed102c1d45db0ab4889abe785b9227cea50a0a1369ac6

          • /storage/emulated/0/.DataStorage/ContextData.xml
            Filesize

            213B

            MD5

            352d7d08485e6025042899636973fcc7

            SHA1

            0ee0bc89401880356251c00beeef862b234cf669

            SHA256

            ab2f14d4111a750ca226e2d56cdf535d5b6090b5d4c157c1e3533928ab6f699f

            SHA512

            9b130eb488cfc26994a2cf60316eaefa71937dbb2ef390c44186f9db368a520327ec5c028c13384d51dfbe7c73a329c2d1540cad3818fa8155853d57762ce070

          • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
            Filesize

            65B

            MD5

            9781ca003f10f8d0c9c1945b63fdca7f

            SHA1

            4156cf5dc8d71dbab734d25e5e1598b37a5456f4

            SHA256

            3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

            SHA512

            25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

          • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
            Filesize

            111B

            MD5

            c4fdba0aef74a348c96c95db8646f441

            SHA1

            adcce5318dbba9147a54eb69c9629b0c584ba270

            SHA256

            58461cd20ddeaab63ee6ed03ae552f911607dc7e9fdad172e43848c9dbba1d99

            SHA512

            e2cd5f0669c2c0b99e41df85c9a0a4a7ccfbb89ab5ad2c6d57cdf393a06131ca561a4bf7273a1447ad5c3c40dfe3e4470c02c5e84bbd3efa913b5ff841a7814b

          • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
            Filesize

            167B

            MD5

            52ab90ad866b944f04ec8021b08ca44e

            SHA1

            7af709ca90125356f8762ed91a6d20c78912503f

            SHA256

            74dcd2dabc4816eb6036d9a09a394be15a735de0ae268991c20252a07390fc86

            SHA512

            099e5721fc1726a54b451dc1e69bb439ba2803cef1f22946ea86b4798d6c0e8ada857dc81e1f3404dd028e60ce225b2c1463c36a49a11b1f3f172bd1faa91f5c

          • /storage/emulated/0/.vivounionapk/vivounionapk_v4.2.4.0_d74cb3a_201808271150_signed_aligned.vua
            Filesize

            4.2MB

            MD5

            3200674229ed57cf762fc3d8c5137b55

            SHA1

            0896d5f138545dc9ddbf0003518880d745c8fe0e

            SHA256

            333ee74803ab4b114d6217250623869c751a00f4748c826c19ffcd7b29476195

            SHA512

            31c96314a2b0d80ef3d6c04c0a6894b6a8ebff7e501fd48499ea0e12969ba4ac00cdd844caf839a16cdcffa5b51ee2f33af36a578dfd450c79c7e2bbc0c521ff