Analysis
-
max time kernel
139s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
24-05-2024 11:40
Static task
static1
Behavioral task
behavioral1
Sample
shadowsocks--universal-4.8.7.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
shadowsocks--universal-4.8.7.apk
Resource
android-x64-20240514-en
General
-
Target
shadowsocks--universal-4.8.7.apk
-
Size
5.4MB
-
MD5
a52724759f70ad5c62ce284c136139d5
-
SHA1
249747b674d5b33d94629e35d9b012a63e3a8d8c
-
SHA256
ca527d0a6c31782bdfc73aa32e46d9f241087bee5bd9b9164248ecd6cc56255f
-
SHA512
8cde58a6edacf0ce0cfc4bc2242c6b95a2a13980fb7efb2a7ef23ea702508169990a63a6ee3736afe83d2ffd2c6d7cbc38ef82ecfb8f63a0f6d7e0ee43ddae11
-
SSDEEP
98304:ZQSKS9+bQrPKcmSBd3eXu2cuiv89C2G04+eYROp2maik9pr5b:ZZbKcm+83cuiIC2GFbUOp2malR
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
Processes:
com.github.shadowsocks:bgcom.github.shadowsocksioc process /system/app/Superuser.apk com.github.shadowsocks:bg /system/xbin/su com.github.shadowsocks:bg /system/app/Superuser.apk com.github.shadowsocks /system/xbin/su com.github.shadowsocks -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.github.shadowsocksioc pid process /data/user/0/com.github.shadowsocks/cache/1582435991586.jar 5308 com.github.shadowsocks -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.github.shadowsocksdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.github.shadowsocks -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.github.shadowsocksdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.github.shadowsocks -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
Processes:
com.github.shadowsockscom.github.shadowsocks:bgdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.github.shadowsocks Framework service call android.app.IActivityManager.registerReceiver com.github.shadowsocks:bg -
Acquires the wake lock 2 IoCs
Processes:
com.github.shadowsockscom.github.shadowsocks:bgdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.github.shadowsocks Framework service call android.os.IPowerManager.acquireWakeLock com.github.shadowsocks:bg -
Checks if the internet connection is available 1 TTPs 2 IoCs
Processes:
com.github.shadowsocks:bgcom.github.shadowsocksdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.github.shadowsocks:bg Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.github.shadowsocks -
Checks the presence of a debugger
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.github.shadowsocksdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.github.shadowsocks
Processes
-
com.github.shadowsocks1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.github.shadowsocks:bg1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.github.shadowsocks/cache/1582435991586.jarFilesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
/data/data/com.github.shadowsocks/databases/profile.dbFilesize
4KB
MD587b31af16ae31a78941c3eac81e1119d
SHA1490868069a9e1c8993d42c3fa5c1559c0d4b4a4e
SHA25663152e2eb21a3d65333c3fa479352d5597e27eb2115a92e7a627c4d3818252b7
SHA512ee0c6676cc9696273631652057b094906d68d1d8ed4c4e8274c7977e4920a27db604d42689f054d0fc810fa8f41bc71bf0d3f1b36354d0feb25676d0fe7944b0
-
/data/data/com.github.shadowsocks/databases/profile.db-journalFilesize
512B
MD5bde6e180a906de473d2b45c311e6384d
SHA1c4ee0918a1be3613821246b6905fbd39e27d333a
SHA256bdb0cf26f4496ba2cb53851c8f0e6e905ec249beb096ae22d928862a4239fab2
SHA512167318d1f441ecce832e043eb3dfa4bde5d40247d703006610e06701998ff584254ec9bfc9d2a45ed067ea43b99d7e9eefa16e3c0045b7d8732f56306301feea
-
/data/data/com.github.shadowsocks/databases/profile.db-shmFilesize
32KB
MD5cb5d81016c3f31a444aa5951bfe3bd43
SHA1ece1c477284bb18682e66bf453f26a2a22405b84
SHA256ae6d71fb1156e32ab184b9f20c43b269d8b2a98adda2169f8a1b954792f6bd30
SHA51218f37827d5c4f58f58e6bfacbc3182d013229558429bda14651e29ea5ccf4c8fbbaa8896372eb2cc3fdb08e99279711fbf399daef0f104a234417d93c56e0a4f
-
/data/data/com.github.shadowsocks/databases/profile.db-walFilesize
16KB
MD518e4fdda9b015a7b8fe47345aabdd9fb
SHA15d74a3a2f784922c50c9ac2856b43f05b0e415f1
SHA25623eb9da604f3d9b8dc62c0a53f9e396941f8c75b55ed0b00ad5ee728d96b7891
SHA512a119bce802c0bb8504ac7f200aa53b99937690b9b3d4f2d62032108e541d16b9a8dc4730b78d95f7fa0fc2370008ce821a02b89f276839d0c7d0456d276fe8ba
-
/data/data/com.github.shadowsocks/databases/profile.db-walFilesize
44KB
MD552d0b62f32f8a6e7ec6103e73b153dc7
SHA14fa3be9143b401e3dbed8136022192f798807c11
SHA256e63e234873b0663b999a1d903a3c85b1e02d513ab4883d42388a01a7e662c0e9
SHA512a3669b45c64da44b842f0a95a769a27e62d2e8469a9d74de5ba22bf725126383b5559d8eb48c1fa8e200074f55d3541ae62f288eb1e166bcd8e49393746ab9b4
-
/data/data/com.github.shadowsocks/databases/profile.db-walFilesize
52KB
MD5627dcaf727ccb5645fe4885ec55622bf
SHA19c27c6837acb7a1b39aac76dd5c1837669d936d9
SHA2568921bccdcea0c7013841e91d65a0c3db267845609834fe31f67bfd4dcd9b4baf
SHA5127a217bcd03ea4c0754c3a33dfad4f0c0e2181b18ae4c1ade0eedcabd27d7a1fa9cb88ad387b21ce59d9de098915d0cce136c8a79cf193458c1d9e45970d94ed3
-
/data/user/0/com.github.shadowsocks/cache/1582435991586.jarFilesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
-
/data/user_de/0/com.github.shadowsocks/databases/androidx.work.workdb-journalFilesize
16KB
MD50090d5a1606ef626b9f848c17ca2288f
SHA13c249de5c609b619c5316ee26dbec92626e3385b
SHA256a686529c706efe9a3ed6fca250d284e388c54470ebc06cabf2605bf5d32b612f
SHA512c60a63734b06cffd8db81ef553b38485d6fc43df24c7b793d6354235eae41293c8cdb04c690d35f732871d2005ee057f24f168e8bcfd4ae5bb7beda63fc81137
-
/data/user_de/0/com.github.shadowsocks/databases/androidx.work.workdb-shmFilesize
32KB
MD5d1c6bde829d08545b5af9eeab38d9a91
SHA1a7c8831301c616e453449044becb8e5ea0496a94
SHA256986430dd5b6c3a09a25a97a5d07976e6fd9567e984da0ffae258807a78c94afb
SHA51279f41f5578e5d2a0eb0d87c833ab7cf708dce11a7aa488c4edc1790b3c00d545516e7935a7dcb8f046a1d28a624e7324c5130af7c4ffce99298740dfba6716dd
-
/data/user_de/0/com.github.shadowsocks/databases/androidx.work.workdb-walFilesize
88KB
MD5eac592563ee1d56f3a0d350a2d209052
SHA1ec1aa9cdaf4ff844ef786f7e6507f5c039a5039a
SHA2569bb34417038dfcbc320f0787c6f1d03abef4d6862594eca42c90a02354e26e06
SHA512f74495a8fd07bde6c7f62a90e20f890aab62d7ed496462efdaad26c924b425bacbf6f6ecf4cea17b13ec6cfb3368b62f47de893696fcb450ba06eca1cd355997
-
/data/user_de/0/com.github.shadowsocks/databases/androidx.work.workdb-walFilesize
16KB
MD562e658f92649fcafee5fb77d3bf50179
SHA1d87d8adf6eadbf2c12028085f24139c672499d39
SHA256da0a01302a641a63336cfd7ff137176d11f323476fe6c50c0c406819f1740c31
SHA5123f22c5b61ccbce1e85d9028fda2354450024fd75f38ec560b36bbef00c8336d5404f16874345777563ef1cc4cbbf6cffe25a5242e0ca980387ae7d57f1bcf3a1
-
/data/user_de/0/com.github.shadowsocks/databases/config.dbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/user_de/0/com.github.shadowsocks/databases/config.db-journalFilesize
512B
MD56e8754d597ee063c2080cc3833d960a4
SHA1f5d5cf4056708108e1591771ad4894b26af98473
SHA2567be5382c50d9cd989c1e7328cca54fd30b6c53f1620af42487a4e7a3efe83b01
SHA51260f28bd787df5a8d374e63d18d4acdd556259c8b2b4b238c53ae69b713279949c78b5610b38ff20069241254d30dce418e9e532721d02521671af63f49f59c0b
-
/data/user_de/0/com.github.shadowsocks/databases/config.db-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/user_de/0/com.github.shadowsocks/databases/config.db-walFilesize
36KB
MD501de8ec3587e100a337780e25fac64be
SHA1eb8c93069dbfea994496f49761fedaad38269a4d
SHA2560dfca91282b68b6d99fab82512cc96bf4a1e658ef301de064bb5fe91c63810ad
SHA51230778b7af8aba7b513c52871d3dc773f37fcb4017dcad5be5a3b96a208501907488d3e05afb0f814ee9fbb1339d67a3a3644b81574d473bd8f9192fc17c717a6
-
/data/user_de/0/com.github.shadowsocks/databases/config.db-walFilesize
52KB
MD50e79c7f7ac2824a163c3d1baebaa9c5a
SHA101b226575dfee380fe145dbece8cd601d8066912
SHA256bc59f1ef851072c6fc299c235aff468d58cb08453645f23a3c3e16994c13d8ac
SHA5122b8a23245c5b3fdd1a5eb4c4bbd7cb91cedf320a6a71854be9444012ced90817bb83543b261c939dbf854c0f71328b0181782a078b0efe150f0c5213c41655e8
-
/data/user_de/0/com.github.shadowsocks/databases/config.db-walFilesize
16KB
MD5b1f062152c4c6fdc3b75093eb3c77426
SHA1048016561a676056949f7ff75f4a947d54acea85
SHA2568406667a1a4023fc1b4db7b5781703885aeead368eef04362dfcc94d8fd83c9e
SHA51223ea89edb330860c9b8f30d20430be30c7e537342b4f6659ace76a6de410d39c03fe62dda2f84502cc2dda7849d1bd4d5b8bfecb012a00e8b1b9910281ae0094
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.dbFilesize
16KB
MD5eb52a90bb70b76e946b62f50b6f7fb85
SHA142d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA25648472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.dbFilesize
16KB
MD5a929125387001d8ea16c38fdefa6f233
SHA10a9c41232281e911eb85e753572013a98596ca07
SHA256191e3ae5bdb95d43eadb42723df0d8bfdfef48492283b69a70f84798a3bea284
SHA512f8d9e0062057c160435cf49fd3635dd05d4a06c972793e08987a50b0e0ad892ca66512a331b1e2e85e5f69435cb2e9ac852ba19f1795e4ce31cf0a4577002552
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.dbFilesize
16KB
MD5d0b476638bbdc5dbae1f43e0232fcf83
SHA118baa9483350a1cc9d7a8f125ed9a1ba63ca42a7
SHA25647f7a7cab443f690ad0c96e0c2041d3c637ee04fd4c3f7b20b9b45511652205f
SHA51288978715d040fc61ca1b5804438de70cf3234d14983fffb06e87a50cd683d7832e85e90e2bb0d5e805e9566f57d120088222568c0dc6644f24f730c991b0335c
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.dbFilesize
16KB
MD50365a204d67348f352aa9fd7de0857e8
SHA1c30f0fb3a6f948aaf8d0daf73b3c5a14652fd464
SHA256e81174016af0fd2b29a7310ad170fa5f50955f019ffad7ab9376b0f3b1402625
SHA5125714a86da5845a1a8cdc03b8151e92bc4f0ceac2b556b8ff01ae09d2e06229cfedb191c6bf3a8aca7b16897f37a0cab836885b4be90a716225d7e030948d5bd2
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.dbFilesize
16KB
MD52f4d849347d9a8ecbe7ea944bd825ebb
SHA1ec1f0ecd9faaf6e89d495136934a1875214c00ab
SHA2563d25645b3785a759c796e4b4f8de16a5ff655a0086f49fd38a3469498fe3331e
SHA51243a4e964e601dc06a66c48ab6d986872220b4d2026af91c8af742f3eb61d271443f81c7b2aaea00836fe6fa930e91436ba7918f44e009562d66d55b73a0cfe0e
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.db-journalFilesize
512B
MD52d77895f1858c8b0d3a320f3d37d279b
SHA1710fcbbbc9e8766589dd711cfa98d22f8c834de0
SHA256776d28f8df31666d25c4a4a82529d32af6d25524a322767e628a577871bd25ec
SHA5124dbb2dcef87b95cbfbe9052cc55725e56ecb95fb6d111bd229aefff2ebfe1cd59aa78a34e62c57c8e3059cb463560c3a8ae16434af46049e6bc8bb73aa700a54
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.db-journalFilesize
8KB
MD5d4139a9528779133def8cc2215e1d216
SHA149bd4e4e665e4631480808a9620d96f83c5cf9ff
SHA256578a2da25cfdbeba930113c8042e893e45265627579b14b99c8d1f95b7e0c1d4
SHA512a89cf84ae8278f095bff7d2ef1d16d6f45064c2ad737bec58d734bbc1d5ec2eb6d92af6b7dcc147f349169711428aa7dc14e534d83def4116b0c7535449dbfb9
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.db-journalFilesize
4KB
MD55f574b63d8cc9a168e2a3dbb839379c6
SHA16c01723b3d30017f8f9b34b8c8be3987112f27ed
SHA2569b11b87c5959c6fc6680f28b682cb5184864e89f5b4ce0aced933d62c3fb9c8d
SHA512e66fc1d732b16e105632073f1a02d1740930f89fc65c8fb22838fd3087ac71a772c822893bafa35653124b2d04c7d18b51d1bb8d718a6d2f4343de32579be4e9
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.db-journalFilesize
8KB
MD58b4d2a4129599053f9e15cb04011b071
SHA1daa799d87b629134fa3d309dc343ec7d4a650ab7
SHA25688d0277d8f6b69c296c7bb6334d0677a85c0a7f0d7d0db8f844b77f5be21a35f
SHA512eabace531e82fd8ffaff5498c6c1adb82aab0878808aef5467bb3fcbf18da04a7de74dd1d89c05e14664596514b22bd183908786d97b72a5fe6ee917b45c21b9
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.db-journalFilesize
8KB
MD5086444c2b4208088d38ea30bc1f02576
SHA1324598251d86dc5e8b3b7bacddba76f9e0af9414
SHA256ba4055570a554a02f154bfd318b9367278e68a7ad2a4c5d082b8167868f14238
SHA5122cdd010debf1a9707919efae634be9c243d72c42d3b088c55ae46f877004c00bedd844c752f30427df943ff2da22cbde3a3b5b4b1a59c7d131824e6547982ffd
-
/data/user_de/0/com.github.shadowsocks/databases/google_app_measurement_local.db-journalFilesize
8KB
MD57fc5a040ba83c0bb007f433f57fc75a7
SHA15f0d12e0e557d485473ab66222dd320423cb765b
SHA2562cf01754b3dc5a4e89cdd878efba086a3dcef129181168ee470710c0c7f7bdbd
SHA5129506323160da80b78df43686627126f4276e01ead083a195176b5b47d5e3ad2672547df4e75034a2ebbdaf555749c35aeff57de8390dbe218c478ed0716f0bf4
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66507CF500AD-0001-14BC-9D9415C28AD0BeginSession.cls_tempFilesize
77B
MD572ead6fa05ec766c3df1e5eae3267a1e
SHA1b55a6a196ea543236cb5e28eca6a636532e85d02
SHA2569348fc288481945105c0e62da1bde163cdea35fd6aa63d07bc73a38c3b859d86
SHA512a92e02f363e3c15fd8b21a33a4147e838a799e534dbd7edc59412290a85e76a9d0b561e5a5c3f2986302a618adb8f8a85a3c2fbe9b1e911e4ae9ead1b4f1524d
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66507CF500AD-0001-14BC-9D9415C28AD0BeginSession.jsonFilesize
132B
MD53d6876b8b5f71262a2a3f75c68f6688e
SHA156a827d9a7ac11bad1304663da63a04071b8386e
SHA256f204d04723c5d0c6921b110ef188a0c1350963afa231a2b056a68962e7c0f93b
SHA512b845fde378f135fb7f7ea41fd41540cbdd90724c47a2af7fe3433cac1587ed2e9ebdc397077d3f3c7682213d1df6d5ca163a2f6bc5f93365d11243fdd0e571f2
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66507CF500AD-0001-14BC-9D9415C28AD0SessionApp.cls_tempFilesize
122B
MD5813ad2cac279b8c7fee188cc4b9513d4
SHA156a7bea395e27a28297cab75761b034d9e33f13d
SHA256c7b61a24f215d1ac800206ddd22397f711138f7310198fd2fe07343726da82a1
SHA512128c0ad892bf4fd4b5b2916c489b061921e475c8dde540ecac9d84c907d592472917d7c64b4db16e88efcef540639daed02a7c7b36d87c1684b2905ba994b468
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66507CF500AD-0001-14BC-9D9415C28AD0SessionApp.jsonFilesize
236B
MD55ef03ff130c0000b49e6920073c737b0
SHA1112fc9f6de2a1f09d5da15a72a459353f0d6e758
SHA256ddb7f07d00e397a0d0874bf0999305e48411ee0e06e0dcc3b913d375ca79577c
SHA512a19296ab68c648b442bd60ca3f06132503c14ef57585aef020899a210a84934c78fbf18aa4632cfbf65f33e5d81d951ac9450f682073a0e6c4f0803220bae0cb
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66507CF500AD-0001-14BC-9D9415C28AD0SessionDevice.cls_tempFilesize
48B
MD52390c1f21db00b20c07107e3ec7275fe
SHA1e663a646460acc071aebee942cc1776c23d77655
SHA256d348072a01496839cfcde3a18866423aee74aefd613fa3bf1ff4a203ef46a699
SHA51243ff60754eb60795ca1c318f44dcfe49194add26cc3d92c2eac7bef538fd65b6290f2e5953b8f1693b9425ebbcdd022ab16a18280146ee0b0c2eefe27bc0bd63
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66507CF500AD-0001-14BC-9D9415C28AD0SessionDevice.jsonFilesize
202B
MD5afa07370d07ed0a8ac9554ee7001bb72
SHA1d1e9de22fda1295087525ff3a377f7d7dd410ac7
SHA2568d4b99fc4968c9cdff4626ff6c1467cdb427f7a597b153f03b4bfb62dde6c07d
SHA512a7a974b1c4ca3d7ca92e1449dc9718d5ea2af7f8e4c605d25c731fb4bbe891fdf340835e2a4e3a363558744e5ee30aec22542f377eb5bffc0097c70d24f241d1
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66507CF500AD-0001-14BC-9D9415C28AD0SessionOS.cls_tempFilesize
15B
MD52566d27ce8c28d8961f082c375d7535e
SHA192fe585b1a2c9c523d2fa1f65ab5c1b6a1a6edaf
SHA2565acdb54ddba2e264f6822fbdbc4e9b5158f57d43785c2f01d981956b18f7a90a
SHA5121c70679bbd25a57f9ac02083d5af0fe72b1417cf3070a195497f03d6f492e87b1ed3f570de7ea7c814c995a1530e32610d9570f31a480648f4062e8d3287be8f
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66507CF500AD-0001-14BC-9D9415C28AD0SessionOS.jsonFilesize
55B
MD55caea4b68c57072f7f52a5a41720566c
SHA14d9712f1702c7238949da43f7d8ae6efb233a666
SHA2563223857b618b924c2b0fbc7bfb373a1aacf300a7b5ab585e18fffcf19039f363
SHA512fe1455d21c521aeae3292bdcc386f6d2005dc253930c03e44dbcb972f96b849670d2aba039ea59e1a5ebc0350e6315151d17bcda55c161a62987d4bb01e91f9f
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tapFilesize
409B
MD51aa40bba39d944237926f4f1cdde9217
SHA15ac26cf745b86d89df5391e6aedfc44ee3b26d28
SHA256a1746fd0793b42d46876f7ebb9b82058a3d2143e4d578feb40e1e8d892d66fd0
SHA5126df586d594256d039c73e8b10fa8ec0922abece45417d0318d8eccedf31e70f4368b61e5102d9a350754900ce540b46e638c98306200620295b693c1545ed10b
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmpFilesize
16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/user_de/0/com.github.shadowsocks/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_fbe59a77-e5dc-4f91-ad3b-6e64df2ba5e6_1716550910560.tapFilesize
328B
MD5c90694fecb1aa5f5cdbc861c6e40f5e9
SHA1ad3781629d065b6c4b91c32c56809a3a5a5f2406
SHA25699e5ce64f8d6af9f62c2f2a03aa8686793bb0288fe2212a372915d321cf954ea
SHA5122b32615822831536519212e672cb1e44078e55084218b75be1562fa01735f2b04e79b568cc34dc0f86cf8dc33e51f79a319a16c1876473c1759772de30a2f63a
-
/data/user_de/0/com.github.shadowsocks/no_backup/bypass-china.aclFilesize
198KB
MD50f998459988dd814771a6a80051c3a06
SHA18be300862f840f88ea78c739ceecb9649edc054f
SHA256ca23e4ac7900d90781749447a26555431aee3422454175efac45a92e0c47f64e
SHA512153b39ba7fc61dca92091b60084bf4f4be6792498c694826e309732c4e8547e89f81183b5379889198c8f3a7b1e09f48aeba879e462f4eda18a89dbf07c3d60a
-
/data/user_de/0/com.github.shadowsocks/no_backup/bypass-lan-china.aclFilesize
198KB
MD5ddd9489da40446c6553b19a9204ac2dd
SHA17d2dc44f05cee429a2763866e5566e005e22f8f5
SHA256bd784f8c67f329b55706fa38649545db72f0566836f8cb87dbd1e544ec803d1a
SHA512c043685f4ffe70e8a7bf0bd57458122b9fccca8be6dc844947aba637fdca40fe201c097ed356a7f8d236decf30443d0e5a1a4bd816c38947950568cdab49c670
-
/data/user_de/0/com.github.shadowsocks/no_backup/bypass-lan.aclFilesize
8KB
MD5a4cf06c41447d4fd7766bfe189541dc9
SHA1835f38ec5a4a2a4db0fce4b704af9b40a0e70dd3
SHA256aced45f007c41ce788e6f4079f4123885ba6ea17594fd6ea6a1610c0dae43967
SHA51200680916582c6209f14c729f44c23a511184155541a6dd10b299c468bb79726cdcd8b29a02a964e3869d056839c81e0b88ffda4f73a6ec81d7da64f8a2a5e36e
-
/data/user_de/0/com.github.shadowsocks/no_backup/china-list.aclFilesize
81KB
MD5d09653ca05e152869da532bcff086512
SHA10aa74dc368a7fae098c7791b3f4e3e5cb9adcb4e
SHA25616b0d1be56bee111ec447ec40233e30996a4884dd6d364d69029231ebbf092e8
SHA512d3b72b0bdeb4d6695551d95b6e3f88d2faa8d4d834a024ba382b0b373ff92d724c7a7dee3e9ea62f920a2313acb79affbb4fa7e34be1348dd1a1373a67e10fea
-
/data/user_de/0/com.github.shadowsocks/no_backup/com.google.InstanceId.propertiesFilesize
2KB
MD5b444efe9ac1ded6d97af177bd3b28cf4
SHA17c2d8524d405ef65a712fdd9d93ab3af47f1186d
SHA256283b15384a2b16d0abac959ed8ba51430fd7356754c57d63c0c7284bb59d5b2f
SHA5127e72256619f788e6713edd18c6ae2ed573dd027385607adc01be0ae2ec190b383e11c78e661c719dbb6aed5bc3313c2b03a3abf4841ce3d313be44cdc5bfb3a3
-
/data/user_de/0/com.github.shadowsocks/no_backup/gfwlist.aclFilesize
116KB
MD56f69e67b9e34ed4ad9ee094c9c3c1f0c
SHA1ff655f3abc8b9e2f133191801248440416bccfcc
SHA2560d745021b8bf6bcb30b6857e40a5a4083f07dd7528df327cc5c07c1d855db34e
SHA51220bd89ac1eb1d4799acaa269ec5cef012970bd5d61542585fa5d4a09204e9b5ab9532412997b1ed31bb0819cb41761b0897d985cd7733e4677814bb482064647