Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    167s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    25/05/2024, 11:57

General

  • Target

    71de92616ddc25b0ebc6fe6014772f00_JaffaCakes118.apk

  • Size

    13.3MB

  • MD5

    71de92616ddc25b0ebc6fe6014772f00

  • SHA1

    8c214b25926ef75eee27dc56de6f7db71f67e683

  • SHA256

    a49d230f33ea40dc7a2525b8bf6b59185e7062a5a014d23b1ee08286f1221c63

  • SHA512

    a226e7c7974b56a8c61a17f935fb84a856c86ee40f06c439666d6125f661877004a3bd01de33ab5c8f3a85d505ffc878a53e2b2d2aa55a0bf87fba0ae060a2d4

  • SSDEEP

    393216:meRXi1y7zrU4IOrHYNrkxmW8okJtG/vMx:mp1WzrUJOxMTIvg

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 10 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.bdzy.yuemo
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4265
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.bdzy.yuemo/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.bdzy.yuemo/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4298
    • sh -c ps
      2⤵
        PID:4532
      • ps
        2⤵
          PID:4532
        • ps
          2⤵
            PID:4558
        • com.bdzy.yuemo:remote
          1⤵
          • Requests cell location
          • Loads dropped Dex/Jar
          • Queries information about running processes on the device
          • Queries information about the current Wi-Fi connection
          • Queries information about the current nearby Wi-Fi networks
          • Registers a broadcast receiver at runtime (usually for listening for system events)
          • Checks if the internet connection is available
          • Listens for changes in the sensor environment (might be used to detect emulation)
          • Uses Crypto APIs (Might try to encrypt user data)
          PID:4336

        Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.bdzy.yuemo/.jiagu/classes.dex

          Filesize

          6.3MB

          MD5

          58cb1f9d65789e2ccb011afd3ec7da81

          SHA1

          52a95be624e7f01fd6170dd21d42e4b81962a763

          SHA256

          b35e498276e3810c5844209dedcd142f2ca2e5909aac7388ee04cea1c5122b71

          SHA512

          a6d2ad6748b9f5191e8174eb3de6352c0140afb6d2bb3b17e842c9381e24326e9ee94cd3d286d42d17a43ee537042c8a88d4c19a29ee36b88d9a580ee389ce50

        • /data/data/com.bdzy.yuemo/.jiagu/classes.dex!classes2.dex

          Filesize

          2.6MB

          MD5

          c85c8bc86fd226cb4a01dbd10c17a535

          SHA1

          8eb1e2a4ea922a11adacdb0b151a476d50ac9a25

          SHA256

          96804002d5fc4823bbb3973933fb4f6a1b09b9261eb66159753318b470ab2052

          SHA512

          c431ea853ba8fbfb5bae91cc60ed4ed09ad40e8f7e05224e2fe29a9fd34bf3a901ab8387cdf63de50f7af9c81b0883ba4c6394fbde3bf018f6a3ec4b3027754b

        • /data/data/com.bdzy.yuemo/.jiagu/libjiagu.so

          Filesize

          485KB

          MD5

          2c1a490890ff15348d2fc3815b2cfb3d

          SHA1

          922e1e5539c40ad5bed578a9cea9f076df02eaee

          SHA256

          4a272d3707e61d656a95d20b944a402a4ae39b79013e3a47a93c0faa3eefc6da

          SHA512

          3a910269e855c3c9a31e40d2d18d166d3c3dc08bb9b063e363be8e737181389e9cc67be8d9ef8d1a63ca0500d0d028aa2562e6fb979beb1a1cccf0fe4d1d1853

        • /data/data/com.bdzy.yuemo/.jiagu/tmp.dex

          Filesize

          284B

          MD5

          f1771b68f5f9b168b79ff59ae2daabe4

          SHA1

          0df6a835559f5c99670214a12700e7d8c28e5a42

          SHA256

          9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

          SHA512

          dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

        • /data/data/com.bdzy.yuemo/app_e_qq_com_plugin/gdt_plugin.jar

          Filesize

          184KB

          MD5

          027ece4a90aac4d84812efa9b20b2af7

          SHA1

          564ec02d38ad8419fb3a96bed470c7a2632d3c35

          SHA256

          ce6f738fc3df590a63cf02cae624cae1384a3198b24b9e11d26d1818c45ab98d

          SHA512

          fbbdec0c28dc0c32d398f1e28cbf5a76a496bf8f6613a90aeda99ef62ff042eb58cd7cf747b1b03ce6cba00caecf1f20a0251d7b3fb999ddecdd3b01ade209e0

        • /data/data/com.bdzy.yuemo/app_e_qq_com_plugin/gdt_plugin.jar.sig

          Filesize

          180B

          MD5

          90e32008d66de8a7fc5fba5ee94b4823

          SHA1

          c647c283080949d16df08a091529024c0d73763d

          SHA256

          3af352e05f4acbef51772f6f837956cda95257283fbe4b9157967e5e38c06650

          SHA512

          7ab71c6cc507ab4918f360350c26e5123d2114f56454182d4fd455061d054e8045006b3436c35ec4791eb7f856cf2b75e358a977d50f4b481f2dc80d7f090aca

        • /data/data/com.bdzy.yuemo/app_e_qq_com_plugin/update_lc

          Filesize

          4B

          MD5

          dce7c4174ce9323904a934a486c41288

          SHA1

          e117797422d35ce52f036963c7e9603e9955b5c7

          SHA256

          0c030586945fe504b604ecc2e875c38ede400cd5cd73da9730302162e6b02c6f

          SHA512

          d570ab6a8f4a7b54d426b0481219074b5277ace37d88438d87ab97eb387938eca1cf7b09fa42d596c56ada860710d2a7385d2a96e1cedff58ad6ed8900f1b143

        • /data/data/com.bdzy.yuemo/app_e_qq_com_plugin/update_lc

          Filesize

          1B

          MD5

          0bcef9c45bd8a48eda1b26eb0c61c869

          SHA1

          4345cb1fa27885a8fbfe7c0c830a592cc76a552b

          SHA256

          bbf3f11cb5b43e700273a78d12de55e4a7eab741ed2abf13787a4d2dc832b8ec

          SHA512

          91972aa34055bca20ddb643b9f817a547e5d4ad49b7ff16a7f828a8d72c4cb4a5679cff4da00f9fb6b2833de7eb3480b3b4a7c7c7b85a39028de55acaf2d8812

        • /data/data/com.bdzy.yuemo/databases/GDTSDK.db

          Filesize

          24KB

          MD5

          755d1d1b0599d7be973031b5a9ed3373

          SHA1

          3b13cffb97005729fc20cd9b9a8547e0fa32632d

          SHA256

          90bc14445f887f7dbff548bdcc44145362d7fd20cc8ad8568b4d5c9372ee9b46

          SHA512

          afbd3a1c76a41015b2d4523d1c08dc14a3a75dfea3a5082b5e0552d750a498fd316bc98055b9f0ad2992f28b820ef15254461fb5df4cd6c21573a96f17b24ae2

        • /data/data/com.bdzy.yuemo/databases/GDTSDK.db-journal

          Filesize

          512B

          MD5

          e4e3975a273476081e57c312d7940bd3

          SHA1

          b89a7d672ad62fc00c991bdede1e0cac787899ae

          SHA256

          0356d087edd3ec0fb24f87a1facfa9f61afea735a55f199cad963164cd2dd863

          SHA512

          1ede3716426443e0ffaabdef451715e6d45f8ce1255c5f871d9e91bb9acad0e0ed107e7bde741f1ecb99061ffaefd9b34e66741f66f7392a9129e2b667827648

        • /data/data/com.bdzy.yuemo/databases/GDTSDK.db-wal

          Filesize

          36KB

          MD5

          4e63867d42f3bd43b55b8fd834555d4a

          SHA1

          f5de639963c04df5500caf142a614c6ecd7bd7a6

          SHA256

          a2b89c66af9c61edda7a1199f0372368c70f43066a51bd9b3a472725ff3a29f5

          SHA512

          46df29713a945edf815166675d007ca37387c759bbc5d4781da18d12ab047b2d76bc389583bdcbd3608af57b4040acd89f79b2f26cb19e8b1c96d1b5ca1b76c1

        • /data/data/com.bdzy.yuemo/databases/cc/cc.db

          Filesize

          36KB

          MD5

          fd348517c53cc0123970ce8e62ef4e7c

          SHA1

          8bc6f0795a1760379c4798f7ba42dc205e5d7268

          SHA256

          228f6e9064a054413346021406992e4b7986c0ba194e0d8e05952073de5b811d

          SHA512

          424dbb895a064bec378dcbc99227166721c51cf416ac2d5edc522725d281895977af66b530fbf4e142f41ec30422748c5a239ebd859dba34143447b6fc67a94a

        • /data/data/com.bdzy.yuemo/databases/cc/cc.db

          Filesize

          36KB

          MD5

          ce6135aa1b1fe4f2c2db2a546d2a5558

          SHA1

          79b59582154017aadab783dc266fcb158c252940

          SHA256

          7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

          SHA512

          2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

        • /data/data/com.bdzy.yuemo/databases/cc/cc.db-journal

          Filesize

          48KB

          MD5

          daa9ab5181d188bfa184d8f44dd5ef60

          SHA1

          4f7aa1cfd64200890c5627a0cffcc5cdd823c7d6

          SHA256

          77ba1106b1ee01993a89e5773e3a433f6f76c658f269505465dd1a925f263298

          SHA512

          be2b7eb075ecf7a0160555063d278d211fd08286b574e129f82aa5ee1a588eed73367cdae5e06cc8552d35366ad317527969fa5710cbde45c313dc0c3abf0720

        • /data/data/com.bdzy.yuemo/databases/cc/cc.db-shm

          Filesize

          32KB

          MD5

          bb7df04e1b0a2570657527a7e108ae23

          SHA1

          5188431849b4613152fd7bdba6a3ff0a4fd6424b

          SHA256

          c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

          SHA512

          768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

        • /data/data/com.bdzy.yuemo/databases/cc/cc.db-wal

          Filesize

          48KB

          MD5

          642c8e62cf2b780834331a4b6ac72461

          SHA1

          e048f802db79fb1c157464dc0c563606fa53ca2c

          SHA256

          7df947e82af8835261917d6d329969a4d2eeeb0b626697cad683003c8d3a0a0f

          SHA512

          111c2a499563cfa13c48e8e85b17eadbba88fff4547668318d39cd94620ff6690d0536ea24d73bf0967f74ae0f37b279837e064efc4d6e797a784ec67707dac0

        • /data/data/com.bdzy.yuemo/databases/cc/cc.db-wal

          Filesize

          16KB

          MD5

          3b46e512ce95ae8e805427914795ae39

          SHA1

          9a8352bf1905a0eeba2c426255c39a28f7276beb

          SHA256

          69ab039d06f0adcdc9b8106cf7dc42375fa85970ba8ba0e7dbdde79baadc1492

          SHA512

          e3a7ddd509158f7c774f8f5276958f6c913c21c30cf38b900197ef8c7a4b038fbd0fd7bacd1418040df2061ea1885e8e2e0451784f8343fe75b3d3a1744038f2

        • /data/data/com.bdzy.yuemo/databases/ua.db

          Filesize

          32KB

          MD5

          2ecd265f7282353a0040de70a6b532aa

          SHA1

          5ff7ad707e1aee407d4f97488c66687cc71b5025

          SHA256

          9db134fc076348959f7302adace9579583921b9d08f65452aacd6ef3d05cabe7

          SHA512

          850584895e5c24870320f25014a202067d8c49e274cf5b7812a262ac3711068fb25c332de7520b2d4cbddc5bbd08315cbd5a9dee3b91ea2785c36812442ba959

        • /data/data/com.bdzy.yuemo/databases/ua.db

          Filesize

          32KB

          MD5

          d604a3bf1f8d992cc320ea5b1f7609bd

          SHA1

          247f88df0b55c7d523ea5398637711a0e4a483a4

          SHA256

          329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17

          SHA512

          67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

        • /data/data/com.bdzy.yuemo/databases/ua.db-wal

          Filesize

          156KB

          MD5

          e23cbc35d986848730aa8b43788db97d

          SHA1

          cc76c960a8c9fb089c4e3ba1791cf084322522b4

          SHA256

          386388869185729ef5c2d2f9a74ad0fdf2e34aeab3d298b3061ca8615e22ba5b

          SHA512

          e17d50941555fdb12572b5aba5ac4699542ff564b6a2573dcf587826793fa9aa38c6cea54e1479ae4d27963f9c2cd527427babf166209a6d69bc0cc2024c06cf

        • /data/data/com.bdzy.yuemo/databases/ua.db-wal

          Filesize

          8KB

          MD5

          966d5d2a48715b4625dccb79e2cf1d30

          SHA1

          136f9505e0a351f2d451d7b6234b0d4c16e72662

          SHA256

          f1ff4ae8a9d9fc5f5725722e966d16bb257ad51be7710b3c11c45b412473d7e4

          SHA512

          e8ed0503af3e880e188428b5c458044b5b7f3a9b302ae2cd11de31c620805603f219572ef8e20891f6cc26174e0eea092e915755541cb24d5c3f8efcf71aa47c

        • /data/data/com.bdzy.yuemo/databases/yueme.db

          Filesize

          36KB

          MD5

          971c9f25635a864e2ae3ecb0e652b9bd

          SHA1

          a4cca6ca86ba995889136893f802882c5bc2c61b

          SHA256

          c55cc52c29b738c787a2f31e698b19e3168edb01fc742c5f87af5dae27bc57ff

          SHA512

          8a080e5b362108849fd734a41b07379769b594724d2975d6cbd4cd0119f59452a1c128ef45bb9256590886980046d3cb3348f81a28160e488d7b9f554babaf2c

        • /data/data/com.bdzy.yuemo/databases/yueme.db-journal

          Filesize

          32KB

          MD5

          55dc0725375cb70e4d4f08eee87badb5

          SHA1

          f2a7a6d18ec6cf1e80b9452489a6ecc64d3d0b1f

          SHA256

          eba4a137b16056197fab2c46e66ff4d3cb41d2fb863a68d6572f365ebf6622f1

          SHA512

          4e22dc3e8f8e49fc6541cfca42ec274ae66a7d3a8dc315b3b208e37d9c6fd4baed6673ddb05842a9b3fc7ae7c3c84e84d87bbf00f23d085ad51f7b0f1f04c706

        • /data/data/com.bdzy.yuemo/databases/yueme.db-shm

          Filesize

          32KB

          MD5

          826ccf2f17e286032716daf7cd19db06

          SHA1

          fedb0b2b8a2e72e49aa0b890b772ded1e508dc05

          SHA256

          927a7699e4c2dbee18c10d0418983254e0bb7c382ddeb3475617addc0860f305

          SHA512

          c05798aa1620eb5f55b6cb54522203ea730bc62ff1e89f31cde547a2fd68be7640d066464329ad424f230d00b4f7f08966e39b0c759bf4e92897e50422570c91

        • /data/data/com.bdzy.yuemo/databases/yueme.db-wal

          Filesize

          88KB

          MD5

          85dfc7f4a3bc33442a603399f4fa75db

          SHA1

          4ab9877f52ed4b5f162c58bc4708bf3577f5973d

          SHA256

          0cdc23a4bba5d33493817b6940dff9ed2531e1f93e9fac994a27aba9af362a3a

          SHA512

          96b454132947dff1b7e57f5329bea89511e7134684407f32e50d4d70eff7acbcc033a60bfb6c7cfa77c95fa81b8537e129ac4f5683d237625a546e4503f45e13

        • /data/data/com.bdzy.yuemo/files/.jglogs/.jg.ac

          Filesize

          52KB

          MD5

          20ab55b817c09956b55250bc7d2fd0f5

          SHA1

          acc1961e4f14f872ce0a5c0970350e51a5e23ec5

          SHA256

          398ab5ef5030c378e66b993570528df333517864a729f11cb60cbd310a24cb11

          SHA512

          7679e5b15d7ed9f0573072b24729e8960ccf110f61438f1ab8905c82ba1294be0e9df0315b914f454016d7f6f49461cdb1dd5fe0fd5fc916e40bbb30fcbe2289

        • /data/data/com.bdzy.yuemo/files/.jglogs/.jg.ac

          Filesize

          40B

          MD5

          115de84a1f9ff3d8d92f9c553d2fce8e

          SHA1

          660082af89b0506cba40cac4bde54a1ff4ff7c32

          SHA256

          05f2ed9adc163d09cfcb3023d86176621737d78091e624dac6254cdd3ae28ab8

          SHA512

          4d9225c7e4c0c717b632ae6d9e47576c975c99a746bc9105b2699cf631c03305e1ae58bb28df500fb9fe27223b5e7f096ab427a9186c516e693a1718d68723ce

        • /data/data/com.bdzy.yuemo/files/.jglogs/.jg.di

          Filesize

          340B

          MD5

          bb448225b9fc545fa1aedc817fb8482e

          SHA1

          bca64c4ee1f2aceef4863d5ee556ddb6843773c3

          SHA256

          f37176d1923d734ddf62b46f5f32e4d09c7bb00a21cd51adeeb37d2391ba3035

          SHA512

          66cec2a2dba22ea3735d17f70b4919a52a2f13668c27d9ce0ca7fd65bcdfb3009f99ba20b633f6ba5a4a25ee4015e804e89a04d8d65fa1ff53a4a8266df69c37

        • /data/data/com.bdzy.yuemo/files/.jglogs/.jg.di

          Filesize

          340B

          MD5

          5f436abdaadb7de8c64b4188bea547de

          SHA1

          4ccb1092d7e5690655a1b7e46113940c9b5a955c

          SHA256

          f01bc7c24907419a705968c86982abcd03277af33a36aa70b5ebe2a34cced66e

          SHA512

          6a5b0946c625dd28641b68f9199690f4f7fad18c664470d20052029ac09cab3a6990b5df5dc26119e62fca89ddbfc5fb573b60c92d2a0811cfe5d9dc7558e6f0

        • /data/data/com.bdzy.yuemo/files/.jglogs/.jg.ic

          Filesize

          32KB

          MD5

          95547407cef74f49d0d6d34c6b12b2bd

          SHA1

          9f339b5eff40e86c225cf8f7c8abe42709ef10f3

          SHA256

          19b50e9d12fce4c923aab912f1cec865b2bf740f2ded92fec2bdcedbfb099b88

          SHA512

          a08e597e6f964d459220e243bdcda8d85f14ab3f05e09f80740ca7dc07c18b827640f96128e2f7056216e9e7082cc9efafb60621d0c17e5ace3839165ad7cc42

        • /data/data/com.bdzy.yuemo/files/.jglogs/.jg.rd

          Filesize

          512B

          MD5

          89d3502bbb8ea3f29fccb4358824895c

          SHA1

          9b9989db3cb679d46eb72ebb2075acc3b77c042c

          SHA256

          79af086ff8ea4fab7726fd2bf4f17b3126f63116cfc377496050b7c3d95febb6

          SHA512

          e34204ef3b3ff80608bf3aedfd4b2e408361a5c137ed59f767743eb432f09d25258d78dc341c32e0102b41f75a4a4ab62c2d4650798ae2ad644401769dd42f6a

        • /data/data/com.bdzy.yuemo/files/.jglogs/.jg.ri

          Filesize

          32KB

          MD5

          0014c4157f7c879e6706b749ea40bff8

          SHA1

          8e5cc6a7e794c829bb99a468fa3ef7eb5e2f5f5c

          SHA256

          c0e73ce69d31b05b546971e2b88b946d61e1ba00d974cbbcfae5aebbe0d6ff91

          SHA512

          9eb81434389da715b09f5d956f4ecdb09ceca62a97cdc36c695203dfffb80ec7a25cecd8219d1d369fa1e20052eff1dadfe0eb516df16b1a39036f67081226f4

        • /data/data/com.bdzy.yuemo/files/.jglogs/.jg.store

          Filesize

          127B

          MD5

          d97170542a165b1c5a7952e458a74a53

          SHA1

          3d4da66d9eb89c68ebe5e5ae6cf601ede66aa095

          SHA256

          0398dc6848fac4d5013afa76a7d1ab79d8f54fa012016f132c71d2de78a9d9d2

          SHA512

          d340613a50b31d3037977e0269e58194051731e92297e5107ddf306ec0b64ce424b062e229307e6aa5ce1fbfdf71e0e4f5fdc05608487f47d4a19cab4b837605

        • /data/data/com.bdzy.yuemo/files/.jglogs/.jg.store

          Filesize

          28KB

          MD5

          0d3e99204c6401ea499fe9e6d9855497

          SHA1

          09829f00ca458eab7374d5079393a2cd69a2348a

          SHA256

          63ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca

          SHA512

          8d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68

        • /data/data/com.bdzy.yuemo/files/.jiagu.lock

          Filesize

          27B

          MD5

          4bc170fa10e1964bfabc345e9cb3fa6b

          SHA1

          62f849e3a03b865cbba79fafa8deb0976be9645a

          SHA256

          e0abde8d706ef986fedb3123eb3cc0dfc9822669ede8308b21a4e3aacde6ab8b

          SHA512

          0f19dbd9b1fba4fff55326cedfc725e812b82d2d1c344d8a8771dc2fd19ca53f3946d4e06233e83e63dec32b5bd0f148a37a7615e6ced6f7624ab512ae0f576e

        • /data/data/com.bdzy.yuemo/files/.um/um_cache_1716638390990.env

          Filesize

          1KB

          MD5

          5a1d40dfd9387be37d6d88f976264539

          SHA1

          30c2a3bee1d482ce532931993e35996ab65d6199

          SHA256

          84ca5fe08c30abf06a55d46fc1386c5fe43f1a7a114c93d0f7e481734c42bc62

          SHA512

          9d3afa631d9e8ec40e5a0c68c682389082e22357339dedf448df7a973b955ef139bd3ac9301df5bf92a843ad660e62aef6de3b740e9f24f3d7b8d06bd51a385c

        • /data/data/com.bdzy.yuemo/files/.umeng/exchangeIdentity.json

          Filesize

          162B

          MD5

          f7922abbf796ba1173a73fa42cb9a9a8

          SHA1

          21f8fb1428d7275b98d68f83a951cd48eb988a96

          SHA256

          cefe3b5378960da845bd6f79ba5e02b7af46e62551e2db4297ea375c044677fc

          SHA512

          37481fa881f68ef5760d151d511245cafe7ea6f6d48f8f059e063c598ff18d524ba8c5b9a45a119f60232bcaabeae7b5f1b9499bf491d9ce8b201b8a4efe7ec5

        • /data/data/com.bdzy.yuemo/files/exid.dat

          Filesize

          54B

          MD5

          3fa8d1b99353014bd33a1bb4ef3986d6

          SHA1

          9a0e36f5073d54ba6669f139eb4ae23fe931977b

          SHA256

          6ad6b246c641216fd7a36a03bcaefb86959270edca4d3320cf096a835f99a78d

          SHA512

          388f67f6feb63882f233e1f4ff537c1211dd2b4247d3a64aff11220b018dd194cc0b5085e3f00924cba6fd0615fa5c9b529c3aef2142a79973c9c44bcad5986e

        • /data/data/com.bdzy.yuemo/files/libcuid.so

          Filesize

          129B

          MD5

          29b5ab6be112f938d4f70c07f60472b6

          SHA1

          b2bb41b92155af3eab3486afcd5c606bdbd1fc66

          SHA256

          17e84f58de00f10799be3fb99bc99ecaaae502b097e58ded8843de36be03ad86

          SHA512

          7712e3421f91e4036879aa8c61f59aea3fdfc95bb324ee1bbab0108ef171397b5305344dfc1d628b96925b52ebd801bd97e3f94b6e5ea8a7ca13974072ef240e

        • /data/data/com.bdzy.yuemo/files/lldt/hst.db-journal

          Filesize

          512B

          MD5

          f75cb94aa1f7e5549f2b4a3aa5f43915

          SHA1

          87acc8d0de3c8ce664dc97509d7a042498750340

          SHA256

          b7ac17f8a06899882b4e3fc264a4326878c0b756d24262a609bcbef99d149efc

          SHA512

          389910f5855d5a63d16d4a61025d5b30028331cfd5bcf769d892861c931e30ea758a0eabf46be46dcf7219c0ee05c75f5549eccf1443a541df9f6208c3119f5e

        • /data/data/com.bdzy.yuemo/files/lldt/hst.db-wal

          Filesize

          36KB

          MD5

          20fdeedc5c011b1af70036e51e331056

          SHA1

          c3e92d7395da4477773d9c0c666c65c5742198a9

          SHA256

          977f5cb881149e9101b2d0697bbdd27120e7c1789852d3490ccda09c0551cdf5

          SHA512

          9f4b511b0edb8ce1eecf88cbddc5943922f478edfaca2b040cc56de539ac123b3963780ddaca287922adce363b307526fe6e54ac8f86fbed49b0bd7a5dff2f3c

        • /data/data/com.bdzy.yuemo/files/umeng_it.cache

          Filesize

          498B

          MD5

          4d9c6f9b53d5b5b1daec6fd11da75d7a

          SHA1

          fce8af4a19e60116124019a88c441ba87285fb5c

          SHA256

          f4dbdd5b3685c39ca9eca7bfde99abfa4d2e45c433fed14a9326336acfdeee8d

          SHA512

          85d137bf5f4f7186a746c9a6f11d5da89d4914e454184127d7a5318e197e8612a9c8c124f2da606b72c644c7a5610b609d27cf3f70db4afb5914bc7164e69610

        • /data/user/0/com.bdzy.yuemo/app_e_qq_com_plugin/gdt_plugin.jar

          Filesize

          409KB

          MD5

          e760621eec4266ae00ef48ad1a7676d9

          SHA1

          5e6add4d5e21f8a9836e3d5db70b56b53822dcf3

          SHA256

          6d9c1159b59b263b8ee84227617e0330557f0d8a8844ea634b4106a9ae50e97b

          SHA512

          6687964975b0cccf6243942b727406c95b19a965b23d706dd26c9722b8e2e4fc6705020de52542ef7c2b7d7316b318ab6c4efea56d9ec004c3bee6ac976eb1a1

        • /storage/emulated/0/.DataStorage/ContextData.xml

          Filesize

          801B

          MD5

          30a7577526c7f5f5a07d69405f71f122

          SHA1

          6187f58553d6dae2e455ff8a0999465f2d5c9081

          SHA256

          01162683006334fc91c41d873c79d9c22ddc88e132d8070ca042d7a5e19ce485

          SHA512

          ae41ea1fb9d5e091bb8a59d831a88495d908fc3146c821abb5d114a8493da58c850d9af99e142a66bd030511479402f9be3fee9a0fecffe258bc2392052b81ad

        • /storage/emulated/0/.DataStorage/ContextData.xml

          Filesize

          206B

          MD5

          6aa57fbf32b4f125f154abfedc92af19

          SHA1

          f6e43f0505f405472085e6e6b55da3aa24b0bf4b

          SHA256

          e708bd7e58bb4fe25ec539713685ddcf0d3177fdf3ecd54e660247517671ceda

          SHA512

          dd2621d927c0c9bc6174f4bf4a5cc3bff9b52f26e6c856c4283869d58f8c0c56c7d3e56a0ac6ab1298e143322359f3c34931232ee6827e93067f1e6b160988db

        • /storage/emulated/0/.DataStorage/ContextData.xml

          Filesize

          213B

          MD5

          eddb60cc9a734ef6542267f62835f88b

          SHA1

          e5d31b39500657e89f6359faf3f8fd933fe19cf0

          SHA256

          29e001dd589a1e151b97646c8a19e88a6a2ad82de2254cf64391ceb07ff0a6d2

          SHA512

          f5ba46e2929073d087ba3b19ffcdbd8aaef1a2143e7180d7c53c10d8453ff5f92405fe718b7e779e40f6af0356bbd89d892c5994d7d4e82c60ae13dfee4133e6

        • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

          Filesize

          96B

          MD5

          6055a4ce5d3b5e65cd5cf390fcb2df23

          SHA1

          4f69e9d918a779dc0822eab301de1f8d2a3ad3f8

          SHA256

          3325ff8d73c5fca7969fe4d5e7977453964b7bcf72b76d816c1d799856500fc6

          SHA512

          9edc7679f7e8d7385aec817c3e054fd27f54997eb7bf1414a08f1fd00258f8445efbcaba3c6015b3eefccf691fb67d0fa9498ef571dbab24437e68752b81d978

        • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

          Filesize

          111B

          MD5

          28a38c24052f3d3456f665e28b57debf

          SHA1

          669286dd5823d863cb7c0fae3d2b39ac28981744

          SHA256

          ef1187d28c4df3125594da4c6c6de67174b708a6316fca1b25e83c25f97bb437

          SHA512

          c33f64d57862497efefb88647a0bfaf4fd47098ddcf7927a1870edbe40e89f513e2f82f725129801faf667c48771e1f0008b008fc1f784979b02044754bbe59d

        • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

          Filesize

          167B

          MD5

          5d65577f884cb712813b0ef35fc513b5

          SHA1

          eeca9876e31b06f4c8f3b18593de5e200271363e

          SHA256

          6407226050e919fea8c781f65f5cdbbc8266479f7fac575b2f730d997d2ef332

          SHA512

          79445b43df694457e2acc4703d7c482f92e6684ccdb4025f5d874d9760c3b4ff7d4b616ed286066f5f658e3f5d4b5f98c16b0a749b4e80cebea102955f616349

        • /storage/emulated/0/360/.deviceId

          Filesize

          4KB

          MD5

          f2b4b0190b9f384ca885f0c8c9b14700

          SHA1

          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

          SHA256

          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

          SHA512

          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

        • /storage/emulated/0/360/.iddata

          Filesize

          512B

          MD5

          4f78e70c83ed1d24989308c9dfbd4308

          SHA1

          126d6347dac00e58ee9116b338480fc8ff793e64

          SHA256

          155fe1f495822224ef0fed6bd439943b12c6fcbd0bb214ecb3bbef1af675a127

          SHA512

          8f77d5b59841c80b254380ab6d461b02702a6c8d62b575c0594d3d145caacf36531bbac1938e83aca0f2eb5eb638d415fb07d13774c3f58a5dd617c8c9df23e4

        • /storage/emulated/0/backups/.SystemConfig/.cuid

          Filesize

          89B

          MD5

          93d1a2357d789ec0d72ce1169e7219a9

          SHA1

          6af0af388b38264651a33d15e23582246424b3b0

          SHA256

          4805377324516f2c9f111615e8001a17d5b083554e1a1dc85fd21b9fb8f23b9f

          SHA512

          4e519fe242df8888d27f66679d63666c550cfa816ecdd61e160b255ee237bb919cb4221a4ad155f82948f11bb3f960a2305b59c9daf44152fca8bfa7766dbe53

        • /storage/emulated/0/backups/.SystemConfig/.cuid2

          Filesize

          129B

          MD5

          de871c130e9c3fc15c45efc07a576858

          SHA1

          b0b55c5be2217cd9824e9c6c4436e496f2a6b783

          SHA256

          abafb3fa00c07710f693d389f3440be353f150f7059a2a1401170a06e2a48376

          SHA512

          c45b9909239b77fa54bee7e4fa49e934609e361d43c570ede71c68551ec12dcae10333d27c95f450c0b4a04a96bf908e4a43598dd0c2384255d67a85a11291ee