Malware Analysis Report

2025-01-06 07:48

Sample ID 240530-p8gjkshd8v
Target 843ac15f4fb024e10b258bdc23de0755_JaffaCakes118
SHA256 8c93c50dca8d8e49e612bf5ed10f2381c3281e9683050b873288607d3cfeba6a
Tags
discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

8c93c50dca8d8e49e612bf5ed10f2381c3281e9683050b873288607d3cfeba6a

Threat Level: Likely malicious

The file 843ac15f4fb024e10b258bdc23de0755_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion impact persistence

Checks if the Android device is rooted.

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Checks known Qemu files.

Checks CPU information

Checks known Qemu pipes.

Checks if the internet connection is available

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Requests dangerous framework permissions

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 12:59

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 12:59

Reported

2024-05-30 13:03

Platform

android-x86-arm-20240514-en

Max time kernel

177s

Max time network

186s

Command Line

com.news18a.wangshangcheshi

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A
N/A /sbin/su N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks known Qemu files.

evasion
Description Indicator Process Target
N/A /system/bin/qemu-props N/A N/A
N/A /system/lib/libc_malloc_debug_qemu.so N/A N/A
N/A /sys/qemu_trace N/A N/A
N/A /system/bin/qemu-props N/A N/A
N/A /system/lib/libc_malloc_debug_qemu.so N/A N/A
N/A /sys/qemu_trace N/A N/A

Checks known Qemu pipes.

evasion
Description Indicator Process Target
N/A /dev/socket/qemud N/A N/A
N/A /dev/qemu_pipe N/A N/A
N/A /dev/socket/qemud N/A N/A
N/A /dev/qemu_pipe N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A
File opened for read /proc/meminfo N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.news18a.wangshangcheshi

/system/bin/sh -c getprop

getprop

com.news18a.wangshangcheshi:mult

/system/bin/sh -c getprop

getprop

Network

Country Destination Domain Proto
GB 172.217.169.42:443 tcp
N/A 224.0.0.251:5353 udp
GB 172.217.169.14:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.169.68:443 www.google.com tcp
GB 142.250.178.3:443 tcp
US 1.1.1.1:53 log.umsns.com udp
CN 59.82.29.162:80 log.umsns.com tcp
US 1.1.1.1:53 api.cheshi.com udp
DE 185.232.59.134:443 api.cheshi.com tcp
DE 185.232.59.134:443 api.cheshi.com tcp
DE 185.232.59.134:443 api.cheshi.com tcp
CN 59.82.29.162:80 log.umsns.com tcp
US 1.1.1.1:53 icon.cheshi-img.com udp
US 163.181.154.237:80 icon.cheshi-img.com tcp
US 163.181.154.237:80 icon.cheshi-img.com tcp
US 163.181.154.237:80 icon.cheshi-img.com tcp
US 1.1.1.1:53 android.bugly.qq.com udp
US 1.1.1.1:53 s.jpush.cn udp
CN 14.22.7.140:80 android.bugly.qq.com tcp
CN 124.70.128.38:19000 s.jpush.cn udp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
US 1.1.1.1:53 sis.jpush.io udp
CN 120.46.131.222:19000 sis.jpush.io udp
CN 223.109.148.130:80 alog.umeng.com tcp
US 1.1.1.1:53 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 123.196.118.23:19000 udp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 59.82.29.163:80 log.umsns.com tcp
CN 103.229.215.60:19000 udp
CN 59.82.29.163:80 log.umsns.com tcp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 119.147.179.152:80 android.bugly.qq.com tcp
CN 14.22.7.199:80 android.bugly.qq.com tcp
CN 117.121.49.100:19000 udp
CN 223.109.148.141:80 alog.umeng.com tcp
US 1.1.1.1:53 im64.jpush.cn udp
CN 124.70.211.119:7008 im64.jpush.cn tcp
CN 124.70.211.119:7007 im64.jpush.cn tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 124.70.211.119:7004 im64.jpush.cn tcp
CN 124.70.211.119:7000 im64.jpush.cn tcp
CN 124.70.211.119:7009 im64.jpush.cn tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 124.70.211.119:7002 im64.jpush.cn tcp
CN 59.82.29.248:80 log.umsns.com tcp
CN 124.70.211.119:7003 im64.jpush.cn tcp
CN 59.82.29.248:80 log.umsns.com tcp
CN 124.70.211.119:7005 im64.jpush.cn tcp
CN 14.22.7.199:80 android.bugly.qq.com tcp
CN 119.147.179.152:80 android.bugly.qq.com tcp
CN 124.70.211.119:7006 im64.jpush.cn tcp
CN 124.70.128.38:19000 easytomessage.com udp
CN 120.46.131.222:19000 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 59.82.29.249:80 log.umsns.com tcp
CN 123.196.118.23:19000 udp
CN 59.82.29.249:80 log.umsns.com tcp
CN 14.22.7.140:80 android.bugly.qq.com tcp
CN 103.229.215.60:19000 udp
CN 117.121.49.100:19000 udp
CN 124.70.211.119:7000 im64.jpush.cn tcp
CN 124.70.211.119:7006 im64.jpush.cn tcp
CN 124.70.211.119:7004 im64.jpush.cn tcp
CN 124.70.211.119:7003 im64.jpush.cn tcp
CN 59.82.31.154:80 log.umsns.com tcp
CN 124.70.211.119:7005 im64.jpush.cn tcp
CN 59.82.31.154:80 log.umsns.com tcp
CN 124.70.211.119:7009 im64.jpush.cn tcp
CN 119.147.179.152:80 android.bugly.qq.com tcp
CN 124.70.211.119:7007 im64.jpush.cn tcp
CN 124.70.211.119:7002 im64.jpush.cn tcp
CN 124.70.211.119:7008 im64.jpush.cn tcp
US 1.1.1.1:53 s.jpush.cn udp
CN 1.94.119.240:19000 s.jpush.cn udp
CN 120.46.131.222:19000 easytomessage.com udp
CN 59.82.31.160:80 log.umsns.com tcp
CN 59.82.31.160:80 log.umsns.com tcp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 119.147.179.152:80 android.bugly.qq.com tcp
CN 123.60.89.60:19000 s.jpush.cn udp
CN 14.22.7.199:80 android.bugly.qq.com tcp
CN 123.196.118.23:19000 udp
CN 103.229.215.60:19000 udp
CN 117.121.49.100:19000 udp

Files

/data/data/com.news18a.wangshangcheshi/app_crashrecord/1004

MD5 754208adeb5c3f28ea4603a6b5c40c28
SHA1 a0a140350c815bf59dc9a914c4bbaa63296cb198
SHA256 428c42a1e6819d434cb38b64b3c7bc61300702f80f194b26f59bfbbbb9226417
SHA512 245ff066b4cc3c01ab3fa129b1d5a093449f98547515e6ce9f09e0e72a845d6a08139ebefdfc9403c04125baf6cb2a2f1bb6b0544a91c03f9ff0897b2c0af79c

/data/data/com.news18a.wangshangcheshi/databases/bugly_db_-journal

MD5 58cad6617f78c75cf20748668b4d4d8a
SHA1 9fe75284b1a6702f321b9c3cd33f3f4dc8eaf802
SHA256 b3bc1791aa51764bea24571df0392067d3f5bc2d80688209713e3eda866b8270
SHA512 ec8f75a964535ee716f952dd2fb5ced9d8dab52d64e4e535cfd8d34bc9a0a6076c5c452662a9aaf4c23d4aceb618c0adeff1e5f9c4ab3dd7e431b004c5722b82

/data/data/com.news18a.wangshangcheshi/databases/bugly_db_

MD5 aa99281ce0cd69a9302f8b64b918ad75
SHA1 ccafc0e5fb16198e466b209a888301f4100fafe8
SHA256 a3cde8388c50e78c7b3c8dab1d0c46c64c375248031adbb6a5802e3da65bb431
SHA512 a8b80f09a555652d3e4b9775b6aa58341dad7fb120509e128df417533ba361353b19530306e8691f1ce5fc0c69f1a89d29bd2eb176291a5e85b945d14c9eb085

/data/data/com.news18a.wangshangcheshi/databases/bugly_db_-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.news18a.wangshangcheshi/databases/bugly_db_-wal

MD5 4aeaa9db3b3f1e609e95eef1a919a440
SHA1 824db6a137918836907262dfd92f40cf182f5329
SHA256 0374b58caeee0cb10b41bfec3e2e1a68fcfc79ecc42b138b6ab666c9e831535c
SHA512 fb47c4f73a87ceaea7655ee39f4bb6b138c40882e8d1c9c7768aa2f5d27680de967d95794463318c4cfdcad60c816fd07234c707cabc2eee8ee9c6b1c3c4a6d6

/data/data/com.news18a.wangshangcheshi/app_crashrecord/1004

MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

/data/data/com.news18a.wangshangcheshi/app_crashrecord/1002

MD5 8f6beeae5bd0a75d12b7bd34d9d7105f
SHA1 81ed61cde53efe8281e0b00854e00de9e3ce1201
SHA256 43e919acefe323d2ed07664565f81bd17b1fa8bc6ba970d7cf250f02c4f18acc
SHA512 4d05b6e3563c86e6b85a10b1c264f407692f82d6e6dc0148ccbbebffc6c64f11a54ce57699dfc7d3a616701eead42e3211ffc2f610105a2edc56a8a5a96126be

/data/data/com.news18a.wangshangcheshi/app_crashrecord/1002

MD5 7526b2a3ccdca68cde3718843d732895
SHA1 cede773ca7eec9bbc4c591207447a44fe310cab0
SHA256 ff4209a4b2342b679fb277233891c74c01e3e3e2d05e0442fed499e15616704d
SHA512 c0989600a92d6b250f20d8e47b3f739d56755c4f5726ea1dbb4b9de54b5b1f77e4bc2bf258571e830aab35a5248af7a247866b7a224fcf2faefdaed77862f98d

/storage/emulated/0/Android/data/com.news18a.wangshangcheshi/cache/uil-images/journal.tmp

MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

/storage/emulated/0/Android/data/com.news18a.wangshangcheshi/cache/bitmaps/journal.tmp

MD5 c59d055873a5324c4f76d0857c7da3dc
SHA1 72e0238163f72b92257006dbc8bd151d2d71a84b
SHA256 f803ad0966d85b09bd077a4e7a4478abdbd11b792fb560c05cf2f7e33fb1b8f3
SHA512 028a0bf5696d0333e5bf8c6b5e6590dc74e37a45204b8e4da2e8e93ed13719fb815bc700c85829411147a8baaef4d8096e63750b3e5d9bfae18db30068fd368b

/storage/emulated/0/data/.push_deviceid

MD5 d022a5da0bcad06816b633905ef3ed16
SHA1 9d5ae90c8531975814a0fdd9807be4bea0b6b138
SHA256 bd3d4c456f7f67b81ead99c6ef17dc1599f3638b728bc1135162d995b2fa1c51
SHA512 c4afb7fe9130112e417036a0afb67b32d845b5bebc133797e54e8224e8e5b1dd753bd597c45e88da5568ce0b5b85c8235b6390f0982033fcad03d1d26150acf2

/data/data/com.news18a.wangshangcheshi/databases/ua.db-journal

MD5 7bc9aab7c64f137813990df4fed456db
SHA1 7fbb95d11a058ed6f03eb682d8f81797331cbc70
SHA256 f0a6905204af609335856b268f7914bda6cc958d55c4867cec83cc7e2b3431a8
SHA512 c27a8debfecc9ffb3a57bb5aa98b08662bdfebb7bdd93083e284a32ef7e9ba8639ab5873b4159de28ca0e262aed92a03e48936520e3c742782a417e61aa7205f

/data/data/com.news18a.wangshangcheshi/databases/ua.db

MD5 407d9963e4d85dadf40ed77e5ad77f22
SHA1 89504c892bdf4fec27d0584c428625afd6c2436b
SHA256 daebc8686697cccc82695158d2585aa999bc069683c3c6a7858214ad0ab44dcd
SHA512 e66ce06647e35fe0c126787a8075e0728ad5abee2df7aedd660330b584f41dd95abeb0d74e775555eb66b454d7b7f304a0389350afd89bb1183e336174d9f2e1

/data/data/com.news18a.wangshangcheshi/databases/ua.db-wal

MD5 9fffd7fd383a0cdf4967db9d2af08cc0
SHA1 2690048715b6c5f7563800bc2af8cafaf3510fce
SHA256 e827afe9c3b4dbc42742f17a8fb9b6f01290febfbf323506a01a57a6187ab54d
SHA512 736e504b6f9773d19e171ae9da50087419d5d984a331b1fdaae7a2151d0c6dc9b3afdfcf1babdc5be5c86b8e025b2baeb416def924c7b5d94eef5e5c5519e380

/data/data/com.news18a.wangshangcheshi/files/jpush_stat_history/active_user/nowrap/17e1a7e0-74e0-4a1b-b562-7a0a78be95a4

MD5 f9eb32c2060f91333b72fd4acdf7d335
SHA1 7212dc2f93971fb16b3485fdb1310575179e76aa
SHA256 d8f86961854ae71987bd98578c7c897bd7bbf676e71655e0befde760cf3747d1
SHA512 e13f072c8dda0169911cf8a97712d96885480ef83bf1b4cc2c1e21ef9af2dd524514c5cc91552e68a34134d7d7b29be88a429bbd314ae81ea53f03a94d28be91

/data/data/com.news18a.wangshangcheshi/app_crashrecord/1004

MD5 2b1d004257ec4519203a1e2916b4824c
SHA1 e7e68c909a766f7265255e46025ebe41f410471e
SHA256 b6680d1f1cbbb549feaa9d03644e517ef0fd4cbe4bd8a1a020f8fe1fe9b83154
SHA512 22856b53a20a28a7b6341ccead6606a50f9bfae3a37139b8b58cf7c85b8d26743480889d590ef3a8d69d702b7b4d0023fd994529033e483303469b39dbb8cbe9

/data/data/com.news18a.wangshangcheshi/cache/-24-10387-90105-11179-112-68-96-18105-19-11762-27

MD5 6ac1e1879e0b0863f181015ac774bfd9
SHA1 9a6d49342d42a84f88d76e24c2c91cb149749c2d
SHA256 ebd54386300c3c2a5d88cedef7e8e825509380c9764f4b4bd15d819e620ab7cf
SHA512 96c220a6b475609c38983389455f45ce0e57e647c0bb10f74a262a6c5c9bce564fe33fc6d8f3b73f4c3bbffca3857383ae8b478a188f7bbc63d2d3067a7d177e

/data/data/com.news18a.wangshangcheshi/cache/-6-98-1109818-9256-89-61-99-108-44112-9837-82

MD5 72ed11ddfd63edc87ecaf2753fa7da6e
SHA1 f89b248745c725d0bfbac66831297f6089e773ae
SHA256 1bfa30911b37a0b24659e6eb39192698937b9622125f9b047797f471ccfb6324
SHA512 ca894d5a6ea88d82449b1958f12114be867c6df576e4922a363b234f2064a6e49bf0fb0200ded07cc0b7fd16d2db9b6eba203f93e875204eb1dccdcd8cd54377

/data/data/com.news18a.wangshangcheshi/cache/66-8673903-28189126-7154-90-20323-87

MD5 fb07d34260020f9a46f90dcb42048380
SHA1 ff483d39f3abbcb39cba3904ece0d900af037314
SHA256 17d7895e96654e92e2663045d7780675ac5ca5afa742183c8af12d098e02bf20
SHA512 ed101f0e0e72175b1bb9c779c492fbfd3f1fe5af5fb488ea9d51c244888076bbbbb24fc82c936df6b04aa77b621d1e9b4a860d2174afbb2f074df53f2c03cff1

/data/data/com.news18a.wangshangcheshi/databases/database.db-journal

MD5 8c896055f8cc738502d6aa53de36173b
SHA1 a6b049b878d53f9218bca71a8d7ae2644c11d904
SHA256 616d81993c20083550d94e00cc7b1e52867a98ce0396238f6c7656355e1acce7
SHA512 646212964e1355240fd43d4bbbcc360a9e032ce3b5d4d58b7f673f45f25d88d0fe2ba9fbd662b091259131eedf4c6a16a0dce681f9adcf3beeaa3986e247910d

/data/data/com.news18a.wangshangcheshi/databases/database.db

MD5 66da0144853eac49e365e582a95dbab8
SHA1 1097f79c8a0c3485d0fcaa586de38c74e32f4273
SHA256 caee2149d6610527bdb985ebeb9ae23200ef24f2abf1c7fa7da97cf337f3e906
SHA512 ec018b5430f14bcf6bd0fa3798af7814c1cc81ae32cd5393de879af55ae1fd9cdcda1de10baa1ab435e636a19f1689c68fee5e6b4ff66d2d8d0890ab10df8fcc

/data/data/com.news18a.wangshangcheshi/databases/database.db-wal

MD5 11d247124545d67b17faeec7fb71174e
SHA1 592de933e13ee609e62156e66eb8fb385d4ba70a
SHA256 f33bb423d10b35c1a6ddf42c73726762a8f0dde958ab7775634991037ee52af9
SHA512 e75d321318d7369c51d7a1da2bc23df8a3bd6d1179a0346f1b89e4ce89ba79cd1937337784e0f4d8772c9e8ca3535146701877a0368ddb173711aa0daa766b0d

/data/data/com.news18a.wangshangcheshi/databases/database.db-wal

MD5 2a5f84a11a3d3040e4809a1e82aa1cc3
SHA1 5fca3c36a18897c5717aac1887360d44c688db0e
SHA256 d880a23a1b3bd23d8d3db8501de977dbcaa9881506142976ca9d6050b6edfaba
SHA512 719967cf679587a6d4d9568dd241a7519e7ff7a0b8f303ac62edfa17f35c0b2613128aa0409fb43575b31b9f73762cc1a9286f860a08bec84da7489011faabc6

/data/data/com.news18a.wangshangcheshi/databases/database.db

MD5 c81e50c1549d5c34e72a3e82e1f131b6
SHA1 9d776c3da5bb4a9752f9575ac1684f0357c2fe7f
SHA256 7015774dfff762be1b1106ce4492e5c9488e6f5491e691ffef89d637fd1b4321
SHA512 37d84011415c83e53e22f0738e30ec1f9a70d8005f9a0c6994a0b1e9ab90476fee8e07bc6f45a67d7d2d93a1d283fab5a70d5b5ea3bce041dead5d01aa8ab308

/data/data/com.news18a.wangshangcheshi/databases/database.db-wal

MD5 b17d482df402b06cb59fc73bbc92ee9f
SHA1 bd9d496b745c24e4b032e173b98ea283b4aedc48
SHA256 fba745c09f34ab2b125a1a0153600634a9fafeb1e42b37cf9fb06c8474c8a683
SHA512 d0d9ee254d9aba1255f7167aa8321f721f199a4f86f963d3a93d3a4cc840e7311d4f7785544af69906249dbbdce9176889d717451ff190867c73c92a467eabb2

/data/data/com.news18a.wangshangcheshi/databases/database.db

MD5 1b87d5d0e34db08db5fadf0809459080
SHA1 c5fd640f4aa65a776aa19640dc69710b0f0c9e03
SHA256 fe7de8e2ac7970fe180969e75fe3de7d78539ef7090b5aad483fb81bed096559
SHA512 c8af6fa72d6ffaf264314fa4aedfc2f990f2e451891bd672aebf92a49e7bc0e8e41498ee7c593f39140239b3c78a7563ae7039021bbef2057e69c806233fd0d1

/data/data/com.news18a.wangshangcheshi/databases/database.db-wal

MD5 013affd64a4cd2d3943e03bd436b5f88
SHA1 b8cdd26b2d82f761040ba273c8be5f2d51daafa2
SHA256 3646aa34fc60d5f52e8e0e120c454417e543eb6c884445f8fb1d9b0c4ee8103e
SHA512 19855df9692846a22afd2a35fb943d9fc9aaca4266178eec09ecef67b9ed319e556c0fb60a630066b9ed1f117c1d60fbf2897d50816dbfe316c7abaced575646

/data/data/com.news18a.wangshangcheshi/databases/database.db

MD5 bbb184fe6473eaebdf17372108456615
SHA1 9a0c9a3dd13436fcd2b4e2c9f9b15385d38ea4cf
SHA256 0bd374aec3e57ab61cee37badc05c8afd179aa3db912b60b84eb61520a80b0e7
SHA512 9feb8d03f174bf22a4fa559cdedb9b05aca1b4c1d8f210777d40d0cba64b51da74d01e09bd0d199253447cd5668fb0bef06057ebd3be4d91c6bd8481797b9274

/data/data/com.news18a.wangshangcheshi/databases/database.db-wal

MD5 ff6dde12a79ef88aac0f6ccfd35d1c33
SHA1 9013f89331f8052c976c0358280df996a3197016
SHA256 8ded97bd5a4647367325febeb6a3902cf876fdc691713c851d3901661ba25466
SHA512 b50fc8fe0a414760f1d89bfd15ef6bf085cddc89288e94a35eb3e0d663be94745cd1482c7510f97255c8908e5b62b1460b8c5634b0d846b77965a830d3802acb

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db-journal

MD5 a7310c2647f36a0b20a570e8d3a0b9b4
SHA1 cf8fc56924ba6e3f3b6cf66272a3601a3ae448a6
SHA256 5a04bc16f6ba984677319dedcafdf599e882c556b236a5aac2fb33b4db625b07
SHA512 a71c94e38d903fd26e1f19e102531c1dba2e8c7611a97ae9045c82f8c4e9ea9518d1e95b434e285f0a866364a43b5938b0b86a4d5b23ae65f16798ba2fcda416

/data/data/com.news18a.wangshangcheshi/databases/database.db

MD5 2b3dfae04de55d0b21b2699e2497cd02
SHA1 c3597299c130fa7792576c642364ff0d80a2c067
SHA256 2bc636e9f6866fae000f0603042ae83fce9718dfd9ed08bd2ee75fc3757d0cfc
SHA512 92b4f7f0735a301eb7514bb25aee38da82879dd40421498c399a518e57376fe700adc1a7efa1931f7301c676f109b325e0f7cce275658bff218fa8cd9a1918d4

/data/data/com.news18a.wangshangcheshi/databases/database.db-wal

MD5 0a6a7e338a1a906d0eee8c41cdf10d03
SHA1 c5412c46390d71fd629177ee84c920aa0878fa53
SHA256 d11bb6836335af974c7106c9cc6cf2f970d60a8369df04de2ec75256456bf170
SHA512 a93b9c1a92c619c4582d2d74adb0f2bb8c197373f0ed2855a3f8f5b4b81f81ce7be3c56e41c4cb7ca819de47b7d6f73ad392569b9b2e03cfe05ec5831eb0b559

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db

MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

/data/data/com.news18a.wangshangcheshi/databases/database.db

MD5 b69444130fbb98740f81fd504fd6dee0
SHA1 6bc88481a86bb5961aa7cb68b72573524441a913
SHA256 087e44d9314b04258aab92a644965406901f1e14464a6f4a0372875e8279b446
SHA512 1c6f767a547c771793c8df90491e35a016ef69b4dfacc9d1044ceae9ea7298ed7975f7022c72e954d0f9c9553412e9169d2333adc7e28cb50ca1d7063959bb92

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db-wal

MD5 cd9d67a7a641f8a3fdda302f5badc835
SHA1 af2413aa2da419839a50a8c82749c0c654854421
SHA256 de54710b9c2b2e37d706772e8a2736f2fcd812de9dc9370ea1ebfff26fb795ab
SHA512 ea2989846bcff7e6051a733a0affc879f53e99b4c44d033c21b2ab7a3c437c4712541f3c5c307dbc6f3a32cdaa3d7b88a79ef2f5b67fb3c2245998a7b6fc8259

/storage/emulated/0/Android/data/com.news18a.wangshangcheshi/cache/uil-images/journal

MD5 0d598f11afff5d0e098fa4d9708708c9
SHA1 acab371b0fa5c701a6099c30fc6b60dad1af037b
SHA256 4cd18af35e03838b3ea5865699ea1f761dab2e21549b8d58d6b731b70f026af4
SHA512 8c40e35f353d2c31b5c10acf4f764fac5638cebb7e13092b8814f360f55bbfaab333725defa865c819f7aa5cc588a63cee88036d1c84f5e51bc75cee194f262b

/storage/emulated/0/Android/data/com.news18a.wangshangcheshi/cache/uil-images/20712364660.tmp

MD5 e3e520c697e361436373b083ab049c6b
SHA1 f76c7ef440e03445c5e5ee633b61b9d3fc5cce2e
SHA256 3459578c272e864508a9845b7efa31ac1976115934abc54d1c1171638092bcc7
SHA512 493315474708e6eb791363d762760e17e675b5f39b7d10cf97cc004ecb24d6c22764ef85b5d696f7c6ce13ee8f1df251fb362c3104aa99fe2cf21b61d19f3030

/storage/emulated/0/Android/data/com.news18a.wangshangcheshi/cache/uil-images/20703129450.tmp

MD5 860252201ae595d31b2b09a79250300c
SHA1 768372cb4653ad54fb6c8264c5149ccfdb003a6e
SHA256 9ae632f41f58b8de0a92100ceef35db5d68e972c6e7fa24a4a215d15ffa5c930
SHA512 0a7a12371015cd1ece3e6abc2e1df34b16b4cd139b219f154f966b42dfcc9b19589dcc57ab0ab04905f01da6c8c916f545cbc717aadd35f828a03c24971861c8

/storage/emulated/0/Android/data/com.news18a.wangshangcheshi/cache/uil-images/20721599870.tmp

MD5 864b41bf4212246eb9fad901fd7ea800
SHA1 ca25f4dd1221671a7a78ffbef1b168626768319b
SHA256 10694a0056279560b29e7ad0d754257fef4d17eca760cf5323ac86291c4995ea
SHA512 835d352cbae7c5d37ba53b148723793db288b54b6eb73ca906648e198e411f6bf1e977dceed64d55955258122db1b1d67de93105aa5f6e530c41d9c4742695e5

/data/data/com.news18a.wangshangcheshi/files/umeng_it.cache

MD5 bfa53779c206b92a58ca86634c2fab4e
SHA1 96fc6f6d6238582bf59b506263b6c2369a2a5e1e
SHA256 d81f3ad3bd7c1a2957d6f099672f3f1735152d2026953147fa7c5dad6072402f
SHA512 967c105b87fbaa0473c0d4ebb5b950357bd0e168edef26373543affc93cac976c21e5ad8c60d69cf458215c58f361413ee478e548d9e948b9a2fd421d4109f7a

/data/data/com.news18a.wangshangcheshi/files/.umeng/exchangeIdentity.json

MD5 b3ff1669c83fb71392f1eec5e1c82428
SHA1 627d9c889c136c221f24894f3fb39131abad3795
SHA256 6de54e7b9e1447efe855fde36ead8c02e4778f2b4025eab51c684d4d7ff19f13
SHA512 fe86023474c4c610a5a16828dc74bd9e98cece108ef8216630b2cae0bc4df08ca46d31ef1db60148bfbf07f755fad3daeed2acadfd0f4918cf65333e1cf39eea

/data/data/com.news18a.wangshangcheshi/files/exid.dat

MD5 33b7e098e51a6045c012cbb8347ac337
SHA1 d1ea1f1ea86efc2fa4df94bd6d7825837fc1a600
SHA256 ba38bbf9ec0ed12d5a3ceff25e1a5e2b922ac26975d28d05c1841355b70f9d51
SHA512 dede2a400ec89a0dfcfd3efbc9289e6d7c2834ee5723eeab9197082a948901941505d8a123d226a3cbed620211c2273bb1cab1ebcd85601477aedb185061996a

/data/data/com.news18a.wangshangcheshi/databases/ua.db-wal

MD5 2843788160e8d764ce8b2d15d952216a
SHA1 74842f0586727b039ffdc9284221322789d3cdea
SHA256 96138c41d594528bfcf022636aefd96183ae527003245d9aba3fc236058d230f
SHA512 27fc523632ac5f026a4e3a2d5e5269c478e9a6f2be92a2b80eca2f22fd79b35a5ac9a46121b6660572ffbd3becc508be48d6c3dce9fb09a67e02648a220cfc43

/data/data/com.news18a.wangshangcheshi/databases/ua.db

MD5 d604a3bf1f8d992cc320ea5b1f7609bd
SHA1 247f88df0b55c7d523ea5398637711a0e4a483a4
SHA256 329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17
SHA512 67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db-wal

MD5 599acaef7a34359c7cda51f0c274b61b
SHA1 ddc08a79a1370da9165c4fb1a1bd50338d7dedc6
SHA256 c46dd59c62b13484f11fde26fce875102637fbc3afb2a9936d7add6b73c69c86
SHA512 eecc1582cf60b617551c48b0816b92ddc678b9ccd508efb02be0cc5aa4b5fffca5bc7127694cb538411455be2e600a484a70ecfe7a6022041cc2c0a965052678

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db

MD5 ce6135aa1b1fe4f2c2db2a546d2a5558
SHA1 79b59582154017aadab783dc266fcb158c252940
SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
SHA512 2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

/data/data/com.news18a.wangshangcheshi/files/.imprint

MD5 f38074ea51f4a5d3c35585dbd968a24d
SHA1 771537bbcd6cc520d536bc7bf75ff3db5a8cdb8f
SHA256 97f30be9df71472a882e0a3fd43ff25281e7af55b77ec983b6a86d771cf055ad
SHA512 e1f927d74b2dceccc303b6313d96e3e80bf5fcb571c6e2deb8d604e37f1c6b2f9103b50aafaed3baec57ae9cf8640141e9f5041c0de2449b8c30e6f5d56aa6c8

/data/data/com.news18a.wangshangcheshi/files/umeng_it.cache

MD5 0afdf20cad0a2c72824ca7107918b403
SHA1 cb6ba1298c37e46600467a3bcdfe6f891b54601a
SHA256 9484f2374432e6499d7e718cd4d5a136a5498e64770fb111e148b04e6b0fdd2c
SHA512 02c238362acb3ececa9489c24843cc0f23795c6428df06f5d97169e609e4b3c7ad8a181ec1a3c37f15b673d6e94d7b6047cbbd5ac9a2c5862b79c7096d9f4606

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 12:59

Reported

2024-05-30 13:03

Platform

android-x64-arm64-20240514-en

Max time kernel

179s

Max time network

188s

Command Line

com.news18a.wangshangcheshi

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /data/local/su N/A N/A
N/A /sbin/su N/A N/A
N/A /data/local/bin/su N/A N/A
N/A /system/xbin/su N/A N/A
N/A /data/local/xbin/su N/A N/A
N/A /data/local/su N/A N/A
N/A /system/xbin/su N/A N/A
N/A /sbin/su N/A N/A
N/A /data/local/xbin/su N/A N/A
N/A /data/local/bin/su N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks known Qemu files.

evasion
Description Indicator Process Target
N/A /system/lib/libc_malloc_debug_qemu.so N/A N/A
N/A /sys/qemu_trace N/A N/A
N/A /system/bin/qemu-props N/A N/A
N/A /system/lib/libc_malloc_debug_qemu.so N/A N/A
N/A /sys/qemu_trace N/A N/A
N/A /system/bin/qemu-props N/A N/A

Checks known Qemu pipes.

evasion
Description Indicator Process Target
N/A /dev/qemu_pipe N/A N/A
N/A /dev/socket/qemud N/A N/A
N/A /dev/qemu_pipe N/A N/A
N/A /dev/socket/qemud N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A
File opened for read /proc/meminfo N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.news18a.wangshangcheshi

com.news18a.wangshangcheshi:mult

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 tcp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 log.umsns.com udp
CN 59.82.29.162:80 log.umsns.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 api.cheshi.com udp
US 69.28.62.188:443 api.cheshi.com tcp
US 69.28.62.188:443 api.cheshi.com tcp
US 69.28.62.188:443 api.cheshi.com tcp
CN 59.82.29.162:80 log.umsns.com tcp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 14.22.7.199:80 android.bugly.qq.com tcp
US 1.1.1.1:53 s.jpush.cn udp
US 1.1.1.1:53 icon.cheshi-img.com udp
CN 123.60.92.210:19000 s.jpush.cn udp
US 163.181.154.237:80 icon.cheshi-img.com tcp
US 163.181.154.237:80 icon.cheshi-img.com tcp
US 163.181.154.237:80 icon.cheshi-img.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 sis.jpush.io udp
CN 1.94.119.240:19000 sis.jpush.io udp
CN 223.109.148.130:80 alog.umeng.com tcp
US 1.1.1.1:53 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 123.196.118.23:19000 udp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 59.82.29.163:80 log.umsns.com tcp
CN 103.229.215.60:19000 udp
CN 59.82.29.163:80 log.umsns.com tcp
CN 119.147.179.152:80 android.bugly.qq.com tcp
CN 14.22.7.199:80 android.bugly.qq.com tcp
GB 142.250.187.196:443 tcp
GB 142.250.187.196:443 tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 117.121.49.100:19000 udp
US 1.1.1.1:53 im64.jpush.cn udp
CN 139.9.119.173:7004 im64.jpush.cn tcp
CN 139.9.119.173:7005 im64.jpush.cn tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 139.9.119.173:7003 im64.jpush.cn tcp
CN 139.9.119.173:7002 im64.jpush.cn tcp
CN 139.9.119.173:7006 im64.jpush.cn tcp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 139.9.119.173:7007 im64.jpush.cn tcp
CN 59.82.29.248:80 log.umsns.com tcp
CN 139.9.119.173:7008 im64.jpush.cn tcp
CN 59.82.29.248:80 log.umsns.com tcp
CN 14.22.7.140:80 android.bugly.qq.com tcp
CN 139.9.119.173:7000 im64.jpush.cn tcp
CN 119.147.179.152:80 android.bugly.qq.com tcp
US 1.1.1.1:53 alog.umengcloud.com udp
CN 223.109.148.176:80 alog.umengcloud.com tcp
CN 139.9.119.173:7009 im64.jpush.cn tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
GB 142.250.200.14:443 tcp
GB 172.217.169.66:443 tcp
CN 123.60.92.210:19000 easytomessage.com udp
CN 223.109.148.130:80 alog.umengcloud.com tcp
CN 1.94.119.240:19000 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 223.109.148.179:80 alog.umengcloud.com tcp
CN 59.82.29.249:80 log.umsns.com tcp
CN 123.196.118.23:19000 udp
CN 59.82.29.249:80 log.umsns.com tcp
CN 14.22.7.140:80 android.bugly.qq.com tcp
CN 223.109.148.141:80 alog.umengcloud.com tcp
CN 103.229.215.60:19000 udp
CN 117.121.49.100:19000 udp
CN 223.109.148.178:80 alog.umengcloud.com tcp
CN 139.9.119.173:7000 im64.jpush.cn tcp
CN 139.9.119.173:7004 im64.jpush.cn tcp
CN 223.109.148.177:80 alog.umengcloud.com tcp
CN 139.9.119.173:7005 im64.jpush.cn tcp
CN 139.9.119.173:7002 im64.jpush.cn tcp
CN 59.82.31.154:80 log.umsns.com tcp
CN 139.9.119.173:7008 im64.jpush.cn tcp
CN 59.82.31.154:80 log.umsns.com tcp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 14.22.7.199:80 android.bugly.qq.com tcp
CN 139.9.119.173:7009 im64.jpush.cn tcp
CN 139.9.119.173:7003 im64.jpush.cn tcp
GB 142.250.180.4:443 www.google.com tcp
CN 139.9.119.173:7006 im64.jpush.cn tcp
CN 139.9.119.173:7007 im64.jpush.cn tcp
CN 123.60.92.210:19000 easytomessage.com udp
CN 59.82.31.160:80 log.umsns.com tcp
CN 1.94.119.240:19000 easytomessage.com udp
CN 59.82.31.160:80 log.umsns.com tcp
CN 14.22.7.140:80 android.bugly.qq.com tcp
CN 14.22.7.199:80 android.bugly.qq.com tcp
CN 123.60.89.60:19000 easytomessage.com udp
CN 123.196.118.23:19000 udp
CN 103.229.215.60:19000 udp
CN 117.121.49.100:19000 udp

Files

/data/user/0/com.news18a.wangshangcheshi/app_crashrecord/1004

MD5 8b9d5e162d20d1919c62aa95ebe6e7d6
SHA1 f0495580aeb701790a049485a9a2e93c009ec3ec
SHA256 d38d37fe4e341a3fe1707f696694962341890dc2568d304ad33371a78c6e9056
SHA512 4ad78fa00b8252407de2e713aff3a0dca1885e6f59f5e3e1c03eff72f7e4cf670f76906c9f30272b3db4bb56e1bb3f295e1dd0f29ca7bded433ac839a8da0655

/data/user/0/com.news18a.wangshangcheshi/app_crashrecord/1004

MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

/data/user/0/com.news18a.wangshangcheshi/databases/bugly_db_-journal

MD5 4144463cf130510e98e9f131fe552a95
SHA1 86e9cd67785cd5f4ef9909a2d858645ebcd3fdd9
SHA256 5f52ffaae26cb0f48014c2ac5f2eeb483f3a5bf25fca56419d34e6a3d2a60590
SHA512 e614a1d9a562ac1fa76dce8e1a570b59560bc69d9b74869b8cd929bd858408ce49a2f88a09f380cda480727fc4a9ad7080296cf7645c4c48acf3230762190ba9

/data/user/0/com.news18a.wangshangcheshi/databases/bugly_db_

MD5 ffa57b721260726f1d6166a46109fc9a
SHA1 5c1d1e613a3a43335b82e6bb36c4ce27d8b5d403
SHA256 10cd1b96fac9fc81b9e39489aedca0ad7609c766e751c1593c13a7f7ef0a8ddc
SHA512 022ef7b90735cc7a796bb0cb8ac05f3543efef886982652b7a1b576d635ebfcbbeab68026bcbf6bae0dba9d92ae4a8d588bffd5c344719687f67479cd90b2bd2

/data/user/0/com.news18a.wangshangcheshi/app_crashrecord/1002

MD5 dfd58b3445216c01e6c0dabe894cfcec
SHA1 1c01652f1b37fed7b1412a13c475d083f3d2d50e
SHA256 15a26e3c153c2ec41f1357afca8152a03a319e3fb1b6658d55dd92c26ae1a95b
SHA512 88d74eef7743aa013ffa39db904bb73104fbaa9a68c7a838164057197950de5da66906418c2d9d49b2165633c83084700d72a84fb0214ee2e6c48e683e5caab0

/data/user/0/com.news18a.wangshangcheshi/databases/bugly_db_-journal

MD5 64c32b4eb9d23286fbe7fe5c251b2d0a
SHA1 f204f4861eba6638e3ac12c8fa35e3e749c75789
SHA256 71d51f5d75013b66868ff516d9fee381fa6ac3142c0d7db56096422746d38836
SHA512 236c81c5d687cde21345742336d3b0198cf09fcba7ba443e97d7dc042d6b244a18888632eb1295dbac561d11782141f1ceb7dd1b16e448b6d8272137cee34c75

/data/user/0/com.news18a.wangshangcheshi/databases/bugly_db_-journal

MD5 45b0ff018e221ff2dfbc7f00986ebc18
SHA1 5a9e3d66ec2476fd2374c9a0f3068ba39c83c3b6
SHA256 29e1aa4418dbbda54a4bb33a5ba679dc5398af0129f2ce7a6d76be64b54286ba
SHA512 90514a1e6d9ef24470be0ff3a8519fe1543a46cefec80033da47623105a46657a0c8ab5901d9f63e3a6b8c07af3c61ac9700bc9535d9f133aa4a915b83c81e04

/data/user/0/com.news18a.wangshangcheshi/databases/bugly_db_-journal

MD5 1e1ef3c3280ee6036ad8dc606b8777b7
SHA1 7573ba8c9d49d156039fc68644ba56d183f9d738
SHA256 8b392206169e5c695959197ba1bb4c06203b27c07b600e3c24b1960b3821b8bb
SHA512 ae0aaee1a533fee2871554935eb811afef6bc588029abce846f87fe4a859b473a646082d4535471d0b5939fcfd92bc1b55496620b3e128e333b73ffc7da918dd

/data/user/0/com.news18a.wangshangcheshi/cache/uil-images/journal.tmp

MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

/storage/emulated/0/Android/data/com.news18a.wangshangcheshi/cache/bitmaps/journal.tmp (deleted)

MD5 fabb7589aca079c9aaa45c3b93dc6c12
SHA1 5d3c8b4d4380b891423e49e2716eb909cd196386
SHA256 4df67d3be76f0fbc49cdafa1f7fff039919c89f22693a03753f2e0e90738d361
SHA512 384cc49a7c1045bcfef2b7c320f06b49360a07e9c09992ae2a1ea86f83f1a54d90197d4abdc609cc7f9e96b8d3b5f960833f1cad5c4342b8856a96315e143cb2

/data/user/0/com.news18a.wangshangcheshi/databases/bugly_db_-journal

MD5 fbf1e34bf34b66a1aaa02f8507f42ec4
SHA1 fde70cda01696c41baa8958e4ef06be4a7af9cee
SHA256 7d8b46fa7e7af43a7ef17247f2e8d63a32a5c24716c5ebfc06b0e3b4933fac94
SHA512 4e6beffb58b7347998b81c67f668c5ca828620d457607251dcb36c4121f1cc399a2a722f9de97071b59f2481708edc3da84adab0c0313b7d67b25a001e028320

/data/data/com.news18a.wangshangcheshi/databases/ua.db-journal

MD5 75620086730d286932b4310db19c835c
SHA1 72a71e4e830b039ec4857d2abf1e9ff99a9d968a
SHA256 b88b03bf1e79f14abbef81aef68ca89540f8e5f8206677ae03445d88960b1ca7
SHA512 7bda8116adfec853f0aba877cb5eb2ea224a386d4b99480ccc50f0871e5de3bfeb996dd1831b90a5f4fe091616c890ccfbd504264b335eb3f4ce41f73a6c3bb5

/data/data/com.news18a.wangshangcheshi/databases/ua.db

MD5 31e31c20383d7f53ad62e64f2a8a6723
SHA1 673bae0cc1c9818cd01800bbf8ba3b89efd5f6e3
SHA256 95c5f844e5bc835b9de66971a46a75ff1fc59507b30ef02496ad89fa26df6de7
SHA512 80625692b411e39ae319af505cf5a2eb9c7f2dd07c74cf53f6760eea7c7256040edd44b2d6bcd4f3dccd12fc77132cf67b1c80dd25c6a70d392821fff777b891

/data/data/com.news18a.wangshangcheshi/databases/ua.db-journal

MD5 8583ed13a7e5baa8fdca564e4cac8650
SHA1 04d10097845f2221c360a8a8857b3133b968be97
SHA256 619d2e1cb8920deaa55a33e7223bfa1c2465234ba7d4991746559af21d584eb7
SHA512 93434ed2d4b654df2ea6533e54cefdf9119fe0ea7502f4d9114eb01ca5117fcedb38c272ba5888b3c1c2f728ddb80c195929000a8032f824785cb4ffb81b522f

/data/data/com.news18a.wangshangcheshi/databases/ua.db-journal

MD5 68536b49ecca32154315eb38b4c43c61
SHA1 a710468c03e9dfb0c5486e082e1e5d455500ad49
SHA256 fe1b4548900137f34c87fd564939d6affacf09bb311f2dd58d3cee08a0b8fadb
SHA512 3b25ebd171c055ad9286b62c802d13e3053aea554b1e748c87c860b27cb4c1f1c5d6941d4e399919f0ed7c5aa51c4709c07a538ab51289f9d41bf8b98ae56e33

/storage/emulated/0/data/.push_deviceid

MD5 8533906c2f8fb18c5ce19f6db814e73f
SHA1 090c0a56335a9463beaed641164ca6fc63ee5e1b
SHA256 74fe80de79bdb38b007f31455b0a838b99030de83c13b0cf23f902409acecaa9
SHA512 35d1a1518dfd3d1a6e4b24f607617b083ccf616dd84ef91c5b48501b6ef1de8306d628cb5a46f8b32691a3fd1cf04e2ba921783d777a4ec7a3b81043ae7fdbbe

/data/user/0/com.news18a.wangshangcheshi/app_crashrecord/1004

MD5 d9de921c1688c0bdc3ea15cc6b422c52
SHA1 8c714f8665917ab23f05d4c3d357e54f1759a727
SHA256 823af3ccfa53ba0e51b2c32177b06c88a9dbb85c4e7ca53b20e2b7cca8774c2f
SHA512 5dde2137fe8ed6f4eab54260842d108866cc29b203741511043de59b408397aec76e98ab17235bcc159e82a2c43dfcc356c8ef0c424cf9d5e613e56d682e5300

/data/user/0/com.news18a.wangshangcheshi/files/jpush_stat_history/active_user/nowrap/a15daec5-5071-4be7-8339-400150405637

MD5 9383a7f49fc231f75686d70619e97b3d
SHA1 379fbf698bba047323385bceeaff27e8aeeec668
SHA256 49b86a254e373a6dbaa105440a1f5841bc3a17882cdf2a77ead2ccf8e2800b3d
SHA512 6628072d1def4fe518692fe7c37e7b7d40ef2ac9907d77886ef7f39f9a5f2b90269562c60b273e046534179425f11537d0ded82f34dcd39b7087dce043d9feef

/data/data/com.news18a.wangshangcheshi/databases/ua.db-journal

MD5 2d6f5cf233c759d7cdbff565f1785ff0
SHA1 a838c630a2ff65f7c95aa033ec33188c98792825
SHA256 50f95d173ef1fcba55615baea0ddb403ce30018a160fb47c9372901483792f89
SHA512 5b2de43c60315930b0fae63c8fe126244942d8e0cf5d9334ffd82da01c5daadacde88e7a4edce5ebf1d831815d97cc12218a2d560ae88c2ac18442797dfd74be

/data/user/0/com.news18a.wangshangcheshi/databases/bugly_db_-journal

MD5 340da3beb46b5e3021800a3bdd86ae55
SHA1 95939bf34fad6473cd891757caf9cc92ee566faf
SHA256 2e8fcc40ed20ad94704b6fc97fb553e1de0229c6f717357a0a15bd655aaf9c8a
SHA512 3a8ac662dfeb4a254327aa130790477985a6ed64b853025dc0f83b2a7b1fe931baa2464ed243e559593552951633c59c6f6df6a1de1e542c3b2b71f4f6bf1363

/data/user/0/com.news18a.wangshangcheshi/cache/66-8673903-28189126-7154-90-20323-87

MD5 0c03171b6b0ef651ff8c003374b683a3
SHA1 b965fd6caff5061a79706c46430c67c93655de4d
SHA256 10a1b57eed2d84921349b06345a24ba0d5bb3b2bd0fb8c78edc37bc39888cfb2
SHA512 b1aced4387ff3f8c9f963dd10778d947caed4b56d5f735a56614359738272552bff000cfb2c3bd2077af89ae2de49af3ce945b1ae80f77c170dc63944a119d83

/data/user/0/com.news18a.wangshangcheshi/cache/-24-10387-90105-11179-112-68-96-18105-19-11762-27

MD5 11529ab272c81ab5aa7f1ce2e168d52b
SHA1 ffde68dd4fb9cce40f1dd98960f97d440a08163c
SHA256 b1888aae98018e1cbf98206d8be9c17defbb0f5a55be8f8504e31dfaa2466426
SHA512 968e0347def67f9e0ef511003a83f0646476a2e104680e3d16389727c552fb47cff5ac6c0c2cd6d8e5096156c4e47deaaedd5b528e7710af530a0c8e1ec7c9a2

/data/user/0/com.news18a.wangshangcheshi/cache/-6-98-1109818-9256-89-61-99-108-44112-9837-82

MD5 e2937b57f9207e67af8e3e0263d14df0
SHA1 2626d87d8bf03771acc16b8a43c335c66a171d75
SHA256 df5cab54b71b3bf06b87c0f52d01f4352f208ec6ad7b54f6418ce7747498863c
SHA512 008bf08fb35736358dd812fcc8dd5670c636abeb507375668c5b2e31cc70663ccbf67ab6151c607d717307b1842f604643a0544f9b04d0e650987cb2c1624cbd

/data/user/0/com.news18a.wangshangcheshi/databases/database.db-journal

MD5 5bf7bb89a36fa8c4013f9ed0d56eac41
SHA1 82183b800a491c7f4b8c4aa4888a158ec3260f8c
SHA256 e473d5d602b82d276780a84b1142d9c0fa9127782e78428914393ee88590de32
SHA512 d3f37bba01fcb4c1453a4ce344858ebc012d4bd9838ff5d97f08bf7008130ab670ec648ddfca9738e945c3aa2558f8c4df512ec7031d84bb64675d9fb5abb482

/data/user/0/com.news18a.wangshangcheshi/databases/database.db

MD5 2c8439b2aaac52646bacb845c3469d90
SHA1 d058f225527ea86adc064abaefafa708823088b8
SHA256 9522a07dbdd70cec65c81c3f7f3ab3c4d804e1a6cab83f8bdd1408d051aab22e
SHA512 fe98cebbab5f406ed18f9855f9d48871850797ddc463e105b581e0964d570ca645cbae5e9fdac303a67dedbfec8151aae8c31efe7201fe0c4df6614a16656938

/data/user/0/com.news18a.wangshangcheshi/databases/database.db-journal

MD5 d429f08e61003be734d1ec939bde63b4
SHA1 5fc0dc78d0eb38d24b0e8a529f6edfbfa4801b16
SHA256 5a07f6d0458307cf8310621a55b4b82d23b6dbf1044c36510e9287397d9661dd
SHA512 a06625e0d650c5e8ee1a098be001ec8f18df6d3f14b8fe9cb64cbf49b141bb0eb85b4531f647374be33950a9e30877292ae064cdd69aa0663d95f5d936f2381e

/data/user/0/com.news18a.wangshangcheshi/databases/database.db-journal

MD5 efedb35f19e90f4130b341b396b84bcf
SHA1 d302aa9d34196ae3b2bb46a480679e0489c0ab00
SHA256 fcbd4bb7bbe7c41f621cadb9f05800d7ccc97cb74fad25bdc0ce5009fc82a45c
SHA512 e8f4cf90ecebe47808b52173c3798f4b3521fec4a5a42e44cab103b8d67a3b1ea06c67f57e60f393d7aafe05d370095d27e0e483372c931af403caaeef5b3c52

/data/user/0/com.news18a.wangshangcheshi/databases/database.db-journal

MD5 f87fb5c978c0f2fe4cc1c0fa26cb41d3
SHA1 f20716e5bfa055a3abcfd208752ba06f971cdd78
SHA256 b86d79e3174f0700dae4b49a2c2205a384a0789363177c19568f1beb786ca8a9
SHA512 03e07ca676abc1769b278a9244abda27d2381f3f70b6cc3a064caa011da77dd52a9060fc4e7ca5c12e4e91b80471b900abc6f2306a0e2fcf381f0d30f92cdbc6

/data/user/0/com.news18a.wangshangcheshi/databases/database.db-journal

MD5 16291fcf41befb6f2ab708bfa919179e
SHA1 30fd4ba63e1dd6c7376794c7989ea8401b551094
SHA256 a34786c270d459d4bc750977e0a95399e19b001e7fbdaefbca58b6411e5617bb
SHA512 7218ae32b831bffb9cf6d917a40e85c1a6ad1ea089dfc4cc808a4634d01e0a34b164807a52c14195a42e88dc6f3fbe9f65e46e4061f8b75464865ecec624f14b

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db-journal

MD5 6728640db4b6fce5cbba9825d44aa508
SHA1 21b4633b41c1d8f5e4d734a1796b8070a484b3fc
SHA256 dc06e62563a03ccfdbb4241cf45e0e17a60a08f83cf9df8b9a372f81e36faaeb
SHA512 2f7b5d9a3502e0a447f35819015d607bee659fa5e89164d8c78c014130cbe960d4d8b921bec0930a81b5a9c3946850407cb3cbf711dc4142e579c1f685cf9738

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db

MD5 4cfe777c9f6e7859f5efe2197401d8e5
SHA1 bb3774e8879ad5f6db0c37f151c3d6bc7b4b207a
SHA256 c422190539b6414072fc3950da19a17985c0c4c2172740b2f74682b520af5231
SHA512 6be469864edaf8eaa110f618f8abd27962da92e20945dcd38073ade2b60b10f00552d54d5db9d9f75ca133213031030e71e2e30113ff033e5ef507a28fe0b1de

/data/user/0/com.news18a.wangshangcheshi/databases/database.db-journal

MD5 bdaeb7e49420361947810b248752e064
SHA1 ab8844bc25cfd92bd6825f489cb80bcd614501a0
SHA256 e6e5182933a8aa95a3eaf9af51bec7d5c6411b5886710af4f6a66a50fa72e563
SHA512 78fff28424bc4fc238edf129fbc45dca1536c73e7169f312133203b852f3d96c37cb91eee93c5ef62944cc0f7f23488f589843c42da509d5a59df7be8ad878cd

/data/user/0/com.news18a.wangshangcheshi/databases/database.db

MD5 6236c6b6108f9c46a4e062966a081db0
SHA1 75a0adf468900390ca549b0b68ff0898a25a9f3a
SHA256 d62af323b5d53d873ebe2af4ab32abcb99528a601ed76d27c1ad08c9e1a02a1c
SHA512 8b49f1cadba18fa4cffa24d147dcfc83f3e77a2c2fa56171437e85a3d6a7d44bf8c8abeb651fa721f388635c5d00ea58ca07f6be181b4660de70c85716e70c7c

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db-journal

MD5 217b778c12b99d2e18bfb084473e3719
SHA1 4c81177a3135ef64d76ef09acc1d6c76763bbd46
SHA256 c46125f5185004ecb28177166dd6f5e4c565b3810cd803e1a3f65a951c940d45
SHA512 ea16f0b6cae90593e3f6d0025554f1140f3423d2869a03226c3cca12500b6af0ed5de1507fd76f4ede69d1257080fb0b5bb525f5efac63b34b16d01aa0e55d88

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db-journal

MD5 2453b99173de53a6f73fddb325234472
SHA1 9395c352d372777df9902deddd3db84d0136e51b
SHA256 ef1849945d9e5a57a01959cf21d823ce390de65187dd8774878300ab0e04c02c
SHA512 c9042fbead5b5f18060732e9148b734b85f1b22f6bd4a155d3cbe5ba9a709aa7ab537e4fba0df940cd5f6dfafe6998c8429047ac6ed6424909913eeab3c18a40

/data/user/0/com.news18a.wangshangcheshi/databases/database.db

MD5 e2802c3b82c4a5cde022cacc21bd5bfc
SHA1 0f64188213de0be544718f2987aa937b1ea98b87
SHA256 430266a9e87d7a7e17bcfc8f75c7e67a6e03b8dfcd610645b754fb212e9d9561
SHA512 e2f233aa3fc37f4f012e0dc7e9c09da4034d756cd24316eef1b80abc32753cabf5e247c926e9392cfc97d8f7a6e6557a9e72d396fb26109a0d3998152bdce135

/data/user/0/com.news18a.wangshangcheshi/databases/database.db

MD5 0075d0e6bfe631879b45bfd8b7236eb7
SHA1 fea32162b8551c4e101ccd7f4e9d0c54eac0c4f2
SHA256 863bcfbac9082062e5a2045b5a3dd91e7f55df74ad7c60bd215397f70b552c2a
SHA512 f6cf803f58ee138d15e36fb128eca83e34a26ddadda5e4673aa8971f99895da6ee6d3cf3f4021e8c6957a2d3d5c30718f81abd78b1bfff71e021f86ece8b8346

/data/user/0/com.news18a.wangshangcheshi/databases/database.db

MD5 60681633eb635f65133d67ff1ab80e8f
SHA1 96b6470e07bd1e26567982f3b60d0388f8b067c6
SHA256 059b8087dff9e50cd19ee9b3d7992958b4dba87950fabefe9af338242516b536
SHA512 7b9d44a145c70571a3e9177e1234dacf1ece216e5203439ca9c7002d9d16f5651422bc6b1167ac355a89ac4083b5483fc2050f1ab10e98540ab18f3ebc5d804a

/data/user/0/com.news18a.wangshangcheshi/databases/database.db

MD5 fdeda97ea30f8a8ce09e793c638e1199
SHA1 7a05b646f37bfb7b96e0f0a3855269b930312425
SHA256 5240b0e488875c092cdad0dd9773ba259ded767d97b0d710e7715fdb8d42b503
SHA512 5059e848b1756754705f49061bb413e0d5a2ce8fcb71da0bff85a0a6ee6323025e66074fc871eaef029b9b9145df8f41ea3f935a6caabf5b84f7a2d17f37e2fb

/data/user/0/com.news18a.wangshangcheshi/files/jpush_stat_history_mult/normal/nowrap/6fb29f13-ce51-49a2-8306-85cae18b6a19

MD5 eff44269ec76dedb25263f1a9d732b66
SHA1 a81e2a9d24fadeacc0dbd29b82dc99bc9326aaf4
SHA256 815ebb91db12eaa482589be2dd91b8969714e74885e62b29c54ed07591d7fbaa
SHA512 9b31de36ced38c6f79e35af6930064c6fe39149f60ea42dde3b6207697188021b93e4a12d0df59d7c3c926a638deb8de7dacab6839f3c57ffbb8092cadbb6129

/data/user/0/com.news18a.wangshangcheshi/files/umeng_it.cache

MD5 5e3ddaa6d484c6f343202ff07c7d2b45
SHA1 b03895dd5d9eb415bef816d91ade810a6dbd463b
SHA256 36fe964c375074f424555bc0c859276671fe5c462d4ca78b0d4485fe70e4aa49
SHA512 4010b4f51e4eccdd5b4bdfd0ca6ef8d659b669848159f72bef846dcbe0fc14b8cc20162f379279d938e4712625a7005d3a92ddeba3d47c04f9aa8b5c4d9ccd1a

/data/user/0/com.news18a.wangshangcheshi/files/.umeng/exchangeIdentity.json

MD5 71120adf3a514ff96fced662ad75c594
SHA1 b5b2dc0a22ec42fd28255e81ec6597acc7a5963d
SHA256 7d1277a028c7493fa7617645ebf531d58767c956034fdff31940f9dd7d6afdfb
SHA512 1649c8da38a6031809904999cf16582419fc02f8b96f868240418ebee7bb3b2adb804032f28c7a0f684f75175e44adb26e28b9bf7acaa3cb5c7b78b751c38e4b

/data/user/0/com.news18a.wangshangcheshi/files/exid.dat

MD5 33b7e098e51a6045c012cbb8347ac337
SHA1 d1ea1f1ea86efc2fa4df94bd6d7825837fc1a600
SHA256 ba38bbf9ec0ed12d5a3ceff25e1a5e2b922ac26975d28d05c1841355b70f9d51
SHA512 dede2a400ec89a0dfcfd3efbc9289e6d7c2834ee5723eeab9197082a948901941505d8a123d226a3cbed620211c2273bb1cab1ebcd85601477aedb185061996a

/data/data/com.news18a.wangshangcheshi/databases/ua.db-journal

MD5 c115381a6db84ed3c88f4f26e4cd0b40
SHA1 23922b6908112b5998591c421e4bb92b8751b135
SHA256 451477c2b5aa0fb5b1ee90cc822c06234bc258caf4de057d3e9fb1ff6bc8ac6c
SHA512 f41c4610bbdc93f162bae2223326c089b56f831769d4223cd51af6c108e9a4ee365e506a3cb20365cb6a620f3087948bc88a794e511c3520244a55c71920f865

/data/data/com.news18a.wangshangcheshi/databases/ua.db

MD5 4cac7d31fb94d5c9581893537f64c5ed
SHA1 96bef3288546196ac3058b5eeddbe9da1d999fe5
SHA256 d1b111041f8aab3269f3da846b2ea199498d99f6905174a9d641f0faedca41c5
SHA512 0ab95e51a640148ac007d47afd5b9fd03ae5a3b9053e5e19a4f0b8089e17e41e311790ee9fe486b6752926799577bee041ed67b64d8772794e9d2329a96ce747

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db-journal

MD5 43743dd8eae26e3827bb13fd7811973e
SHA1 d93ab9bcbc7d3a2beb5d30ee3e22cf259239fe02
SHA256 4ad61338ac7d21389b5f940aaff596d845ea43d8eb393f508fe891e279bf9bac
SHA512 6b325471178db2567f02546187a8cbdf009b3cc068409013a8f24ac8aa0b0fe8b49d6ef780ff312f2da2d2471fff3239e60981e9b451884dd5e8f02770acf0f4

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db

MD5 86752a4be6564d8370f2f0e403995003
SHA1 29f7d50675f6e59f3b808eb6dcc8619384412115
SHA256 50484dcdc6b9c2801773018386a8143a52a5153eb2eeeaf5be8bbe46a49ca90c
SHA512 79c9435c1e0d41a3f97784be3e5a3cd8c0bd2d32ecdf326808bacb00c76d876d0447617d6e72ef04cd4b996c92eda4eb7bb200987ae7928ce2e0e7c8e807a5ec

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db-journal

MD5 63f34465c78065b054da9303e699081c
SHA1 d583998966b56ce32293c49049a375e6076e45b3
SHA256 60e1122a7ab51cae29e36df9645db9a96c0444024a10932bd674fe9bbf22ac0e
SHA512 5a2174775aa4c01e25432ac04d6967e70d108462f3adefd7e20812c83a58b357dabbfc9d2790c06273a4f193076ef571b2100bd55bc8d22cdf5c54c81df61846

/data/data/com.news18a.wangshangcheshi/databases/cc/cc.db-journal

MD5 fc3f3708b23b553b1368a5c7488fac61
SHA1 f83a3d5d108b66d049639ebb6fe763cf379ac557
SHA256 f0d98f3e4063d7bd287393cf4c709364cb4c75741615cfc342d087714f30f94c
SHA512 44fc5d9231b12f6f21d51326b1ea9d604d16ace8cdb1c6f6bc41ed7099250bfce9b28113cdd296da6c0205657a9e761e93a34dce7ed3024d80e4b317068a16bf

/data/user/0/com.news18a.wangshangcheshi/cache/uil-images/20721599870.tmp

MD5 864b41bf4212246eb9fad901fd7ea800
SHA1 ca25f4dd1221671a7a78ffbef1b168626768319b
SHA256 10694a0056279560b29e7ad0d754257fef4d17eca760cf5323ac86291c4995ea
SHA512 835d352cbae7c5d37ba53b148723793db288b54b6eb73ca906648e198e411f6bf1e977dceed64d55955258122db1b1d67de93105aa5f6e530c41d9c4742695e5

/data/user/0/com.news18a.wangshangcheshi/cache/uil-images/20703129450.tmp

MD5 860252201ae595d31b2b09a79250300c
SHA1 768372cb4653ad54fb6c8264c5149ccfdb003a6e
SHA256 9ae632f41f58b8de0a92100ceef35db5d68e972c6e7fa24a4a215d15ffa5c930
SHA512 0a7a12371015cd1ece3e6abc2e1df34b16b4cd139b219f154f966b42dfcc9b19589dcc57ab0ab04905f01da6c8c916f545cbc717aadd35f828a03c24971861c8

/data/user/0/com.news18a.wangshangcheshi/cache/uil-images/20712364660.tmp

MD5 e3e520c697e361436373b083ab049c6b
SHA1 f76c7ef440e03445c5e5ee633b61b9d3fc5cce2e
SHA256 3459578c272e864508a9845b7efa31ac1976115934abc54d1c1171638092bcc7
SHA512 493315474708e6eb791363d762760e17e675b5f39b7d10cf97cc004ecb24d6c22764ef85b5d696f7c6ce13ee8f1df251fb362c3104aa99fe2cf21b61d19f3030

/data/user/0/com.news18a.wangshangcheshi/databases/bugly_db_-journal

MD5 37d0a7ed864f614d2668cc4efc80ea23
SHA1 fb3d9250b28c91f61eba15c9fcc1a050c17cc8c1
SHA256 160c3e0d347ca3e13a38c5f8a3b679e9747043f39bc15cbde4f0a04b20345138
SHA512 43f20be1b458607aea2de7dea244a712c0ee400d79a72df66c9cedc99bfa12664cdb49448958387cd70669db08591cbc7fdeefaf2bf5ba92e97963cdfdb830bd

/data/user/0/com.news18a.wangshangcheshi/files/.um/um_cache_1717074133267.env

MD5 99854053b1b5bec0f8978dca79346ade
SHA1 0a9bdd8bfe28b1b0286be574ab3a0d590692216b
SHA256 ddc962306c37997232f11abd43b37a6edfa68b9839a53a6f70f67891b20db564
SHA512 a355a7f8dcfdb086ed93a6cae7878f6a2986d0b4f9b2c211f773da6eafaceb916691bb18b1276788e6b9a96d650502e30459eb5e12854cc3bd6c9606247a1e4d