Malware Analysis Report

2024-10-19 13:18

Sample ID 240602-dc9dyagd8y
Target 8caa3427932ea23a8dd107152dccc910_JaffaCakes118
SHA256 3a12f0528a4379b52b6cb07832c1d577d58b2f9559e6844775579cac7c0d9a8d
Tags
collection discovery evasion impact persistence credential_access
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

3a12f0528a4379b52b6cb07832c1d577d58b2f9559e6844775579cac7c0d9a8d

Threat Level: Likely malicious

The file 8caa3427932ea23a8dd107152dccc910_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

collection discovery evasion impact persistence credential_access

Checks if the Android device is rooted.

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Obtains sensitive information copied to the device clipboard

Checks memory information

Queries information about the current Wi-Fi connection

Checks CPU information

Queries the phone number (MSISDN for GSM devices)

Checks if the internet connection is available

Requests cell location

Requests dangerous framework permissions

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 02:53

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 02:52

Reported

2024-06-02 02:56

Platform

android-x86-arm-20240514-en

Max time kernel

125s

Max time network

177s

Command Line

com.kingkr.kxegohs

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /sbin/su N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Requests cell location

collection discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.kingkr.kxegohs

/system/bin/sh -c getprop

getprop

/system/bin/sh -c type su

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 172.217.169.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 www.google.com udp
GB 142.250.200.36:443 www.google.com tcp
US 1.1.1.1:53 adblocker.appbsl.net udp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 14.22.7.140:80 android.bugly.qq.com tcp
US 1.1.1.1:53 www.appbsl.net udp
GB 79.133.176.187:443 www.appbsl.net tcp
US 1.1.1.1:53 mkl.xy6464.com udp
US 1.1.1.1:53 dispatcher.3g.qq.com udp
CN 183.61.38.168:14000 tcp
CN 112.90.140.213:14000 tcp
CN 180.163.210.30:14000 dispatcher.3g.qq.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
CN 14.22.7.199:80 android.bugly.qq.com tcp
CN 117.135.171.182:14000 tcp
CN 14.17.41.159:14000 tcp
CN 180.163.210.30:14000 dispatcher.3g.qq.com tcp
CN 112.90.140.216:14000 tcp
CN 140.206.160.242:14000 tcp
CN 180.163.210.30:14000 dispatcher.3g.qq.com tcp
CN 119.147.179.152:80 android.bugly.qq.com tcp
GB 172.217.169.66:443 tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 info.3g.qq.com udp
HK 43.135.106.42:80 info.3g.qq.com tcp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 14.22.7.199:80 android.bugly.qq.com tcp
CN 119.147.179.152:80 android.bugly.qq.com tcp

Files

/data/data/com.kingkr.kxegohs/databases/ip.db-journal

MD5 06b0d42b053eca507a4b69796d90dee3
SHA1 57cb2a918ebb3adf00290c0e3e9e54c8d28f7e76
SHA256 43ea637d8a546b9a60eb8a5b3ef6a17320c5ba806eb00bfdac89ceda7216e2c6
SHA512 617bf221aa7a9429b2345a5512950178b266111d722d847df24d33cdbef50e95017504993621614083489c9a2de39283b2ede81ee92fd1c7e39a657cfa72ebfe

/data/data/com.kingkr.kxegohs/databases/ip.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.kingkr.kxegohs/databases/ip.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.kingkr.kxegohs/databases/ip.db-wal

MD5 d1adb781859e1bc3fdbac2296b960611
SHA1 697d20bc0534a6d2cd84e889cb8486107b733291
SHA256 5119d902142bdcb3b322b2743227e9cc43a67c56c4f1d8092316171993715970
SHA512 6c7c137db778f1cb8374048a946fd32bb8b5957c68dcebfefa04f1958183909096dbc2989be585fc11adc8a70c951f033b93e01dd49ef5999de3cfabb8682a4a

/data/data/com.kingkr.kxegohs/databases/bugly_db_-journal

MD5 e380c2437cb9ba3591dfe2cb2dadb6b5
SHA1 91263038d0436db9927693d40592ed7d0f02fe66
SHA256 a31074643deeb3c9c34f13310a3a9fbb36756663ccea3112fba4e83e52606291
SHA512 e92d96aeaac0676b43d8c14a57d8c6873b54619d4ffc1012a8de1e0d0fec026afe8872488ce6b344c5563cfa33705ba11139017b00b3a9f41b3757dbd29248ff

/data/data/com.kingkr.kxegohs/app_crashrecord/1004

MD5 b96f28f244fd42d9643b88f2aac21a33
SHA1 77bfca31ac52e4a03ae444a742dd8195cdb98c20
SHA256 a25fa66921f6bdce46a347a628342cb52a66b156c40139f82ecc41b9242e7008
SHA512 b93d4a202ea3ac25a188eb2182ac847e360b3eedb1b5c5a2d7fec22176b68f323c416546b76f9e3699259951079eeaf272b5e4f9617c9b04fcbd9e51b8c15814

/data/data/com.kingkr.kxegohs/databases/bugly_db_-wal

MD5 4959e574e7d216d8b38834e8f0783be9
SHA1 6c40686cb939db44cd552895f65adb86eda1bd88
SHA256 0ace08153d00f490b429b7dc952e86d6718e072974687362334269e9288374ab
SHA512 f95c527051c659a1e1ea1c44831bd4350e8c5b49b28e0b4963b7f1a641324ce502df6a0c269521ffa36f9f1495a0dd58baa2afa3a437650c4b4401f349214d71

/data/data/com.kingkr.kxegohs/app_crashrecord/1004

MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

/storage/emulated/0/Android/data/com.kingkr.kxegohs/files/tbslog/tbslog.txt

MD5 c3297436197b2ba439b1342f524c8a26
SHA1 bf71cee0879202e3e43fd06b23f350824192deb6
SHA256 e6264e89c73a30987565323d454ac1eb1139f6d6623b9b05d856d1fc5f771060
SHA512 1de967c1b9ea82902f359fbd288cb88246dae4ba885ef4c56122a7fe11262c43ca2b414d6a9ff2d251d8ca07732a1b57d91b6b70e058b727883b50f1a62f20b3

/data/data/com.kingkr.kxegohs/cache/image_manager_disk_cache/journal.tmp

MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

/data/data/com.kingkr.kxegohs/databases/0M3006CS7U0ZC2K3-access.db-journal

MD5 727fa0e941076060b1e3a3642b9cf8a3
SHA1 9e46aef45b816e13b20df5018c494745e68d4b1f
SHA256 bde6adaf05d75d235488731da0e9dd112606f88f5a443f9db4c148ac0ee13f41
SHA512 f5586c799aefb70d158e81672d6dae9533f7f065d6b2d2909867310dff183a1eb99940ccceaaf521b2459647d8a4f307185e786742fa6843a371d8eea50e562a

/data/data/com.kingkr.kxegohs/databases/0M3006CS7U0ZC2K3-access.db-wal

MD5 805e37b8485844fefc5829e0aa052616
SHA1 3325fe29e2f4b2bf1ef0128b854af785c6b4fdd0
SHA256 673f3255ad63a8248ef1a45e80872b6a59dd027af5a30573136a1ab5332b48f4
SHA512 37b00dfc1e5c1b913dea93fab7f82a963f24e1b1db536a350420e431ad7bb71f1613459b3aa087723a3124805dd86bc79de099024c83243639ece4c1102fba82

/data/data/com.kingkr.kxegohs/app_tbs/core_private/debug.conf

MD5 a7e59a6f0807e3ce81df0b980e2a3712
SHA1 dd42db4d3d5ef84898548768fb214b22fc055f0b
SHA256 910b916ec7b817e323314d205170b359d5d140b80b6f21917f15f3c94faf547b
SHA512 2ef3889ef76060aca37fc60c0e27b3dbf60e3746c8c3001a85bdef03dc897ba1f84434e96686fa40007c89c50a603c87922468dad6bc9a59358b500768a8e65a

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 02:52

Reported

2024-06-02 02:56

Platform

android-x64-arm64-20240514-en

Max time kernel

47s

Max time network

140s

Command Line

com.kingkr.kxegohs

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Requests cell location

collection discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.kingkr.kxegohs

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 tcp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 adblocker.appbsl.net udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 www.appbsl.net udp
GB 79.133.176.187:443 www.appbsl.net tcp
US 1.1.1.1:53 mkl.xy6464.com udp
US 1.1.1.1:53 log.tbs.qq.com udp
HK 129.226.107.80:80 log.tbs.qq.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp

Files

/data/user/0/com.kingkr.kxegohs/databases/ip.db-journal

MD5 421696ca4c5be22aaa2b0330917e628a
SHA1 f1eeec2841404beb9bb3d946944fdbee1ea85bb5
SHA256 a5aaa81b0d9bdf1e399d8275c35f8ad06abbfaa4cccbb02f509fee78d4d61c3e
SHA512 84e9e767a406bef0c3ac7b7b204b5503436b1f2863d6efa24f59a3c3b683de8d365b3b102703bc880679044a403eb20245df30dd4b2653b75a00fd679e9cd5fb

/data/user/0/com.kingkr.kxegohs/databases/ip.db

MD5 f40a57c66313e33698bdd07e38b00641
SHA1 fd8e0a6db4dcf1848270c91412270207f874b127
SHA256 65ab2642bdff4a2cb2b79153eab58d04e936cc84d8abe3177e05cae5465ea5d8
SHA512 b944aed5333eb991d68aa90a1c28908987147faeca09c144edc532c417408a2fec820cca6bd61e5d985e0e4e855b2808ea6cc7897bafdcce94a90a573cc9f9fb

/data/user/0/com.kingkr.kxegohs/databases/ip.db-journal

MD5 5106d67b64a4668dd3ce23e343bb5c22
SHA1 24ac293a9226783ef6f2be5fe31e6829d647ecb8
SHA256 030d70cdaef572e1bd9fc8c9944d1924b0bcb2071100f9a0fa3115e734a51a86
SHA512 25e8c012e45e98d4086e21538145fc5bdb1987a358271e26c7489fbde56f0b6568db61662ae0ca8298c2de4668db6086db76c0bd05a8d663e285a0d92592a5e0

/data/user/0/com.kingkr.kxegohs/databases/ip.db-journal

MD5 7fa734f3b038d6b3514b2bb2cc9abdb8
SHA1 eb88db3a1df6b32699c651e29c5647b37529f77f
SHA256 62abe4d9db8f3cd4a03d36b45a2fdd0dabd0791ab11d0591cc804ee30004fb68
SHA512 0dfabe492ce24d2776ec93f4480054310dee2f2cb77f9202cc8a1664c7f736b1ce84b65f4b771388734e01d78319e604493f1fa07f2ccdb9178ca225bd914bb4

/data/user/0/com.kingkr.kxegohs/databases/bugly_db_-journal

MD5 3b8c44a88a7d0b02da671e52674112f9
SHA1 774583060d702a06b55e06edd46833a4e0c4cc9c
SHA256 4c588f65b96ab08a69f9882ff921605606a9930e6d3d6ea7164d31fa5905e6db
SHA512 341948953857f2210e756826e0293f010ccf037e147de0c3d7ee98af429ca91f47d0998a90497001df4e10af5ce67df3758c336411159ccfaee108c8c74cdaa8

/data/user/0/com.kingkr.kxegohs/app_crashrecord/1004

MD5 db89d2f64a67c1aa4acbc4f8e1d30419
SHA1 545fa5b3a5a949edef24784a3ef68b7ddb4954ca
SHA256 c4d76831a2937f819f692c8da3f77852935ffc7f0a743f08c120159cea224bea
SHA512 304ffae986d7d27be7e82df932de9c2e91e24fb47d6a564905f03088f15a56b08bdea4a16e72c45319a4a6b9f6efab81cb8ed1080b729df8ee09b157e8b123b1

/data/user/0/com.kingkr.kxegohs/databases/bugly_db_

MD5 321c4f4f1d15299cf03ed4172f384274
SHA1 e42666ca29bc8313d6e10ec19dcaa79a37136174
SHA256 a5146789d256662aa5e7cdd5c935322f2ab1e3fc7e586b04c0226dc0faf1c3bb
SHA512 9b88a7f7c8acc8e36db065b9560e59da23f4d0d0a070d695b78f25300ea6bbe91a944a8434e885760af5a19006848904bab0cca5e200821dd3b4071cf4216cf9

/data/user/0/com.kingkr.kxegohs/databases/bugly_db_-journal

MD5 318e6fdaafc849a3ae80dcd5ec77bf6b
SHA1 1daf9713f8fc12d2e49b0303a938175c08555211
SHA256 bd9e6d659cb88039bcaa81692043660dc4f29ea3751e8e336268ca3a73b20e26
SHA512 ccd9739a2cbd22230a47d21c64aa66aa94c427cb253262c524a7680ed36824c15fd577228e7fc8e0207db2ca53df4b115fd8128f9f66ef1a9da4c1221d69887a

/data/user/0/com.kingkr.kxegohs/app_crashrecord/1004

MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

/storage/emulated/0/Android/data/com.kingkr.kxegohs/files/tbslog/tbslog.txt (deleted)

MD5 4eb14f27cc4441dbf88dd7d996470534
SHA1 ccae171b0c9439e2f6bfb6d7e583b71a4d7651f3
SHA256 2dbab4979c076de98f0256a8c8b026540e4d6007d9b405abbc06dc334775b79d
SHA512 98e8d633fa6774fb443a8919082371318f22bdf17dec9fb31220c2f5ebc4410aaec2187fa5a37565c965a29c846f26508ae29ee65a09e724456cd241e7ea439b

/data/user/0/com.kingkr.kxegohs/databases/bugly_db_-journal

MD5 08613f1023f1963b5d2397b04e58ebc8
SHA1 896c7456a99824c778920f6ccdc5c64eaddaeec6
SHA256 2e50a418b43574500caa69e229245194484f3cce64c0b2e5e6fbddd5bd7e60c9
SHA512 e10965335287e9444d806c821ad36c3178b3adbd0d65dc8a40504e3f7c7bc87675f63a2bfcafa73adc963031c915aa82788ce5ad8b6a7912d174e5136687f4ce

/data/user/0/com.kingkr.kxegohs/databases/bugly_db_-journal

MD5 b7c063ba6e159bcc213960df55671e19
SHA1 b1d77db28008362f340662aa5c90d5113fc1be3e
SHA256 37cbfc2838a4253ce6690c3eca7667e47e29b72d182a49309818236cfdc0daf6
SHA512 701007458796df2df61e25447b3e944292d06e6f64c415960a12098bec63aab95ceccbf39bd8e0e22e72f86037322033fba1b9c522d64fc5f24be0572d155b64

/data/user/0/com.kingkr.kxegohs/databases/bugly_db_-journal

MD5 752e7273e1d5897a3105be471a7c7c64
SHA1 b99f84e6d8a740d7300ceb6dc6769c32b1211f12
SHA256 b9de4e44b8979768ac46811a62f0392f1dcfd1db9710c4883c942f22977b9b7e
SHA512 e060e0fd71d6cd46d396649d969f74556fa11c8f3d280a73d3e91b403ea0c2bf40f9a3c8b956b49763ca1351a17da17c7348762fbbcdd24402c21f95adcd6f6b

/data/user/0/com.kingkr.kxegohs/cache/image_manager_disk_cache/journal.tmp

MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

/data/user/0/com.kingkr.kxegohs/databases/0M3006CS7U0ZC2K3-access.db-journal

MD5 8adcbb8fe3e9649a94f1e39192daa015
SHA1 7925497682404edbbb4156398a4273fbcea70006
SHA256 cc882a7296e8af9c5eb5437ec98dc6eb117a0b9d952e47893ecf4c45804c2c0a
SHA512 a3f7b283757303fb76ab6cc5f31393e0ffe46017346fb70aacb9bbf21689bd976fe3dc44a34972efa8c70e01ededc03140d8a4174a7471fe08ceef852c53a261

/data/user/0/com.kingkr.kxegohs/databases/0M3006CS7U0ZC2K3-access.db

MD5 e8a3cf1519f76f90fe66482692fb2735
SHA1 de43fce34992dbfeb9d216b1ecf45e489c7a67f5
SHA256 950dcb46fb427d6c603ddf7b05954f5dcd02840e0a0657a40b71d0d6ebf488f0
SHA512 21b0c416e7ad89bb460aa7e8211c626aa20df41bdf46afd10877c6234649bd0a4de301c88af57a7000750a208774e06e2a30340cd9f96947b962f6e9ba112651

/data/user/0/com.kingkr.kxegohs/databases/0M3006CS7U0ZC2K3-access.db-journal

MD5 2ab3bd6012880e3c9ad3f6acea86c87d
SHA1 ee1ead8666f276a571014158ff7ad153e15f6b92
SHA256 ea8473e812eda38f7fd20feafb4b7174ee52d499ef602d49b8fa624ebd5d3ff5
SHA512 06ff394a702fdfadd63af0970dd2b28267539b968777b9146b1da644ddd3deb5fe96584a5655170c7ae75bca4cb63de332c314b0cd9b87a0e81521c0c8696084

/data/user/0/com.kingkr.kxegohs/databases/0M3006CS7U0ZC2K3-access.db-journal

MD5 7731771c4261ac24aae4d9e44a00fe56
SHA1 f17f7659f6f8e2c7923368a6b4ef795217641082
SHA256 8b5b36f5eb39463b6f4c6cc894fb76615b006764a127ff5bc64a0a38c96ccc76
SHA512 00ba9c4f06c52335b1e1c6320051894fb8a2a7d22a589985f1b521601932c55560a602cd85a63808de36723ca794ccf0de787af1760f7b9df60378f6cde73018

/data/user/0/com.kingkr.kxegohs/app_tbs/core_private/debug.conf

MD5 67881de150fc04b1cfa9614fb2818b43
SHA1 c0ad04c4f9dbc52ed3e23989f4d16cf9e469a3f4
SHA256 77d4cbc2e541ceb31ee7784b1fde7bd0c925ddbbd109792b2ca6686286cda72b
SHA512 6f888e5fc92f2bb0fb43fa5e47a35a7458f4d2fa8c6a216fb7ab971d8a1e5ab9436efa21811a002ffc308f6c4aeff63635fd211a6b129f70761e7d0611be0a52