Malware Analysis Report

2024-10-19 13:18

Sample ID 240602-yjjgbach5w
Target 8f37da916c775c0b7e5dff6c37995dee_JaffaCakes118
SHA256 fa9371c84e1eec53f64bd3953883247894addb494a89a945bd32685e9887bed2
Tags
banker collection discovery evasion persistence credential_access impact
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

fa9371c84e1eec53f64bd3953883247894addb494a89a945bd32685e9887bed2

Threat Level: Likely malicious

The file 8f37da916c775c0b7e5dff6c37995dee_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker collection discovery evasion persistence credential_access impact

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests cell location

Requests cell location

Checks memory information

Queries information about running processes on the device

Queries information about the current nearby Wi-Fi networks

Queries the mobile country code (MCC)

Obtains sensitive information copied to the device clipboard

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests dangerous framework permissions

Checks if the internet connection is available

Reads information about phone network operator.

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 19:48

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 19:48

Reported

2024-06-02 19:52

Platform

android-x86-arm-20240514-en

Max time kernel

178s

Max time network

160s

Command Line

fang.mp3.dlv7

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Requests cell location

collection discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Processes

fang.mp3.dlv7

Network

Country Destination Domain Proto
GB 142.250.200.14:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 apportal.airpush.com udp
US 1.1.1.1:53 a.applovin.com udp
US 34.117.147.68:443 a.applovin.com tcp
US 1.1.1.1:53 udp
GB 216.58.201.100:443 www.google.com tcp
US 1.1.1.1:53 init.startappservice.com udp
SG 168.138.188.189:443 init.startappservice.com tcp
SG 168.138.175.122:443 init.startappservice.com tcp
SG 168.138.179.114:443 init.startappservice.com tcp
US 1.1.1.1:53 www.startappexchange.com udp
DE 132.145.224.90:80 www.startappexchange.com tcp
US 1.1.1.1:53 google.com udp
GB 142.250.187.206:80 google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 1.1.1.1:53 imp.startappservice.com udp
SG 168.138.179.114:443 imp.startappservice.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 a.applvn.com udp
US 104.17.1.3:443 a.applvn.com tcp
US 1.1.1.1:53 data.flurry.com udp
US 74.6.138.66:443 data.flurry.com tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 142.250.187.234:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db-journal

MD5 ed5be03965cdc0a82016ef6dd23a2572
SHA1 99d5e6f6e71878d8f8223a1f7e9ad396c94d70e9
SHA256 7f4bea18787595abd6c759241c39d1f5ac1bcf818fccd7c87b3a0640d894b4b3
SHA512 3c21e400e5611d6acbde5d7d88b8c64af47b72517d32d1ce1ffc10a7a0fb59fe5e8edfa63f8ebd4ef7a6363c65fbbee50059d256b41b32f4063cb86d465f9047

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db-wal

MD5 d39f622d8af4e8a665fe810a14a5f2ab
SHA1 a7639671c2462467c1cd57fbcad77fca599030ca
SHA256 b007f8b16e3274f4954401add2269bcc334dffb5f2d8330eb591efdea4633aa3
SHA512 c5cbb8b760548e3fcad9c010c2194e3914f9ec6268506cbae96d58f4bfdf60f702853b3d36110d0b7ac76b98668477c5972d9c762f332037d46c0807a7636ec1

/data/data/fang.mp3.dlv7/files/shared_prefs_sdk_ad_prefs

MD5 5f1a61cd768d1d0d2ba1f41af39ed1d6
SHA1 e9efaab032c07d485ba10b77448eb05eafb5a8ce
SHA256 323711ea097e99a032b55fd7c52e319f64c28762778f63760046ba3f368bc082
SHA512 2a89c90459c010d2e0a943bc5fd085d0472d9c167e827dc7d25843b66a88e284330827767c4978a96ac3c763fa18242bb225590973fe0ca2fd321d28b04e4d12

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db-shm-journal

MD5 dea9126d01d051c50bfb209c0a4242be
SHA1 4d87ab7d419f4403cdd5e2d0688ab594d2d3a0d5
SHA256 55757cfe977113e0879fa3f4d51107954293aea7f0dd4140267adb33a3578e7d
SHA512 5c277a7776559c9aafd78a6d88bfd1027cba47ded359bae053cf4fa17c269309e617047ff95cabfcce355264419139f52b2e6f198288db67777ca578c7e34361

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db-shm-wal

MD5 0e6e1fabbf256c635320c0bbb177fb21
SHA1 893125b73d03f3225f2265f8590129ec375c05fb
SHA256 fb61d12ff8f4e021f6d28fc93fe5a1548760ce2b43000922a4d5a46fc437dcbe
SHA512 76181f6cef6c75ae410cbd5a860c4eb83ea72c588ef706691bf1af0418d0859316da8d2b4d496d82f0cfbf8a2884cee4a1e042cef38cd922d3b570f37f6806f4

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db-wal-journal

MD5 57f74606e7ad7929044509665f17fb6a
SHA1 f9929542892c6651a5b253fb1e52c7f962ee7e2d
SHA256 b6f6ea968b80aefb00e150710ab20b281efb078b78835314af248106c82d871f
SHA512 043d5e206cb5de3f3985bde14c4d9e8a6e33bbf021c2128a13ae1be792089cbf2a826ea94110ea1f2d01b752ac499ecf7a0828011ef39068d627939e693d2c39

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db-wal

MD5 3fe30614d7e0d11db870b4624f6c50e0
SHA1 053ff0fc621ab40f2afeddb3e7b4a73ee41ec533
SHA256 67c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d
SHA512 c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db-wal-wal

MD5 30aecd7ff8300911d36c29c84add6a01
SHA1 e3454c87fa2375b838d335b330828b22f24d015d
SHA256 e9eea39a236c6752637f7f313adff0ebdf303d335a14f07a1db09ab4ae56be24
SHA512 0878160397d657d6016391b000f677176c606add518f13fd1d92c620341d3fc986782a355a7d55f38939067bbffe930349ebd65a3d05ce6dc2ca2aec6428c9e4

/data/data/fang.mp3.dlv7/databases/dBMdYFN-journal

MD5 36291e028bc011052d3ac0e47ef97da6
SHA1 b382bfcfc03ebd91ff25540b7ef820fd0c376888
SHA256 814fd710a424a5554e2abca346a5738f4e566341f322f5dca8e38e54a69d7581
SHA512 bb25191c87ba88c57c93a137b2a11c715af6f6930dc615ea512378765a6ded29c923a44444c2bf5191fe54f53c8ccf1684387a548489c866e19d918593811284

/data/data/fang.mp3.dlv7/databases/dBMdYFN-wal

MD5 e97f11910fb00c283c9acfe4c94f710b
SHA1 0dc45c48c600517b9a76705b5140d99051d0cec2
SHA256 f3fa38f10ca58274122c8f627197116751015041059f72b3863c467a771075ae
SHA512 bcce1355e76b13a2f86711e84bc376922e2d2795c9e9128a0005ba4bcf5e7bd8144be0cb99d5ad2c0b6abc72fcf2081adb3a811544c19f5de1a90bf6f96eacd3

/data/data/fang.mp3.dlv7/files/gaClientId

MD5 b317f0628c7248011ba7f9d05c77dfc7
SHA1 5cb7a78bf4150bc65779764382151b3b8721cb9f
SHA256 6fb2e1808d82e2545621669d38d60f3650d140cfea39fe7c95caa3985278330f
SHA512 0766e0d426cd62ca0b5969c48da6c70b4379512e547934faaa0c55b20da696dd7fffe24f9a080e900094b1a228032a5c2a512dfa07c9084cf1ef4e138bf82152

/data/data/fang.mp3.dlv7/databases/google_analytics_v4.db-wal (deleted)

MD5 447b08af159c4dc5037c7a89d44c9040
SHA1 209deae3691167acfb3c15ed745b0f8535823743
SHA256 f8227a52be933527798cbf35ac6136b2f4a2413cc291bf4a3f1e5fd1957ed231
SHA512 d1bb7600845092c83c60d74f39cec4c606d541f6707f914bf8f9580f3db5be9e601e53b76f14ee0aeb2e0fe08cdae2cdec028522fb4c29f1d1ab6b0c8255a3ff

/data/data/fang.mp3.dlv7/databases/downloads-journal

MD5 51508b1530fd58e5955960339893604d
SHA1 ddcd33783962877aa355104f383f171dcb7564ed
SHA256 d359fe82e72f5b91c36c1728bdb14c3f4cf42d2a6be88abc1286fbd786c39a73
SHA512 194479a7615e3beb70dda86e95b7d3218e345dbe7964aac27f79f2e2edfc2adf69a80fa2e02a12b1e4cd954a7e34c670d263f9c8a145838f41a1be57007a0e1e

/data/data/fang.mp3.dlv7/databases/downloads

MD5 aacb15c9d685827183320fd93a59c0e0
SHA1 e60f357537a48b0f9e782efa2aaebaffd03f5090
SHA256 2accdfe01e5e158568a6b579d231565eac7adefd4e57ee30493274a0c5147cda
SHA512 730955879fd7aeb5a7e286c46ad729997bd8dd16c6f206c2752dd667043379bc60b1f8d1ae7ecb3d8276ef944b8b27182a30f0f003981376a25b48dbb46a027d

/data/data/fang.mp3.dlv7/databases/downloads-wal

MD5 0b0f8f44c718dac5030a43988e7b57fe
SHA1 dba6c7b0d5e8a629783936483447de1ce62c5599
SHA256 cfb7bc562c15f35ee5177c7a05f9661e1286ed7681e337c7a586b59213354696
SHA512 523e84915afa8bdde9cb121bd6f12c6cf48ac00d7ff2c527d9736dbc7943ced160d87ffefbf5fcaff66122b6f9b7cdad6d7341af5f45d5a8a3c983455de2b20e

/data/data/fang.mp3.dlv7/files/.yflurrydatasenderblock.9793ad1c-b85f-47a3-9241-4edf6f841988

MD5 1487a8eb5d60a756b9a7ce9bcae92bd3
SHA1 db6365a623e3067de9df10de6c06bbee5a50c9fb
SHA256 3eeab6777f65a359c2507468b6a33540af2cd214d0ce07ef3dc45d1f521a32fa
SHA512 763046370fddb05f13f976cfd2bf897b9724b552cfa0dba0ae0b2e877f62aa12ccc1e14eb44eed4c3a2943359d11877760ff811d96f2c5166c4748a4e0dfeea1

/data/data/fang.mp3.dlv7/files/.YFlurrySenderIndex.info.AnalyticsData_5TG4JGVTYX3S34VZQT7N_216

MD5 bac9ca3176f41a0a4629eac6a8438e8c
SHA1 be415c1a0fb6ac420d275d5bd379ef561225b954
SHA256 5168e64cc1ff198f48ddb6d9b93bdc9467aed6c3710913faf3487a42a0eb3275
SHA512 a100904a54f4b96c8f0c53da3f3cb3f07640242558afd08fece47840b0a2132550ec6b7af370913be94b09291f66f625f94eaf1d3d80dc3e6a4412a1ad22a8a7

/data/data/fang.mp3.dlv7/files/.YFlurrySenderIndex.info.AnalyticsMain

MD5 b93c096c4a4256a76a35955acf75f98d
SHA1 4c915d8ff701ee2d9e24fdda0ebc87cb37bde37f
SHA256 801ee8f13155406b640b4d7b630d0473100fcbb82eb727bff03585da4343ebe8
SHA512 a557418d61d18a00116c2c8de7c45e14b071fb933b45ac05c1b322952957594d6288abd2f95d20d0f724ac5acce18b14aef00009288206eb7c43ab60c5de6f79

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 19:48

Reported

2024-06-02 19:52

Platform

android-x64-arm64-20240514-en

Max time kernel

177s

Max time network

135s

Command Line

fang.mp3.dlv7

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Processes

fang.mp3.dlv7

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.46:443 tcp
GB 142.250.200.46:443 tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 apportal.airpush.com udp
US 1.1.1.1:53 a.applovin.com udp
US 34.117.147.68:443 a.applovin.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 www.google.com udp
GB 216.58.212.196:443 www.google.com tcp
US 1.1.1.1:53 init.startappservice.com udp
SG 168.138.175.122:443 init.startappservice.com tcp
US 1.1.1.1:53 www.startappexchange.com udp
DE 132.145.224.90:80 www.startappexchange.com tcp
SG 168.138.188.189:443 init.startappservice.com tcp
SG 168.138.179.114:443 init.startappservice.com tcp
US 1.1.1.1:53 imp.startappservice.com udp
SG 168.138.179.114:443 imp.startappservice.com tcp
US 1.1.1.1:53 google.com udp
GB 142.250.178.14:80 google.com tcp
GB 216.58.212.196:80 www.google.com tcp
GB 216.58.212.196:443 www.google.com tcp
US 1.1.1.1:53 a.applvn.com udp
US 104.17.2.3:443 a.applvn.com tcp
US 1.1.1.1:53 data.flurry.com udp
US 74.6.138.65:443 data.flurry.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp

Files

/data/user/0/fang.mp3.dlv7/databases/google_analytics_v4.db-journal

MD5 84a969f41b8beaae4608bff469a407bf
SHA1 4c0285a963644725cf32a3a7be07108aae0c6753
SHA256 53a2e83a0676f51d3b84656d6b06779fd4a8123a098cc6d1b2870c3f74d1c513
SHA512 189a17dbbf793b7cf8f956552f8e625ab0cbd541520825d65f7411e556a9bfb4cf3ff8623a2561b07c5b35b49e5beac51885a1c9d1ed0f5f4b414be34a3551f3

/data/user/0/fang.mp3.dlv7/databases/google_analytics_v4.db

MD5 60ae3555b60853ad5a921e6f0e489e7f
SHA1 707ea120f60037bddac28635b5f3c0d74a69dfc1
SHA256 68be1e675b68f8a894c80caa952c1205e292c427657bb79a58b9b366934d1d8a
SHA512 550cfd40a3a3bc7be604a81c9c9c879078033d12282cf32ca6464851479823febd12ed2162ca6241b01a03ad52cd80cf3fe3c0252591e68cb11a8ceb682f2f39

/data/user/0/fang.mp3.dlv7/databases/google_analytics_v4.db-journal

MD5 9f9edf6fd7cc3e3cf2fb8849a29bcb70
SHA1 a4d34aa1ea42046a84eb24932654fc83c0ecb250
SHA256 06c1a3d8975d7ca08a50fa243b7a6da6fdeca0af04ef22946ca9a2205c0a223d
SHA512 5c44eb488a47b16f50064e8f2bef089437a3aaeba880c71757474e9a8552f5066a9397f7e2c8d9a019fba01843e464e28233046de6f5c96444a02790e9693d84

/data/user/0/fang.mp3.dlv7/databases/google_analytics_v4.db-journal

MD5 2101a26e8422924ff24b02034c3c62f4
SHA1 4289d246ec867ca6b6c4293a8d519f6d2a047b26
SHA256 99bd00446ef2f75c6c24a8fed4a169aabc2d4a1c9df33a9268b725183f88d8a6
SHA512 e234e8e6dc064f0a959c4b64b803df232eff9752344b18820861bfac25a7a5bbc40820167a7f3809a20d2e2029559cfb51bd4e2184d4063287968094863052ff

/data/user/0/fang.mp3.dlv7/databases/google_analytics_v4.db-journal

MD5 964d61b4288401a0f1daab330659cf5b
SHA1 13ba6f1af800addd15a14849c82378a079020ef8
SHA256 6036607d2b3751f661401164a6f00608c206025d70adba2c8609c31bb000fc53
SHA512 ae8b78df2811ceeac759aba3b40dc3e0fa9be206b5c9f2c5051a0b29b4781314efe5700cf8ddbc0bb3329cc9f5ba866504d594ea5be30cb003283ece43c8eb80

/data/user/0/fang.mp3.dlv7/files/shared_prefs_sdk_ad_prefs

MD5 5f1a61cd768d1d0d2ba1f41af39ed1d6
SHA1 e9efaab032c07d485ba10b77448eb05eafb5a8ce
SHA256 323711ea097e99a032b55fd7c52e319f64c28762778f63760046ba3f368bc082
SHA512 2a89c90459c010d2e0a943bc5fd085d0472d9c167e827dc7d25843b66a88e284330827767c4978a96ac3c763fa18242bb225590973fe0ca2fd321d28b04e4d12

/data/user/0/fang.mp3.dlv7/databases/google_analytics_v4.db-journal

MD5 b61bba428318a9d3f468200c60152a48
SHA1 41863503aa08fad43dcf7938abd4ddff64b0471f
SHA256 348d0b33498b9d46bcf0c5985af90b1bf309c22c86d3e170962a96e5c1c9716e
SHA512 35c6d3bdab624b40997422d867e8ff1176723a64421b810087e1d81eb28e1f26651d1dd27ae443d5204da3e12154cce36846a6407e4c59b092650bb6c50a52c3

/data/user/0/fang.mp3.dlv7/databases/dBMdYFN-journal

MD5 93732375f32a691461a4b0f1f092835e
SHA1 957325886d5ded074dc2aff84828f90a7f076bf5
SHA256 ba486ce6ae8aa4e112d59d952f250cd866119651e1f7c2efe0f6f8e4f08f23b3
SHA512 ce40a6697e9f5991e80b7927a51532cb131608322fad6812bf3cea76fa24772103e4da08860b0dc62cc760543fb75fda225cc1f289495bbca9371556ddfa7e10

/data/user/0/fang.mp3.dlv7/databases/dBMdYFN

MD5 acb3eeca747c7d15277490824ee9442d
SHA1 239ccf9162a24b0fd2aedfbe4433421441d1c32d
SHA256 4afc99ce74b0379a8054b5154064f448b859964f08e49d36c80591ba94f56317
SHA512 f13f01306f8e86af317fbf782d802c5f696db85abb6fc0b77fbfd9cd13be6e073fa2bf5ebd4ce60e9d92adf412494d51d8d162bc63de5e9d03d041dfeb4bb00a

/data/user/0/fang.mp3.dlv7/databases/dBMdYFN-journal

MD5 c43c4ca8cfc91810367eaf8dd060b670
SHA1 ff31e1cdd22f1d3985909b2b04d635a93ff1db8c
SHA256 b133f9b68316960f4e04f6730b0d6861d0911b71e6a4dd5d99c047e83416ff39
SHA512 e27a63439140c73e6ef6a00f724bbadaf5650b6651b0de8e1e5cc24fe6a2344a8c9a93ecefb217891d9aca963735e9aa89ad9dba3ed224a58969c41095eb889d

/data/user/0/fang.mp3.dlv7/databases/dBMdYFN-journal

MD5 aa1d5962a5427eda7ec0c759fa73ea26
SHA1 546b8af62be4792b913d3c7cd9bc1456658b45b2
SHA256 c4f713de66e30100b5ec28d28521c3310183167d7c03a9b0a73b98ac9aacde22
SHA512 fafaa30250d43cd0114ee566077cf31e6702bcfa60ce0e9e80d66fdafd1b42d95450ff936a4522a7998e0b55929c89571a9d0982f4a286c1c77d97f68072b564

/data/user/0/fang.mp3.dlv7/files/gaClientId

MD5 18550577b484a0e18b800de8263e7e8a
SHA1 572844163c9228f628c68ca4f2ee4213c8ff321f
SHA256 b67b6db86cc63d81d3c96413b85faf6aab01bb14e400b5fffd25149367cddbd9
SHA512 a9753164d7b3c4dc716378c0ffca58943707d3c3f7900610fba1224f25bc88ce0f096bd8825891c25b54f6eb77e7a6e6c177cf3711ab13f64bade1c6c63123c8

/data/user/0/fang.mp3.dlv7/databases/google_analytics_v4.db-journal

MD5 99ab26c4859660f855e20a6340c8946b
SHA1 bb91f5819b63cc5b210c4845b169e97b6bb4837f
SHA256 efa972b27b9324391a69073b0240e7f21882af0459a56a96cef853502eec769e
SHA512 9d56d08949d653a707ec08ff2c34fb930a77aa7c5f52cf4181e43d156e635c4af97fde26c4c505488ef42dd6b112eb3efe12b1fa07dedc37069df8724c3eb4a7

/data/user/0/fang.mp3.dlv7/databases/google_analytics_v4.db

MD5 10714bffbf718ecbb32d283bd591f617
SHA1 ad71c32edc529ca0f45462716feac924b45f1dd9
SHA256 da76d3995aab64c9c92034e9fc431d6ad25e50f678ed9c4556cbadc53aee3870
SHA512 e0de14edeeaa1b1cd65c90e03c20c28a01741e527f37d1790dee5b9dbe6091a1c5d4779983d1d2510194cc88fa8823e4507f032e26d6941f4d1df32a3fd6adfc

/data/user/0/fang.mp3.dlv7/databases/downloads-journal

MD5 7103423d2b7b8407ec045fabbf944ef4
SHA1 9181b64cbf5b8c682f402563ad267c374cc9d860
SHA256 3e4eb66d4f315b7dd691001b215de2e3c3ec20b28b7371f63a1313102f397724
SHA512 106df9e98544a5f9ba9e1a0ea7701a51719199152d957e6189363e7e79a304df3845731b396503e61b77f7b59e2695f4c90fc427ad031db49e4930e89e0558cc

/data/user/0/fang.mp3.dlv7/databases/downloads

MD5 1004008473569b78baf0cc8684f7711e
SHA1 6e7e7093ee301ed36053ae04120a1d4aaae378c9
SHA256 31b7a13b701379ef78317f70edf75ac7308959405260bb0f54b6f4749b159839
SHA512 1a61db1d9735421b4cf6b2b732c357f38b2f40f98fdf89dc48faa61603395f3d793fc7c13389c9d7c51a391bb727c7e613de03fc3a512f8b63ed9add0ba494a1

/data/user/0/fang.mp3.dlv7/databases/downloads-journal

MD5 7a843342bd0510b2095978d67c20555f
SHA1 09dd675838169a1a9cae46ce95226fce6beb0e69
SHA256 710e3ec8c0b696b2899bcfefe4592c332e10b6e5adf41aa28eb2a2605840a8e4
SHA512 f43c637a0ff17287f1b79bbe82e99c1fce36d62a026bb53d769fe4de84a2e6740cd28f45c73d93aebf21ab05e4734b68f34d3b4610fd1f4bffdf253c2f55c2f8

/data/user/0/fang.mp3.dlv7/databases/downloads-journal

MD5 7394ba0a6c15c4dfe60e24b3afb19563
SHA1 f43f9674de2e65ba45ecc99b90310a90947c3f23
SHA256 1e396a1aa872167972f5b440975b4ff76beee65c68cdaebaf920c28076d93d9b
SHA512 c228c9b54998516054fbad67eb1d5cd2102293cddf0e6254cd0488346d663cca46a2c35a6b4ef5d40603dc30574cde1570bd95820fe0db26e4f9e202b9baef89

/data/user/0/fang.mp3.dlv7/databases/dBMdYFN-journal

MD5 8f4bec1df3bc756e67c408f531f16d56
SHA1 f9588219d6a2299a14fc687fa345cfb339f2316b
SHA256 86fd226cb794edac7e1e0f4ce82c64184a9f92bea41f3c7a4e5f2d2c52c59504
SHA512 116659b2fb885017cc8ff8eab1c78bc9cea4382c3f698b75e54d62c4beac7113164898906505ee400f070cb7cd2d3df791ff2ee6e9d75159c4ff5f9c44728a32

/data/user/0/fang.mp3.dlv7/databases/dBMdYFN-journal

MD5 5245e446a8bd467afe916f98f8be6efb
SHA1 ea0f180509d260733e430a89113a788986e0a9e7
SHA256 8baac51222c2974aaeec23453809e4cab915d4642dcc915a153865822a860e6e
SHA512 ce0508b0eeefd4720e1b7c59babc43ce5dc8a81444776e2560d2b76c78ac35c58bd95cccf0cae8c98769119beff40a288f166e92240c3e04295a253a4ae55c95

/data/user/0/fang.mp3.dlv7/databases/dBMdYFN-journal

MD5 9a0e096780a51716b788f7377f7cf317
SHA1 63b3ee02a7911937452bc25ad6047e50c4f1e52f
SHA256 295dab911c12e6e33e06ebf57469e39ae728598c73f75c83d7eade7bd0ecf6aa
SHA512 1d18ac22b3867788e61aae7a4e8487bd8eb89f7f10ffde4ba9ef825aae1c35a8986951dad865fba646adf6789bf45b7430888e972ebd89b81182bc6b08223ede

/data/user/0/fang.mp3.dlv7/files/.yflurrydatasenderblock.42fe4fb8-f88e-4b32-bf89-fbbb8303c2a1

MD5 4e442c923057315460410143bc18a5c5
SHA1 1e6ce6ea51ea7c7608ae6889160ccb91f0d7c116
SHA256 e4817155fdaf7501b4ab3c9311d8d07705e0d9c8de8c07835bbd20cd2a6390d4
SHA512 5d9d07310a2158183f32ea1540933d65ae53395eabd7dd0693ad4b50683be673ca688da5daafb1d677df04e9861f99b7cb6c82022d49e7b3363df1c046cf3b4e

/data/user/0/fang.mp3.dlv7/files/.YFlurrySenderIndex.info.AnalyticsData_5TG4JGVTYX3S34VZQT7N_216

MD5 53d64a13f382e1835ce3428842351b87
SHA1 2af6b0f9d30553688e84e2443d8729ef24bd905f
SHA256 7e2f215e11d8e78c4bebfbecb102671e126455f5a27ffdf8c1b0b230f40a2699
SHA512 cbee974a075e5763b471906cd3b6aaa7f2414da77fc6ec69256fe0506c5ba150fb8bc61e43c6aef4ee930646949cd90088a7303b0bc51eb6426f7d0a294e3e1a

/data/user/0/fang.mp3.dlv7/files/.YFlurrySenderIndex.info.AnalyticsMain

MD5 b93c096c4a4256a76a35955acf75f98d
SHA1 4c915d8ff701ee2d9e24fdda0ebc87cb37bde37f
SHA256 801ee8f13155406b640b4d7b630d0473100fcbb82eb727bff03585da4343ebe8
SHA512 a557418d61d18a00116c2c8de7c45e14b071fb933b45ac05c1b322952957594d6288abd2f95d20d0f724ac5acce18b14aef00009288206eb7c43ab60c5de6f79