Malware Analysis Report

2024-11-16 10:46

Sample ID 240603-j5xthagh3y
Target 91151ded36a8ff088f7d7f9b4bc1b838_JaffaCakes118
SHA256 81a4c5c54eeaf453527ad0abb52f8217319bec2d3ce54db846dfbe69650bd693
Tags
collection discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

81a4c5c54eeaf453527ad0abb52f8217319bec2d3ce54db846dfbe69650bd693

Threat Level: Likely malicious

The file 91151ded36a8ff088f7d7f9b4bc1b838_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

collection discovery evasion impact persistence

Requests cell location

Requests cell location

Registers a broadcast receiver at runtime (usually for listening for system events)

Queries information about the current Wi-Fi connection

Checks CPU information

Queries information about running processes on the device

Queries information about the current nearby Wi-Fi networks

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Requests dangerous framework permissions

Reads information about phone network operator.

Checks if the internet connection is available

Listens for changes in the sensor environment (might be used to detect emulation)

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 08:15

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 08:15

Reported

2024-06-03 08:19

Platform

android-x64-arm64-20240514-en

Max time kernel

143s

Max time network

183s

Command Line

com.tss.cityexpress

Signatures

Requests cell location

collection discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.tss.cityexpress

com.tss.cityexpress:bdservice_v1

com.tss.cityexpress:remote

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.238:443 android.apis.google.com tcp
US 1.1.1.1:53 api.map.baidu.com udp
HK 103.235.46.245:443 api.map.baidu.com tcp
US 1.1.1.1:53 rs.easemob.com udp
GB 193.118.32.52:80 rs.easemob.com tcp
US 1.1.1.1:53 a1-v2.easemob.com udp
CN 101.201.233.110:80 a1-v2.easemob.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.200:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 api.tuisong.baidu.com udp
HK 103.235.47.247:443 api.tuisong.baidu.com tcp
US 1.1.1.1:53 v2.1h100.com udp
HK 103.235.47.247:80 api.tuisong.baidu.com tcp
US 1.1.1.1:53 alog.umeng.com udp
US 1.1.1.1:53 vector0.map.bdimg.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
HK 103.235.46.245:443 api.map.baidu.com tcp
HK 103.235.47.84:80 vector0.map.bdimg.com tcp
HK 103.235.47.84:80 vector0.map.bdimg.com tcp
US 1.1.1.1:53 newvector.map.baidu.com udp
CN 14.215.182.52:80 newvector.map.baidu.com tcp
US 1.1.1.1:53 sa4.tuisong.baidu.com udp
CN 112.34.113.94:5287 sa4.tuisong.baidu.com tcp
CN 14.215.182.52:80 newvector.map.baidu.com tcp
HK 103.235.46.245:443 api.map.baidu.com tcp
US 1.1.1.1:53 loc.map.baidu.com udp
HK 103.235.47.89:80 loc.map.baidu.com tcp
HK 103.235.47.89:80 loc.map.baidu.com tcp
US 1.1.1.1:53 dns.map.baidu.com udp
HK 103.235.47.89:80 loc.map.baidu.com tcp
CN 182.61.62.50:80 dns.map.baidu.com tcp
HK 103.235.46.245:80 api.map.baidu.com tcp
HK 103.235.46.245:80 api.map.baidu.com tcp
CN 14.215.182.52:80 newvector.map.baidu.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
US 1.1.1.1:53 www.baidu.com udp
US 1.1.1.1:53 sa.tuisong.baidu.com udp
US 1.1.1.1:53 sa.tuisong.baidu.com tcp
CN 112.34.113.94:80 sa4.tuisong.baidu.com tcp

Files

/data/user/0/com.tss.cityexpress/cache/com.parse/applicationId

MD5 1419f9e2349f167ab0ebde7467bd9e76
SHA1 2aa63dec022581021f29d4f6a92c3881d23fe3a6
SHA256 81546749fc12349a70682f38f027bfb4d31ed105cdb73c73b340114861765d30
SHA512 f70a696d42b08f443b4edd8f97a9c010fcd975411948bccca30180706cc70186bad208f5508ae9a6e0971258fa6646282c666a5e666f8f0188b5e13090ccbb59

/data/user/0/com.tss.cityexpress/databases/ParseOfflineStore-journal

MD5 e2c58b77c8409b969743565ec4a39d38
SHA1 cf67fd7fe48b4c0d371c7038953d96ae66cee0a4
SHA256 56574ed9d8db3a39aa60baaafa9f8b1c55353a494718918eceebb096ef1f773c
SHA512 768db6a41301f9b0d6e36911e2635bd5d4f69e7b5ca755787b7d53669e2ce740669b8a5d2d0c5e49c765195af9098f6c61a87c12be7cfe435d4f19e26597813b

/data/user/0/com.tss.cityexpress/databases/ParseOfflineStore

MD5 fd16c876cf7be2137f69f13b2677551a
SHA1 bbb3c66f04503fb14409d8d203259531d3b963a8
SHA256 5ebf6c87519462af27fa0ec9eea3a31723a1a84a8378a08e422a2aaa9b1908ab
SHA512 03c318d4456bb48c96bda0e9262b07fce839e3f717633ed1fc6438d044092f5e6e285c522ded46d4cdbaa853067dffc4401b97999adc0af19a9f5f6f14cb0c99

/data/user/0/com.tss.cityexpress/databases/ParseOfflineStore-journal

MD5 c97ec64c9cbc88cf5035a4dc7cf71a59
SHA1 2569325f6b0ca6d703b701f9d0f7cf4908014c8a
SHA256 f84f6310851f81425ff2b4c4629dcb54674284a885c4106850951a002d61b5cb
SHA512 712dd593fad4e12d4239e46eb864b1be343448fea1d30df827a97accfebe771e6f89cd239c92c108c949f3761e3106c950d090bfb0a4513374dcd1b2a479ee8c

/data/user/0/com.tss.cityexpress/databases/ParseOfflineStore-journal

MD5 3beac65eb875cfe015fd986ae3b4e12f
SHA1 417ce4d36f74153dbd23346ca81442b3d85d3bb3
SHA256 b4b86674e4545338422673ff23a7abc16d88f398092aa43b55c09efe4a99c2af
SHA512 bbd58ac77b598ae4e9c0d7735df9549635436e6b1d1e94dcd5faaaa058c3f5e6a0080eef962eec1f46994d84963ed0a860086a530827799d51368a6e9d07a1d2

/data/user/0/com.tss.cityexpress/files/config.json

MD5 7c8dddb13f7e4b530728e6dffe7ddf14
SHA1 f02e2f5ca8a3820aa54d0aa58b7b248128b6ca4c
SHA256 36ed89a13b7eb85fe0f87d7c0bf2e60b105a5ce1c5574a184784ed5f444a91c9
SHA512 deea0d532da7a7adaef4777e9bfe37dc6f6b7dbf0be70c692bf23d6b1b2c42e618699e2b4417c86f8c97ea833ea3bbc15f3850d6a491b20fe428f1f16dce3482

/data/data/com.tss.cityexpress/databases/cc/cc.db-journal

MD5 785db7f82e9b09bb0a1ae84009f7d083
SHA1 4665d555bb8c2625bc0ce5fd1d3fc887df42f052
SHA256 a8ca7331bfb35ef80e01b1ff7d86dfa72c83e095b32e5cde37d9f5425f6d923d
SHA512 2cacef74d71ce16d1f9963693c804301876df78abe5696c880bfa82b5b6c3fe6b08003ec95737e0e5fd90922236193de44b649205093b47e84d15ee1722fa99b

/data/data/com.tss.cityexpress/databases/cc/cc.db

MD5 28a5a82891b71423dda0469f00070cf2
SHA1 986a091ee16f1ee4e49c5582dd550c1ef86dedcf
SHA256 2f98a57c24645ca6aac499c232e96ebc5249f09d428271012d2385ccad6074b0
SHA512 0362598c673409c01a974c6d56747d92dd597996f7136835055f325d2aaa08a70da60f452398610384c750b2b23c594bf411de4e65ad7e271516d8606fde3804

/data/data/com.tss.cityexpress/databases/cc/cc.db-journal

MD5 0f1d016b72965660817257279fe6db8a
SHA1 c6df5e5df595298450460b93783f47d41de93da6
SHA256 28c646a98fca3b32bb3bff6b16e1804300bd374395fb345c4d3135f827143ebd
SHA512 c6200160aa333f7383ef48b3a8f0b94ec2e7fbb08ae8fa6df872a6e29b95457efae0ff9a0624e336369c69ecb91d0266ecdef94fb8d037ce94f99ba362a13773

/data/data/com.tss.cityexpress/databases/cc/cc.db-journal

MD5 dc79f5fb344da7d1218bd3b6d02f615d
SHA1 c503f1c1aa4ee2110b5c6b350b19e87adb371753
SHA256 bc32b4623d16a6105883b9dd47c4b966758ab2de1209502c82a752420a619267
SHA512 0ab427ca8e08560bd2d7875c71762ba3956f26d45db698a44b8d1cf49f6c8b8df2258cb9f48486fdbf8d1dd183f3529e234b2a8aa32cd710c2296ff4df8aeb3e

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 be0dac5e47a3d960390d9806b497ba77
SHA1 1f389c9cd5ba87b95723450e9481a46c82d7a51e
SHA256 48348f1d94836ad6b79a4f47bfd1fa59868087a64eb5eb3f7916a080eda5e06f
SHA512 41c003e16fdf874e6994dd142f1e62acf46ac1a9cb9953b820190cdaf93f91c3623328b9745b62b57fcce6465db84bb314f8f512d3a58bf09131cd65f37df30a

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 7b71d1d86aa41696021a90d55e064d8d
SHA1 14750edf8bbac511875018783e9882c1c66adc05
SHA256 855796effae348bbe91d5494df37ce2864c0ee786645e45b1e18621cfabbcbd2
SHA512 0b41f3bbce608b13b6cc46038e1f15bde7b0e858fd53ef2a9a00486d6e1d9fb3ff9f27294e238b9386d326204b4a3c654a4a2d7f04194e2987b8e26e9d550b6d

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 68b6e64fb9ae7947ccff0150e5f41d9c
SHA1 21590b15bdc69fbda74eac300d0afac4c7923210
SHA256 0aaae8464086275e18ca93d7de227cd0ab108fb18b3a67b40b3e17dbd963393b
SHA512 cf04b0f74f937ed38af262421bd87195423bfb235d8d67fd60240e9c4e31a8681e0cbab10fa561589b3e5662cffdfa6c3279ca52b11f9de54044a3ee20b3839e

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 81a416795ad85900b4f6aaa10976fd8d
SHA1 01bfab1088f1b17a617cbde4aa68fbc71d513eff
SHA256 b6415756ec91cd098832b08baffbef01a9294312027318e92c765ffd13f0ab76
SHA512 0ada7b344840c4c3c98b063bd3d03570f14af7724301cb0abdff3a59ddea2bcb3a2e28f385a877857259c1acff34d063ff5947668588fa80d93b66897271a340

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 c7b9eb8fc0b3dfccfad13a421925a4dc
SHA1 024cd7dc1d8110ae3138c00ebdd17d984b9610ea
SHA256 e2e2a01f22631d5b4ec23eb07d746d090021a1bb9f7457791102fa4aa5069153
SHA512 942554b44b40aaf4f221ee350659ceff14b140a8f308545da98efae581f95ef2db8aefee2733a772862fa9e2500e5556583f69618c2c11fd0355cc3e7f9e723c

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 f5cc3fef538573495a95a0f0341a7a0c
SHA1 5eb74dc70de4d9313ea3ae1a2e6f47f4133d4bc5
SHA256 9b41756e7eaa1fdb7e3998905bc10b70ced2dfdd27867cb22c242a0e85194584
SHA512 df852a4e13bd3f91d116302f38ed431ef45aa2c8d009a7790e893f94eff38a05cc8b826f250915b22a4e112e5101b541d15d820a134e88a4099cdf39ce4a1981

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 93a655d1d15229fd777feb2608c641cb
SHA1 04dad9565984bc05a88d6c83d2f40c7f2884c930
SHA256 9bb2907a5160e9559e13289cf736d46ac2f9acc0b5fa145220d9288d86fa63f7
SHA512 6a6ea698a31ce081c181230e751b6ed87836384e3e9408812083202b66cb533e7d132927fdb372c7012660af5429be0be128428df5d8cd3805bcf40c5b3cacd0

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 da7e17026995275a4d2cc8c4f691434d
SHA1 596db1d5e74e59dddfbd6d1090cb8d9e4c1ee8ee
SHA256 62e50059335b7ae1dfb4ce3513687a9a586fd1c5f77c531d76d285339e6af38f
SHA512 f6ba8cfa8f5eddc01411e30560e21b7873a3eb6b5e60662e38c04aa7feb58824c9ed14021bb2033d90753c554501e97e12b2120e48b64497b0e940bc34e9a895

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 698a97f16b4aba06b7764aebacfb2cad
SHA1 f04857900cc74a78bd86bcf65982acae54c8747a
SHA256 c115e0808254cbfa615a39df87ea549dadc360b4f7a55365d31496f6ec9a937a
SHA512 2f2f7bd5fe09c41da3b7dd939ff382d93b38cda289da98b2678f9ba15d240b789ca3ea5067b18eb4050b933668a57a93cfd0023b0ac08917d5f69ae426826cc6

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 80e7afdbf5739a8dbe4615cb26efe758
SHA1 eff1bbf533954789711985f7bb1a937efdfecf3c
SHA256 6a4ff8867436f6ed6bbce9e8f215f02b00aa59998c7738bd4aadccfb25a84845
SHA512 7fd0e1547493115b6405b3c38a587a9857d500d9ea7bf690b9b37bbcccfd82b14184d9ea818ede9b535a82bca1190d753025fa69a9482bca13bd8f57b2fb7335

/data/user/0/com.tss.cityexpress/files/libcuid.so

MD5 09f364576b8780001f64affdf2cb3ec9
SHA1 f2c32fe65ebe5c59363c3d034af6bfe83ddf7ae1
SHA256 245e392a1e2aebd6ff477e63e24004582fbfc74b62a73f5d4af3184448114d56
SHA512 d246e0a83dbd569383edaf77c699b127c163b78dc6c02e5cdcbd80bc2fff989a4d553740d20e4b1ac0d76002c7fbdc2a123876cfc7473fb5cdaff9d6e7d87f46

/data/user/0/com.tss.cityexpress/files/umeng_it.cache

MD5 7adf6179aa4833bbf08d552cf1b2d8dd
SHA1 f13007b1563b7e8eff5cc13120ec6aead5a19568
SHA256 b61855c9c2298614ed29c37b0bb27f3db3613429f2494b7a019f505d9e9afb42
SHA512 d2b1377fe3618de7a0e39df5336b45a42d7c4a687f9462d5ec8c15acf121ba80355ee0fda7b8fd06042146d3f77011e0248d9a9b5a9fb14db6a85f7a75919b34

/storage/emulated/0/backups/.SystemConfig/.cuid2

MD5 c13e5dbd6259fea2d6d609a8deda6000
SHA1 c70f020cdbd2c4ade77a6824740c705af21f9d8f
SHA256 c4888673c68a9acbbad16d92e83049931bba248d4f5e8af74265c9ef045a23e9
SHA512 26a372a9be2c78f9d3a9349f0a390bc558b9d0ea34d81747186c42e326806c877d2d590ec3eaf0395aef3a4911a8f7114a02b9a80110ac9c0ef897f80d4f5676

/data/user/0/com.tss.cityexpress/files/.umeng/exchangeIdentity.json

MD5 17feb6473652b8fda9b2c6f08931c412
SHA1 9c51d19a9bf0bd84433f91a439bce69d96d8b795
SHA256 9bf622a949b6cb1bcadfe4ccb1040f7bb0163ec9588a2597a9e755e9b2a808bf
SHA512 a8fc55232a39adf3f2d3c0c20a8c3b504f05a5b16e081a3523a01a3b62271f746df7248cbab608a6bdc590e971571dae73b98eed326ae20d54bf2a93f470e785

/data/user/0/com.tss.cityexpress/files/ver.dat

MD5 fc44091a86dffa0149cef0b8a0a63764
SHA1 6c0b3272e6bf772eb7319c01fe5e4f64c847083e
SHA256 c079001f8461b9533606745b289fe76a1ef629bb212ffa0415ac699a93eed38d
SHA512 b6603be0e3dd175fa49e54ebf7ccd8e3423db3ad3e0db75662eb0efb1f98751a1c2a4949cfb9973207ac8d346b8ecdba0fe800da1640bbb3befa9f3604842f4e

/data/user/0/com.tss.cityexpress/files/cfg/a/CustomIndex

MD5 bcb5c2ce67f97602aa8bf6d796fb8dc9
SHA1 9ff1df44c05ff5602c75fb178be2a07cd8085fd6
SHA256 6b1f56ff21aa70c5f60eaaf0a51b289eb020fa28309368c4da821a53b7358194
SHA512 0b1399d8523cf38f6df8e7b0f7f6df56410bc51c757f6e72757b784083d9e73023b1ed9b636082c90fe406f9d1d8a91d80971aab35ae9b678e2310f14c5f0c79

/data/user/0/com.tss.cityexpress/files/cfg/a/ResPack.rs

MD5 486e5106aa2801b1cf7d2d811032d991
SHA1 dd4db9dd7e63a84ad394b00633322c58ccada368
SHA256 dad4ee83567b58ef6dc70d10a2950d490456d50378d65af3c88a693166431170
SHA512 5c0f7fa50dc937bf67a2e017635709bcd0667a8a19f70093b9c8d639cb4bf51269e75bd64a19367d0dcdd3b52360cef02a0f49956a2f4c0e716038eeb46e1307

/data/user/0/com.tss.cityexpress/files/cfg/h/DVHotcity.cfg

MD5 c48b8a3018f1886792cb487bc232c159
SHA1 7281a61ab24d416057dca5c4ccba27f08de0a64f
SHA256 f6672bc8e132ba5903971a9a39846a06ca918203d80c948cd46ec39719655ef4
SHA512 68694fb8331dc724e3715c4e4952c60dfa2a9620d1d440557db7cfe6553b514f88ab11d28c455d75688c558e015208446a0e0ad415dd2cf19ae1ed859a4d38d7

/data/user/0/com.tss.cityexpress/files/cfg/l/DVHotcity.cfg

MD5 11ed43e96f09a823eb14788bf3caa090
SHA1 8e29e6ef80cd77c0540b429532c49b24bea8cb9c
SHA256 8f871252718e80ce8ce25f36bd390f813cf6798035e18da2a385369a747aa41b
SHA512 bc7af1e6da3d69bcf86db46749a99a410d40c7ede77d1fd37c7afc12b067ede9659d89ed356b27ae877cea45ec7b93dfd46d618c358bdf7219d91e55e2364891

/data/user/0/com.tss.cityexpress/files/cfg/h/DVHotMap.cfg

MD5 0994d3e9eae65e7f6f483e34dbf0aa60
SHA1 45be886bd35743fa0f79ebab8502df2dde412e85
SHA256 1918ce881b260c6086bf6f347e702b72ada55a0248df59042c548e846a4d951e
SHA512 b6bf7cabb306ac97aaca0bbc0c3b552af1655fce44cfbf43144015d60774123453f3167dd58a940139159793b43e18fe0eaea7ff3ac3b73380da337a5f1f7627

/data/user/0/com.tss.cityexpress/files/cfg/l/DVHotMap.cfg

MD5 3f44ca873593ee15b867334e0fae3c9c
SHA1 5571e2f35ec8204cbe35d975d9f611533380a99b
SHA256 43415b419e6349c5ce4f4f35bc884ccb2548c0a33ecfbb73d62b5d9149cf0e95
SHA512 9e7f6bbc907e79e636074652cb353dfec9c9fd981e5813b6d586d8a5fbbf88d5182cb0cef37eb93428ad3a7748a7d0679e879e8db81bdc2c39afc9e752cfc937

/data/data/com.tss.cityexpress/databases/cc/cc.db-journal

MD5 a4724a17d685fcbb8ceed2d462704a78
SHA1 881777f9dcf3dd72975ec8fed02cee682a65573d
SHA256 7fd08f4b54dab49cd7fa3fe5b04b6b80a2a2c621ced017dc663d4e207cfc5c6d
SHA512 f47d7df70e20edc054a7f854d07a0f8c6fb0975c2cc1dae329143e6208e5f3f3bbddc5555c0bb21ceece3ba6bd2a4a86bdeb5dcaefdfd97754bf21578db64299

/data/user/0/com.tss.cityexpress/files/cfg/l/DVDirectory.cfg

MD5 1107c2249c958b6d8ea65fb5584fc123
SHA1 30b1ac251159756a41ef1c13b0eb48487bb4eb20
SHA256 9889f14eec0d798ced2b8c7a1dba11bcf5f12fb04b5b5116775439038b34e4ac
SHA512 fd00cfb78c0871fbf4e253ca7133365578b6abebd4edc43a5988f62fa7c5e1725986856dd0638dfdc0d6769c6edded483d147bd19a6f3e81d950c9b16356a421

/data/data/com.tss.cityexpress/databases/cc/cc.db

MD5 86752a4be6564d8370f2f0e403995003
SHA1 29f7d50675f6e59f3b808eb6dcc8619384412115
SHA256 50484dcdc6b9c2801773018386a8143a52a5153eb2eeeaf5be8bbe46a49ca90c
SHA512 79c9435c1e0d41a3f97784be3e5a3cd8c0bd2d32ecdf326808bacb00c76d876d0447617d6e72ef04cd4b996c92eda4eb7bb200987ae7928ce2e0e7c8e807a5ec

/data/user/0/com.tss.cityexpress/files/cfg/l/DVVersion.cfg

MD5 d54b7b380a5ff46c78283013a07d8e0f
SHA1 f697c5f7028ba2679a96d6bc5291c38ff96d7982
SHA256 c7ad837b097687d92e0d944815fc70adcb0e1cdc82db28f728d13e8a48d7532c
SHA512 ade792589c33179c51305f201bfb6db28c05b2ea098d12bfefc1a5cf9bd3014d53830ce2e71f027719ee1b83b2394c7654b5ddf4fdc7f678840869d2a2787ef4

/data/user/0/com.tss.cityexpress/files/cfg/h/DVVersion.cfg

MD5 2460985dbbaab6f2d879a8480cef78fb
SHA1 4354a107d47974f99797c8a7e1a7ab67a62cb876
SHA256 b37020c2a212b314ff2eb779d3a04a9b450dad770c6e60a34a25885da43ecdcd
SHA512 986ca7c1f517a001bb0b8ee589ebe4d7356faf01ef552fd4605fe9ab57cafc097eb8d6af430dac673159bd06d92cb3b909ed8d898999c9d6102f097db6edeaaf

/data/data/com.tss.cityexpress/databases/cc/cc.db-journal

MD5 8f611f476b2effba4b3bd5fbb3aec64a
SHA1 2bfb3f95f706b206f1e893d365a563a54f3b65ab
SHA256 94ab1ef0e5dfe1814100c5354f4a4604c4bd60c75ee8bce5cb24e167d3291470
SHA512 64601ae3126b57d6b44277d8d8e2bdf52c06496f293d5ee2e698a84c27b8bc4a1bb591a8403d25e3163d0a5b69b89f7531a4bb376a7c63cf3c677af827899f83

/data/user/0/com.tss.cityexpress/files/cfg/a/mapstyle.sty

MD5 0d0e5cb56bb2bec1b4f455b6a6ae5604
SHA1 3cbd9c27d9fe4420d930935c538db22305685227
SHA256 3edbba809c33b07612382fe92d102d1936815ac78786fac900d0283b3631672b
SHA512 54c92dc8b02ce20b6645a6d55d8a8c45b88424fc69b13ba97d903dba1f08551bc99f9fe0dd1c24dcf1447ec5d415bb8cacf2b122222c0306a308eb342f3fa0fa

/data/user/0/com.tss.cityexpress/files/cfg/a/satellitestyle.sty

MD5 256d4695ded7acc2e1f8cd37f457d0e2
SHA1 e6577b8380098c8b72ebc045d358060431909620
SHA256 71174e8a886da0631e586824e2bb3aafd944768427508c548577a156a9bf778f
SHA512 5c90ae90d6cf490c87bde3f6384239ee38ddcc2fb572b3acf97d38f35ae68ebd6b3c4a92df34d09346f116944b1dc1694ee3e48bea25c19bbc11e806c5ef8f3c

/data/user/0/com.tss.cityexpress/files/cfg/a/trafficstyle.sty

MD5 831c0530133dcc6511bf3d9e15d44505
SHA1 b608f72729bf14b2397b06a54b933229c454b38a
SHA256 15a5813a7868f81ebf58cfd76b93e4f40d139bfa46f93112f247f3ed25deb161
SHA512 ec4120830d2737e3f97fdc0e894e3534ccaa84edb2af7709cdb8070439ff63e4130ac000daab3fadfb95cfebe123d5c7a7929a8e5313b67cf7baabff911c5f15

/data/user/0/com.tss.cityexpress/files/cfg/a/CustomIndex

MD5 bd67f62f96b2f9a4321410c964299e1e
SHA1 566888207a9e271ab279acdd23b33ba89fbfb796
SHA256 49972b7d8f0851f8ceaa987aee4e5d8d4da0cf05f8aadce3ee1e33b01d15bd57
SHA512 ab7b584dedfff1ce3e09e1c80fdccb07e3afe7cf2e2925aee937296d04ee154c556c067e1afec372e8724d050020e266ed066ef1e9b126ea373f1d9d306d52a8

/data/data/com.tss.cityexpress/databases/cc/cc.db-journal

MD5 c31e446a5c8dc2a65099c8c7482a8d58
SHA1 d097ff6a173a8e5d8670f09ae3f12545a8fda1e9
SHA256 79eab29c1c55b1e0f154e063a06a341c47828bbe8ba73a6b14293597eca52c02
SHA512 4909683268121aa11928edea6eb111639e227e3a8b963148728257ff1dc2746c9e91235f3a03e26637bef28ae6a051f9117f4d35a14bd25ef4bd944d41e964dc

/storage/emulated/0/Android/data/com.tss.cityexpress/files/BaiduMapSDKNew/cache/tmp/DTTempdat.dat (deleted)

MD5 ce4aff7e3387698102a44e6fe50ca06a
SHA1 2e899e6a83f64d9fc871b60524ce43006c2c08f0
SHA256 708f1e85a600e14ec36e9152e38d86728680e6f8e396018d95a190b662498a27
SHA512 37d4883182c1abd7236bb9d6861029618431364e34d7eb2067d9f652deb5b7bed0d3155081f27bd94508a3998f42bc00577e169ba52447203e69500966791edf

/storage/emulated/0/Android/data/com.tss.cityexpress/files/BaiduMapSDKNew/cache/tmp/DTTempdat.idx (deleted)

MD5 9821fa9bf06a0d5162dcaa8b76421dcc
SHA1 921532f0899bceb3d4573c6c1af5c5781f182db4
SHA256 d6441b5f22170d11a2cb15c2b58ab912734740ff3c083e6ebfd83914ea2ca6a7
SHA512 54f2fd30be645b1ab1b4ef3a4cf052642ccfb6f7ca461f8f97ad7a6d674f609e2fe3e815b00e2cbf421fd2123eda59faad451767d8e8479fa54d7f8d59ca9664

/storage/emulated/0/Android/data/com.tss.cityexpress/files/BaiduMapSDKNew/cache/tmp/HMTempdat.dat (deleted)

MD5 a135d8083cc8986e59fd0c33db069059
SHA1 f950d4aafa0863cad2490923f5840a193772b139
SHA256 f153b34b526593ee49744f8528b9b49e95bd8857ea123222e6b5907e213e5d5a
SHA512 135c5ca7c8ccbb0c08af0554c9063fbc9161a042ba4717f0f83ba4bc9794520a3eeec64efe3e94397378cb0bf7170dcea4990c0b5a3da07c3535e3281ca277b1

/storage/emulated/0/Android/data/com.tss.cityexpress/files/BaiduMapSDKNew/cache/tmp/ITTempdat.dat (deleted)

MD5 6e4165d590cb8f5e934ba317c8e07000
SHA1 d433b1c0bc77146414ad94fb12fc39cbe6a609eb
SHA256 00b865139970e945b1c9390ef93281f8e6c3650da83fd70a7e43aea0f970a05c
SHA512 abeb12dba014466d4629973c65dfb2fbff32cba67600068338dd7902466a342fc053aa008321f8b01fe0c33b218bbf8a1240afefc51b23e4d0e58d43e6b89882

/data/user/0/com.tss.cityexpress/app_sslcache/api.tuisong.baidu.com.443

MD5 899bde7ca99b2074754e66527891e2cf
SHA1 9867173605ebf7d7080c4ad59cca74a548b58143
SHA256 62185e7dd2baa623d3d1ad7a6d1533153cdb9e1e09a69b4014f0449bf8de3753
SHA512 1d6fea0b313003ed58c72b85f16368209e10cef4fb9caab446f464aeadc44bc77a7db9c289142b8f48c95d1776a69063e2d4c6ae571dfc11a643e841fea6ba94

/data/user/0/com.tss.cityexpress/databases/pushstat_5.0.0.db-journal

MD5 7e00b9c32eeda6864891d7a43a0b5f87
SHA1 c5b73be724e1024aca32662914afbe1f31db1dbe
SHA256 0ffb7d3ab7950fcd110c117d5f1c25eadf99ace4943028da23e684ac32228e42
SHA512 888d7132bbeda4edaa6e3ed5c4766f0b64d171f2220ab8ca04a760e9448724aaea87cddc7f32b8e4def1ecefac51b7f708015b4e7af6204d20aa18e35884d919

/data/user/0/com.tss.cityexpress/databases/pushstat_5.0.0.db

MD5 5dda5f492bf65e4b9a869d9e63c54c5e
SHA1 b1a44841c36ba4244908c51d5325c387ca73cdec
SHA256 71adcd2433f48ed08d48643373f7a8f23b98e710f11510d1abd7938374743c50
SHA512 0a5ed94181d17e47a2f5e5e74d18bd969d39c0d649bf6536e0cb4574d0005322853d0895049f12653edf274b663c9e9fac7e690a96462ac5debbc6e075e74735

/data/user/0/com.tss.cityexpress/databases/pushstat_5.0.0.db-journal

MD5 729ac19b33405889eea4384af563736d
SHA1 7539e54d84fbbe08583971fb387a8a9063626e86
SHA256 e90f9330bdca1c387b4e29840be00ff5c423a431682c6ed5d66722493c980e69
SHA512 d2af9d855114e621fee0bff2f536b2b8b418c683e8a31a2def6c9c54f34a03da6eeb0cfeb91c985bf3d2dfe4e2616721f1eccdaf757ade773924ada2157d7c14

/data/user/0/com.tss.cityexpress/databases/pushstat_5.0.0.db-journal

MD5 e7dd0fae46b37095c78171fec880ab19
SHA1 6de745837d8bd88df9d4d316436685e95f4f0e84
SHA256 3ba9c037bf8ec485eb444b1129879535a992edd492899cb1d93da59be29ba8a0
SHA512 e34e926d14d68a5c500653720f0412e9a1d9271249e2b460cee381c71ef65fe03daca56668655e6cdfdced1c940ba9315e4890d7526771aeca12a65d797f78f8

/data/user/0/com.tss.cityexpress/databases/pushstat_5.0.0.db-journal

MD5 5ce7e6b7a3db9ea50d89f1b620ba65e1
SHA1 9cb226f5fa5c897690d112a9845d25e81d964569
SHA256 57b759dac9dfdc79fd7be5a35a79e13dd0827fb536d68c45917fb94dc5cbc024
SHA512 3fbe97c8a0183fcb09ee2545f887472f77d496a2ee58ac32207161a93f2576f4ac4436fb107224f1a9a204497e6c45eced0249694278e071e847d485fa3b617d

/data/user/0/com.tss.cityexpress/databases/pushstat_5.0.0.db-journal

MD5 90d39b7c49186c307a8575593dc57656
SHA1 bac7d3f324817f7a5221098558201a39ebbb9788
SHA256 f26eaf4206e2124541f651135e7756c9d2ae0facd7729e8c42a5bbb66ee82848
SHA512 95718700d6ee659f49b3d148da411e79c5e3496439b2fa376c00416ef80cc7924868cd77d1d3b49eaf3cb3d2c9d67d7ecc362e8d0cd271bfaa6620f255029e14

/data/user/0/com.tss.cityexpress/databases/pushstat_5.0.0.db

MD5 fd8f6fe70c059346cd27b6742b2f204c
SHA1 af9b67e435c4f13386d0f92a639b4ca10469f051
SHA256 2c485a416290e7e395cad710d5033c2bc858bd14fdddbef851cfefe2d16ac702
SHA512 77306eb10df69df88ae7b3588e616343afb8a54f08b2e342e4dc3e10fbc831db3db3d9183c25bb35db670c354d2ca4648cc4a6ea7e69eaf00793f9323b3032b9

/storage/emulated/0/baidu/tempdata/ls.db-journal

MD5 d696d7906d2fd59a9e3ed344d47b116d
SHA1 7af78d489e2f633f10f77bc3bfd4906d06b3c63f
SHA256 a4f53e195dcee3471b2123d3345f132583511af0dec3d5eda106cb2808bc295e
SHA512 7dc2e210bc31aadbfe4c84bcd4627dcddcf795f057c37916aa9ead509f7360d733b417519e221440d74754d356ed4a9cde6f850fceac6014747154622b61dd60

/data/user/0/com.tss.cityexpress/files/cfg/l/DVOperation.cfg_seg

MD5 2607f6aee3282d74326dc6c558a45f49
SHA1 9226fa427fd56118fda48dce006321f0e3bec548
SHA256 e872b7fe6f9c425e45a5f9d3fb9709b30c9241816a4f3699efa25de963e3eaf9
SHA512 c7e71bffd3e57e02b91ca04b143449fd5ae8812f3321995429c2d021f8aacde9afd2444eba8d3e62491d2229d5d1f7950ffaded51beb76fe3fd90cd82ef7de47

/data/user/0/com.tss.cityexpress/files/ofld/ofl.config

MD5 e2854b7628f7a27b86650a9b20a838e0
SHA1 9c5268782ee77dfbb3226aa8adf7a9907402a9de
SHA256 b06330116403a84cfce0b0db3b59ceba5f1a3ec444a1cec2acbc00c370b4c2c8
SHA512 35b07a1cd5fb5fb36d701d04c532cd4df367f7003243ad1d7c15015178a8adc9225eed764101c4b1611f56b3c4e6014f3b337df1414f8d126d35774d914823dc

/storage/emulated/0/Android/data/com.tss.cityexpress/files/baidu/tempdata/conlts.dat

MD5 8d80bc8ea90e9cac010d3ddf97bda5f5
SHA1 f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07
SHA256 f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93
SHA512 9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7

/storage/emulated/0/Android/data/com.tss.cityexpress/files/baidu/tempdata/llg.dat

MD5 dc99cf74d8649707d487fb185147d666
SHA1 1b91a4eeee127057a94b6f92698c2a3d6c222210
SHA256 9d2c78e3200e396fc438ab93702114bd78dd263dc5be7113d5f7348e3633d036
SHA512 549666006a58c28bae8e5c6c4dda3d266dd6541f897ac69105ebb29a1cb112ab0661811e8a18685715640f2c09e8af1534d5916ddc403a03f72e9f4a654cb02c

/data/data/com.tss.cityexpress/databases/cc/cc.db

MD5 c71e6522a30d079ed725b55811204124
SHA1 5224ad86361eb2d77f39e85098845f743021c4ef
SHA256 823018ad296642290b56d0aaa76345148c57fd9d4bba425eb1f899715681715b
SHA512 66857ce4c21b2639a2d23b31f9e38aebd566b251b56e0f7d578006d4412f9cfc5eeb5e01c5ed99f3c23c65e15f68ce84f7e7e547294701f28ac9882c39a57039

/storage/emulated/0/Android/data/com.tss.cityexpress/files/baidu/tempdata/yoh.dat

MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

/storage/emulated/0/Android/data/com.tss.cityexpress/files/baidu/tempdata/yom.dat

MD5 a936690571e9104e1922dda4a0ba5bd1
SHA1 65f49c57edde2f96be2a1dbdfc3f7351f1e66554
SHA256 f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412
SHA512 3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 08:15

Reported

2024-06-03 08:19

Platform

android-x86-arm-20240514-en

Max time kernel

141s

Max time network

178s

Command Line

com.tss.cityexpress

Signatures

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Reads information about phone network operator.

discovery

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.tss.cityexpress

com.tss.cityexpress:bdservice_v1

com.tss.cityexpress:remote

Network

Country Destination Domain Proto
GB 142.250.200.42:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 www.google.com udp
GB 142.250.200.36:443 www.google.com tcp
US 1.1.1.1:53 api.map.baidu.com udp
HK 103.235.46.245:443 api.map.baidu.com tcp
US 1.1.1.1:53 rs.easemob.com udp
GB 193.118.32.52:80 rs.easemob.com tcp
US 1.1.1.1:53 a1-v2.easemob.com udp
CN 47.95.246.247:80 a1-v2.easemob.com tcp
US 1.1.1.1:53 alog.umeng.com udp
US 1.1.1.1:53 api.tuisong.baidu.com udp
HK 103.235.47.247:443 api.tuisong.baidu.com tcp
SG 47.246.109.108:80 alog.umeng.com tcp
US 1.1.1.1:53 v2.1h100.com udp
HK 103.235.47.247:80 api.tuisong.baidu.com tcp
US 1.1.1.1:53 vector0.map.bdimg.com udp
HK 103.235.46.245:443 api.map.baidu.com tcp
SG 45.113.192.94:80 vector0.map.bdimg.com tcp
SG 45.113.192.94:80 vector0.map.bdimg.com tcp
US 1.1.1.1:53 sa8.tuisong.baidu.com udp
CN 111.206.208.123:5287 sa8.tuisong.baidu.com tcp
US 1.1.1.1:53 newvector.map.baidu.com udp
CN 14.215.182.52:80 newvector.map.baidu.com tcp
CN 14.215.182.52:80 newvector.map.baidu.com tcp
HK 103.235.46.245:443 api.map.baidu.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 loc.map.baidu.com udp
HK 103.235.47.89:80 loc.map.baidu.com tcp
HK 103.235.47.89:80 loc.map.baidu.com tcp
US 1.1.1.1:53 dns.map.baidu.com udp
HK 103.235.47.89:80 loc.map.baidu.com tcp
CN 182.61.62.50:80 dns.map.baidu.com tcp
HK 103.235.46.245:80 api.map.baidu.com tcp
HK 103.235.46.245:80 api.map.baidu.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
GB 142.250.187.202:443 semanticlocation-pa.googleapis.com tcp
CN 182.61.62.50:80 dns.map.baidu.com tcp
GB 172.217.169.66:443 tcp
GB 142.250.179.238:443 tcp
CN 182.61.62.50:80 dns.map.baidu.com tcp
GB 142.250.200.42:443 semanticlocation-pa.googleapis.com tcp
US 1.1.1.1:53 www.baidu.com udp
US 1.1.1.1:53 sa.tuisong.baidu.com udp
US 1.1.1.1:53 tcp
CN 111.206.208.123:80 sa8.tuisong.baidu.com tcp

Files

/storage/emulated/0/baidu/.cuid

MD5 629b1e3225d53a34c8b17478780254bb
SHA1 46cb87c06d891747ec9dcaba1ce1681f66ed5d6f
SHA256 0fdf7e4b6e369ea447751ea610f8bfbc8e7a5554e90bd3042adf5a92da1d6901
SHA512 1775bc92a68837c52dc7b3f2bce3e55d69636d313b98825353486f6c53b8797c3d5502b0259e029cba731957df400166522d9d34f4a6fd1992471616017780d5

/storage/emulated/0/Android/data/com.tss.cityexpress/yuntong-express#yuntong/core_log/easemob.log

MD5 49b9fe728b5282f9ef5858a9439cdc15
SHA1 cc30ebc523d96d00fd6370d730cb4a39c08b6d73
SHA256 698726934b65fa5f7c6ab9a5787f9a2fa9c467a2a3dff4e47e96e0b889114818
SHA512 2101a2e0a3dca2f86f5aa53ea50e4b8789463f112293574a8d0a27837d4d660eb9cabb05db33ae8a8f47f6cdbede63062a3dbf47910e8f874f9b876790197262

/data/data/com.tss.cityexpress/cache/com.parse/applicationId

MD5 0d3e99204c6401ea499fe9e6d9855497
SHA1 09829f00ca458eab7374d5079393a2cd69a2348a
SHA256 63ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca
SHA512 8d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68

/data/data/com.tss.cityexpress/databases/ParseOfflineStore-journal

MD5 c33e0532a4d13d6e4975c2ddc76e6e4f
SHA1 09ef643ecb4b2a035bb3bb40bd9aeb319c4c8e46
SHA256 5a091cbb7b16c0fc7f158f7f73739e4341dada3151c2ab2da3c1793cc9a4ed97
SHA512 cace3f4341676885f130fa0a524e808029ef5e28966fb0d14f70eccd21e4dad14b9e02ed495367f14e5151b252591925254ba10ec8305f92cb05c2a0aa72f8f5

/data/data/com.tss.cityexpress/databases/ParseOfflineStore

MD5 0bb4e8bb4361acec5eb827508ccd15bf
SHA1 35be515d19d6ca3059c046ad9ed4ac5a3ad47c5e
SHA256 55b45f2ce6f98ca90b9b1a7226f2acd77f43e238ba42e2258225010ca2ba69a0
SHA512 0de5752f98689a0188a68b32cdbfd0f2a5fd9a8e9d646de4a05693560f332c1412dfabf7020468ae19be0f2d71c33a0275a252a5a2d4b69634e35c33e5935783

/data/data/com.tss.cityexpress/databases/ParseOfflineStore-shm

MD5 340ad20277c1c396c18d1c34e7e15c0b
SHA1 86eea9f6437b4b36252946dc728d6092e3a19c14
SHA256 77953233fdba334fcfe20c53aa03df901925a4104c1434d9e4b4dd7f1f48e8fb
SHA512 a83e1bc3f37bd96c1990ff1a5bd7e06f34e4a1d4cac9242a1560d817e6768f0b22b567686e93420fe0d645660d44218f32e9d6d26d5788607036c799a5caae71

/data/data/com.tss.cityexpress/databases/ParseOfflineStore-wal

MD5 695e4b061e6223b289719a74b1296771
SHA1 5f6e013234b78b45b71085e143849702389816b5
SHA256 37fe41b154af9ba7fe62e376b51cb4f15b0a570e859e7d1ad7be097235d7c271
SHA512 aa980df0cf69f0334e761f2079c68fd32ac8639f5a7f6b9c6c83417b74bf4803f2eaa14d24cc830c076ce97a4a3198878e2ab061b23b520f852841c867c63a97

/data/data/com.tss.cityexpress/files/config.json

MD5 0ab516b8968ac64637f72a0caf829ff8
SHA1 a57d63946b60317fe220ce5b936272414bfb36e0
SHA256 de7f752bbfb6de23dd4ce154ff96229759f09a6a169a9145091cd952ff54975a
SHA512 df2c159d73dbe7d66b3f5321b5a0c3941504ffa30af6ff80d929ea62acc43d82aec888ea4a690421dcc9ac56d4e7ea004b7bb2c359109f17ca293951a78ae091

/data/data/com.tss.cityexpress/databases/cc/cc.db-journal

MD5 a76c77f31a37a9f7e351a339ccb8a659
SHA1 26c9206da3d5c3dd06dee842647b144a83058a8a
SHA256 40e3c92b59dc604ac5849b1f810d1d61bdc7fee422e5c4c059595a4e29e22549
SHA512 382f44488230d528f291787dfb3b0473d8804030b0edc98213601979ff57157b9ff5888c1a5f5fe0bee6197aa46919687f4a8aa3942291b1833ad3e456c828ef

/data/data/com.tss.cityexpress/databases/cc/cc.db

MD5 d422883e4047fbd3fc0c03fab6719b53
SHA1 b43b28d5c2f95374347a1f4923cb342ecf2ce2f7
SHA256 b416f5aa42a8aa5ff34bba8ca829b3146be1e5c10f8bc040be3e633ef28bd6ef
SHA512 15a6f413433f942c4e8c58ac7aea7ba1a64215c2f75a3d9e0610262d4ddb3ae75e2753321d442bfa177bf63c9b62e3b8a167d36d237e5237c154f669f44376f8

/data/data/com.tss.cityexpress/databases/cc/cc.db-shm

MD5 1c4274aa7a9a5cac8c6d1df71e4588c6
SHA1 abaecd685e01cc68801292e3dc7085654a22feba
SHA256 3f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be
SHA512 1adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c

/data/data/com.tss.cityexpress/databases/cc/cc.db-wal

MD5 0ad2c344e3019e433d9d724ad84f8d11
SHA1 30325d17b0d7c464d96718bc01201b4b69f275a5
SHA256 28d09d197a5369156e35567f1eb58afbf3aa4f86cf1f8a7f2d2c76acc55d07de
SHA512 3cc14dac48092791c93bd8005bf22d3c68cb5634a4f6c34502dbbfb55d69d452fac7a94d92e7d7e85bca45e8049691ee4a4c396374785e58ddc98363b8af2194

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 8c3d530b58edbed748b6ad49baac96f9
SHA1 ffadf22253a908add3bac2e5f67571323035903e
SHA256 15e983cde499c712fcc58d8b3a5bb0b9af6529fd48206a5c74a79aa0f5cf45c0
SHA512 2254dfb7a39b83daaa34f04c0b65c7d037a6a7d0a9c61719ad0813486b78d8e1a925201e3844875d9c91d0f1c55db6ff8a8fc75a73a52dc9ac4ef60848da69b5

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 09d4e84e204a74e7451ea3fa150c661f
SHA1 2038972c5dc2af6b150a41cd70271d1a19046172
SHA256 a77c8699dce61006cdb73bf29c5cf089fc766e5bce147e34ad23cf36b008f94d
SHA512 360ccc9c4de8aecc9e7b3966fb0da39837d4e5d3513ec9ce224f82fe986d63d2828b5c9e246a8784940e3a02f631477097660bb02c82796c707fe8748a0d76e7

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 e1918ca3f2493df61ce4fd78115144c9
SHA1 c038b24c7548e447724a39949079dacd6923e2d6
SHA256 7e907521b14a53daca540f4438a0d5a20a9bda9f668f343dd3951b5d3a9675d8
SHA512 82473d11661ab476151dffa7b705cfb033171e3172afc92cb722f5b5421d686a325d2bc7d3e8680578af15b9a2b759fa1803ee6ae282a015dea3e5b0e1175ccd

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 11ee11bbf0f71eed287923ea341ee660
SHA1 78063d74a970b0ef1f660d3da7cb62f34cb8f11a
SHA256 55fa13a77878caee3e94c0bb5717801c725960bbf74ce298c18ccb549e9f3df2
SHA512 58d7c0afe1191dd7ba273233d407729a3b66fb242b35d8d3e3a1cbb32ecd6fe74f27272576764a2d5eac592f1091b140c350d853722232a9faf1ad80fbb5f709

/data/data/com.tss.cityexpress/files/umeng_it.cache

MD5 22f8cd1da36eba3d1ab20023cd0debeb
SHA1 b564b682462713aabf98b86d64636fa7ce17d7f5
SHA256 fd69c69bd586bae77f52878f18de51dfb656a15d07d808efa2a3c6192cfe57d8
SHA512 5ae537e571de4133e374915b9f0f7cefb069a5013ec0bdc069dc363b51c0a2be4e5cb51fc14242828fbdcc7772081556af47e9e9cac79848d77378c48de2e4c1

/data/data/com.tss.cityexpress/files/.umeng/exchangeIdentity.json

MD5 6a581739c4fac8bbcc4006bae27c1691
SHA1 986a6efd1ac6a065a1c371b5d6de78339863a0df
SHA256 36e89ef0391e44c4f9d67b0269f79e44bc4e61889d7ceac9168f5e9abe4ca714
SHA512 4075a6dbd9cacab7703fe5676671e82218bbf38d95e6fe95e7a1559e9a9af5a2af2bec5861edf655dcbf8dd3c601dba5041c98816bad79353f463db16c00d806

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 39d432b7d9bd622633aff48f8e60532e
SHA1 29191bd2d694146fda3f741afabde315a1fc51cd
SHA256 056a0702a4a8d3a97c5643929ef1745d6944289a90aa58d8e97ae923e5129183
SHA512 7033c50f70312b1f70a9c669d105327440b3bea49253e3a7716082feaf9f8aac3df73532bf689a4a60be12efc5840992f61950b47d64a91e5a7812e9970ab99c

/data/data/com.tss.cityexpress/databases/cc/cc.db-wal

MD5 f78841046c9c96e3ac630e2ba0d11432
SHA1 efac74ec72ff4e4a0480344e4a20b4841c4e51b1
SHA256 c9cccedf74f6bb900d5cbc85fed036870b127bf426ba0d213f8ccb8181bba6e7
SHA512 fa6d599c93826bdd3b5788762afb5e8ed80eac659735285466ca265ebf88f3abd8f5eedb0c3e0bf7bc45b1a803ab508b111c8a854c3be345aa1be6288be114c7

/data/data/com.tss.cityexpress/databases/cc/cc.db

MD5 78a953c8e7c4a4bf4e78ced4b49d5e43
SHA1 a3f29f28ca09be29aacd66de9480c1b60ef57081
SHA256 30d7b5f17e83964522192a187a4f70f4a288556cfac75c0aac193d44a773ca1d
SHA512 37d631b7d55e5ac17deac1b81783432a63de3fc49f71027e2e966135f0497bec178f95ea79ef37c8b93564cf0b73d04a8f76ff169f5084bf1d57da98483a2960

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 1cefd5c18f719cb6b6cb33bec1445b3b
SHA1 19e7580f0a16ef0a22643918a9876bc330615bcb
SHA256 f2cd75fcd7a6474d6cd9dcc3a4154c75080b60cfd9ac5e5f4d3ddf84d7396300
SHA512 85cc5ab65beef6bd5719c68fbc9d021b3d9bd8b081cbe2f5a59462f8e3fcad517e66521897294c218c4a9422cca2d15a76d86689b0d87fff87d08c017b233b58

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 01895fd8de5fef5810c4e9428c2985fc
SHA1 314a97d924d3cd94b615e9dddffd77cb0e1959fd
SHA256 2908c6e2cdb25c8583a21e83ac404faff1349e5e3587bf82dbc233de29684905
SHA512 1978a48f9b33d2abfc8b152701927e71d5d7b19c03869a16e413ce3626114ff394afd7ab925a109bad6de8115435623a68e63dfd3895c94ad4efe06f618087e0

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 fd6854f227d987f839164ece971f44d6
SHA1 9be81d3075a568ead48f39b8930edb985ee3dfbe
SHA256 efac2c0e5c2ac980119af2aabfb43ad962302008cfe60b1e273d671be287fd5d
SHA512 085c6783f44baa9558d5b6a5991ea881ed7cb8fd3bad67eb4e58a6443c693647d342f8d1f8a6eaac7fdf8d9eba798b100e9947265de1e890c974ddac5cb8ee69

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 c04cb7766d7491ee1e91d74327397fbf
SHA1 cf25c929018d0d4ab99e5e8a8e9a9fd8c8fd2137
SHA256 028e9a3f0e2c961ad4852b219e4a4810f00b50bf5934c1d68a9b8e3765d0494c
SHA512 12ae06b7917bb550844d117c3f7f6c341e98cc9375d0a6afc9497ea42e3cbfe74fd1a9a934c66a520d45ea76cbe64d43bf0d8258c259cbef2809ebb084f2c9b2

/storage/emulated/0/baidu/pushservice/files/msg20240603.log

MD5 34adfbd3bd3d8a8e2a9d20160842b386
SHA1 483e91e1f6a1a40e5ba57dbd7529e532b69b8bd5
SHA256 4096b1d56ff2ac0ce6d944189d7cfd7b6f2c166e181e56a026df70c046c0a0dd
SHA512 f1334d1da8d0d14c581a992f33d1904653d6b192aff8b3e130b7126d2c67c73c79ec6f7505ca7a472bea95578cb721336863346a4c9813ca2810296986cfcf86

/data/data/com.tss.cityexpress/files/libcuid.so

MD5 2f9a876a9310be401751a4581102bfa6
SHA1 ad8ff92c5c8a88e2866d4abadb57aece37751990
SHA256 e4126c2f26a6ebbcd6d0f25001b7b37ac678fa6990b146453cbad9c2d6642b5d
SHA512 978658ec1919f4052875bebc4f3cd81a4059d50fbbe535fcf9cb6204103e0438fb7d1df96ed11b4b482e9c690d645a17dc6ec85f802ac9b02e17e417ac4731ca

/storage/emulated/0/backups/.SystemConfig/.cuid2

MD5 0cb640f41f49b6dcf0021d7419229873
SHA1 0ec732e08a1680a50af70f6ced31bc43668cfab3
SHA256 98427dffc147b215d2ad41ce0cfa4f2c5711f623950a21c037c713578ae699fd
SHA512 cb048fc16bef0221b304db8c15473965c02b5b3e39c4be1d0ae9f0a65c7418395b470023a352d8578ac9bbb99adec8688aa883d06cb8bb2f5b47efbf06d76745

/storage/emulated/0/backups/.SystemConfig/.cuid

MD5 c2414f4d837345eb8789834929660fab
SHA1 b4e87f0f38bb8fe118bc69996b2848ce0a60d87c
SHA256 a5a2e2d90e56ab4460a458897c4f75c6ee482e5d55463e7408efedb3ac7f8ee1
SHA512 c39907d0a8d26a0c91b73851883115c3e2fe5b58161848e3ec9f17b4f2353af8149dc2535680178ef01cdd20307636215868e01e2480cc1dccd4e6d57234fa49

/data/data/com.tss.cityexpress/files/ver.dat

MD5 f302a064db74a0a900b71518595a48ff
SHA1 8b84f3fd1ce1031a7a28dd117fe9622f3459538f
SHA256 fa60209e3a9bec767668374d985ce8b4626da26b851452fd38e900b94bfaa284
SHA512 8286c5b07ab07b239e82f2001faf3a3312f50a2f9b3d7f2734eb3a222323f16aab3a0c3382803c168eed93ff4c023520e201a9ececf215dc22a2e16f4c234270

/data/data/com.tss.cityexpress/files/cfg/a/CustomIndex

MD5 7d8ad27d080edc7a3a4d1efebf18109c
SHA1 6713d58662aaa87a248a488c18f161adb419f970
SHA256 446878ab4448f06a16af9c23bb48af9ce21f53815924b9af76ca57a556f86ffb
SHA512 2e8ce294a87ed4f6da76d2c3abd8f2704fd3de9268f011f160b058eee782f21d157da5c360dbb1e3a776559b182e37cf6f0dd396e48b63ae82e7ebd9fa54ff4a

/data/data/com.tss.cityexpress/files/cfg/a/ResPack.rs

MD5 ff856e8bea094eed62fa71fa35adffc4
SHA1 e7e4df134cdf63f1657f4cc6d2d8c9f17bbc682f
SHA256 6783ad6236962a9f17a685bc9f3efbb858c707bca9ed0b6575e6ed3067ec93ad
SHA512 d95218b37b60c3a269ad0545367d5465cc6b33424845826c4cc9dbd26722e7251a4d7c93dffbc61e0918781bc70508b31b7f12024bf02930b82f16337388792d

/data/data/com.tss.cityexpress/files/cfg/h/DVHotcity.cfg

MD5 11ed43e96f09a823eb14788bf3caa090
SHA1 8e29e6ef80cd77c0540b429532c49b24bea8cb9c
SHA256 8f871252718e80ce8ce25f36bd390f813cf6798035e18da2a385369a747aa41b
SHA512 bc7af1e6da3d69bcf86db46749a99a410d40c7ede77d1fd37c7afc12b067ede9659d89ed356b27ae877cea45ec7b93dfd46d618c358bdf7219d91e55e2364891

/data/data/com.tss.cityexpress/files/cfg/h/DVHotMap.cfg

MD5 c16f5ca1517683c46e02a6b71aab3c00
SHA1 2d09a048d1b8d556d89d4d723947e9e234b5e59b
SHA256 13d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9
SHA512 a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b

/data/data/com.tss.cityexpress/files/cfg/l/DVHotMap.cfg

MD5 cc3fad9057e0940ad4d4c7ad27922023
SHA1 403cbbcd7b819733b5caf49ed2a58d654441e99d
SHA256 f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864
SHA512 ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

/data/data/com.tss.cityexpress/files/cfg/l/DVDirectory.cfg

MD5 1107c2249c958b6d8ea65fb5584fc123
SHA1 30b1ac251159756a41ef1c13b0eb48487bb4eb20
SHA256 9889f14eec0d798ced2b8c7a1dba11bcf5f12fb04b5b5116775439038b34e4ac
SHA512 fd00cfb78c0871fbf4e253ca7133365578b6abebd4edc43a5988f62fa7c5e1725986856dd0638dfdc0d6769c6edded483d147bd19a6f3e81d950c9b16356a421

/data/data/com.tss.cityexpress/files/cfg/l/DVVersion.cfg

MD5 d54b7b380a5ff46c78283013a07d8e0f
SHA1 f697c5f7028ba2679a96d6bc5291c38ff96d7982
SHA256 c7ad837b097687d92e0d944815fc70adcb0e1cdc82db28f728d13e8a48d7532c
SHA512 ade792589c33179c51305f201bfb6db28c05b2ea098d12bfefc1a5cf9bd3014d53830ce2e71f027719ee1b83b2394c7654b5ddf4fdc7f678840869d2a2787ef4

/data/data/com.tss.cityexpress/files/cfg/h/DVVersion.cfg

MD5 2460985dbbaab6f2d879a8480cef78fb
SHA1 4354a107d47974f99797c8a7e1a7ab67a62cb876
SHA256 b37020c2a212b314ff2eb779d3a04a9b450dad770c6e60a34a25885da43ecdcd
SHA512 986ca7c1f517a001bb0b8ee589ebe4d7356faf01ef552fd4605fe9ab57cafc097eb8d6af430dac673159bd06d92cb3b909ed8d898999c9d6102f097db6edeaaf

/data/data/com.tss.cityexpress/files/cfg/a/mapstyle.sty

MD5 0d0e5cb56bb2bec1b4f455b6a6ae5604
SHA1 3cbd9c27d9fe4420d930935c538db22305685227
SHA256 3edbba809c33b07612382fe92d102d1936815ac78786fac900d0283b3631672b
SHA512 54c92dc8b02ce20b6645a6d55d8a8c45b88424fc69b13ba97d903dba1f08551bc99f9fe0dd1c24dcf1447ec5d415bb8cacf2b122222c0306a308eb342f3fa0fa

/data/data/com.tss.cityexpress/files/cfg/a/satellitestyle.sty

MD5 256d4695ded7acc2e1f8cd37f457d0e2
SHA1 e6577b8380098c8b72ebc045d358060431909620
SHA256 71174e8a886da0631e586824e2bb3aafd944768427508c548577a156a9bf778f
SHA512 5c90ae90d6cf490c87bde3f6384239ee38ddcc2fb572b3acf97d38f35ae68ebd6b3c4a92df34d09346f116944b1dc1694ee3e48bea25c19bbc11e806c5ef8f3c

/data/data/com.tss.cityexpress/files/cfg/a/trafficstyle.sty

MD5 831c0530133dcc6511bf3d9e15d44505
SHA1 b608f72729bf14b2397b06a54b933229c454b38a
SHA256 15a5813a7868f81ebf58cfd76b93e4f40d139bfa46f93112f247f3ed25deb161
SHA512 ec4120830d2737e3f97fdc0e894e3534ccaa84edb2af7709cdb8070439ff63e4130ac000daab3fadfb95cfebe123d5c7a7929a8e5313b67cf7baabff911c5f15

/data/data/com.tss.cityexpress/files/cfg/a/CustomIndex

MD5 bd67f62f96b2f9a4321410c964299e1e
SHA1 566888207a9e271ab279acdd23b33ba89fbfb796
SHA256 49972b7d8f0851f8ceaa987aee4e5d8d4da0cf05f8aadce3ee1e33b01d15bd57
SHA512 ab7b584dedfff1ce3e09e1c80fdccb07e3afe7cf2e2925aee937296d04ee154c556c067e1afec372e8724d050020e266ed066ef1e9b126ea373f1d9d306d52a8

/storage/emulated/0/Android/data/com.tss.cityexpress/files/BaiduMapSDKNew/cache/tmp/DTTempdat.dat

MD5 3ea263bd8b7c62446ccdb822ea14321e
SHA1 3f8c8c60b1f7f26c12665b4b24a21cbd308caf92
SHA256 cc984f684d65c0262704871888bc14233b46b4b0dd9b34c4242b97c1070ca925
SHA512 cd8c701e49e36d89bfa06cefea39f068acc67794448b3823c0fbef73eb9734dc1591a448e5684c65de96d4a2ae14f3cc4d22dc9d7330df7bb71d300304c4ba30

/storage/emulated/0/Android/data/com.tss.cityexpress/files/BaiduMapSDKNew/cache/tmp/DTTempdat.idx

MD5 9821fa9bf06a0d5162dcaa8b76421dcc
SHA1 921532f0899bceb3d4573c6c1af5c5781f182db4
SHA256 d6441b5f22170d11a2cb15c2b58ab912734740ff3c083e6ebfd83914ea2ca6a7
SHA512 54f2fd30be645b1ab1b4ef3a4cf052642ccfb6f7ca461f8f97ad7a6d674f609e2fe3e815b00e2cbf421fd2123eda59faad451767d8e8479fa54d7f8d59ca9664

/storage/emulated/0/Android/data/com.tss.cityexpress/files/BaiduMapSDKNew/cache/tmp/DTTempdat.idx

MD5 7dea362b3fac8e00956a4952a3d4f474
SHA1 05fe405753166f125559e7c9ac558654f107c7e9
SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
SHA512 1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

/storage/emulated/0/Android/data/com.tss.cityexpress/files/BaiduMapSDKNew/cache/tmp/HMTempdat.dat

MD5 eabe6bee6e08fb16c5ebe88cbf201629
SHA1 c192bb1ff70c073800f78cdb74629e438345425e
SHA256 ce338981ea2ce0f03ab4456273e26d70afdad00b9a5ee930753a34c4d1c4cfd3
SHA512 dc287ccc3c52600882a3f699efddea9cc8a8260b4b01091372a526cfc34f8a98bce241080c34b4df2576d83aebb323438a7d637cd132ab38cd9e268ebc53c264

/storage/emulated/0/Android/data/com.tss.cityexpress/files/BaiduMapSDKNew/cache/tmp/ITTempdat.dat

MD5 6e4165d590cb8f5e934ba317c8e07000
SHA1 d433b1c0bc77146414ad94fb12fc39cbe6a609eb
SHA256 00b865139970e945b1c9390ef93281f8e6c3650da83fd70a7e43aea0f970a05c
SHA512 abeb12dba014466d4629973c65dfb2fbff32cba67600068338dd7902466a342fc053aa008321f8b01fe0c33b218bbf8a1240afefc51b23e4d0e58d43e6b89882

/data/data/com.tss.cityexpress/files/.imprint

MD5 d7dd94bce3560dcbd8bb050348d68b71
SHA1 50b9b038349a20b807ce996b849e78362187c3d7
SHA256 53aeacf09e23d0379ce00959ee1ce78c9ac2398596d2624dfc87fa364a09e338
SHA512 a861b33cd11416a0d86522ac36ee705a0a52383ca93bcf1bf126402531dfee53951c89a476b30f29451aeec5f6c698feaeeabcf14cc12c4a7ab9c06eddfd23fe

/data/data/com.tss.cityexpress/files/umeng_it.cache

MD5 4d1cd6c7f523122ae1321d1ae0a257a1
SHA1 21dbfb19cc27a7624dce57c75377da130a93ae4c
SHA256 f9af8fe55a60245aaccd2adf077ab8ca68d994bd06f82d308066132fbf4f0c5c
SHA512 aff1d3ff6a6aa1990802b2cb0c53cd676dd1b249d7d3283408bd25a160c613002f380a946b5dfa4c37d3965a27fe7d5394b58714de3ee288f31f723ec3c61673

/data/data/com.tss.cityexpress/app_sslcache/api.tuisong.baidu.com.443

MD5 2aa0ee9606fd6bfd2c13208eabf63c86
SHA1 216ca3a9a4da092d16526a0a676015493a1e9075
SHA256 d4c5f9cf6e85f6b596c701f77dca9b361a690dbae7028604671d5031eb13ec21
SHA512 184e3eb3ba87f6b1b72266e657022f403218f598da30f08a3fa457999e8417851fc57ae0014242164b87d5cec6771db008ef919f4d2b683d7a506d5f167812e1

/data/data/com.tss.cityexpress/databases/pushstat_5.0.0.db-journal

MD5 c958fc09e80987fa0f9452722043567d
SHA1 fcee13a5b8efdd94c70a66b86221d4698041d17e
SHA256 63951db49435c16f8dccf28ffdb1267eccd43db5d307b8d3adf8cf4c5e27e2d2
SHA512 e38ba2fc508551f1404b316cc0ae9de08dd26e8c21b015541d6c72821c76cfa748122cb1be2d64ac252f2c0706d1c0ec78ce3137da50314cac350cd55944c275

/data/data/com.tss.cityexpress/databases/pushstat_5.0.0.db

MD5 f5d06a0d4bc7ebd5eac2c7b1b756ce68
SHA1 0e345afc88b132aee3496cfb0f6d3e2b184193c2
SHA256 b791e74486d08ccfdc791f01b8d694dc43b436ecdb01736a21f533e00cc9968f
SHA512 c1be10798ce6e195ed281320d559abf7df98e2a30cb55aafeef2a15db9b8c3a02e860c9cf2c8d10464faa907331389fa58fa97f2500eb9c1cf4f3901b8839a29

/data/data/com.tss.cityexpress/databases/pushstat_5.0.0.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tss.cityexpress/databases/pushstat_5.0.0.db-wal

MD5 4d767201d237a987b811852e689dde78
SHA1 ccf880efe41d470b97f060b4bf6a3eee619a3280
SHA256 b9fca1c9046e1a33987911e02d57104f28b407329803b936ff0dd6bb89e9162e
SHA512 86cd0b0464ee24477114088b50d47cd03db579f27efec5e25c5617477597cead3e45c5b59067b6b4658b4f87f53159d0ef3e14022b08db45ba5fe3ea58cbec05

/data/data/com.tss.cityexpress/databases/pushstat_5.0.0.db-wal

MD5 a0675c2a114494f7b8829b691be267dd
SHA1 5b5f8e90812f50f058c0a57a342061224fd1a215
SHA256 1e62e8be0490f4e0f084c815d146a0bee56329bf09186972af75762514ce9c98
SHA512 3a288344b3358252e7c75e9ef1721dfceeea436a0df30ffd204159a0aaab0200e42109e2fd0b65439402e51cee63fb1e4c0e35ec4358608d968a5c7ca62175ed

/data/data/com.tss.cityexpress/databases/pushstat_5.0.0.db

MD5 86e52b954ae903160b1cbf0c4235430c
SHA1 eaf2c3d82bcf46e9dc7154ae4a96e0019c1a2f99
SHA256 4a398f6c35a938a44ab43b29b014c1555e8cfed8b9a0ecbc6f69287dd7f7a33e
SHA512 27b88bcc514b6ec6b62e8123a0fa1010a5d3274f44b349a9f91af628316bf0d609e0f7c9ce6c7a8caf4703f9073afec4d88dce6c18fef41329cf4af29fade70e

/data/data/com.tss.cityexpress/files/ofld/ofl_location.db

MD5 64e377ef816efcf08adfb5152720d2b0
SHA1 83a251613f58055499f95d1398b65be8bd82d905
SHA256 35e584c70adf9ab95022cbf8bf5698e0af49abeb0d07f3974a90da4bc2a5de5b
SHA512 6790d81cdba3ccef5486f8cd9ce38f0c0166ce3e7a1160ccb08d8c3184b980916e0eb1f2973187f88aaa8174f8839a15d1d691cff9975c553bcd59c26ea27a8b

/data/data/com.tss.cityexpress/files/mobclick_agent_cached_com.tss.cityexpress2006

MD5 9e1f5479622d6e48458625f28b1a615d
SHA1 aa07010162f5ec3cb98da1a53c8ff3d260a8cd25
SHA256 60a896793b8bdc1545adf2c01438a00c666c593dff4328e8b9c874a2cd72dc8d
SHA512 a9082add9639229eae2b5a2756015a4a6ab69bad62ba0de6a45685f5181ab6d86b8bdde2df33564aa6d0de3f4e5ae052764b190be7cfc8f8f8d3136dfe921cc0

/storage/emulated/0/Android/data/com.tss.cityexpress/files/baidu/tempdata/yom.dat

MD5 a936690571e9104e1922dda4a0ba5bd1
SHA1 65f49c57edde2f96be2a1dbdfc3f7351f1e66554
SHA256 f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412
SHA512 3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

/storage/emulated/0/Android/data/com.tss.cityexpress/files/baidu/tempdata/yom.dat

MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5