Malware Analysis Report

2024-11-16 10:44

Sample ID 240603-lpl36sad4s
Target 9150c70749f910776f093ae584eb3bf0_JaffaCakes118
SHA256 d359ce234c22363c21e98cc291057fb4cc8c3aa89541009b7691549fd1ef426f
Tags
banker discovery evasion execution impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

d359ce234c22363c21e98cc291057fb4cc8c3aa89541009b7691549fd1ef426f

Threat Level: Likely malicious

The file 9150c70749f910776f093ae584eb3bf0_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker discovery evasion execution impact persistence

Checks if the Android device is rooted.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks memory information

Checks CPU information

Registers a broadcast receiver at runtime (usually for listening for system events)

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Schedules tasks to execute at a specified time

Requests dangerous framework permissions

Checks if the internet connection is available

Reads information about phone network operator.

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 09:42

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 09:42

Reported

2024-06-03 09:45

Platform

android-x86-arm-20240514-en

Max time kernel

176s

Max time network

175s

Command Line

com.baiwang.PhotoFeeling

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A
N/A /system/bin/su N/A N/A
N/A /system/xbin/su N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A
N/A alog.umeng.com N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.baiwang.PhotoFeeling

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 graph.facebook.com udp
GB 157.240.214.1:443 graph.facebook.com tcp
US 1.1.1.1:53 setting.rayjump.com udp
DE 3.120.56.161:80 setting.rayjump.com tcp
DE 3.120.56.161:80 setting.rayjump.com tcp
GB 142.250.200.3:443 tcp
US 1.1.1.1:53 s4.picsjoin.com udp
HK 47.242.105.154:80 s4.picsjoin.com tcp
US 1.1.1.1:53 api.cloudmobi.net udp
US 1.1.1.1:53 s5.picsjoin.com udp
US 1.1.1.1:53 s1.picsjoin.com udp
US 1.1.1.1:53 s2.picsjoin.com udp
GB 18.164.68.38:80 api.cloudmobi.net tcp
HK 47.242.105.154:80 s2.picsjoin.com tcp
HK 47.242.105.154:80 s2.picsjoin.com tcp
HK 47.242.105.154:80 s2.picsjoin.com tcp
US 1.1.1.1:53 scheme.mobpowertech.com udp
US 1.1.1.1:53 api.tinyhoneybee.com udp
SG 18.140.40.189:80 scheme.mobpowertech.com tcp
GB 157.240.214.1:443 graph.facebook.com tcp
US 1.1.1.1:53 api.mobula.sdk.duapps.com udp
US 100.22.20.86:80 api.mobula.sdk.duapps.com tcp
US 1.1.1.1:53 sdk.api.altamob.com udp
US 1.1.1.1:53 api2.batmobi.net udp
HK 209.177.84.159:80 api2.batmobi.net tcp
US 1.1.1.1:53 analytics.rayjump.com udp
US 1.1.1.1:53 api.altamob.com udp
US 34.117.255.242:80 analytics.rayjump.com tcp
US 1.1.1.1:53 net.rayjump.com udp
US 34.102.167.98:80 net.rayjump.com tcp
US 1.1.1.1:53 feedback.umeng.com udp
SG 18.140.40.189:80 scheme.mobpowertech.com tcp
SG 18.140.40.189:80 scheme.mobpowertech.com tcp
US 34.117.255.242:80 analytics.rayjump.com tcp
SG 18.140.40.189:80 scheme.mobpowertech.com tcp
SG 18.140.40.189:80 scheme.mobpowertech.com tcp
US 173.239.5.6:80 api.tinyhoneybee.com tcp
US 100.22.20.86:80 api.mobula.sdk.duapps.com tcp
US 1.1.1.1:53 api.mobpowertech.com udp
US 52.70.80.122:80 api.mobpowertech.com tcp
US 1.1.1.1:53 smart.tinyhoneybee.com udp
US 52.70.80.122:80 api.mobpowertech.com tcp
US 173.239.8.164:80 smart.tinyhoneybee.com tcp
US 52.70.80.122:80 api.mobpowertech.com tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 strategy.lmobi.net udp
HK 209.177.84.159:80 strategy.lmobi.net tcp
US 34.102.167.98:80 net.rayjump.com tcp
US 34.102.167.98:80 net.rayjump.com tcp
US 34.102.167.98:80 net.rayjump.com tcp
US 1.1.1.1:53 usdk.batmobi.net udp
US 1.1.1.1:53 ggimg.ssl3.doglobal.net udp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
GB 174.35.118.62:443 ggimg.ssl3.doglobal.net tcp
US 1.1.1.1:53 t.appsflyer.com udp
GB 216.137.44.95:443 t.appsflyer.com tcp
SG 18.140.40.189:80 scheme.mobpowertech.com tcp
US 1.1.1.1:53 upload.mobpowertech.com udp
US 54.158.229.244:80 upload.mobpowertech.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
GB 142.250.187.206:443 tcp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umengcloud.com udp
CN 223.109.148.176:80 alog.umengcloud.com tcp
CN 223.109.148.130:80 alog.umengcloud.com tcp
CN 223.109.148.178:80 alog.umengcloud.com tcp
CN 223.109.148.141:80 alog.umengcloud.com tcp
CN 223.109.148.179:80 alog.umengcloud.com tcp
CN 223.109.148.177:80 alog.umengcloud.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp

Files

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_ts.db-journal

MD5 9746d934c914947b0663d294ad67edd2
SHA1 32a5c55590888b73145766bf5c1d56b2fe8bdd76
SHA256 f5db0c933b8e786fcb095d4cfd0d9cec64cd1f46a9df3a4fff1cf09869d1fda4
SHA512 721f36782e21495dd2832f9e1840622aef48b7a3e45c6cb5313db99832527726332e5f00c183f30b4c7b0a334d70325af73f929a9090b59a693e78b7cb885985

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_ts.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_ts.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_ts.db-wal

MD5 a83342d0f2b595368d9da82e2913cf4f
SHA1 e4645739129e502e712312ee3bde6c5f130850df
SHA256 ec61b2fd968b55863cc9d6ba835256bfcea8bd46d10353138875a2123823be9b
SHA512 6d2aef18b52675ba714369f878855db0c1f58ed174847ebd5898b17ec66f4160ad4f7c9a80500cfbdb86b0aed567e84c0d48b4352baf2b6a84cdc20a071908f8

/data/data/com.baiwang.PhotoFeeling/databases/mobvista.msdk.db-journal

MD5 5f327c21b88e2d2d1e2fe0cbfc6af620
SHA1 428925a30f8b6fbb8a6cff76d7fbeadf4cc295e7
SHA256 4392b7d0baca473d0308dda208e232bac7133474def510eab39efbebb6204c72
SHA512 3f462836a73baf7cccff3c20f2e069325291416bbfb3ac5a6be3be3f49e73f92f15c8bda6ec0f4889f08be20ff5299af16d3e7da0d7511f72580a16bcfac11b2

/data/data/com.baiwang.PhotoFeeling/databases/mobvista.msdk.db-wal

MD5 847b4c679c8904a048846859b0803699
SHA1 5fc4173b3475c8724c415c7da63f461327e8eae8
SHA256 d27c290a23aa0054241bf41cdad7b4ac71e6070b0e9d562f2f77fef2c838e2d1
SHA512 e5fc9fa9c8a74473c9037a00384fc2a235d6df939e79941d0040d2fcf4e6b692de95e52b043b88681366e948a3f384084eeb51ea165e12c10076556277789987

/data/data/com.baiwang.PhotoFeeling/databases/altamob_ads-journal

MD5 33fb34cd108b7671bd54bee7c39a3144
SHA1 ca9f18cfdcb256cf93357afe5e790ee3735d5832
SHA256 4a79f522f3737dacd423971d3cf085a50f5adcb0ffe5f94c177b8ad028f2c818
SHA512 b894a4110fd49692890659e61dd2e81298b0992f86968e7f33ce0458da328bd25724e3ab507c3fbc11c32390a502cb5b46ab5f57c53f01ea4270b02f0c361d3c

/data/data/com.baiwang.PhotoFeeling/databases/altamob_ads-wal

MD5 be8199ae6eb000e821b32c27d6cd051e
SHA1 42beb7cdd0060dc5bafa95c8034cd0a75e2104d5
SHA256 25289192c704209bf4af9d7a511b67b0b3a8c32db436cc4cd0dbfe862577a707
SHA512 57f9f597dba3bd03a89ff4a0f69e9d591ba4e6e817f11d5ceafe3641de6da6dbe79e65d8d1415baa58eb725c6388fd97dc8278673f12279e8a051c76a5c2d7dc

/data/data/com.baiwang.PhotoFeeling/databases/mobpower.db-journal

MD5 7e741a7fc6b2db0a383acb5fa8b230ef
SHA1 30193d32250cd86d2870241d44e946cd048d4a07
SHA256 2b98de46aad4a5a5b019bb1791fbd4887da10b4eaf37fa49542a6175b478bf4a
SHA512 88dde695e8ca94f59287b69da8f4dd5696ead8e95ded10fde4511d5d98137434c552577d31482a60e5e24a33ecca46a5d071b7071d26d009bcbab3ed130361b9

/data/data/com.baiwang.PhotoFeeling/databases/mobpower.db-wal

MD5 64bc100d91f4cc493de8a554fbe4e98f
SHA1 58934f11fba396ed8ce483c39dd66c917f2ceb38
SHA256 e0ee7fe9643bcfb591a5843fff2a9246bbfb30579cb0e4788ea3aed4214ab1ab
SHA512 bbc678858e7911d1da85fcf7001842420f62d1c9dd6d51662915c1f2879882aae02524b2f9aa3f08b5f7fe4dcfbae19c8576ccbd30114088837e3dce34c4f908

/data/data/com.baiwang.PhotoFeeling/files/altamob_device

MD5 e964b06456b5f3d67066f5cd6613523c
SHA1 76d0866c41beff1da912004ef434a9850ce9fa3a
SHA256 63efe7ccf55b213e2f2848e861f9d6b394b2f58910a195bce4e17b94099e342d
SHA512 27d5c351e187795a6cdf8ac7f50caaa397933d6ecdcc1487c7b30d66ac7b70c7134820df16cc32d16cf5d283faa05d3c8ddda2c371258155a5899017f2dd60c6

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db-journal

MD5 deb61861fe9f7ffcc1465c555be3abd0
SHA1 0b65ffea6e0b425488dd58d085b70d6690c085dc
SHA256 987ef938ccfeabc46c121efa4342405043d99af2420e74b68a8368cab348c29b
SHA512 861b83f9f6899895c009a53c5f8e9c9b3be2993db44cc1cfeb0ea4091a7dbddce1b38d259043d7240ec74173df285276c5643dbf7d286b271382fafdb995b7ec

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db

MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db-wal

MD5 b0e2292b4540ca14870da5595d694826
SHA1 22e67456037a619b01f0bb4e05f6ebcaae5569b5
SHA256 7977d926ef9f0e400311b6021df23b0a3fe9a25aa9aa13d796b38f0c226904a9
SHA512 2daab195f97b4a64fd8a5688cbdd9e69b638c2e87bf3df365ee4b8fc798fbde3fe46704ac4e90e0c8e9f90f66ce964203963572be303f874237c7c2bab9c53f5

/storage/emulated/0/Android/data/com.baiwang.PhotoFeeling/cache/uil-images/journal.tmp

MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_cache.db-journal

MD5 06d10102105e7912cbad12a77606888e
SHA1 34c2fd4abea1e03e1a0d366e77e73e98417e3f14
SHA256 1dcf13821bd95e7b6e9aeb3cdb5df0ee27034a3b886a2bda8aca805f2c4ecdf6
SHA512 3ffae5df1e1ff11f2ef9b606c1d9d08d6efcaaefbffe2e5094272c2600c59bc9e9ff4c6e75df72511c34449250862d599394d57f7fe3cfaa16142276023b5d61

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_cache.db-wal

MD5 be6ec546cbf4155c8ad2dd6b4655eea4
SHA1 9964b90750d872c754ba68c7ab3fcfe470cd1b4f
SHA256 242ad1f0b01c2cd7043a96ac5a438b49a48de60821450f55c8d55788dd88cf14
SHA512 77c82a6258f07a918d978af7a67a84c80254ed7103b1c381fe38633b87666e8622d3bbf93f1769392db356b53dc136fa7210022049635d4c2e76f77a677a5ea5

/data/data/com.baiwang.PhotoFeeling/databases/.ua/ua.db-journal

MD5 7802d0b6581ff4d88b5295c904e1fe78
SHA1 f026af96e70fb04d63c7ebd1c5f1bde23bea916f
SHA256 898df5258e97f751ab126e991e0060ef2902973f335f5e3e0f55a660ccae1f5d
SHA512 0ec62c9387883c2ef863e7d326c6db8190c364a77454e8bd8ba16da9a2dea87d75374c9d1bf2e3254732026373e8a9e7cdc583aeaf069fc25ab017d13876abbb

/data/data/com.baiwang.PhotoFeeling/databases/.ua/ua.db

MD5 c6b1eb4f6eecdbb79f64a96ef5c97754
SHA1 bd616ac3037558c1982d51ba2269dfeac72c2cbb
SHA256 7936153b04f873aedf2aae91ff4750040384065037489051461c06f2da2c772a
SHA512 b221f7e34b814266e4be7635e7bdb6ceff8f569d71a043ed95c54d6b9f83b1eba9a2528e893bfac74cd07a2a9cf48adad876decea8e378d5581f26d7b28cf5f0

/data/data/com.baiwang.PhotoFeeling/databases/.ua/ua.db-wal

MD5 03bc265db72b4f3c81cb138f6ad33efd
SHA1 1e9559f290cd9b3427db3761bd8f00b4335f25a2
SHA256 600c78a28735dabca01dda0da148e656d212fbb9768e8ff9a22b92f1d2ffeb51
SHA512 3a1e2dc2fbfda52d3fbc96277395395f43591488f7bb00bd5e10d38f4bf8adf29e018d477c0ecddf94de249a2928a64f4dcf5581b41267be0c2ec67a2e5be793

/data/data/com.baiwang.PhotoFeeling/databases/.ua/ua.db-wal

MD5 3687952b548e96acc70edf2bd2fbd414
SHA1 1d34e992581b44513dcca9106a71418947950e86
SHA256 f00fe46fe11ea6b0640850e4ab67a59ddeffa616f1a86cc197ea8df10b6ce716
SHA512 0b79163c823e7964b53b133ba40c6b639ed0a5dd69dc9b54023b6dc4a04a6c9c2df4577fc58435d565bb41b45722c68915260617dc3d76a678ac9576b4a7eb1f

/data/data/com.baiwang.PhotoFeeling/databases/.ua/ua.db

MD5 138eeef7e9145e43b7e81954755891d3
SHA1 f4348f07ce2c6241a4d1e8dc9051779bd2d91a36
SHA256 3805dce71781332250b93db0747e6c6b96568aa63dfc94d21a1e952306b9d041
SHA512 80518ef1a1b9b9b68e6e80f027ea424b01952aaaa3f96b48c9258e82e7f84cb1791a3bcc6622fa1ed905add39d3e4cd32771598d4683e37c6be6d3c5e7f20eef

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 ae54b6c1d941f54b3124c419a4330997
SHA1 dd956e928c838e896171b9d080133496a7261d6b
SHA256 d0dd2438c67387e3fd83c56ab848a3e829095b36130fc0415ff4e9f531fe8333
SHA512 699b3415c141b8ccefad683058194ad8735e01374360be142a57b40c42f4f8e53f76f83005b80fa466048d78e39a714c50797dc89456fbf86c23239b3c34fff9

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 fff71458377e4ac01f4c9a85f97d33de
SHA1 f7e012cef571ab5f1bbbc88cc2343a8864dfdc76
SHA256 a787547ca34ebaf136b3a72de5a9a4e3c1c1fc84654da8ef454c69dc7c596554
SHA512 11f53e993045126bb6279dafbb01eedc936908259c9fa732b3ba7c73d821775a800b0d46a54f81a825a58b4f53735d29f6c03f4dbc4063054f80d60858620444

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_parse.db-journal

MD5 6d09b4a0f500f4a83b80ae9fd41595ef
SHA1 023ad7b27654c4a653f3180dcc07c87882dbe0a2
SHA256 baaf003cc2594a324bb318958116c8f9457cea6c44182ac41bf0917dc741ba64
SHA512 40df6f94b5568c9b562fbf361ca259611658feeca12d8f33bbd2f9b65ce8312db7ca079197af423459fc477828595b08b9893147f47e791ae66930606a8359eb

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_parse.db-wal

MD5 3220d229ec72bdb8dff3fe0f2e7c72d3
SHA1 d3d5197eb232c4f96cb1877103fc38a56aab7918
SHA256 752b412effbe2f26d3a7cc7c22a4b5e2c26f8c3441adf24f1b5136e16e5deba4
SHA512 748da3a8dd5843bc6cf0978fecfddd6f9b49004df703db7402eeeede76880b9384ed4988ef8bdbb95f35c6bad0055978dd5cbda838ace3add514bce0c01f6c34

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 dd672d581d05608f1ef561cac0962399
SHA1 c5fa93aff826d1475836d142613a8f8700186375
SHA256 3581ee4961ef99ee4d982fabe3d88d8a2579c064cd80f57456d192aafd84169d
SHA512 4b240595f72577e4d981a3b586ee19cfa392e9c03e997e873ea94e43c1734e915060826ec37331d26627ff5fbde05c006e394513ca60934a9393c02b9bfd5034

/data/data/com.baiwang.PhotoFeeling/files/umeng_it.cache

MD5 e7b2db36980a909c453a07e3fa043b5c
SHA1 d03cb8fe66e9412c0b471a4ff7235139ce0fe84b
SHA256 9165957a89221d6a79ab302b821af24cffeadc26709130e4b46294e8aa09197a
SHA512 e1fec6f0e00de2d2aadbeaa144740b1919884dec68c287d5367dfb57ec228426511330e5fd494ac4621a09d88b32d89196b7e290e1f5053a2b5e67fd35359b87

/data/data/com.baiwang.PhotoFeeling/files/.umeng/exchangeIdentity.json

MD5 6c36a841030910194e9dadcf6a7fd6e9
SHA1 07ebf43346eb170c43ea94022a4534fbb8924534
SHA256 01e72eeb42576d317d51cc50d67f54a2f29670fa9c720c2e9a4373485dd67b06
SHA512 ffe3e85ed31c2f62f63dbabb96c48cf4045ba0c65a7ed218d02fb60c4ffb1526d9f748813dba53fd9b59d19af05c9a17a25d09171f2f170d1fdf17349b8a1ab6

/data/data/com.baiwang.PhotoFeeling/files/exid.dat

MD5 558a0d38fb752d35a21374d66cd32acf
SHA1 533e3bf0733e9e18c213383e34954468b4faa70e
SHA256 2a388ef817ae711dd033bfc475fd7ac0dea470a71fdb9fa129e7311261072f3e
SHA512 8f2c84166eb3fd7825193e7acb78b6d7c21be20257fdaf7e9e39926f6a5fcb4809f736dfcd57f20000551adcd8a2cd27fbe49abb10c3dd4035d444f9d35170af

/data/data/com.baiwang.PhotoFeeling/databases/.ua/ua.db-wal

MD5 26ace128d0f024853b865a5213feb437
SHA1 5547cae4ce868efbd152bbedbf53b6435dc8ace1
SHA256 2399dc2e84d8e174af3bf1198cbc87f3c27157c23263b4198802abf80a6e39ac
SHA512 1de5fabcab2f3dd6a952d68d258e15a789c908507c5ab8997b1b17e638c75102ff788a95734c6561afdfc327a1ce5d063da15db020e9db9542d8c3aec2f8c5d2

/data/data/com.baiwang.PhotoFeeling/databases/.ua/ua.db

MD5 d604a3bf1f8d992cc320ea5b1f7609bd
SHA1 247f88df0b55c7d523ea5398637711a0e4a483a4
SHA256 329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17
SHA512 67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db-wal

MD5 e03b623be4d9654beb95ba86dd1f53e9
SHA1 e366d6203575728cbbc00c223ebcf2840e591527
SHA256 1e31c910c014dc3ec0b8d41caefa2ef633f17fe6ac39b90a816774112a856169
SHA512 4dad6d0d50ecca316e0c07b79880c3c85b8055d86544c92d932bbb438432d0df5187cb4fca5a0ea661d9cfa98804b4ed0efd320c5f98033adb2cb0deb8d334f3

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db

MD5 ce6135aa1b1fe4f2c2db2a546d2a5558
SHA1 79b59582154017aadab783dc266fcb158c252940
SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
SHA512 2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

/data/data/com.baiwang.PhotoFeeling/files/AppEventsLogger.persistedevents

MD5 539d6723b6fef34de686985461315af1
SHA1 a8cbc9864d04b5df00d8653559116cf570177f14
SHA256 318551525c257a14ed921793105a17680ab909e31a65d8ba8b3cf5be1e49a241
SHA512 963c7b9b6339e8ec12cb7065f1b6b1c7c85ad8cc809a9863514e5496a4fa6b4e8366a9c33fea5d03ca5cad4a4450df555f3b7936b9c63be4f6e11c329acb8927

/data/data/com.baiwang.PhotoFeeling/files/.um/um_cache_1717407904340.env

MD5 35d486ee9adbb6575b0e2661d26f849b
SHA1 17e9342f2cd95128d42003ad2a5976109b66b393
SHA256 59cb15ba3a254701419765537df02915e6bd297587e2e7927608515d29a7f0fc
SHA512 91aa229ab7df1c604008ed8024634a306a44bbea04b3c33fb7a0d6524ff7d2920bcf7edc49fd8ffbae96fcc8e61d0d49a75c2af783746b2649945dbf4075f181

/data/data/com.baiwang.PhotoFeeling/files/.imprint

MD5 1f204eda9ee7674de850d7febaf2a30b
SHA1 42277f0ce91b47459100fcbe14b1c12fa2492c53
SHA256 121d3e0e740623b023a7941eae67ecb83f9ad85c9f809e699d8de6990ffc5c70
SHA512 5aad7b65da86d57e354e078669fe1f8a7de1a10cf006ab27280ccec36b72b1edb47517aa9c2200a0d5be0efc4c9d6781952e0936414286cf9f4079cb055a0e68