Malware Analysis Report

2024-09-09 13:39

Sample ID 240605-hby9sshc62
Target 975ec006f485b20e04b22734ba601deb_JaffaCakes118
SHA256 dcf5bb8568c8a027f696e0b7e1b38869081ac763110ac8046219575ef7c858ea
Tags
collection discovery evasion persistence stealth trojan
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

dcf5bb8568c8a027f696e0b7e1b38869081ac763110ac8046219575ef7c858ea

Threat Level: Likely malicious

The file 975ec006f485b20e04b22734ba601deb_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

collection discovery evasion persistence stealth trojan

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Requests cell location

Requests dangerous framework permissions

Reads information about phone network operator.

Queries the unique device ID (IMEI, MEID, IMSI)

Queries information about active data network

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-05 06:34

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-05 06:34

Reported

2024-06-05 06:42

Platform

android-x86-arm-20240603-en

Max time kernel

179s

Max time network

144s

Command Line

cn.sllb.contacts

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/cn.sllb.contacts/files/5000337-1000/comsaappopqgjw3jseanmtr.jar N/A N/A
N/A /data/user/0/cn.sllb.contacts/files/5000337-1000/V4/1717569580971.jar N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

cn.sllb.contacts

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 sm.haikegi.com udp
US 1.1.1.1:53 hp.hkoptimize.com udp
US 72.52.179.174:1610 hp.hkoptimize.com tcp
US 1.1.1.1:53 ua.hkoptimize.com udp
US 72.52.179.174:1610 ua.hkoptimize.com tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp

Files

/data/data/cn.sllb.contacts/files/5000337-1000/comsaappopqgjw3jseanmtr.jar

MD5 fb9f61029be5e91cffe1611ad1fc834d
SHA1 38ff760cb895ecbe7ded06a00f1b5284b9bcef8f
SHA256 423fcede580be77b6950828a5b7d42fc624626ba386bcaddab5e02521fafd950
SHA512 bed46cf01212fdda0bf823763571fa4a92ae016578c4f3cc7da2fadd915e43027771356d36c409bd2e4572837c8f3c6366c21641feb35a1b58cb80238e22d680

/data/user/0/cn.sllb.contacts/files/5000337-1000/comsaappopqgjw3jseanmtr.jar

MD5 5673c0e6517306e207a8723301f2cb49
SHA1 024387393cab1033374d404ce98902d4453d185b
SHA256 369eb26a4b6818585a4b76da430ee6871e408ce3338736359a822345a3fbf95b
SHA512 ad765ed6eb1d02af3ed34df5f91587a854aa8bbd7d65da60622e464cb64ab104f1d7b6f034b6bf9110d67e018a8047def8f06046bd4df11bf689588357cde151

/data/data/cn.sllb.contacts/files/5000337-1000/V4/base.so

MD5 a34614523067cb205f612e929270cdd0
SHA1 562157bae1666fb796bcd7e806740b72483e999b
SHA256 82d6c5559cbc089e31bd3d22fb2422582df127671de40df3a4cb8142ae56ad3e
SHA512 42118d29ecb6c855106f33dc8d49b146ae964176a96a995770f9f6ea95dac90fdff80ac7a312fd1a296477b3ca650368faf96f05b6f6cf5c61f1a99a35c70c6d

/data/data/cn.sllb.contacts/files/5000337-1000/V4/1717569580971.jar

MD5 399b8a5bbaea391c4f2d413fcee8547e
SHA1 8356ddaa43f2b9477d17261807f9adf072a7f43b
SHA256 bf639746c1be112103d5d36013cdc181e196b337ce4d75704a306b1afaa55bbd
SHA512 89f4947f6f7412c4fc6776687c613bb7a5c06d11051839c423b506cab331f2b04835cc592e959d4a06c116078e9a5e6a9a8baf4e2b3605532999e3eb38725d21

/data/user/0/cn.sllb.contacts/files/5000337-1000/V4/1717569580971.jar

MD5 0da5cbf5f12e8827e6360dc62dff2eeb
SHA1 7593c94995fbe672b660c28dd9ab3f010a8ea9ff
SHA256 5814054044c97e81830da96c39f8692a5b9bd40e05d66abe62bf283e80cd2580
SHA512 f38d2d72b91c1fc42bb5501f79610f710c245f73cf22655ed2e67f1bd211296cfc45963ce9f9980650252e12da6a4861d5e531f41dc1eee3eef0dfbf879ee20c

/data/data/cn.sllb.contacts/databases/5000337-1000_point.db-journal

MD5 356161e41b1dca0bee6d4f3e16462024
SHA1 3c206c5c993ae654b9f52f70a8ab62f1e069cb35
SHA256 21572c3d9d2e2cfd0eb57459d18c104f9866175ac605717b6a6e0fd81dd9ed15
SHA512 5e8b9d6cdde4d6779dcfc4088b68d070779f453ce76dec4c5fc709bce2d26f78fac5f0139ffd1a68f971baffecac69634dfa15b031ba4ba6d8f8e860e4544562

/data/data/cn.sllb.contacts/databases/5000337-1000_point.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/cn.sllb.contacts/databases/5000337-1000_point.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/cn.sllb.contacts/databases/5000337-1000_point.db-wal

MD5 c7321ab6014f20f53e6399aafc774d22
SHA1 bdb4727e9093e46a9eddc428c149e5dd6fd2b25f
SHA256 3772f6bf7d93e4266c0dc8b669dbc28d8f9e51d5ff1cd74b5802b726851fc921
SHA512 52416fe4005c1352a4f374e9ccca28573b99b7ed92da85c6c6add0f62fe9f5495686e4458e4db7a68ef3bdf2afc4efc6e7000ed84c7ccb5239887c12515c267a

/data/data/cn.sllb.contacts/databases/xj_adlog.db-journal

MD5 88863ac1a691390b82a531714860bd68
SHA1 ff26f46567ef8c1895822e8706d9990bfb01a19e
SHA256 8fbefd7d0790f981b60b35f9763535bf326e55eaa91d3047246f028340e9b9b6
SHA512 1bebc4216ca038cc33f9f85376c476a003990dad8e702bdb71aa5b4b60b1666067f493438bef821a99d3aaa65137d731e126f7c776d11843c0150bc78c5fb053

/data/data/cn.sllb.contacts/databases/xj_adlog.db-wal

MD5 5900e4116bf96229a1179e32972d8970
SHA1 c95522427c75e8c578e1fb959ef7dfb3855eafe1
SHA256 1902c054061af893153cb0fcac68d6808a66b7923926239b8c908961f6cfc106
SHA512 37782ba65a9fae74f1cd84f2066ec2eb5dd623d5bbc686772e40acc3ac8e3d9593ce3abb9e5946cd70eb5b57d022453112e41e9640ab74a315450a091b9f820c

/data/data/cn.sllb.contacts/files/5000337-1000/V4/oat/1717569580971.jar.cur.prof

MD5 d7133c9553712a1f779b0d27b788ba8a
SHA1 4880f62aa41b4682cdb8f2f4d6e8f19d3300b4a8
SHA256 544e8efe2e8d473db5a047809c6360e98b7d19b536b37b611b8e82c57019eb1c
SHA512 9e1c1abd8faace7efff5bea70d26a75b08eb692ea19d763b335839fc8b6f736e30193935cd89e4c88cbf6df3ce1bf496412a04ced33efc72ca9a0fbe5bc98de2

/data/data/cn.sllb.contacts/files/5000337-1000/oat/comsaappopqgjw3jseanmtr.jar.cur.prof

MD5 50536143c6e42cd9602b48c5ec122f58
SHA1 f10d16def214a5a191d1f5f68032fd93219ecadb
SHA256 528418d0a9706efbea41736b592d9d5fe68931015fa8349eb529e472c4eadb06
SHA512 558e8c35128b24edf384b1e8f0cb177b6e05b2175e0e50c74c3eedf4fd0fbf7a5d87b6d7cc00286a19e8b930c07ac3edbfef84dfec7d119a99a3a04eba47a569

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-05 06:34

Reported

2024-06-05 06:42

Platform

android-x64-20240603-en

Max time kernel

179s

Max time network

154s

Command Line

cn.sllb.contacts

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/cn.sllb.contacts/files/5000337-1000/comsaappopqgjw3jseanmtr.jar N/A N/A
N/A /data/user/0/cn.sllb.contacts/files/5000337-1000/V4/1717569579876.jar N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

cn.sllb.contacts

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.213.8:443 ssl.google-analytics.com tcp
GB 172.217.16.234:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 sm.haikegi.com udp
US 1.1.1.1:53 hp.hkoptimize.com udp
US 72.52.179.174:1610 hp.hkoptimize.com tcp
US 1.1.1.1:53 ua.hkoptimize.com udp
US 72.52.179.174:1610 ua.hkoptimize.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
GB 142.250.200.46:443 tcp
GB 172.217.169.66:443 tcp

Files

/data/data/cn.sllb.contacts/files/5000337-1000/comsaappopqgjw3jseanmtr.jar

MD5 fb9f61029be5e91cffe1611ad1fc834d
SHA1 38ff760cb895ecbe7ded06a00f1b5284b9bcef8f
SHA256 423fcede580be77b6950828a5b7d42fc624626ba386bcaddab5e02521fafd950
SHA512 bed46cf01212fdda0bf823763571fa4a92ae016578c4f3cc7da2fadd915e43027771356d36c409bd2e4572837c8f3c6366c21641feb35a1b58cb80238e22d680

/data/user/0/cn.sllb.contacts/files/5000337-1000/comsaappopqgjw3jseanmtr.jar

MD5 5673c0e6517306e207a8723301f2cb49
SHA1 024387393cab1033374d404ce98902d4453d185b
SHA256 369eb26a4b6818585a4b76da430ee6871e408ce3338736359a822345a3fbf95b
SHA512 ad765ed6eb1d02af3ed34df5f91587a854aa8bbd7d65da60622e464cb64ab104f1d7b6f034b6bf9110d67e018a8047def8f06046bd4df11bf689588357cde151

/data/data/cn.sllb.contacts/files/5000337-1000/V4/base.so

MD5 a34614523067cb205f612e929270cdd0
SHA1 562157bae1666fb796bcd7e806740b72483e999b
SHA256 82d6c5559cbc089e31bd3d22fb2422582df127671de40df3a4cb8142ae56ad3e
SHA512 42118d29ecb6c855106f33dc8d49b146ae964176a96a995770f9f6ea95dac90fdff80ac7a312fd1a296477b3ca650368faf96f05b6f6cf5c61f1a99a35c70c6d

/data/data/cn.sllb.contacts/files/5000337-1000/V4/1717569579876.jar

MD5 399b8a5bbaea391c4f2d413fcee8547e
SHA1 8356ddaa43f2b9477d17261807f9adf072a7f43b
SHA256 bf639746c1be112103d5d36013cdc181e196b337ce4d75704a306b1afaa55bbd
SHA512 89f4947f6f7412c4fc6776687c613bb7a5c06d11051839c423b506cab331f2b04835cc592e959d4a06c116078e9a5e6a9a8baf4e2b3605532999e3eb38725d21

/data/user/0/cn.sllb.contacts/files/5000337-1000/V4/1717569579876.jar

MD5 0da5cbf5f12e8827e6360dc62dff2eeb
SHA1 7593c94995fbe672b660c28dd9ab3f010a8ea9ff
SHA256 5814054044c97e81830da96c39f8692a5b9bd40e05d66abe62bf283e80cd2580
SHA512 f38d2d72b91c1fc42bb5501f79610f710c245f73cf22655ed2e67f1bd211296cfc45963ce9f9980650252e12da6a4861d5e531f41dc1eee3eef0dfbf879ee20c

/data/data/cn.sllb.contacts/databases/5000337-1000_point.db-journal

MD5 0d6848b1ee95c2479576f91648de2c46
SHA1 ebc537020b33881d087c79b39dae50ac765046bb
SHA256 8464f4e9e47cd0911c333d481dcb383bc7b90f4146e813e621538d04cf44c203
SHA512 efe1b5265c4100365888e6161220aa44f0e5c6e9bd3bc833a2a0f4fd02a94122487ce36806866defe6261b4cce754dc7372353995b8c6bf52aca6c76730bd794

/data/data/cn.sllb.contacts/databases/5000337-1000_point.db

MD5 f919f25fbdf7f9596dcaf468399fabae
SHA1 735804f7f7eeca55ff04ec1a42c99dfe0ac9125e
SHA256 79570148e6e09cd551d52e46eac80124419f35130514dae3b9ef5a0f7be12dce
SHA512 f4ef69247904512682940b4b194ecd503e30226071fcb78a9c9d13aaa95b75af56b3c0931c4b98491b6da76122877a21f703eab45e9aaa2e678279b95b8b4e1c

/data/data/cn.sllb.contacts/databases/5000337-1000_point.db-journal

MD5 29e3125471006289ccaba3ba1edb0a6a
SHA1 a7aea062d0368cbb07641f96be39f29fa89e1cc2
SHA256 5277870a2f0bfda43d775af1ef8ee8e8e350185739328059894f714c4532f853
SHA512 dc7f00b1cd9e9916de39ee7e19fe8d7c45cb15ec5e48caf9d4c6fe78e00b0f3cea522b5d8cb93f3600800e5e257662dbce517648cc4d56612b16a7eda75bc701

/data/data/cn.sllb.contacts/databases/5000337-1000_point.db-journal

MD5 76a42832119bc4a1611c5e32e89a145e
SHA1 322bc67d1267ee57e0b5824349696feff6642842
SHA256 2bc1dd6f7f0866318c85ddd47c11f16a2507d68e9f17c53a13dae9e7001c3dea
SHA512 d10564dc83e3c000fba944d63316f7d2ede1951674916483770f88aaf91751a1de195a61519228a786aa1c433f56854f5a589186c5c7033e0fb0b9b9373e9131

/data/data/cn.sllb.contacts/databases/xj_adlog.db-journal

MD5 c6aa717a8a180914ed6d9e8949b59433
SHA1 7185ca289a889f48813ef87c148f9e0864ce95ad
SHA256 87811bb8d80a30236d5138d1fa0ac412abc5e564fe7a2183728dbacb3f34e0a6
SHA512 bc94ef63d7bfccba6d31a1c8046fb06cbc960ba3d3560908e5da8401336215d75162623c5b999d50e5229c12dcbfcb7ec809d2e1c0a71b26bfe7085db26f51ff

/data/data/cn.sllb.contacts/databases/xj_adlog.db-journal

MD5 b80c92a93ef3463482401bd65de44479
SHA1 e435a17ada3eccd114663c2c5542c5359908dac5
SHA256 ba6d189c8f96204cab19215a5909547ed947b19ecce692ec0e213455561e6c77
SHA512 a36293f962907f8da86bd104c0e812bb0900dca84ea2ea5d04e365f9a73158e7b11046b58f89c2b70ae66b8fa5fb06cb02cd6841310e3d08eaa556fb4816da93

/data/data/cn.sllb.contacts/databases/xj_adlog.db-journal

MD5 d58ad46fc747094aa08c4b3867707efc
SHA1 a1b657b3cd07653e1a4c7a238ec8dce8d524c0ec
SHA256 a8b70d590fa99b32aecfa3bf1033bbc7b74c671541aa47f9fc864e53bf353a5b
SHA512 06451ef6b5f1b0a14d019bd9f58c59610e14c9b4e3a0b915f7771628b05bf84d00d56df9315a3c764ed37e29a9561d3e2dd4d38e99d6dab0af88649a262fb6ae

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-05 06:34

Reported

2024-06-05 06:42

Platform

android-x64-arm64-20240603-en

Max time kernel

179s

Max time network

138s

Command Line

cn.sllb.contacts

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/cn.sllb.contacts/files/5000337-1000/comsaappopqgjw3jseanmtr.jar N/A N/A
N/A /data/user/0/cn.sllb.contacts/files/5000337-1000/V4/1717569582715.jar N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Processes

cn.sllb.contacts

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.179.238:443 tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.200:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 sm.haikegi.com udp
US 1.1.1.1:53 hp.hkoptimize.com udp
US 72.52.179.174:1610 hp.hkoptimize.com tcp
US 1.1.1.1:53 ua.hkoptimize.com udp
US 72.52.179.174:1610 ua.hkoptimize.com tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp

Files

/data/user/0/cn.sllb.contacts/files/5000337-1000/comsaappopqgjw3jseanmtr.jar

MD5 fb9f61029be5e91cffe1611ad1fc834d
SHA1 38ff760cb895ecbe7ded06a00f1b5284b9bcef8f
SHA256 423fcede580be77b6950828a5b7d42fc624626ba386bcaddab5e02521fafd950
SHA512 bed46cf01212fdda0bf823763571fa4a92ae016578c4f3cc7da2fadd915e43027771356d36c409bd2e4572837c8f3c6366c21641feb35a1b58cb80238e22d680

/data/user/0/cn.sllb.contacts/files/5000337-1000/comsaappopqgjw3jseanmtr.jar

MD5 5673c0e6517306e207a8723301f2cb49
SHA1 024387393cab1033374d404ce98902d4453d185b
SHA256 369eb26a4b6818585a4b76da430ee6871e408ce3338736359a822345a3fbf95b
SHA512 ad765ed6eb1d02af3ed34df5f91587a854aa8bbd7d65da60622e464cb64ab104f1d7b6f034b6bf9110d67e018a8047def8f06046bd4df11bf689588357cde151

/data/user/0/cn.sllb.contacts/files/5000337-1000/V4/base.so

MD5 a34614523067cb205f612e929270cdd0
SHA1 562157bae1666fb796bcd7e806740b72483e999b
SHA256 82d6c5559cbc089e31bd3d22fb2422582df127671de40df3a4cb8142ae56ad3e
SHA512 42118d29ecb6c855106f33dc8d49b146ae964176a96a995770f9f6ea95dac90fdff80ac7a312fd1a296477b3ca650368faf96f05b6f6cf5c61f1a99a35c70c6d

/data/user/0/cn.sllb.contacts/files/5000337-1000/V4/1717569582715.jar

MD5 399b8a5bbaea391c4f2d413fcee8547e
SHA1 8356ddaa43f2b9477d17261807f9adf072a7f43b
SHA256 bf639746c1be112103d5d36013cdc181e196b337ce4d75704a306b1afaa55bbd
SHA512 89f4947f6f7412c4fc6776687c613bb7a5c06d11051839c423b506cab331f2b04835cc592e959d4a06c116078e9a5e6a9a8baf4e2b3605532999e3eb38725d21

/data/user/0/cn.sllb.contacts/files/5000337-1000/V4/1717569582715.jar

MD5 0da5cbf5f12e8827e6360dc62dff2eeb
SHA1 7593c94995fbe672b660c28dd9ab3f010a8ea9ff
SHA256 5814054044c97e81830da96c39f8692a5b9bd40e05d66abe62bf283e80cd2580
SHA512 f38d2d72b91c1fc42bb5501f79610f710c245f73cf22655ed2e67f1bd211296cfc45963ce9f9980650252e12da6a4861d5e531f41dc1eee3eef0dfbf879ee20c

/data/user/0/cn.sllb.contacts/databases/5000337-1000_point.db-journal

MD5 4729eb348e77674cb32227ce1c098fda
SHA1 d5a5cd6d0e49e6c061a214feac32911e4a537ad3
SHA256 5f5bb0cfc5bc5ae44c3e5a0c40d18345f12c436ec2ff23d3477cabdc031b9c26
SHA512 ea7996f25a5c782f6722f5f4d000163f14aa62c57d738c3605dbb5fffeaae59abf08c5bdad85bab1b09af59df174602c17d40498a4a5f58e84e3566dd391a90e

/data/user/0/cn.sllb.contacts/databases/5000337-1000_point.db

MD5 2e0379ff60639368f320c6ff2a0b81b9
SHA1 f1a8dd04f830fc306eda60594d64db7af486bf84
SHA256 a6bf2ce600ec054da8fe92fdef74c5485bd8f222a088fb014575acb430c258c3
SHA512 2d82297ee3eccee0852ec475bf79116eea8f7b60000f3ecd1154fe4c2325b8ab099dc29d3a0eeca904878e9c013accad0251874111176cbe4e1c3e2e735345a3

/data/user/0/cn.sllb.contacts/databases/5000337-1000_point.db-journal

MD5 f05ba752bf80423125bea51b394d93ff
SHA1 95613fbee01b99110c46c176ccf51e225fe27660
SHA256 85842d42a9cde7d5f56c78740250b8738f144685150accdf10a734c6a7636b03
SHA512 8772f84ae3c68c41c071667328e81a636ba529d1d79f13ba810d63c234f6ae47c2deec65184f357348b3f6ba406e336d85df9e28792076bc545d1d99b0c8ccfa

/data/user/0/cn.sllb.contacts/databases/5000337-1000_point.db-journal

MD5 056f339c3bc9008344a0c7e8774e2164
SHA1 9bbb9b7a03a234a8a45e93786f5fa92f3f64a770
SHA256 07351ed23d9568e7e8582549a6fc23ca151afaa74a8f5ba5c842e0fbac3f4d7d
SHA512 3cc7c6efbec99d2062220f70f3e45b44ceeed577c9bad2eef3f2b4251709bac7e58f4d1b1e59af2e78fbe639f916287f26c666f9dcc7b0c324384e56f06924a8

/data/user/0/cn.sllb.contacts/databases/xj_adlog.db-journal

MD5 647b1e8c26369870cfd8ed138a9edf87
SHA1 48451f7a3f2bda4dd220adcbeed697d2ce88e15e
SHA256 43ac9631b5096bd23d6c0374cf662e2dbf4be2f052de66f731a96254cbddd54b
SHA512 d62ce6d5940521a5f0618655f5d2485e18acc8101cf7564cc85f65cff5f706622585c93b0a62999e07464879173d8dd79194c065ecd4b4051c6343b0f9f1034a

/data/user/0/cn.sllb.contacts/databases/xj_adlog.db-journal

MD5 69ca635b7c5d42c58713acca28df3a94
SHA1 4a21e4306b9cb6f3574bc43f2f3f5fab1f445a39
SHA256 9ef232d5c0dd807a29bdf1f45c19d2a4b8659123c71d330e85a6d14051003cd6
SHA512 40bad6692216bd45bdc79afa26740cfbfe471fa537fa50aa29be47f4926efb85ca5bb093996cbd77db510eac128e9a0f4ad567c407b1f939f4a8d862d0e71717

/data/user/0/cn.sllb.contacts/databases/xj_adlog.db-journal

MD5 5f2c32c074f9b49c95007f84b4c999ac
SHA1 233993529e3d0007522fe09b4dcbc101f9cab0d2
SHA256 07d8f20072e14625c79b8eb77613f9384c1383a11bb1b66d9bfb795f621e3cde
SHA512 3d5b0d8ce8334461aca363313099f06ad61f8b66664e49765ed93748af6b46d708432c44ea50e140c11e69b7f92d8f1950000606c223c4e98f85961e72ffbb67