Malware Analysis Report

2025-01-19 08:04

Sample ID 240610-sr8hhs1grl
Target 9b24498efc20ecb0ac36bc99ffaf8b57_JaffaCakes118
SHA256 8327f9ab07b9394396fd8512c4622868ec2fbaccc1bfbf485222463fe0babc19
Tags
discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

8327f9ab07b9394396fd8512c4622868ec2fbaccc1bfbf485222463fe0babc19

Threat Level: Likely malicious

The file 9b24498efc20ecb0ac36bc99ffaf8b57_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion impact persistence

Checks if the Android device is rooted.

Checks known Qemu files.

Checks known Qemu pipes.

Queries information about running processes on the device

Reads information about phone network operator.

Requests dangerous framework permissions

Queries information about active data network

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-10 15:22

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 15:22

Reported

2024-06-10 15:25

Platform

android-33-x64-arm64-20240603-en

Max time kernel

5s

Max time network

169s

Command Line

com.zhangyangjing.starfish

Signatures

N/A

Processes

com.zhangyangjing.starfish

Network

Country Destination Domain Proto
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 udp
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
GB 216.58.212.227:443 tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
BE 64.233.166.94:443 tcp
US 172.64.41.3:443 udp
BE 64.233.166.94:443 udp
GB 142.250.187.228:443 udp
GB 142.250.180.4:443 udp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 142.250.180.4:443 tcp

Files

/data/user/0/com.zhangyangjing.starfish/app_crashrecord/1004

MD5 7ad77111234b703c06ccab7585d7e425
SHA1 c0cf54e2457a13e09077074b03d46d962cf2d54a
SHA256 0383fd69db1bf26049587ddd714b195f8ce74c238997a21a4dbb6a725425ec8a
SHA512 b82dd3f0d2304f930d665d8bf4eeaecaf1d6644e597553fccd9cb9b888896af4374549c1540ac55a966cb4e7a43a6ed1625e3bb24c355d2985a92722789c56c4

/data/user/0/com.zhangyangjing.starfish/databases/bugly_db_-journal

MD5 c8c96de2acb71d6c21ec523d2fadc02a
SHA1 0f482b264cf66190061ad8eb4b3f613ef186a754
SHA256 c9e6e860e6ed62fd115df8be71031c64e0c0439151b7899f20f229279ca2ef3e
SHA512 e2642b60be0d88812f8c18a4c992056f808aed39e985db29b37cfb50bf0f38e334ce4b8d350f0e8a3c73e345fe3d82d4ee46645c9b2f19716f4d22874f03f261

/data/user/0/com.zhangyangjing.starfish/databases/bugly_db_

MD5 7cde3674d85ffb52f50f91db81e23d01
SHA1 52fbeceff15154567a4c3a64a0d7c17c5b6c1f43
SHA256 8cc7da7fd691c577cf27d71e25250d0af31e6e177e359cf9e96a80b3494558a6
SHA512 31c8c570a09e3600349b0ca951cefe2484fde52b722efad94c543ce33f6e2be94158f3790cd6fc51e155fd793a8b0d6e5ad75f4f26ece509a9077976ebea0941

/data/user/0/com.zhangyangjing.starfish/databases/bugly_db_-journal

MD5 71f3339e3260b76616e4b6771a0a4d51
SHA1 065aa7ec22e64b9455af2db494016e0992e48686
SHA256 4a0dcd847a10e642d354fcdbebc6ac6e05452d78eb18e702152bf22c7cd8d702
SHA512 423184d4c7c86f8cc4e30e27fae49027f4562d96ea6f21d184f1722713d2c0eb600bef8881c5c32b558f69a0eef907429befb969c953ea43e33e96e5d3769848

/data/user/0/com.zhangyangjing.starfish/databases/bugly_db_-journal

MD5 3e67b148b434147c2efa52f5bc43909c
SHA1 39c066657aa1d6ab4b3aead288573dfc3bad0e50
SHA256 abaa2eb71860ee2f1689b482e01c276cd1bb5680b029b9709d894a665e53cebc
SHA512 cce34c685dfa712c2dbf78a99168c3344dc5853f852c56166ab8dff7367db302efb752a9b7a577174118684e8e050408c7dd40345a34682ca7e8ea9286d0d47e

/data/user/0/com.zhangyangjing.starfish/app_crashrecord/1004

MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

/data/user/0/com.zhangyangjing.starfish/databases/bugly_db_-journal

MD5 9d1637cf37bf899420847e2964b00847
SHA1 09cba4c70c4daf8d24b5266ed2d6ec1eb1ff47ce
SHA256 fbce5bddf3ea57770c1200976e534512eba67482b85e88f3cd3203190d60e721
SHA512 c1ab21f9a30fe06eae08577fad19b980ab9888d101c02ad9334f1d10c086fd4a4e0877279e8250e1e13ad7888a4c15363bc877dcf94f4554c955119106f175f3

/data/user/0/com.zhangyangjing.starfish/databases/starfish.db-journal

MD5 da36c0a9c23817a1f6a264ed2bad90a2
SHA1 201eb97cee0fe974feab3cd16c6ad57cacfe8ebe
SHA256 9ff8e4baa954bc94e0fdf2654876462445453c95ec7c457d1a9e47223216fedf
SHA512 aad6820200163bb4d32c4e69af17b3c0f156d9aa466e443c6fb19749461cafd01c7cda520442df804068994a16bc65b0690eb4c7c71d70af07ea9370ebbcb95e

/data/user/0/com.zhangyangjing.starfish/databases/starfish.db

MD5 905ba344f7fabd8c91779aea8502d19c
SHA1 34f607da16cff5d05ab33fc59d275643a3a54e05
SHA256 5efc203a61d43ab9e04671339819b054e8066a7147e67e183eda2e6f579441de
SHA512 d1e597a479d4a09704360822f7b893ee9b1cb681d31c78a2aabdad4285f9a37b813ff72a2aed438e272b1f63878310043de953d4818663dd7b43e8b10d36b0f6

/data/user/0/com.zhangyangjing.starfish/databases/starfish.db-journal

MD5 4e817452b618cab04d7c3772cf052ad0
SHA1 ebd61623502b67c776691ead03e6d73b19548091
SHA256 3f46d3ec449240a6f99ce8cb45932375e1d3f400e3719bce6963da72c459b7e9
SHA512 f0091a2b60871d3d22113d13430013fc1ca917a53fe5c8bf792c7284b88d7bf68eb4affb227de21c3227f56fa206c6d8bedc458230e2dad93cea23a49c31b1c8

/data/user/0/com.zhangyangjing.starfish/databases/starfish.db-journal

MD5 39b9b84e50576033235cf06fb7edf848
SHA1 715c62c9ab7f0f78ae7cf0c92ca761351c0567ac
SHA256 32e5ac6a60d6cc0865a1c8e6a1247699d668b7ec96175246cfb0bdec30452b53
SHA512 300df282206bf42dbff71aa020f77ae3018be5f5799be0088a84a380abbadc400717b48ca01ae283447905c669f77cd5a1014105aaf56fa2d25867dec719818d

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 15:22

Reported

2024-06-10 15:25

Platform

android-x86-arm-20240603-en

Max time kernel

158s

Max time network

180s

Command Line

com.zhangyangjing.starfish

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A
N/A /sbin/su N/A N/A

Checks known Qemu files.

evasion
Description Indicator Process Target
N/A /system/lib/libc_malloc_debug_qemu.so N/A N/A
N/A /sys/qemu_trace N/A N/A
N/A /system/bin/qemu-props N/A N/A
N/A /system/lib/libc_malloc_debug_qemu.so N/A N/A
N/A /sys/qemu_trace N/A N/A
N/A /system/bin/qemu-props N/A N/A

Checks known Qemu pipes.

evasion
Description Indicator Process Target
N/A /dev/socket/qemud N/A N/A
N/A /dev/qemu_pipe N/A N/A
N/A /dev/socket/qemud N/A N/A
N/A /dev/qemu_pipe N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A
File opened for read /proc/meminfo N/A N/A

Processes

com.zhangyangjing.starfish

com.zhangyangjing.starfish:filedownloader

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 api.haixingmoni.mobi udp
CN 47.92.164.222:80 api.haixingmoni.mobi tcp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 14.22.7.199:80 android.bugly.qq.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 panic.haixingmoni.mobi udp
CN 47.92.164.222:80 panic.haixingmoni.mobi tcp
CN 47.92.164.222:80 panic.haixingmoni.mobi tcp
CN 119.147.179.152:80 android.bugly.qq.com tcp
CN 47.92.164.222:80 panic.haixingmoni.mobi tcp
CN 14.22.7.199:80 android.bugly.qq.com tcp
CN 47.92.164.222:80 panic.haixingmoni.mobi tcp
CN 14.22.7.140:80 android.bugly.qq.com tcp
CN 119.147.179.152:80 android.bugly.qq.com tcp
CN 14.22.7.140:80 android.bugly.qq.com tcp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 14.22.7.140:80 android.bugly.qq.com tcp
CN 14.22.7.199:80 android.bugly.qq.com tcp
CN 14.22.7.140:80 android.bugly.qq.com tcp

Files

/data/data/com.zhangyangjing.starfish/app_crashrecord/1004

MD5 70cec749de8055198b2084c7c142d275
SHA1 55ae2c566af2121a129d4f72542d0a96512e3b0a
SHA256 ed64d1d2c0d04d1b7442db21828d20075f06c0f0d76dd6dcfc71838a7e4701f7
SHA512 c3f36016b0da5fc175b5692d048963ff59dc36b6c5655af54b70b2e468d7fea39b473a707fd0cc860473c6daaf26e25cb2a91c0a64737249941b1100753a6a0b

/data/data/com.zhangyangjing.starfish/databases/bugly_db_-journal

MD5 e6c26ad754fc89dc79e858dd76660690
SHA1 f4b679d4c83a2c0e8c955d7bfdbee15d9aa61ce3
SHA256 e900b2bb69dafb716926869ef470a17798aefe4e55f87037180455845d3a58bb
SHA512 39e033bce139d2bb7dba8dd89f8a357c0529188d15dbff7bfe022229b93b05271f44275470de6eacfa469e3b4b16a32030ccbc4d1d9e4220eb1ee98c82a833b2

/data/data/com.zhangyangjing.starfish/databases/bugly_db_

MD5 aa99281ce0cd69a9302f8b64b918ad75
SHA1 ccafc0e5fb16198e466b209a888301f4100fafe8
SHA256 a3cde8388c50e78c7b3c8dab1d0c46c64c375248031adbb6a5802e3da65bb431
SHA512 a8b80f09a555652d3e4b9775b6aa58341dad7fb120509e128df417533ba361353b19530306e8691f1ce5fc0c69f1a89d29bd2eb176291a5e85b945d14c9eb085

/data/data/com.zhangyangjing.starfish/databases/bugly_db_-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.zhangyangjing.starfish/databases/bugly_db_-wal

MD5 90a260b2b2352144df90607a640a4c07
SHA1 664d802c17a5311cd55dea80c5b7bb25ca8414cc
SHA256 8dafcd18119b321b41645ed42d784ba79c8d212235a6276ebd2d02f9d9c231b4
SHA512 c6a5bd3ef795e4f639ffb91b54934e2124ba4e77986bebc08fd9dd52c53e36f1eec93cadf6c0cbda7d984277b17485296e6c94138461f58e6e23d329bec65456

/data/data/com.zhangyangjing.starfish/app_crashrecord/1004

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.zhangyangjing.starfish/databases/starfish.db-journal

MD5 4ff9feea07afa1dc503b081c2412bc67
SHA1 545d7b874500416cc7e7e705bbdb0881efc4780d
SHA256 62dff12a5d06ae611e66a6c54c046f754916d49a5fbcf8245592486e420a895c
SHA512 ac38fb0fef05f687c0d060de718034c9566cba35b130d62fa910d518f9eff9fc4060b10a93e0719b6ad2e2f0c9c58a5a5a2f4460b4c6db8f5c1e50861fcb32ce

/data/data/com.zhangyangjing.starfish/databases/starfish.db

MD5 244fba6ca228a04a269730e280a10cfa
SHA1 1d9a8fef8adf1238d9ee5573dedc8723403a9c5c
SHA256 4c13ad2e91fa95a8b284eda64fb6f28f5cda0c56920f32cb1c3ada88a5d35d26
SHA512 d599f03af358dc89efa48d11ab4d56faa7596f111f2ece416a15ec6241ef2139959cb5b62d3f3da641e0e6cd6d18386898c078a2000c1e4af21d9622661a479d

/data/data/com.zhangyangjing.starfish/databases/starfish.db-wal

MD5 67a30af8eee6fa2316a3d54675e20534
SHA1 0dcdbc31487503080fb7c2031f89c7d50085d114
SHA256 3596db776ff7ef02ece3fc12d0029b0bb00dfc80f060f4f0bf610fea7a1fbd68
SHA512 1d91cfe99275bdfb9266a0ecbbf19b81beba6fb36cbacc5a7d194c1af42ac174b6796c3f30aee12a6a999bde67a66f733a0ac62c4142d3604c06066da73e7d2e

/data/data/com.zhangyangjing.starfish/databases/ua.db-journal

MD5 3625996aabb588661c3e918cc42ca2f9
SHA1 67a84058573e35396ba99c2ad5844570534de083
SHA256 eb49dbcf4dc197f97e2ac5a6893c452f952e73c3ccf9079cbc7205f408bcb5e5
SHA512 6f850ad523d7c9e7c10d7c61a5868c93d55bc1ab3a6e2cdc1825f1a06a9b272451a3d0fc7619b115e8c0a9757a53207d485174e776987ab2c6cff81c631d7eba

/data/data/com.zhangyangjing.starfish/databases/ua.db

MD5 bbe224d144279d63e096e0728ff67c26
SHA1 ca38b7d2ae24ec0cb264fc1100502c938c8f4422
SHA256 5434eda97f62e6505178d903e27493f18e70423834304cb04232459b7e42b69d
SHA512 e00fcf395c75ead587b6ad7955fd3fc906b97049cccaba0e9896f8220924afbf5ce1957b0698f0b37bea3c21ed3bd49a5aecbafd4d7ef9329be1ed5258f8a06b

/data/data/com.zhangyangjing.starfish/databases/ua.db-wal

MD5 a7b4d676269b43726fc7bd6a05160656
SHA1 2ca965be827e99e1a4628cd0c5b3106b62136571
SHA256 c234c4c2330589cba1c0357fc48bd4fa0de2336c12b8c401f4f41a35f423ed20
SHA512 25e203083306671f8588f870cdcb59912b4a81a7831709e24898b22128af4f2fe6bc0826ce4f6572d236511f79a801da621fc5c415b16dd1c1fef7baacd852c1

/data/data/com.zhangyangjing.starfish/app_crashrecord/1004

MD5 c969f7d64d0823c94bc0f97859d73350
SHA1 47ae29e9e95278f3704409185590da6ae894c239
SHA256 072c16bf71d03c16cc23076d2fd744545e4f1aebfb8e24ffe0d047b74660c51d
SHA512 ffc261da75ba291c3c25a6be1274efe1fe4203e4ede87373f15c9afefa634303d32cf60dfe35bb26958ba49f14656e2ff81a99512f6d82ba404f1ab4fba326ea

/data/data/com.zhangyangjing.starfish/databases/bugly_db_-wal

MD5 d7f2430d5eb574fcb851917f5e1b9d0e
SHA1 61bc5887b5318d243a8765d1ad56538856d3c4fb
SHA256 039a937581d8f67841614ddcd83962c4872c98485bf3b73aaa7f57eaa73e12c8
SHA512 f655d964a0c5694d73595c4cbe55d57f7e126c92a77cde04147de717c6b7546ca50db5c5af2286e032856ba3bb5cc56fd646168e9fb7edbc2c5e47ead7c099a1

/data/data/com.zhangyangjing.starfish/cache/journal.tmp

MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

/data/data/com.zhangyangjing.starfish/databases/cc/cc.db-journal

MD5 f0e00ff57b8f521b1e2d9defccf769cd
SHA1 d1744555bfa4efe8384a7c435c11c1ca0a90b859
SHA256 b84bc5b3da926bcb10bf52c0c012a949836cd360ea5f39097cbe4dc3b1aeca0a
SHA512 3448af7d13b31216ed1ec89b169ec65b6562a73df15df5b51c9e87d43b3cd5dd4483485ab20c32b945c63d28ed30cf7826dadee8c41c6106921227c029d1d9fd

/data/data/com.zhangyangjing.starfish/databases/cc/cc.db

MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

/data/data/com.zhangyangjing.starfish/databases/cc/cc.db-wal

MD5 1058e35c1c6c99f17c7719a9dd8ba7b8
SHA1 efb14a29fe6199e6ad837589bb6c46d63dd7e722
SHA256 86a7354cf741102cea4d51b31adef154c339d5084a27296cfd79d6c58ceb989e
SHA512 460044ce0a8ef826dc28713255d44510dfc1e5543fe8f5fbb857a3e1edb47588b4416ca1b052acb1a4b0db69b976187bb20418cf564cd26c00eaa5790f421a10

/data/data/com.zhangyangjing.starfish/files/umeng_it.cache

MD5 d56a9240fffdfd4e29e81de3d9717484
SHA1 00305951ea954913fdf4f8618cdb3b45a45d3626
SHA256 31e80afce876768d5c453b82944ebd4d8bb680b1174e50098bcf48f540806d59
SHA512 585414cf0367ca920533f1181f2de595eee9a26b25818fc6cd6d822177191e3be9b1861c3dfaeb8c0f0ce6e585199cf321c213ab74e51cf1415ad81b33aed0b8

/data/data/com.zhangyangjing.starfish/files/.umeng/exchangeIdentity.json

MD5 0e6eeaafda8c44c9836ccfd577eeda22
SHA1 37047c473f8307c861199c3f22e8bd02f83fe01c
SHA256 ce8d7f438e576b31f4d6573cdc21dddc8b0a9aa11c620199e608edf25cb26f60
SHA512 6392e524dcf0febd44a9ba3b5d954873a24d3a6a3cf6a92f34b9c67cbabc577f51807367c6d7f926a3857765e643dfb5d343b3baef05db7ff098f2937568c7a3

/data/data/com.zhangyangjing.starfish/files/exid.dat

MD5 5417ca0f5d42ce347c9fdc2516d2c9ec
SHA1 a76465ed0a540fcd44788c302264ec2290ec5c3a
SHA256 ca2b7fd92195c3beee0fae9f8db159703f7b63daa4fadd48527b7d90b04dfcb7
SHA512 ed56c89f96b7220382b1dcbf370abd6b45a33bf2814c3ec03e56dcfa28aee5e771bace9abdfde5274dc817d23022a56dff2994f546584549333c880b4e192e6a

/data/data/com.zhangyangjing.starfish/databases/ua.db-wal

MD5 38d8814a3c98897b367c9cddd89aa676
SHA1 2e7c7e23e64be6f40b004e265b6ab13d09910875
SHA256 2e4070664cc3aac33a2406713de7d6a0e4eafd4f3e7b8b708217f2b9aae1cf1a
SHA512 236251a89612b702adebbf92b53fb37d68590a491dcf20ca735fd44888ab5d17cbd8fc4be0644c7330234d78880f4f491311c80b31a8612085d339cc58ada2ee

/data/data/com.zhangyangjing.starfish/databases/ua.db

MD5 d604a3bf1f8d992cc320ea5b1f7609bd
SHA1 247f88df0b55c7d523ea5398637711a0e4a483a4
SHA256 329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17
SHA512 67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

/data/data/com.zhangyangjing.starfish/databases/cc/cc.db-wal

MD5 6c030011c5dfa6e07b280ada3f24c62f
SHA1 01fc68a9d65cf20ded99a57936f5994935c5e367
SHA256 367706303e2b9d0f0d79299927eb889b0351dfd4c155dfff0c8c05e5ef3eaff8
SHA512 64abbb8ecbff13a31d3f32377815f0288ef8abd2c28738012f4df25424204b970101b27d111830aab2900853263a8b36d83a058593ba7871937e2ddca804dabc

/data/data/com.zhangyangjing.starfish/databases/cc/cc.db

MD5 ce6135aa1b1fe4f2c2db2a546d2a5558
SHA1 79b59582154017aadab783dc266fcb158c252940
SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
SHA512 2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

/data/data/com.zhangyangjing.starfish/files/.imprint

MD5 37093231587ee339e947de1ee4ad3f68
SHA1 3f415dc90408938ec1b93cef0ee334b55f92cf25
SHA256 29e0ef0c974e3d298d9590258e0199604f71098b72c752e3dedfbc65e6249834
SHA512 2c409dd0fce2c0fa9e5d80626b9da805a84bb39245d654ac5b7d36170620e5dd2cb1298a8fb9d6688ba9417a47d1322cf111ff4bbff30a75fdcf3fc490ec65d7

/data/data/com.zhangyangjing.starfish/files/umeng_it.cache

MD5 d4533fb4e324305bd20d5e349dd0f938
SHA1 2e5b23160c0683d6177c589f8682661205d91bd5
SHA256 ae61b9ce6ad12966f67553e80007d8ef4a97e0dd04ea2442245d7a8deea1354e
SHA512 18b59a87bb9409eba979dfead26794177508cc24565695bbff9a3f8f8d72dbeb8a33b7c14aa58e701db59d92d9b212672ca324343ed7812aecf8587a697a3c06