Malware Analysis Report

2024-09-09 16:38

Sample ID 240612-vkqp8swemm
Target a16e2bebc41ff43177b8abd2d967a3f8_JaffaCakes118
SHA256 26ab7796b1dbc2593b93c9dc3d07d8a1c4d7a40c9edf507ba72dd556e4dac083
Tags
banker discovery evasion impact persistence collection credential_access
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

26ab7796b1dbc2593b93c9dc3d07d8a1c4d7a40c9edf507ba72dd556e4dac083

Threat Level: Shows suspicious behavior

The file a16e2bebc41ff43177b8abd2d967a3f8_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

banker discovery evasion impact persistence collection credential_access

Queries the phone number (MSISDN for GSM devices)

Obtains sensitive information copied to the device clipboard

Checks Android system properties for emulator presence.

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about the current Wi-Fi connection

Queries the unique device ID (IMEI, MEID, IMSI)

Queries information about active data network

Requests dangerous framework permissions

Reads information about phone network operator.

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 17:03

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-12 17:03

Reported

2024-06-12 17:03

Platform

android-x86-arm-20240611.1-en

Max time network

4s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-12 17:03

Reported

2024-06-12 17:03

Platform

android-x64-20240611.1-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-12 17:03

Reported

2024-06-12 17:03

Platform

android-x64-arm64-20240611.1-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 17:03

Reported

2024-06-12 17:06

Platform

android-x86-arm-20240611.1-en

Max time kernel

140s

Max time network

131s

Command Line

com.kinuo.tokyozombiesurvivor.pj

Signatures

Checks Android system properties for emulator presence.

evasion
Description Indicator Process Target
Accessed system property key: ro.product.model N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip N/A N/A
N/A /data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.kinuo.tokyozombiesurvivor.pj

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip --output-vdex-fd=60 --oat-fd=63 --oat-location=/data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 client.bayimob.com udp
US 1.1.1.1:53 client.aqmob.com udp
US 1.1.1.1:53 client.aqmob.com udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp

Files

/data/data/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip

MD5 b77430b4f0ea3e73fca73bc73982fe0b
SHA1 974e495154eea081242ae9771b31f5ecaff69249
SHA256 a49c8f8af89fa5d6c27715bce8d8c0f856c06894bb364c1c8042a1785318afa3
SHA512 d4f3e4805b78324f02e22698a35443095290eae5b262fa84e810e2de617af7ae7b98cf2e7b81aec5e49f0e43dea895cd3c9c38fcb7957267e3e971bcd2b41eac

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip

MD5 7735479e1560b713d9158ef0191c9e4f
SHA1 d69d6536b15035443ee4f7336ffb893aadedf593
SHA256 dbbd06409dedea647214fda2f481774d744e22e79e41bdb1945c4fd6bbc75bf5
SHA512 89bbc99e38c1ceac83fad539e2cfc9bb188b9790cb7d9d6af4a4c1fcd075822302d6d2f5b5ec6de70227829d3de488db0300477d1634d3b7df8c8f8f2288e0bd

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip

MD5 9c77c82ab8ab2099e3d5dcd6cfb36309
SHA1 16117fec123cccb91d0e02c9b4bde752fa8a9434
SHA256 6f2716e68c22512340d5dd3305077e9e9f14eeda5ef062abff0d07402cb92373
SHA512 e67af9f9085fd67622ca1c53e679eb5214c65e6e9421fc15e46c939e2fba320675345beea13dd23dca7afd1cd75e243d423388feab437a7b3dd78afe1d6b1a47

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 fb606f215ac9dd0a0499cfea9ba891bc
SHA1 cce25b05584959b367c4597b964565c5aabed531
SHA256 58cb8b825d6ecf6064c0f1eada7e968940eadccf0cd1e393abceb75470e3d986
SHA512 e119d6b7c2719f2b74a18d0a58d98ad324c402d2daad442f08a9952089a043e8ed9434e98efe8b9e661b81d16c1f09aaaf85ddad87050fd3c3a0f2209f1a55cd

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-wal

MD5 7e5debf6cf6ac620984d5032202caefa
SHA1 5e99064b54feec2b83bdf04fd76a6d0a0f80e509
SHA256 90194f9a68bfce869739820aa467a53aaf511f1ad9b24446478732080134a121
SHA512 d2d573cb5ad5a46182532de07030f7b31e67a079762827910c166db6f1b2530bd646e8e0da7a3d3cf8fe63bded03a1e763a7f08de9c692938d58fbc118da8cae

/data/data/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/oat/classes.zip.cur.prof

MD5 868ccd347ca6f819cd457cbbc6f84579
SHA1 4978b387b0ff0290fa962bb6fbc027bd195a06de
SHA256 af7179770517bc007ce8f2b91185ffcd86c31d46abd04ec625ae7d1b6832f903
SHA512 86e1140232637e284cd23884dde995d6320ebf87a48d13c441338a128172ecde65c1464374cc33a74c41120669c8eeec86f93ebbdc81eabaa368e21d6355baaa

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 17:03

Reported

2024-06-12 17:06

Platform

android-x64-20240611.1-en

Max time kernel

139s

Max time network

146s

Command Line

com.kinuo.tokyozombiesurvivor.pj

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.kinuo.tokyozombiesurvivor.pj

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.232:443 ssl.google-analytics.com tcp
GB 142.250.179.234:443 tcp
US 1.1.1.1:53 client.bayimob.com udp
US 1.1.1.1:53 client.aqmob.com udp
US 1.1.1.1:53 client.aqmob.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 216.58.204.78:443 tcp
GB 142.250.200.14:443 tcp
GB 172.217.169.66:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp

Files

/data/data/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip

MD5 b77430b4f0ea3e73fca73bc73982fe0b
SHA1 974e495154eea081242ae9771b31f5ecaff69249
SHA256 a49c8f8af89fa5d6c27715bce8d8c0f856c06894bb364c1c8042a1785318afa3
SHA512 d4f3e4805b78324f02e22698a35443095290eae5b262fa84e810e2de617af7ae7b98cf2e7b81aec5e49f0e43dea895cd3c9c38fcb7957267e3e971bcd2b41eac

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip

MD5 7735479e1560b713d9158ef0191c9e4f
SHA1 d69d6536b15035443ee4f7336ffb893aadedf593
SHA256 dbbd06409dedea647214fda2f481774d744e22e79e41bdb1945c4fd6bbc75bf5
SHA512 89bbc99e38c1ceac83fad539e2cfc9bb188b9790cb7d9d6af4a4c1fcd075822302d6d2f5b5ec6de70227829d3de488db0300477d1634d3b7df8c8f8f2288e0bd

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 197bcf01d8dc23123e119a5f1445c5aa
SHA1 7eb3b296b3834f7f0a7ddf9b577a7fc9f953982e
SHA256 8248b932b133c0510d5ef72814ea62bec7a4928094178be129252631aa995ef5
SHA512 671dfd27e2ea5a9e681de0bc3e6d7013e71bbe26fb7d62456ec32bd863c622f961712dfc183ab78f6147b71d1ce5a7ea39634bd532426f8b610d35572d35699d

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db

MD5 7ef26df86c339f2d666e806f58f0a929
SHA1 ac94c3b2af7aabe554cc60569dcca29279617279
SHA256 62c12eda1b614408d06ccd25d1bceda328b6730b6cb241b75bda05e8b6dabe75
SHA512 5c4f3411b1edc4363b2a82d76cb70b9b3c44a5265684ce9db729f5cc4f02ab60f19d775f19e7e4dfe54d92cc5bd68a42812cafb5b44f2b65cb50485fd1d3ed7a

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 a4dfce96c29dd05a97f762909430842a
SHA1 bc54b0fc27e18f2ec7000376b2c0930c188e0c1f
SHA256 077155b0f3edba8aad78c723ea6f856bc93d8c5714b1213ff9498ca5d7544fe2
SHA512 164993412eece17e7d6b0a5a561a3548231b47c2cb6411e8cab8431e1a6c6f07f5c82251f41fcf885df5a1f1543efe15afa4a2094f885328766fea8f62e9a7c2

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 ed38ac851a96fe7e612a9870ead926d0
SHA1 ffd8dab716121d2a64dd5c9a825f89b8c56e1223
SHA256 2c5edc2cca5810cb27e7beeb7eb82b113df15c7dbb49498d88c7771a4bf6d471
SHA512 aee7c55843cf07226fd778a1af785733eb7ad5b1c8575d95febfb06cde0f8cd82c4d8d57b037cb64bc18db61cb078ca2d5e5a7a2c53e368ba93a17d6fd5a3a58

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 ced031c0c17a534ceffb68b6d86f108a
SHA1 dab0112ebec56066b2c8ac677c5f46994625c33b
SHA256 435b5919166dd577d4c5cc1d991bdbc727fd94b2492968715c96bccd8fa263ea
SHA512 cf3e08fb162d1fbed5052627f354314bbfcac51d72c4380547aeb430e67fab859fae9582830e2c030e8b2946c3302368819755a7adf377e5e83b84d927de2daf

/data/data/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 1ce1c1ed919f0e7703b395ab4a351434
SHA1 734efbb6cd8b07b4f27ee512c1fc59764fead8b5
SHA256 4afe07835b2f21a38086555d2d0156b5e30976ba58af9cd6f9b92af141d713b4
SHA512 cb4af1199379f86c0f5accc8b92151006e032824cda341f5b34b568a958d5cf425f71e2b498b39de91106c5a8ef78bbbdb813ad263af0e8c0da084c763bf62fc

/data/data/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/oat/classes.zip.cur.prof

MD5 76ecb327bcb3fee6c3c5a3ae2528d4b6
SHA1 5d1e6c152edd07ff766be53d7bff947a7ee30e05
SHA256 d4b817f5301bc0ab901088de683cd0034b2cf3286ecf81ef81434d62dd43dc4d
SHA512 ab9af6a7ecb6d60ec4bc903d8510d194de611b59f6bf892304f1612d4211e91100908d68a924218f66c141848f7c909bd21b40ac5c4e410e3cfd10aec3a39630

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-12 17:03

Reported

2024-06-12 17:06

Platform

android-x64-arm64-20240611.1-en

Max time kernel

138s

Max time network

131s

Command Line

com.kinuo.tokyozombiesurvivor.pj

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.kinuo.tokyozombiesurvivor.pj

Network

Country Destination Domain Proto
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 client.bayimob.com udp
US 1.1.1.1:53 client.aqmob.com udp
GB 216.58.212.196:443 tcp
GB 216.58.212.196:443 tcp

Files

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip

MD5 b77430b4f0ea3e73fca73bc73982fe0b
SHA1 974e495154eea081242ae9771b31f5ecaff69249
SHA256 a49c8f8af89fa5d6c27715bce8d8c0f856c06894bb364c1c8042a1785318afa3
SHA512 d4f3e4805b78324f02e22698a35443095290eae5b262fa84e810e2de617af7ae7b98cf2e7b81aec5e49f0e43dea895cd3c9c38fcb7957267e3e971bcd2b41eac

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/app_bbb_data/classes.zip

MD5 7735479e1560b713d9158ef0191c9e4f
SHA1 d69d6536b15035443ee4f7336ffb893aadedf593
SHA256 dbbd06409dedea647214fda2f481774d744e22e79e41bdb1945c4fd6bbc75bf5
SHA512 89bbc99e38c1ceac83fad539e2cfc9bb188b9790cb7d9d6af4a4c1fcd075822302d6d2f5b5ec6de70227829d3de488db0300477d1634d3b7df8c8f8f2288e0bd

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 b965494e7da17e41f53331ae7914f69f
SHA1 6cf2f72f9035d477094a69ce886aa551d9193584
SHA256 582ecb151073cbce93c68560d90a3528a60f71e3669ad987260ba8421256e668
SHA512 77bd0a56b587e4a39f271fd28d78a80f278547778f49ac44d3e5da786a54f4a30e1bc6cfd5e2d3da8feb208695c13c2f7ef167412fb39857128f24bcfb2fd52a

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db

MD5 bd0df1ec32421abbb3e6f410318233b2
SHA1 cc5a06ff44daf12168b66d5d54f2a48ead5dec49
SHA256 4fbaea690a1f0aee6a847a415afe3acd168602e0154cea8db2d05ffaeed7f9bc
SHA512 4ec9dca7bc5b2bd57366acf1b3ddfb2b907484c3e955e925170be90642bc376c6488f7142127b5083ddfb0cff105c91a558f0e5ffa5a3627d921673af5de6382

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 ed6dfdd3316cb7e8224a846dc5c2ad14
SHA1 5d9895dfb856efb3c68c58cce1a39d5b539a6ef5
SHA256 14970498dcb371192503c4641e32a4c3e2d6db171883fde38089063ac36076c9
SHA512 6b2c6d782baefeb3eb2fa2ddeb1f0022e63114192dd9656d5a213a093687a3aa9b9812d5851eeca19ba86a764bcd9864a03c40c228e797870fca46f3264b4ad8

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 b9f0ec9825e8ac91872f378b914e00ab
SHA1 149e55c850cf4d3f06f9aaba10330bc768713d38
SHA256 fac3a5446793a877950de886f9298b8cdec2d8e49a8fe7efbe3f7256118d111d
SHA512 f5481fd33a20e4395d709db79f58a159556021db61ca6472a9c1e79d9db3bdac75d03bb304cbcb13e21ade6b852fe483c5ccab7e1261d05f92ef25e8ea59db15

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 e945145d2ca206530f9eb996c45fb6b0
SHA1 7ec4de1e79617d3a0945a97a058e8320eebe4c44
SHA256 3708fbe044cf4eddf1793196c3cfd070ee36c7ca2a9476602450c001777e0c52
SHA512 8bf7466d2ee17f8e470106b0c489cb4aa985462721fbb50bbfa0d4521350984ff8f6f8f580f66ffcf1c0770be7d43d7eaad48f609e6c717febec3f708c0e7070

/data/user/0/com.kinuo.tokyozombiesurvivor.pj/databases/bbb_a-db-journal

MD5 4125c1fcb57d2d9f49176c6bdc160a9b
SHA1 8abbd69d751aaad9f2b4fb60e1c61779c368cc36
SHA256 b8856568afda662cc6ab78e285db4892930a9c08532c07878d66bff506561180
SHA512 d3a97c8297fae83b0e29f4447fbbb2f1569b1f27047cfcbb7d0eb3bf1f1fe519b8738eeca0817c5bab9d3110605c8a848f982da42f33b2b0da4bd8e78084d6aa