Malware Analysis Report

2024-07-28 11:28

Sample ID 240613-f9s5bswbrb
Target a4038c77b3b97973870df63d21ef93b7_JaffaCakes118
SHA256 3ba7daf000357806b477889fb923fdfd5da807e507fae871073fb9b9046db7a4
Tags
banker collection discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

3ba7daf000357806b477889fb923fdfd5da807e507fae871073fb9b9046db7a4

Threat Level: Likely malicious

The file a4038c77b3b97973870df63d21ef93b7_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker collection discovery evasion impact persistence

Checks if the Android device is rooted.

Requests cell location

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about running processes on the device

Queries information about the current nearby Wi-Fi networks

Reads information about phone network operator.

Requests dangerous framework permissions

Queries information about active data network

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 05:34

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 05:34

Reported

2024-06-13 05:38

Platform

android-x86-arm-20240611.1-en

Max time kernel

169s

Max time network

182s

Command Line

com.homieztech.www

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/app/Superuser.apk N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A
File opened for read /proc/meminfo N/A N/A

Processes

com.homieztech.www

com.homieztech.www:pushcore

getprop ro.miui.ui.version.name

Network

Country Destination Domain Proto
GB 142.250.178.3:443 tcp
GB 142.250.187.234:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 api.exc.mob.com udp
CN 180.188.25.46:80 api.exc.mob.com tcp
US 1.1.1.1:53 collector.bughd.com udp
US 1.1.1.1:53 m.data.mob.com udp
CN 180.188.25.47:80 m.data.mob.com tcp
CN 180.188.25.46:80 api.exc.mob.com tcp
US 1.1.1.1:53 s.jpush.cn udp
CN 1.94.137.180:19000 s.jpush.cn udp
US 1.1.1.1:53 update.sdk.jiguang.cn udp
CN 1.94.137.180:19000 s.jpush.cn udp
US 1.1.1.1:53 app.homieztech.com udp
CN 39.106.108.44:80 app.homieztech.com tcp
US 1.1.1.1:53 sis.jpush.io udp
CN 124.71.159.41:19000 sis.jpush.io udp
CN 124.71.159.41:19000 sis.jpush.io udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 113.31.17.108:19000 udp
CN 113.31.17.108:19000 udp
US 1.1.1.1:53 _im64._tcp.jpush.cn tcp
US 1.1.1.1:53 139.9.135.156 udp
US 1.1.1.1:53 139.9.138.15 udp
US 1.1.1.1:53 119.3.188.193 udp
US 1.1.1.1:53 im64.jpush.cn udp
CN 124.71.183.120:7000 im64.jpush.cn tcp
US 1.1.1.1:53 tcp
CN 124.71.183.120:7002 im64.jpush.cn tcp
CN 124.71.183.120:7002 im64.jpush.cn tcp
CN 124.71.183.120:7003 im64.jpush.cn tcp
US 1.1.1.1:53 m.data.mob.com udp
CN 180.188.25.47:80 m.data.mob.com tcp
CN 124.71.183.120:7003 im64.jpush.cn tcp
CN 124.71.183.120:7000 im64.jpush.cn tcp
CN 113.31.17.106:7000 tcp
CN 113.31.17.106:7000 tcp
CN 1.94.137.180:19000 easytomessage.com udp
CN 1.94.137.180:19000 easytomessage.com udp
CN 124.71.159.41:19000 easytomessage.com udp
CN 124.71.159.41:19000 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 113.31.17.108:19000 udp
CN 113.31.17.108:19000 udp
US 1.1.1.1:53 m.data.mob.com udp
CN 180.188.25.47:80 m.data.mob.com tcp
US 1.1.1.1:53 tcp
US 1.1.1.1:53 tcp
CN 124.71.183.120:7003 im64.jpush.cn tcp
CN 124.71.183.120:7000 im64.jpush.cn tcp
CN 124.71.183.120:7000 im64.jpush.cn tcp
CN 124.71.183.120:7002 im64.jpush.cn tcp
CN 124.71.183.120:7002 im64.jpush.cn tcp
CN 124.71.183.120:7003 im64.jpush.cn tcp
CN 113.31.17.106:7000 tcp
CN 113.31.17.106:7000 tcp
CN 1.94.137.180:19000 easytomessage.com udp
CN 1.94.137.180:19000 easytomessage.com udp
US 1.1.1.1:53 sis.jpush.io udp
US 1.1.1.1:53 sis.jpush.io udp
CN 1.94.9.210:19000 sis.jpush.io udp
CN 123.60.89.60:19000 sis.jpush.io udp
US 1.1.1.1:53 m.data.mob.com udp
CN 180.188.25.47:80 m.data.mob.com tcp
CN 123.60.89.60:19000 sis.jpush.io udp
CN 113.31.17.108:19000 udp
CN 113.31.17.108:19000 udp
US 1.1.1.1:53 tcp
CN 124.71.183.120:7000 im64.jpush.cn tcp
CN 124.71.183.120:7002 im64.jpush.cn tcp
US 1.1.1.1:53 tcp
CN 124.71.183.120:7000 im64.jpush.cn tcp
CN 124.71.183.120:7003 im64.jpush.cn tcp
CN 124.71.183.120:7002 im64.jpush.cn tcp
CN 113.31.17.106:7000 tcp
CN 124.71.183.120:7003 im64.jpush.cn tcp
CN 113.31.17.106:7000 tcp
US 1.1.1.1:53 m.data.mob.com udp
CN 180.188.25.47:80 m.data.mob.com tcp
CN 1.94.137.180:19000 sis.jpush.io udp
CN 1.94.137.180:19000 sis.jpush.io udp
CN 1.94.9.210:19000 sis.jpush.io udp
CN 1.94.9.210:19000 sis.jpush.io udp
CN 123.60.89.60:19000 sis.jpush.io udp
CN 123.60.89.60:19000 sis.jpush.io udp
CN 113.31.17.108:19000 udp
CN 113.31.17.108:19000 udp
US 1.1.1.1:53 tcp
CN 124.71.183.120:7000 im64.jpush.cn tcp
US 1.1.1.1:53 m.data.mob.com udp
CN 180.188.25.47:80 m.data.mob.com tcp
US 1.1.1.1:53 tcp
CN 124.71.183.120:7002 im64.jpush.cn tcp
CN 124.71.183.120:7000 im64.jpush.cn tcp
CN 124.71.183.120:7002 im64.jpush.cn tcp
CN 124.71.183.120:7003 im64.jpush.cn tcp
CN 124.71.183.120:7003 im64.jpush.cn tcp
CN 113.31.17.106:7000 tcp
CN 113.31.17.106:7000 tcp

Files

/data/data/com.homieztech.www/files/jpush_stat_cache.json

MD5 d3e9abc90046979c74213e1525a41057
SHA1 e87caa613e762812165ad75b26acfad7040af797
SHA256 ad0d236ed40af08b0c1e2434dd10a5dc99be967fae532de8078b9cff1beeca36
SHA512 1a62de7bff9bf77292f461b8a338b11cdd395ff9562fd01bcd799b2e733ef40281354a0eef1d7f655b489ea5f5a94ce5aab52840ad3a8518aecb2d23f6aa0acb

/storage/emulated/0/Mob/comm/dbs/.duid

MD5 88e3c498016ee250369fc8e82a0ebac0
SHA1 6c6b095e5b60084ff1b9b785ba363d2b48452352
SHA256 213f96f908ae541af49fe5ccfebe19a6d7e0859ff66d90f26c00e290dd79e820
SHA512 1c17c294ca1ba0958b469dd117ab2a8470a419095709275a599900df4011bf29c03b96f6e2158c9f7101ea14a7ca2dab2b3c5ab87e2d8893f4bc2d5f18854ad8

/storage/emulated/0/data/.push_deviceid

MD5 2af99c5300347e89747be94698332a77
SHA1 cb06ad9ee33b13f38f544f71f895436670f1823d
SHA256 72dfdf99a321829e30af5590d7992156dec0234e84f9a9467751c5f275e6fa6c
SHA512 72e76bf30d28f1a174e7416e16534fbb12b3d3f43f54729935ff72eee3ee2c9f6e735f8bacccc981f4b6a332db03bb4e47327e61b439c9ea686225a505822c80

/data/data/com.homieztech.www/databases/thinksns-journal

MD5 7d7ddedaa1ed5b9cd22a205d1639f659
SHA1 905c42f54a3b2a66e75e54b9dc5c5bde4927e320
SHA256 c3b1064c55a51b2ca62f8ee9eda993715cc9b224d8374931bdfcc8c2a8cbf98d
SHA512 5033ba1f1ba29670acd89713b98d9e6b7723572dbdf1bd8fe8313272ffde27a0e360de9c18fe5ff3520182ddf14253999bb16cbe906c252895853752ba3ded4b

/data/data/com.homieztech.www/databases/thinksns

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.homieztech.www/databases/thinksns-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.homieztech.www/databases/thinksns-wal

MD5 480afbd9eafbbde5e79f701f7d0f8dee
SHA1 c9aead5134b776732eb1adfdec8a9426c121056e
SHA256 97a9f372eb0d81a9bb4dec3ccdb7cbe610e4a4366c8675f3ce3ff96edfa57916
SHA512 71a11516c05f4e7717b6e0efaa97da6226a0ffd22b28321ed07b9af9fca9591254231051068ac10338ed9c220f67d3ef2342e8fa039dd956bd4324d45f7b5f8c

/data/data/com.homieztech.www/files/libcuid.so

MD5 6f8f89065b7a2a8cbd466083163643c0
SHA1 6ce318395ebd97aad32aea0c107afbaa5dbadc7e
SHA256 d48b44db95077d21060670bfc6640fe189bfecbdb34837d0c2bf0e8b42dc25a0
SHA512 a55844bfb5c8a6402961cfb9ad0ff27a6e4b9f6862e2fd612842926767a7d93f76644a672471fe3fcfde1496ed0760864da739d2c04d3c3a17d2abd61aa41fda

/storage/emulated/0/backups/.SystemConfig/.cuid

MD5 a04756ea2f6cd96a309a5670453ee538
SHA1 e804967c5a96105abb8b704297aae0313e6f6a06
SHA256 2c3cff74e6e0109fd5745ad3eea15ccb9dd7f9b7b684bbaf1ea6acf29778f236
SHA512 65f03364392bcf8b575709b97a81eebf3ecf48d126761d2b99f7d1f340c1d5c1cd15cf160228ab8e8f2badaadd466e4aebf5fe26a014bf3070e9c9b90ea5cd17

/storage/emulated/0/backups/system/.confd-journal

MD5 9ff2aeb622fb74d106ad855f0e03cfac
SHA1 f247127f359074975027768c6feab9146d3aad43
SHA256 1772086b4ef65e1b3d17603434f79833d67ad86dabde8580c4648716cc6a55fb
SHA512 a8baa2bc923782cabbd8d68105f7f38f56203eb77482e314b8c706df047c1dfeaa0fe646ba1349fda933b440eb869597f82384823059504d3e1d97466ccc1357

/storage/emulated/0/backups/system/.confd

MD5 249e034c9703afc1fd6062371c7f3da8
SHA1 9ca489179488e0fe5a35f7c0d5887f163e4890cd
SHA256 18fc5cf216b05487a87be99a662e7474bd54120f214e034b3179f40ca989352a
SHA512 b819b152548431c7892678ecdf23abe44cbdcf80e8f22707ab32a2aedb5356346b27e3c3e750665ba893d602af1c7dcca97edbac3c820859a0fc20714c22c0bd

/storage/emulated/0/backups/system/.confd-wal

MD5 0fd552f3ce8ba7deabfec5d6c40b923a
SHA1 bbf54b60883c3a59a56b792982e04a4d5bd30f86
SHA256 f398d1f4263b875cddc632857872619ce20c011d243ccd11706ee647caa61171
SHA512 4b04bab95f354d9d3cbb5147076a4e6e145588ae5ffb67fedbdd5b8e0d840d3bb31f9d8fa96cd43616bcdf739f5650dc6a4a935b1ec45c83941f536bd73e9d52

/storage/emulated/0/backups/system/.timestamp

MD5 8331d6f6872b672d9dd90678ad1a9ab3
SHA1 67a0bfcfeca59270a08272db38df557cac28285e
SHA256 dd68bcf383329db83ca27f5f6eb3b72d9f874666276c010c29b4c7852447ac02
SHA512 d824435cf6b52e8d5aaec3ecec5a612908e132cae5f25aed5f72dbbdf84c4dd214833b18c548bfb8edb83ed952399cc1372a45cc4fbbe5c1d03362566c8062fc

/storage/emulated/0/backups/system/.confd-wal

MD5 454f92325fd432d63a4e2cadb1e13191
SHA1 0b6517c17a924c2cb04e8ee4b02937c597083b15
SHA256 9cc5b19c87fe8b8ff318b7b66067ce66d0e4e0ea0c34ff759249a4610b65deeb
SHA512 4eb7b1f43348f78536fe6b8f9036db679ec5ac83d56c8c62c6c6adaac6d46dd37e85b0243c79b4f2c9c6c4a6414718002e896930225651a4e0dbf4cd9970e961

/storage/emulated/0/backups/system/.confd

MD5 8c7f6e3b52e6e841b895bbd13644ed43
SHA1 ec8daf46a7eb99c75ea1ce8582ef77b2df8455d2
SHA256 6615188d5d8fa77b44fbae7a249d073b3623316e7489c5fec95fe53188ea467c
SHA512 cffafd628e62fa915872796ee02dd8119cfebd6811291155acd400986ee5d34b244ab3b5d0bd386566724205771f665571bcb04950d390c5c60072fdb90c5280

/storage/emulated/0/backups/system/.confd-wal

MD5 69f5b903e526839df4a66c26b0f8d148
SHA1 9cd80bd6ca469f15c40b2b97c9af869cbbd9ba6d
SHA256 7393fb0af14316fb03223769d65d9ab770d277631d0f3b7a1cb54c829d1b07fe
SHA512 b9bae3a3bd1eb663ed6053fb04ae66085986f789cafa7ddc42b830fee005c568827cc8778caf914add85b8187f6de8bb1416da18586048440cad51541c8eedad

/storage/emulated/0/backups/system/.confd

MD5 242b37fdff447a3e044bb1af478d2505
SHA1 b9e8ee85c5577ec22661472426677b69d5afa6aa
SHA256 3778b78bdb22b0131bda27e6a563ede316a8f61b3b48a1dd3ffa9443ca6ebf8a
SHA512 5b786db9c3581b5a413db8f1612e133113247f3b9496c3fcfd6485016522c1b09e3142a0201c30744772679b89b8c44bc23630371d4a954b25fb6d6d06c35261

/storage/emulated/0/backups/system/.timestamp

MD5 9e13746d6c4e412a62ca65cb33c45d0f
SHA1 7726ac4c77777bd4af8035001ff1d404e68a8a33
SHA256 14cc36015e97a1b54ed555c45300de4f62ece2f6dd8c4dd7efa4ddd461862b93
SHA512 6b29002daf885e3e8f5199aa2d7a07345fce0e9432e0f8a925959dd5be0e0f19cfff84d7122cf3a21d9a7a53e52a9873a9015e84063040f0ba1b54b25acd5e60

/data/data/com.homieztech.www/databases/ThrowalbeLog.db-journal

MD5 f0aaec9ca262f6467587316da8a2d2c3
SHA1 5ff0d2180cdcc1e6c34ab76243fefd45b716eeda
SHA256 5f11bef2deecf349759fbc5b4e118b2ad82984a3d7d570391e375216627b0b0e
SHA512 df3f282270d473c65b9da8518c0ffbdf4d43d9ca41995cc8b3a58d6b2208fc052cbaac0278f6f30767c5706b2c1bcdc27534ed9bbf4ecda6d7d060446aa133ce

/storage/emulated/0/backups/system/.confd-wal

MD5 bf76744ff3befc08bb52bc0832e2065c
SHA1 349ad6f9b2db33e57ee548055960d62ae2077e77
SHA256 7b40fecca3c457865de964ae582c90fdb86ccecc1488ae4c34bd805841f35f24
SHA512 de00d7ae4240a603eaec887c01a37c23a80dd8aa8bf98700dc84f7e1fcc92bbb6fe940bff9b2efe7d606e93d6988cc805177a5a465f2e4240502b87a7c8cd4c2

/storage/emulated/0/backups/system/.confd

MD5 7d5eab29ce3281b5c84c182a9a5db363
SHA1 83659a6e010780fd91acf424add21fd472128742
SHA256 9ed26abb232251c5f1b254be3debe9ef8a7e2fac69ed94dc2b0d76f813248aef
SHA512 6949aa9fc75f2394830f607b70091d6ec9913bab82e932dd3418830979eeda0effc3faad169ba89db5bbda1968175fa5fe98c02936108cd5bb5d35c07d040344

/data/data/com.homieztech.www/databases/ThrowalbeLog.db-wal

MD5 714f6579c194f102d91bed0287c9badf
SHA1 97ff9a17e833c2908e32a23b90223b5cd01e5180
SHA256 2aad92e97bd93affb6f0cc7cd2c4c4766c43adfda7c3fc692e85644b1ff48d71
SHA512 6ce15542518a388f4f75816faeaa60bdb662d24ddb511c3bd72548af907c177effdbfbc907a4e81ddd58f8dca2a96d6209ee1f2f4aa1f73a3c681933d2f6c812

/storage/emulated/0/backups/system/.timestamp

MD5 cfd18f2e3a1e50349ad1515d46f75163
SHA1 560d4426d585a3a3689296cf9f86e5c4dab25ea3
SHA256 c88b539c8f98b87f1091d68698adff0ec99495aa8cbe7274f9d5b26c40581cb8
SHA512 e32043e1bd28dbea18eaec60f67ed49db61f2e3d0fadb3d4c602f69becfdb42e136c066da3e4a46062a42f91d4e9aabc5fbc691bce676e670f42aa3eb935a35e

/storage/emulated/0/backups/system/.confd-wal

MD5 ae489e2cd93f8ce155d7f06de9550ecc
SHA1 ab951bf9d8ef6a08579d33bce378397c2531694e
SHA256 3e9a04a7c61297ea4052a5bc66a68ad170641f8f42570b552643acd8a15ab2d4
SHA512 ccf89d1619d951ef6fbd58418f1be6a7934738d23725055cf1e2dce03e78bd06252a05cf5e57b626ec3436e7fe711aa0a88e07e8177087edb116dffd9cc90070

/storage/emulated/0/backups/system/.confd

MD5 a916fcf45c574be7f4d9e05318fb5465
SHA1 e4155c845b6e3f5ae4f65d955ed5daed305aaa37
SHA256 ddfb303952c37ad3f957071db59d952395c630ec1b178b7c0bc67f29ac8fae85
SHA512 3d774ee95887b6221c16694d6f5e88f0062722104faae2c2234db2e376a692167bb9d10ee24bc240653c1d53dfc0295f4f1d42fb591469cf98f3965c8ed55bbb

/storage/emulated/0/backups/system/.confd-wal

MD5 f454f04e5f960a3e3cb38e2b51efdc48
SHA1 6f074772e354a79a39122d801b129542e800c7c9
SHA256 baf4720c323a7e1b45521c7c3c7a4255b510a16d2c77faae8d635be33ae091d4
SHA512 e97c26aa525e85ac20ecd15fe6991946734d36b76665f524c06261c83fc22f0d7296733a4591b7ace172c65dba25c652dee743af64751aa91e3ea560c5877674

/storage/emulated/0/backups/system/.timestamp

MD5 59f4ab08f6c5f03ff47c20c4050c288b
SHA1 c464b56ed0e0062336a8f9b1a5380b8a3ddaa4cf
SHA256 fb5a8df324b9e468b169a575509ac649e7bf9384cb38be56f96e0871f39bb1af
SHA512 d0e38b79b6000bee32a5c195785dd1a8f0748d6a576785bad500321bc4800856315cae41c9464e6445db9f030e20fa140be836e5d663f5635b960c0e923b9841

/storage/emulated/0/backups/system/.confd-wal

MD5 98a3fda26d0ca575199374cda896597a
SHA1 8674216e39269f76849fe36d49cefc80616e49ae
SHA256 53a9efaa8ff06cb8e4451c6e7e391f6ae03cfa21b03bc8c1564b470126e355b3
SHA512 e3a49636c615fc0413e0f03862489f18bfd57bf97f7d4c028aaf5fff44303de56c5314165e8c8f81aad1ca7f4f46f0215c9b828e64d8d10a6abdfbd5be3a3ae8

/storage/emulated/0/backups/system/.confd-wal

MD5 da90d4fa05b9cc129a164c425e01faba
SHA1 581754bd6f70290d6138b932a6e5db356c243e95
SHA256 22c719d74edc84db0288628cf32a33b97b3a3389c528b69fb5a70e2807bbf324
SHA512 eedd21f198d7df73f49ef9f1d62ac8fe978afe30faa2f0c01ce19afd0debb2bba092fed9d78fbdc2d1f4472e68edf6eb18c89f90ef1846e29faae159f915d8be

/storage/emulated/0/backups/system/.timestamp

MD5 1835484bf6c8caa79e734fecec5e494a
SHA1 ea0652f3496cf4c53feb735e2c7b653ec7a7a552
SHA256 ccdc3a4ee148cbf3bc4a96aed72f533f2c1bb83d7c66607b5cfcd911c8096185
SHA512 770534b0d62c386d117194ab9e926de54ad4703c123e87e483eb95c31fa47a35cf5fe07db206cb43566366118f4743074d694aae980c38a6be2e3da695ef8cda