Malware Analysis Report

2024-09-09 17:11

Sample ID 240613-k7tejawerj
Target a4cd308b16b22146ff4f78840513c2f8_JaffaCakes118
SHA256 c39e5f5678149cc1139a23bc2cde905b7e737a9892497682b2b212d75f270624
Tags
banker discovery evasion impact persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

c39e5f5678149cc1139a23bc2cde905b7e737a9892497682b2b212d75f270624

Threat Level: Shows suspicious behavior

The file a4cd308b16b22146ff4f78840513c2f8_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

banker discovery evasion impact persistence

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about the current nearby Wi-Fi networks

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Queries information about the current Wi-Fi connection

Queries information about active data network

Requests dangerous framework permissions

Reads information about phone network operator.

Queries the unique device ID (IMEI, MEID, IMSI)

Listens for changes in the sensor environment (might be used to detect emulation)

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 09:15

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 09:14

Reported

2024-06-13 09:18

Platform

android-x86-arm-20240611.1-en

Max time kernel

177s

Max time network

189s

Command Line

me.yidui

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

me.yidui

me.yidui:core

me.yidui:pushservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.212.234:443 tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
US 1.1.1.1:53 lbs.netease.im udp
IE 54.73.57.121:443 lbs.netease.im tcp
US 1.1.1.1:53 t.growingio.com udp
CN 106.75.118.58:443 t.growingio.com tcp
US 1.1.1.1:53 wannos.127.net udp
HK 103.129.255.21:443 wannos.127.net tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 api.yidui.me udp
CN 39.96.126.77:443 api.yidui.me tcp
US 1.1.1.1:53 stat.miliantech.com udp
CN 47.94.177.149:80 stat.miliantech.com tcp
US 1.1.1.1:53 plbslog.umeng.com udp
CN 36.156.202.68:443 plbslog.umeng.com tcp
US 1.1.1.1:53 ulogs.umeng.com udp
CN 223.109.148.176:443 ulogs.umeng.com tcp
US 1.1.1.1:53 sdk.open.talk.gepush.com udp
US 1.1.1.1:53 sdk.open.talk.getui.net udp
CN 183.134.98.112:5224 sdk.open.talk.getui.net tcp
US 1.1.1.1:53 sdk.open.talk.igexin.com udp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
US 1.1.1.1:53 norma-external-collect.meizu.com udp
CN 183.60.176.112:80 norma-external-collect.meizu.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 106.75.70.154:443 t.growingio.com tcp
CN 39.96.126.77:443 api.yidui.me tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
US 1.1.1.1:53 tags.growingio.com udp
CN 106.75.109.179:443 tags.growingio.com tcp
CN 39.96.126.77:443 api.yidui.me tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 106.75.118.58:443 t.growingio.com tcp
US 1.1.1.1:53 plbslog.umeng.com udp
CN 36.156.202.73:443 plbslog.umeng.com tcp
CN 223.109.148.130:443 ulogs.umeng.com tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 106.75.70.154:443 t.growingio.com tcp
CN 106.75.109.179:443 tags.growingio.com tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 106.75.118.58:443 t.growingio.com tcp
US 1.1.1.1:53 api.growingio.com udp
GB 138.113.20.166:443 api.growingio.com tcp
CN 223.109.148.178:443 ulogs.umeng.com tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
US 1.1.1.1:53 sdk.open.phone.igexin.com udp
CN 115.227.15.235:80 sdk.open.phone.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 106.75.70.154:443 t.growingio.com tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.112:5224 sdk.open.talk.igexin.com tcp
CN 115.227.15.6:80 sdk.open.phone.igexin.com tcp
CN 106.75.118.58:443 t.growingio.com tcp
US 1.1.1.1:53 sdk.open.talk.gepush.com udp
CN 183.134.98.112:5224 sdk.open.talk.gepush.com tcp
CN 223.109.148.141:443 ulogs.umeng.com tcp
CN 106.75.70.154:443 t.growingio.com tcp
CN 183.134.98.112:5224 sdk.open.talk.gepush.com tcp
CN 183.134.98.102:5224 sdk.open.talk.gepush.com tcp
CN 115.227.15.241:80 sdk.open.phone.igexin.com tcp
CN 106.75.118.58:443 t.growingio.com tcp
CN 183.134.98.112:5224 sdk.open.talk.gepush.com tcp
CN 223.109.148.177:443 ulogs.umeng.com tcp
CN 115.227.15.7:80 sdk.open.phone.igexin.com tcp
CN 106.75.70.154:443 t.growingio.com tcp
CN 183.134.98.112:5224 sdk.open.talk.gepush.com tcp
CN 183.134.98.102:5224 sdk.open.talk.gepush.com tcp
CN 115.227.15.225:80 sdk.open.phone.igexin.com tcp
CN 106.75.118.58:443 t.growingio.com tcp
CN 106.75.70.154:443 t.growingio.com tcp
CN 183.134.98.112:5224 sdk.open.talk.gepush.com tcp
CN 115.227.15.227:80 sdk.open.phone.igexin.com tcp

Files

/data/data/me.yidui/databases/growing.db-journal

MD5 69365b132e862f52356d50e8d7634109
SHA1 18883e5c1a98b75efeaffa484376b5d43f23e140
SHA256 6f912c7e9d94efc5757462bc41b301a4d1a3e11ca793e8387675c26dd556c4cd
SHA512 8da12d42cc2b706b77d3b51af9b6e0adccfa36fc6255e2c80b61ea89a64c1b78be96a41d4f5b32b4c341d52bb0f96a130ebdb97eab403e3efb1280b3d412cea4

/data/data/me.yidui/databases/growing.db

MD5 e51ecca129d12b603e6b00bf5b995798
SHA1 2c8aa785508e393cfb2d7dbb9f82fcdc8536d662
SHA256 81fc99eac73929ce02c780400d24d162654a5ab9d2d57babb385ab0cdbc4e271
SHA512 62aeae3a8e2f3b41bfd6a083a62e5a409c87ab062dd0d577ce8bc546bc0ce40c4bd65e15d4f4a3ff67a8ae3924ec47bb2b70178ff0be16a18887b4419babc753

/data/data/me.yidui/databases/growing.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/me.yidui/databases/growing.db-wal

MD5 6fa9cc0b968ec6a75a9a0e59fa11980b
SHA1 e36d4716d255a63baf4d3fd1d2d8c368e479f652
SHA256 7b1922fbec4cc02085c7b7c5e9d1ea0ec83766d62e28c555acfda3aea6e6be61
SHA512 91f48f1a81dd18252ea85a437d7db87aa279460815064dd460bb016c7c16c4679a6dcc169950350e2d7dd435a1d6c6b3d3d0f3371d6221da5113aa6af025c819

/storage/emulated/0/.me.yidui.uuid.txt

MD5 c3d51099c262bce12c34ebbdd0e4d0b5
SHA1 cd5482ee46654747cc84d5ddbd7fcd49f059580a
SHA256 2199a7a724aae75183bc84ca5ef5c5fd26df57fab6f450f28d45e31ce39e5045
SHA512 a3dcbd15c69afb47c2587c7befad6bfaa2178ee7aaab358c35d56e4dd14fb47a318c742a8f536d3ab326e59dfbd2509b003b4ff5ef1276a3b9e0ed6558b22315

/storage/emulated/0/me.yidui/nim/log/nim_sdk.log

MD5 5a501855d12f16577adf8bb9703bbe35
SHA1 afff3303554f2f85a61ad88d53322b5b197841c8
SHA256 0852cd527fc5ed07a6b5f857184b99df728741f3039d08d905dce22ecb61eef1
SHA512 337538a3931fc247bd2016e6896b28920c3ef6034fa9c24fb6b9e2a87b259f1cb5fac1e7dfc6ded25c8a93b639cbb0c889793ae56105860b793a68e74283b429

/storage/emulated/0/me.yidui/nim/log/nim_sdk.log

MD5 27457f34429f876e6ed40d468bee9067
SHA1 ec835d92e3292fc895dff4b2909caa94d2224094
SHA256 7d97e201f1c362207b478e955eeffa574456f12133b283e1ad5521abc1656d5c
SHA512 7afa98979bea7ef5756357a7832dcf204df440af325068cab0588a92b0370d984c341ee3a344fc83273e829a820aa8ec7eb97992accc6ec59f727274025c12a7

/storage/emulated/0/me.yidui/nim/log/nim_sdk.log

MD5 1cdc28ce2c6e957415026ddba6b0961c
SHA1 38044b1980ece7dffc30f1ff407d0a51ad4bc09f
SHA256 8fc1ac9360e957cc25475d730ab3a6b91afb9189429491279e2a97652d026709
SHA512 9764543efd6570e84db935b753e61edc3a50ba37b9322fbbcc1b5a45cdbc52e15677bc9efee0fbdf1cd33d526358f8448ad4428069330fe7c510f4f3ee03f9e8

/storage/emulated/0/me.yidui/nim/log/nim_sdk.log

MD5 a86dd21af8e56d96b495115fce234f29
SHA1 a515ecaaeb2914b7ca31080eaab823cd8cb3ca1f
SHA256 97dccec5a861840901ce048f447d187e90c5b31d357e6026cad8c0f696241136
SHA512 3aa8e8cd8f65c2021dc4069784f3faedd05498055eb9af80be42357aa4944cb9c023cd499fa9333ab20eaa7d4c845c382a6c29cf18ee7fb1105df03c911a4035

/storage/emulated/0/me.yidui/nim/log/nim_sdk.log

MD5 d6deb48da7f3bd63de8767c360ff4694
SHA1 6452880495bfd9e1c972b95233cb9d91c2effd81
SHA256 211c2daacd60bdebe6b7c34ae5a86a3224a685bf860e665f209dbe70522ecb98
SHA512 80384b8c9b49e33ba45b4454310f5a85469790363f9ccb4bfde73a0009ed0f2b83e9ebd044de1c4c24a8f779e3965c4eb2d2b0001d9abcc8754f1bee1a763904

/storage/emulated/0/me.yidui/nim/log/nim_sdk.log

MD5 108092f004a1381db608aa2bdd58348f
SHA1 ef6f292c1cc3f26fc9bf973c3b8f52aceb184616
SHA256 28229410aadd593f15ce66847c8bba1b67678d88240cef454d3a98d31d31553c
SHA512 f64e5b081cfc9f2ad2a677778be9fa75731fd59d4f40b5af991a2968e02431d115a9bb01b06f8d78fab240fc0de348c8771637c18f3da6fe25e00b6b582875e1

/data/data/me.yidui/databases/yidui.db-journal

MD5 afef68142898875dd897eddbb8d94ecc
SHA1 f3f2f4026f2b9f253bde89cb5d0ee12a570622dd
SHA256 ffb3e68993de3c023254c373a4a7cfcd9713c604bcfab783bafb48652ae9e06d
SHA512 e77e91df42a9fd98612e56aff27dd8ad9076cd9234b85cd223d22adc0e3bbb0a809a3236022e5289e3399932f14a91d13e0b836b25764a1a60a0dffae1f74e53

/data/data/me.yidui/databases/yidui.db

MD5 2014231e0a1a4864ecec5ca72d2cf4b8
SHA1 a244573e4db5aeb763066242310e523b0ad7d39f
SHA256 d2b0c7f047bab7ec6d8f0004e00d783a26f1a086e96bdd2d6713911092d71295
SHA512 ccaad5157ba0c4b1be151ae7634873a79ba92244d2f1744c966aa18d873b88298549148c6b2ea2ca28cd29f0ca37aafc5f702be0f882267395a8560faffb9374

/data/data/me.yidui/databases/yidui.db-shm

MD5 16653384075cbdb5a969a4cd1a0f6ed5
SHA1 4c7b075cb714edf81200b82282e0b96811f5ab08
SHA256 05a67d4aeb20cca0783c4740048186179b59adb33910f9200d09870c7aa5ae71
SHA512 551c705e6ddeb2d2f4767dc5b8a9eb41577bb2a62fcb18ce6166e6de7bb0d1b542947d328a56466675c4d37566e21ff3bc82b2adb37db40613478d086966ddaa

/data/data/me.yidui/databases/yidui.db-wal

MD5 cc57faf44c24cb6e4b6b6b48f388599c
SHA1 766cdd979e0fa61783825807339f755cb7231409
SHA256 25f46994a9eb1fc74163a352d6fb56edbee5dbc0fa3e24fe81f06e750460153c
SHA512 d69d114db53fc0d5f30c2c80a92fc624f4b72c5a2825813c8f42babe2419412d29568553673033d1dfdb33b7d0315be452b3220c4317e0454044d34e26279be4

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 5ed967f93bb18c7c20417f81613b1631
SHA1 14254221123b200cab0065bb657a3a286e45f097
SHA256 3805e7cca9869eb94715b5c2d97ae4da28f5cd10449eee81598b83500fc357cb
SHA512 5bc20da3ddb46693f75d541644551429047218e31d3003ac96a669b20e9d67ca2fd01539f29b4d1323e4567f2462b5e0c2da8fc9c45fcd42e6dc116cccd5c7f1

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 433c5e4f2f10494a3f682fc58b77d081
SHA1 8135480777a3b1045621920ea6bb51e5a6255e86
SHA256 27bc1c09b040c42a7e5237218ebab4ac4d310da628e7c8bae9fcdeb61ee39700
SHA512 1b09edeea904236ae6609ac3dcb3f5201bc0fa23d940d3af2a4104b82907bb7ae14baa339ceb8c4feac805bbfa8ce0102de2fbb59ed7e0dfaf02f8c64b3e2ff8

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 ebfadcee8ff427db0c14c374048bc3e1
SHA1 7e171aa5bb1c52f85e720de9ef589528179eb715
SHA256 50f7ef020f6498e9d516a2e15826b1a2ba5952b71246f2ba4c1af063b3fb7ae3
SHA512 96f1156c7a7b0941b7130abdf86621f539c25d770f2ac9524a33af1334d1447370035f3e9585a316b30b4816b401b268f90335be267a9a6a592b8210eee873f6

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 0e258c8655f42297e4ff01482847247b
SHA1 ee92ae0d74afb6c5d84a0e4ebcaabc652128c516
SHA256 ac57be96fb424ec07fdf5805daca724d0b9d7e3b019a4249ab64b651b7134afa
SHA512 23d3422c36127b6ec22c964ff422c6136de0f4507263818046ab12e7efba3f406301135a3494b8741e49c546374da27b260247b6ac7a79ca1a5cdcbfd2172386

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 5c1e2d31066ded6aebd0d2c158333b42
SHA1 d8c1c48c2ad04f62a5f00adea58947672b900008
SHA256 d9660e32bf29364f6e3780ba85ba2cb82c749458b6632c487158cb3bc41a42ab
SHA512 106dbf0ea3e9c84132dc8962dac0454d1353e4727d6f080cd3052ff9ed014374ba99b29bfcddfacb450a6313a71ee8aeff469e23002322cf9e36eed05f5399c4

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 3dfa3100a31de9f4a6bc6221fb5d8139
SHA1 f14217371a285b830245a998f8f1821c61005ed5
SHA256 23d785b4371cf33d112abb9aeba54be81ce4ecf8ea77be17b119edab16dc2bb2
SHA512 83e30d135502a6644c92a840d5fe3f822fe5ac4a582f73948af11624c9dd187a2f6cff7a26b381e2f210b0b4d02e86a03129d177d1707eb3d80eb91bdcd14f02

/storage/emulated/0/me.yidui/nim/log/nim_sdk.log

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/storage/emulated/0/me.yidui/nim/log/nim_sdk.log

MD5 4c90e1e3b62882a7d198100df4f8e96d
SHA1 67772fc85ab8964b9fe7f36016ea4b82ae3f0ee1
SHA256 fe6701b39136653e4b846ca624fa0017a7e1dad52d97cbd6eb02eaa0a41f8506
SHA512 7d9a61250191ef94c4ab7e3c7f344ad0434689ecb50f6f3e98eebc86bf7a63a7defff9c914df4346ded108e5dd7adb85b22ea5adb9cb964a420eae2620818847

/data/data/me.yidui/databases/growingio.lock-journal

MD5 cf9a1fa6ae2e17267994619a6d0b804d
SHA1 dcef360fab487a2341f0872bc08b0c3a5aa2e139
SHA256 7497a06c0caa2d650d38242027f9ed9d4a6499d1e436f226fb395147b2dedc3a
SHA512 63798b91145009bf8134be924e51b03fedeca1d0871169a4196d0fce831bf1dec27cdb61bf44afcdd0838dd7ed4266d8c53075dec450415d78aa96f97739eaeb

/data/data/me.yidui/databases/growingio.lock-wal

MD5 6c5c535c2350dc162b5429c314ea9de0
SHA1 ea45aa432a7994da3945b6b02e058b8f97a9f55c
SHA256 1c718f3cf19369e4b88d46507421cc2586bb409743a1c1fc563db1bbe1c7f7af
SHA512 429bec340c708f898cc94e06cfbaa710b4cdc76980f5924023c0679e868176308a1e3606952373d1ce51f024735b1dc10a5a67acab4739f00829de0340dee543

/data/data/me.yidui/files/growing_ecsid

MD5 54e79e1c66390bc712add7a9efda3430
SHA1 50fd8cd770cb169c2d7bcc26c2a9d07ea54c590c
SHA256 db9623215bf4709d7fe15f988c5a9c863bf6c7919404e88f3b2d3dd3db65efd1
SHA512 125a9e6e429bd6891b3b6abafee806ef9800268c0859f009c8ef22bac9e0df589ce6855763ab744f978647d510ec251e1a6069d419d2640d3a37278b7e79d9fc

/data/data/me.yidui/databases/ua.db-journal

MD5 f4e88a61a283011bf529dd3b3deb494f
SHA1 cd38b676d1f6cef6de39c87c4ec4076b5e5cbe4d
SHA256 9c6130b57590f3555df7dfcfb6ebc06e7c6055270af52c179d605ea0bbeecb37
SHA512 a19ec0c32c6f880d49664046f5350dd75b4f19007513abad5a234be4b8d4ba5f89ceee587762fac0d39bb70f1b6b77085ae47ebda5f57cc0e438d5bf3c8daae9

/data/data/me.yidui/databases/ua.db

MD5 0adda9c85a5e4808f5b1b74c0a8591a5
SHA1 5048107883ab1e345af9cf2e6849ce46e0e612bf
SHA256 1e17860bba2bb4e3e92df3890aa6dddc973d6602c71519a15556d37bb69de2a1
SHA512 646061d3d5849772511bd94e36ca2d775a9a672851629d1812942ec0f0f925714eb7d4ebac44889911320cb6710a2f586014f6b1e126739cab653c4f8deef2d1

/data/data/me.yidui/databases/ua.db-wal

MD5 dbe5cce684a2156dc6c7d3f6ec89e6e3
SHA1 d37b6262bd273a9e1942ae47f6c1720b43e13e6b
SHA256 95549a55195a48dc2aea70cbee2b1933c46ce4ed0a2520f78d4547f34f956e6f
SHA512 4e5722ea0fdb8613825861ebe9d340809ffd31428d4c4a8f21cc57007f7242660f0927ca136b75cfffdf969e34bdb27eb17ceef018d038602e713d6b406cad4b

/data/data/me.yidui/files/umeng_it.cache

MD5 e45533d09078cf290b5de9990d9b4423
SHA1 a170a5396bffa503f9b1c658eaf7eaa648ced846
SHA256 21ef0d055376ab8e44c2398fc489a554b81768c66b637a44323c58c6bdf17672
SHA512 85bb9bc3d873a1bc948a5ef465410c18ad5e901de532fa20f1d3be9736c7e33f08393dfd476198a1bd483ecb4d11b982519da7a0c4d1242f99508a242ccaebac

/data/data/me.yidui/databases/ua.db-wal

MD5 64280754506e47da41d44ed392a79026
SHA1 51088a95f63342b64a0aac278ddd932215a6d642
SHA256 c14961848dcf798f293f0d4dd15167edd482fdd32d04f176ebf58a299c7751ca
SHA512 916276a814dbb8f025b53eeb88bbb5e58162a260b31a97d5ac63c80dd41951d85990020e929f76e14581e011cb03057e8e237f04522d9ec30c671f74d1c1f82f

/data/data/me.yidui/databases/ua.db

MD5 fc29773b5a11c4b5fbdba0bfebbc3750
SHA1 194cbd203831572e100c1ede20d8b293f54746cb
SHA256 f7cd4201a390a64ddf0db976125dcead3df025af2c5b089e1490b8a4154cb9dc
SHA512 bcb5f86610644435b447aa14c3afc5ccced9b3a9505c27d96c9e3bc5df80fbb96fa6e9357c25fcbbafe1c96d52dda6d2cd42880d09eb7ba05cf304790149bb77

/data/data/me.yidui/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4MjcwMTQxODEw

MD5 9e5471848741aa47d1600687598634d0
SHA1 a4609918206233e587f3864033517c44a55608cc
SHA256 b92c3fb9933803f43d96d1ba2d82796ee3c522f03bba3497a6cf2aa04a8141a8
SHA512 057fe45b6e0d8f134dd4e690c2e512a7f7127cea7c1f751ea80cf33a97eeaf3803714281dd9502b06d132261d041c20cfc15d5e4780a9dcd2593acb6f18e6459

/data/data/me.yidui/databases/ua.db-wal

MD5 9d65c39fdf2a2c67bbf0b4afa9a162bb
SHA1 689774916e2f0650739215d3f89fde1693e0c944
SHA256 b2be70fe17ea4ad3d7f6f1fa4004b1e0e886bdcb4200ae0e7414e20d775b82f9
SHA512 a6049b4ed426464a127bc1e04d78e53c22ca977744a535377e2b8ab3c726550337a36f3d0b4266d9108915718d8318a474b19fdae3bbaf1f98e0744433b83b0a

/data/data/me.yidui/databases/ua.db

MD5 1d44d8f83423fc8890064902a81285d8
SHA1 79a2e368e982029aecf59c1c4cb577a650817a68
SHA256 6c8a604dc01342d8e16af8c4fbfc9b556788de859561cdfb4fdaf38a336bdcc1
SHA512 d1272de54184eed90dc7c3e48cc5358842028c15376215c913ad8a04b6ec29848403c6a3b0bd20d292f80f51132d13ced2d0d1015a7d9f8b72d61d36ff18a2f5

/data/data/me.yidui/files/.umeng/exchangeIdentity.json

MD5 6123ac5b9f6f9bc9aadd4edad4741660
SHA1 7b405c8c5674dfa1169e99bb0060c24fb5b21d64
SHA256 a7e219797318662c044f23a41bd935a18b692a3683a07f6582528b8a48e326a0
SHA512 1f936a3dacf43e0d021e7731e39d74f0e89d6a986d1949fa406afa43460fc493d8e480c8a37715d5dabda833686496502db5a21343a3365b1db8b7ed0b9b8449

/data/data/me.yidui/files/exid.dat

MD5 06e1233e7daa55e5ec755bf4b3b505e3
SHA1 b574659bd28be3925bacd84b7f97f7c9c9123043
SHA256 d5292161fb29959019d45cdcf6ded0e70e4cee18d19dabefc5c8fb322efb306f
SHA512 3cc559945d8a01262861729e6c7b20040802158b129fd303a7890fdc5ac0856bb19d20e9302a1964a58c8683c2c6285af6a5a76d5165d408a48d89a3a98ce98e

/data/data/me.yidui/files/.envelope/a==7.5.3&&6.6.0_1718270143370_envelope.log

MD5 4125566312193c80a014f3f66f8a2172
SHA1 e12a81e148beaf206231f9ec05d58e86e0d8b7dc
SHA256 64e000c06765f643989279c8d88144eec38b17a6a743e4f3179be12de7160fb9
SHA512 85549c9256a0749153e536f800b3b3e00f0caf481a6c998e58434d89c6ea64445e827c0a8349c8faf3dd54fcf417d962c9b00697f8e4f5f2fe20ebddf36cf81c

/data/data/me.yidui/databases/ua.db-wal

MD5 d825628a481a34cc97073c1a9ce05459
SHA1 9aca0bf2291ab6574699174aba5f54acf402171e
SHA256 cd74cdf645d1b280a4cb9d2a55a0594945484c99797ac20986c1463432e23697
SHA512 41d726108bf7406da2eac1d3c8981ecea7a840a42b2bf24c67b537b5edf198551eac9e09ab76b7953af9c504013b9dd372422fbc7a3b19ccb220952b5d3cfa15

/data/data/me.yidui/databases/ua.db

MD5 69d2b3f42611ec0d98ec8925bae52f75
SHA1 f93f5477de033d51c81fbd147e5bed1dd51bfd7f
SHA256 f2b3e1325594852594a37651d53c631550e750a10f3d2891b8cb26dd2bfaf337
SHA512 aad6597d877f72c7bede2bcc508f1ee1955f7ca1fb1266a0fa3a402ada950182d8777050d5d5aaadcaafab73967693ac13a59595d43298a5116aeb873ce8802e

/data/data/me.yidui/databases/ua.db-wal

MD5 1d1c174245e969118cc3c9cd05567860
SHA1 e1972d705e44e6877bcd0b8f08118d738331dce1
SHA256 156b433fde81955a08a7a9ed2128155372136ed85177c7fa1a7085c8f563aff9
SHA512 e0f50ac5eb0ee7d1e448cc63fddd70e8a144b2f321bd347ae03c7fa9eb7f5f7bc43cf49776989f1e8307fb5643188bad6344e967c0ff15b35ad38c68b93cc1b2

/data/data/me.yidui/databases/ua.db

MD5 7ceae3c4160f800413cb10e9da50dcb1
SHA1 00df8c82d9f3f4b5de4c8087272e88687260fb62
SHA256 530adfa6e3058dcf49e39b63392182e0608655a6202d92bc533ce242f71d6cd0
SHA512 0c06369a930843ca32e051cfa9756334c499218b30d9c5b64908058737eaa485ca5f4b8f14165eed8f49b236eed5b7bc211b7823c4b7e481a4456c5c601e64e9

/data/data/me.yidui/databases/ua.db-wal

MD5 572acd829c1184ac9482c4386ab0c86b
SHA1 c95ad04fa9351d2550c78fd1690d94f2ec566303
SHA256 87af3355c762da051eaa7bebb7ae60f46ed2be8e4a9670cec1c70c0b58bea456
SHA512 7cbbef51dea0909694c33f855ddd744cc1008d2fc80590ab6093ba4d84a20271ea9813754e1551b832a9b78880e63f911283bb93b773714810c8235984dcf875

/data/data/me.yidui/databases/ua.db

MD5 9b221739157c2961d965bfd559be40b5
SHA1 4c990dff214c2a5d023c02beb0eb23494fb69e47
SHA256 068379410571b4b8c1c62045dd5cbe0ae3319e8d76a7012c957ea00ccfa0464f
SHA512 ebb3f58751a70fd94492da37914882234e6135aa4350e5aad19a07d6a401ff8c19c3bfb936f0db2d593adf9d37ac5b1c113328f3cdfba129f4ef16ed8065af03

/data/data/me.yidui/databases/ua.db-wal

MD5 6242979b8e073316bb66404e79c25bb4
SHA1 dd5c66d93cbecbda45e337e4eb2c66413c9c2cae
SHA256 00fd94089cceec891eceb63536338210efbfb2d1a14c5aa6ae3d8b9cec52406c
SHA512 bcf555623878569a5a2c786e8279ddcd21d31cfbafa86b0b865549cf9b289fc35574d8836c36f6046b37cd7a39d94cd0bc91d4c1ccf468e17986421750766373

/data/data/me.yidui/files/growing_ecsid

MD5 566f54c18e1a5833fbc714cba8ec8c2f
SHA1 242fca7ab233ed214ca847b634e9e38cf321759e
SHA256 b01724f70a99895d02e9f65c8d6c6c071e29823efc6c504d14e21541c6a9926a
SHA512 95ba9faeea31f804ee517a27694a7e93088c63e8d6a492cd0879e06e7a6725f8f7e21130ea04ccb2f444ad37304ba2a6b38ad6d9c3775c3250bca00a198ca93f

/data/data/me.yidui/databases/growing.db-wal

MD5 7a5b65c4f6900f8998c584ec7ca50d5d
SHA1 3c7d241eb56f290d0054ba5ebd26688e250236ac
SHA256 6579591d5608d42d5cb5f76841ce42267aa756c6b417b756c2d12458e324214c
SHA512 56f08844b1871805589448b6ef98d8ba7e6f750e7f794e9c9dd0a7c24682e06bbf01d0b16c6efe73a89d1954ff047273369e944a04f3aaa650b33c5201e01817

/data/data/me.yidui/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4MjcwMTczMTQ3

MD5 0ed5656fea1cd61070061e9f236ba74c
SHA1 1938faed7ec50e690674bff460a65d61ee441ae6
SHA256 389324c3066bbf8bce1deb95a82469c43b12efecf598164fa7ff33056fdd4886
SHA512 8f3bdf333344ab0289c719347c8a2e1d2a11e76372322ad8ec2190f5573fff896df5c4442de4ad91a4d4129e084aecd291691a5b6528a7e688774c423abfb7a1

/data/data/me.yidui/databases/growing.db

MD5 1ba00ce58c5a1757062fd1fdd33a2a99
SHA1 65cd703abcbb10bcdb0079cfc675bfab2ca1b89f
SHA256 349b523e29aea1d446a134193cec6a2fd9203371e0eb564929f31736fad8d1a9
SHA512 1f2851934e08e62064daf2c9a93a5161d74ee4a20e4341ebd6e38f7cfe2882874517f853d587dcb5731181a2be216c8371ec0ff10f97072a65bcd37b0fbf2cd5

/data/data/me.yidui/databases/growing.db-wal

MD5 b70e2ccae7716d67ecd936b068ccfaf6
SHA1 03d4159096e618c6b394bbddd7612b9a4a51f71a
SHA256 9f2434315afa98ef2c81a7d6ec54ef7fb71b52924a76a3d3f96fd3a340f372df
SHA512 d28269bfa234b55dea91e7144fa5a0b3495161e6a011cb70b64324ef1aa680d3ff950a8b30ba2c9f2774be5bde4bd9f61fb4654d883fbc1103422d0912750243

/data/data/me.yidui/databases/growing.db

MD5 5f7f8d272561987315c02c5f6726d364
SHA1 34bbb92a58dfc8ae38c620bfe30fa7334161c1b0
SHA256 cb5b98a01de2e915c3a43afa7e5cf8a5c4eda4c6617fabf66cf81a7d9b493f3c
SHA512 4ef81bdd2996b1a28a2e3ff75b239ead2cec8d809b84112a6243829cca13ec29388742c7915a8b25b947b7af27b158df75f0dc536a4b3610c95962e4162051e0

/data/data/me.yidui/files/.imprint

MD5 0fcd3bfe09f579535dacc0674e5b1ba8
SHA1 0c1f5aab2a1b112eea61d318168cc5068c71d4d1
SHA256 e7cd9c85cf8c82cd25ae597a37e1d1592b77c564479330e5cb65ee02d1b03175
SHA512 c4a39131348afec2d6f16cff972f21a1de3caf5195138bd5a8325082cff76cb2b2767d19013085b2a6d5d163d4bfdcd1e7c62302497e1fa1f9c8106d73cc04ea

/data/data/me.yidui/files/umeng_it.cache

MD5 f7c8533eeb3ce6da909b927133f78102
SHA1 9a6940787c9c5efa41f5f50417911d0a7120127d
SHA256 3225df8102212a35b3b5d4ba41ebdf114a5fafbcec5643642f8e404b1b6fb70e
SHA512 33c3f3ae8d31d5d15855c9120d0ac06f20ac5ffc7ab12d50520ccc7ab319fcf24bdf2c264e6a1b32152dc15f99e81496b31458043c1ea329e3159c12279f34ae