Malware Analysis Report

2024-07-28 14:35

Sample ID 240613-r72t8stbqd
Target a61d6f81dbd3008fae9a29cee9033231_JaffaCakes118
SHA256 c0e8df7bda5eb7d44b82297df36ce7dc4fb5bab202dc45290594a7eaa18ea28c
Tags
discovery evasion
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

c0e8df7bda5eb7d44b82297df36ce7dc4fb5bab202dc45290594a7eaa18ea28c

Threat Level: Shows suspicious behavior

The file a61d6f81dbd3008fae9a29cee9033231_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion

Queries the unique device ID (IMEI, MEID, IMSI)

Requests dangerous framework permissions

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about active data network

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation)

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 14:50

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 14:50

Reported

2024-06-13 14:54

Platform

android-x86-arm-20240611.1-en

Max time kernel

73s

Max time network

184s

Command Line

com.cdel.yanxiu

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

com.cdel.yanxiu

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 manage.mobile.cdeledu.com udp
CN 42.236.6.59:80 manage.mobile.cdeledu.com tcp
CN 42.236.6.59:80 manage.mobile.cdeledu.com tcp
CN 42.236.6.59:80 manage.mobile.cdeledu.com tcp
CN 42.236.6.59:80 manage.mobile.cdeledu.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
CN 116.153.68.72:80 manage.mobile.cdeledu.com tcp
CN 116.153.68.72:80 manage.mobile.cdeledu.com tcp
CN 116.153.68.72:80 manage.mobile.cdeledu.com tcp
CN 116.153.68.72:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.85:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.85:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.85:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.85:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.221:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.221:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.221:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.221:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
US 1.1.1.1:53 manage.mobile.cdeledu.com udp
US 1.1.1.1:53 manage.mobile.cdeledu.com udp
CN 42.231.136.127:80 manage.mobile.cdeledu.com tcp
CN 42.231.136.127:80 manage.mobile.cdeledu.com tcp
CN 42.231.136.127:80 manage.mobile.cdeledu.com tcp
CN 42.231.136.127:80 manage.mobile.cdeledu.com tcp
CN 122.189.168.140:80 manage.mobile.cdeledu.com tcp
CN 122.189.168.140:80 manage.mobile.cdeledu.com tcp
CN 122.189.168.140:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.85:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 manage.mobile.cdeledu.com udp
US 1.1.1.1:53 manage.mobile.cdeledu.com udp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 42.231.136.127:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp

Files

/data/data/com.cdel.yanxiu/databases/analysis.db-journal

MD5 b38255721cc6ee350e2c1f88f9c0973f
SHA1 33381f6bbbb79dcdf053cc5dffa00a32060e9d6b
SHA256 647532c3b41ac6cc154bee11b584c15afb8c847027728ccf60eb64ae0237c676
SHA512 9956f585c79e1aae40ef63fbdf54d157aef2999a0be5adb5a5e4e6e8f70f8a27b3e2807697e094b9b2ada5299adf3289ac4d4dc056a8bc9a5a1a2e2af432a5f3

/data/data/com.cdel.yanxiu/databases/analysis.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.cdel.yanxiu/databases/analysis.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.cdel.yanxiu/databases/analysis.db-wal

MD5 688f8e885dffaa45cbdfeba9c462ab0f
SHA1 db2da874471aae33d0744b67da28c1d44ebf125f
SHA256 470252fc9d5032f5e09ddeb0e63031e413c8c0bf748bdeab71228a466767ab0c
SHA512 c34b9415038f40f54fb6e049d789c5d6034e3282f52907eaa2a53162b6b049877a74c476883e76e4f41acd98375bdd14d84251b83c70112c90ff139f2cd3b38f

/data/data/com.cdel.yanxiu/files/umeng_it.cache

MD5 e09471703f6efd6a78e62b9f9f073a2a
SHA1 6ec90faa46d9ceebaab7d2e1df530de570fee442
SHA256 59fe6462e87e21af2b5e15ca363dabd97e53804ad1d67ef59b96eb7fa16960a0
SHA512 91c0ac6c6ce71673f27da4c7d3c1dafef826b432021362c52c617f8dd04b67bb0055621d072974e1f7ad4f32f7bbbc20e175f742118562a8b9e1e2479d22d305

/storage/emulated/0/device

MD5 748d9beeaa1899252a7365b780b95fb0
SHA1 2158cbe9044f2b138df0094615afe6616e526c9d
SHA256 59290d2d5a77605f8140feb82e44e8438115fb2f93dc56ed4c225b88c21baaa8
SHA512 cdeb0c4cebf1cc96ebda6940763a940df76120ee991bc7f003480caf055a970f16e4a19ef2ba2c56fa056d539b981e16542ec7239a7b91dd3828585bc2d1e440

/data/data/com.cdel.yanxiu/files/jpush_stat_cache.json

MD5 2807ba7c4d036891de85bc35860e5998
SHA1 4c1c446a1382e150df16ed90f482df602080a63d
SHA256 eec5903b297b56fe8ae531021d71a24012cb72df2a6338bfb34e3198dfdc0302
SHA512 4bbd1c2f43530445c4157d4caf9c1c840e65830fe6fa4f6a89cc5e76b72011ed27f13d4046df55d687ebf062a6c24a317d9dacc2f476b6881c27fcb1610f3c72

/data/data/com.cdel.yanxiu/databases/user.db-journal

MD5 f3274b730bde79548cfd2a393cf08a35
SHA1 ca2975c148a0024c463999655d7b67aa70bd98ad
SHA256 ebb82e067328872be0e2ed998f0c6605e6ba41f3226b04ef5e7c5e769c6d7b56
SHA512 5ccddafd7b5eb4b8a471aa2fba00cb46046cfa39abf6c4b79a6728775bcb2708c2914107d718aa5412237e7ef8cd940865b6cfc795be4dd53bbab98382bcb9ae

/data/data/com.cdel.yanxiu/databases/user.db-wal

MD5 e756cf7daa69c62244682e5443af850e
SHA1 226229a362cd429e3e6c6b8d0fa4bd41ba5ce344
SHA256 79c4bafbf5cf07fddda735dd65ee119781fd7578a23770b6d5910f90a16e2462
SHA512 1d66385c0b5d5af74863522c14b13799019db325c6ae0bead15aa89f3285206110d0383fbd11fff9548157a27ede9605d0b1b3583f85f74eadf9478955cf3e74

/data/data/com.cdel.yanxiu/files/.imprint

MD5 4c52d46e11afed5fefa7aafd2f24f127
SHA1 1edb0568495db0042e64a01de86f1f780c319870
SHA256 d23a801b658d6290fe1ed999f2835d8ac8bd8400c205fb06f57dba88fb705e6d
SHA512 7662f9546c2f88023a9fea1451d822739f723edc55fa34ac111965b6aa6edfb3744d7032a267228f398c8207eea7f2ca38dfecab460cde5a5ec0966d4a17525b

/data/data/com.cdel.yanxiu/files/umeng_it.cache

MD5 c45f832c9288dbc01fc8891f977bbd47
SHA1 c6fe86665e003d3374329ad8c21d0a57c333dae9
SHA256 326609837df670f74781a890014ea49d82500d1d739706931ab47d5251d3c717
SHA512 819b4dbcc28d1e9ea23be03e3878ce189de96f77d664ab6cc246fd37a797aaad0cddab1461cf39d50ba2589578ee77648d032b97c6d6370418343e54937c8d8d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 14:50

Reported

2024-06-13 14:54

Platform

android-x64-20240611.1-en

Max time kernel

75s

Max time network

188s

Command Line

com.cdel.yanxiu

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

com.cdel.yanxiu

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.8:443 ssl.google-analytics.com tcp
GB 142.250.200.10:443 tcp
US 1.1.1.1:53 manage.mobile.cdeledu.com udp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.176:80 alog.umeng.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.85:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.85:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.85:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.85:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 122.188.38.63:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 123.6.37.221:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.221:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.221:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.221:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
GB 216.58.212.238:443 tcp
GB 142.250.200.2:443 tcp
GB 172.217.169.68:443 tcp
GB 172.217.169.68:443 tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
GB 142.250.200.46:443 tcp
CN 116.153.68.72:80 manage.mobile.cdeledu.com tcp
CN 116.153.68.72:80 manage.mobile.cdeledu.com tcp
CN 116.153.68.72:80 manage.mobile.cdeledu.com tcp
CN 116.153.68.72:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
CN 42.236.6.59:80 manage.mobile.cdeledu.com tcp
CN 42.236.6.59:80 manage.mobile.cdeledu.com tcp
CN 42.236.6.59:80 manage.mobile.cdeledu.com tcp
CN 42.236.6.59:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
US 1.1.1.1:53 alog.umeng.co udp
US 1.1.1.1:53 manage.mobile.cdeledu.com udp
CN 42.231.136.127:80 manage.mobile.cdeledu.com tcp
CN 42.231.136.127:80 manage.mobile.cdeledu.com tcp
CN 42.231.136.127:80 manage.mobile.cdeledu.com tcp
CN 42.231.136.127:80 manage.mobile.cdeledu.com tcp
CN 122.189.168.140:80 manage.mobile.cdeledu.com tcp
CN 122.189.168.140:80 manage.mobile.cdeledu.com tcp
CN 122.189.168.140:80 manage.mobile.cdeledu.com tcp
CN 122.189.168.140:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.2.207:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 123.6.25.199:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.58:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 122.189.171.106:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.42.137:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 123.6.33.107:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 116.136.12.139:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 123.6.37.172:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp
CN 119.188.174.59:80 manage.mobile.cdeledu.com tcp

Files

/data/data/com.cdel.yanxiu/databases/analysis.db-journal

MD5 f8eee6453e6ef4df4e5473d2c2b3842f
SHA1 3f0219dd655f0e6e76d6b1bd565d82c2701314ab
SHA256 ad8cbdcd3591c6f2f7b687e49b38fe430bf6d1e803c794ac44c0484eebc14d44
SHA512 c0d6d929843e618f728c3adb3132a1d955bbda1c35f0cfd0e75c45e1a71964c9178416b125893c373a0c09feefbed1a401e73875417fe822cf93a0d638655e1f

/data/data/com.cdel.yanxiu/databases/analysis.db

MD5 68dbdb29b287904b2af4475616f0abc9
SHA1 8991decd5e9cb5c2877a8e1e314da1d58708a2ee
SHA256 2c6f61666746459d5c2b93f6db6b6e45aea8ba40bdcd273a89977a0fc0086158
SHA512 b358eed0f9082f1766cbcf97b0d59371f501ad3ecce5484ed24dfa6eca7f8614fa0f52d82743e51b7fcc4d4706793018b119f1bf74a88752d330e875004e28c8

/data/data/com.cdel.yanxiu/databases/analysis.db-journal

MD5 cb5108b023e052564959b41ec2901000
SHA1 a193843f386bf4a8264d7cf00a1f82056ea539d3
SHA256 9f63c9e925f5eaabcb190ac54b0cc32c272fb6d932625746f05d2f51e4f7198e
SHA512 c82ceaf980a91b933e7700410f9aaa6856b7be3d7d579ba96380d5235ec2d275905a35c9768b131e97ce9ca62ad376be0db2c53b8bbf43f36912478b4b196508

/data/data/com.cdel.yanxiu/databases/analysis.db-journal

MD5 e6153d2d7e951fd78a5e426111ab6822
SHA1 28ab3444a723ab630dc637bd39618203ca6e7901
SHA256 865ff8830124e4d987e7fcd36450e3cfe303cc02d27c5b717aa2d5afeffcecda
SHA512 7c6d5937cb1415d98c31f69d0bcd3f6e08822325e5ff8eb931b3734daea6028c50b6c225349c382db53cf487b5b05d7240dc08dbd6df002f65c6fc14a9add81d

/storage/emulated/0/device

MD5 016917bf3d40a65e2019c2f2730d8e34
SHA1 8f3ecebd2424185dde463f8522710b4639fa81e2
SHA256 a913856055be9c69942a009efc3aa2730d6edf5b5d8db2b7d053a2ec34c4111f
SHA512 cbef0462e482fb2b932d9208e079db5da37fafdff01ba89d1fbb0e35505c8c70185546d4320601a3925e52788044f79d37b1a4aeabd673fd70a8f199792069e4

/data/data/com.cdel.yanxiu/files/umeng_it.cache

MD5 1245f2d2eb163d89aeec0186e6b0755d
SHA1 b85e18131617ba4e27b640806ee6d7960aecba4f
SHA256 00125c39f10e41e38e12c1016190fd1f5355baafe5744f32ac54e9382b1bfe6a
SHA512 04608677b0e7156c3973c40f7180a954fae787b5194eb7f28144a38685adf18fa95fd583fa7df51c3c6b73104e3401085282821eac8f5653c9e1619a9a896c47

/data/data/com.cdel.yanxiu/databases/analysis.db-journal

MD5 1d01ef543744815852b825b0c5e3a941
SHA1 901ba76b6bd5382c50e30b6af540543049d84735
SHA256 731b3f1a957797de256157daa081e987ab0f1d02fc122d4e0782b10b80ea6c1b
SHA512 6712c587bc71a2456ca8c0e8c4ca6a698e8d284af6c8f92c1bc0bbaa1ab9f56ee075598332caeddbbdc3addb6e078c693d00bcea7827f6544d37bebdc7d34293

/data/data/com.cdel.yanxiu/files/jpush_stat_cache.json

MD5 2a30c6eac5f952167cfc61201018e629
SHA1 78eb5372f205d42cf5218c9a636432c1eedc2dfb
SHA256 648c43fbc080974a72ebb62e7c5953f00337be7c4bd25f10c86784c97c4457f1
SHA512 be79590f9152772551bcf270ea82b1ba2678995628a8c7e554454f6ab4b395cdb1697c5ed7ee64af9f2fae8acf8bed6257d0a294d8888b6303503a8a09904d90

/data/data/com.cdel.yanxiu/databases/user.db-journal

MD5 71a143d87e5411dcdb26f969b65aa71e
SHA1 b0d9759a470e485f69224a99497f6a9c03391bf7
SHA256 72f16097e19b3cd05db02092320e7dce782d87cd8fd55217c83193d64b07edde
SHA512 99f446b2d73420be1f6c32f9c1530ac5628ee3949ae65c0365636965d79b0309a978d689ff0856cac39f688c13595233b465124d638ac12c7e41785027fbebb8

/data/data/com.cdel.yanxiu/databases/user.db

MD5 9697aa299052d66390a21a873cbcfa30
SHA1 4512a2343a02c03f255de74260eabcfd14a9b0dd
SHA256 fd4ae50cf0f0fec1a88070ca0d347b0c8dcfde4c89909c4da615d53fe92dd6d4
SHA512 62acb552b24fcd43b05e6857f2bfe6778d5b1a067f2aa7872c8dc614f58ac9bc311d7112786a6b2a3ff0ec801b288ec862c86ff12b4d12def864792e49be8e96

/data/data/com.cdel.yanxiu/databases/user.db-journal

MD5 dd1a21f2953344a3d8885b7b52e23eca
SHA1 e145c0c0086c94778b0afa56ab6f8b8311d8866a
SHA256 b2e5729939d7591ac1b8f6858c402257fa9474f115c613fc11d4fbbbc71bceac
SHA512 3f07497d95a903c6f5e552d567834e300a5fa9d4628248274cacd2ac39d9b87755b2476d4a828e03c4a9e42c378d36d6c63a73e214f881cedea31ecc3c84c9ee

/data/data/com.cdel.yanxiu/databases/user.db-journal

MD5 5897a41b1ffe9ee95491a4c1b9bc3c01
SHA1 ec04fb2909cd12daa83ba211c924c89cf9aeb9be
SHA256 498ddb37475416ffbe06db34b5445cf1b71bf65264e4109c898389650354a3b3
SHA512 671ea8c2e7e23be5a0dd661ada04750a31235438c511fcd4d2b28ee4eeb088686148822a6cb43900f2efce8c01f2a94834de4cacd8248894e4d878ae086f8e66

/data/data/com.cdel.yanxiu/files/mobclick_agent_sealed_com.cdel.yanxiu

MD5 5928c7f7be5cb0a04a4a4edf76db14e6
SHA1 4181a300121e09d71856bf96af15f2542c377cdb
SHA256 8afd62021d997deadde457df50fe8c4133e6f58c336822a48bdcfa3957198889
SHA512 b5e10fd87e990f495d030e454d4539d4944b2a5311ddc2013949a429b697e0147235058033e0b7d55a104c0bd22baa2735645f0374ad4038f5eeb337de235b54