Malware Analysis Report

2024-09-09 17:41

Sample ID 240614-ae19kaxalh
Target a73f417a964c2fceaa713b41dfaece51_JaffaCakes118
SHA256 fe76dfb323c58246c908e93e7879c2f1d7ce3febc18e8e60d811a90d24a9f18a
Tags
discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

fe76dfb323c58246c908e93e7879c2f1d7ce3febc18e8e60d811a90d24a9f18a

Threat Level: Likely malicious

The file a73f417a964c2fceaa713b41dfaece51_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion impact persistence

Checks if the Android device is rooted.

Queries information about the current nearby Wi-Fi networks

Loads dropped Dex/Jar

Queries information about running processes on the device

Queries information about active data network

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Requests dangerous framework permissions

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 00:08

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 00:08

Reported

2024-06-14 00:11

Platform

android-x86-arm-20240611.1-en

Max time kernel

175s

Max time network

131s

Command Line

com.wsw.cospa

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/bin/su N/A N/A
N/A /system/xbin/su N/A N/A
N/A /data/local/su N/A N/A
N/A /data/local/bin/su N/A N/A
N/A /data/local/xbin/su N/A N/A
N/A /sbin/su N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/data/com.wsw.cospa/.jiagu/classes.dex N/A N/A
N/A /data/data/com.wsw.cospa/.jiagu/classes.dex!classes2.dex N/A N/A
N/A /data/data/com.wsw.cospa/.jiagu/classes.dex!classes3.dex N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A s.appjiagu.com N/A N/A
N/A b.appjiagu.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.wsw.cospa

sh -c ps

ps

ps

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 s.appjiagu.com udp
US 104.192.110.60:80 s.appjiagu.com tcp
US 1.1.1.1:53 b.appjiagu.com udp
CN 180.163.249.208:80 b.appjiagu.com tcp
CN 106.63.25.33:80 b.appjiagu.com tcp

Files

/data/data/com.wsw.cospa/.jiagu/libjiagu.so

MD5 6e8ea47d2d8500b7fb8855394fdf0526
SHA1 d3c719bda605cd787c4acf30507edb76b7fb6070
SHA256 cc3b55086867ed7136d474a21b1359f49e6afed3b74fbb4ba5f11b36ce1f4d46
SHA512 385241f905c46ead517e4e0bcaf2fe00160ba0f7f40c6926ba288bf41d46e77a8bd63ec0a97d57a5b65cf6fb1f93b5f86f51d9cb24809ae934ebdb2fd49c0b70

/data/data/com.wsw.cospa/.jiagu/classes.dex

MD5 58843986370e2224c6fe1609460954e0
SHA1 8078d39fbee7c795c0db64389e28fb0122d9305c
SHA256 1042e13c5b24dac5632de33ff442790bfaed3627bd3e3dbcd24f0e9e1c44307b
SHA512 a033c27245feec1da660ed6c2beb4392f9e6710754b67561b0959c26ad5005f661e2829c523f9af7ea4e860c88cd0dc7f3d17f6ffb087d52eddf9b69c42d9b4d

/data/data/com.wsw.cospa/.jiagu/classes.dex!classes2.dex

MD5 f7fe0d25833ce464eb127a8ca669e628
SHA1 dd7ea1b57eb771cf00ac50217734158795599ea5
SHA256 46defe0ca7a20ccdf33bb816ed28021cc85c5e2fd43c0773a4d30273e7e0ae43
SHA512 dfd8e75c9b20617e9672c99d38fa6f1b38764e067396f4d0117193be3d91c605929daa4dc31780541ec65a2d31112ff3536bcefc95f0104058c6d49c5ed920e1

/data/data/com.wsw.cospa/.jiagu/classes.dex!classes3.dex

MD5 0483cef51b4a123f7bf73379e3fe1df9
SHA1 efecdfb1978a36354856690fb371529055be35c6
SHA256 ef666613fa7923c563c61424cb2ab23f89ad6a9c9671eef796148f54fc54fa31
SHA512 11c620e4b772f92ee0722a4c7acff1834fd59a1c375a3bd67ce978cc0403b5180de242fab3548a76723335dcb3661504dc2643c7bd159a5053c1f0fac9f2d7f3

/data/data/com.wsw.cospa/files/.jglogs/.jg.ri

MD5 3fa6a6ce027acfa99bdc8919c79eacec
SHA1 a35cd4bbcb15fc5311e09c5d1f07688dfe7fecd9
SHA256 b4ebfa7d7c94fdd9eb0537d8ea6ed0eae1124f185d13126d4392d872f7fc829d
SHA512 ea5f9efcdb54dc7c206b9a6e86459109a1a92668b8f335382798dd5f5c5560ce3bb9437b156c03df961c0d35b1f57044b783667e4f6be8824d4030199ab5dbb2

/data/data/com.wsw.cospa/files/.jiagu.lock

MD5 438914befb85d9f8710e05b6e960fa48
SHA1 eba6d388b98fffb1cc90e213adbe6cf0b59ecfb2
SHA256 b3be0319578fa41a5a972d098694a5707a80376991997341ca9a8dcb2164517e
SHA512 6c5d0f3660070b83e4fefa89f2547e4b067db7aad56da86dec94129873838a8f2dc67f6c36baf019b28244068c7c1cbbc40f3a4aba5eecaba0675c9e2dc9f581

/data/data/com.wsw.cospa/files/.jglogs/.jg.rd

MD5 5feb1ea91acf9df739bdcd039acf16ec
SHA1 4595ada233077f2ec67b77c12fc4ec7cf4c37297
SHA256 68b41f16682b0d6c19e5d06d055114e59b5fb8db29042dda6b8e0b0d04aa7dfc
SHA512 024ecdd0c13e9c43ef1796c3bf33ea6355245100a85f6027689742998ea323dda2c6141ac6b711b564f5b6fab88f8f1a89de82117cfa1f27e4c63018b5eea36a

/data/data/com.wsw.cospa/files/.jglogs/.jg.store

MD5 448e391c59eef34ee1defbe4dee4c41f
SHA1 df1f890987371d7d8e6963c68b787856e42bc146
SHA256 55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549
SHA512 ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

/data/data/com.wsw.cospa/files/.jglogs/.jg.ac

MD5 20d83070d7a4036335059e003f52bf92
SHA1 19e1ddb4ba2c0f8560b63108bb98d718b6e1c502
SHA256 33694dc60e8959e16b242987e41a7eeaacb415c3b6aa200ef54421dffad26f0e
SHA512 fda6fd8b7bcab48433047319e89181a45b05d363d7d00fd77edb6afc3ab2d3c10319bcee123eb72a9395f4d09900fc605e26b45de3917236f7c9289cf752f55a

/data/data/com.wsw.cospa/files/.jglogs/.jg.ic

MD5 8761d66d316646eecaef5f2baf7554f1
SHA1 48e20c2d755957fefe12870be579fa3abd8b24e4
SHA256 dbccc8ab79e579286e86f31cff13d0ad3bf3594d61cdba4510052e4cde8bf75e
SHA512 004df6aa91197768a0722a4045b88aa433ddafda52da21eee36b9037d32afeeb6c72f4f1097083f7c1f982882c2028538bb2d6a84cc64b58cdcda8c0ae2da660

/data/data/com.wsw.cospa/files/.jglogs/.jg.di

MD5 1246844b445e22988d1901f7d69d0947
SHA1 d8416d346fd18db9295779961cd113494bfd3a09
SHA256 703f73f61c82748e100076a0685e91f8430e1c8e5cf9e33cec9d7651d13bebff
SHA512 221425bf0c441d10be712e021874ba8fc91aef970cceb631ede29bb66828434f25e6fad334eb00d06d2cbae2852f0681b84f4ab334d370b40729eaf243a89db7

/storage/emulated/0/360/.iddata

MD5 d31403f317a40d5b3d77abd513abd555
SHA1 bfd308022da9e0e2096bda0b9de0488e3d5b00b4
SHA256 a9a9cb9583e194008c869f0d4e0cf0eb940a84e207477e2fd2df8cf5564753ca
SHA512 fd91ba491056eee858d61d8c4450ffb9f5db7466b7a3bac2d3fa488063b5dad37161c36b89a8cb205abf8133bab217983e8d6d2a46ca7521b38cb06d5ec89fde

/storage/emulated/0/360/.deviceId

MD5 1d8d16c4e3b19ebf18988530d9b9a757
SHA1 bc94c1cce05cd848a53271ecb9c5311e27ffebf5
SHA256 abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7
SHA512 4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

/data/data/com.wsw.cospa/lib-main/dso_state

MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

/data/data/com.wsw.cospa/lib-main/dso_deps

MD5 c4274a8bb09d4ded32d0a26b213bcc75
SHA1 cf07299087d7b332ef403fcde553a8380f21a2e5
SHA256 22b0277f761198032ac88d48be444eea89774176818ba17c8eb2acea627b034f
SHA512 4da723b2c20fbe4d3aafd3c392609e219601bdc53544c90b590d250b8a47c946e3f7f4d599fc40a6592b890df9888fcb6c0089f91547e992fbba26562a040b16

/data/data/com.wsw.cospa/lib-main/dso_manifest

MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

/data/data/com.wsw.cospa/lib-main/dso_state

MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

/data/data/com.wsw.cospa/databases/comic-db-journal

MD5 cfac20b8ec3232250503b46a49a4c7cf
SHA1 e98671860f948cd2d2d4f2431c92cd230796217b
SHA256 a44155f88d217384d314a4e80fbc5d17c9f7166d74421ca13e9909776895a757
SHA512 ff2a567744016760d52cc7398d2654535c79669e83805a75f6eecbcf0f3721bbd16ce69f45939f0c4f8ceacfc118279f3796c53eb3cb24e48815951484d97e5f

/data/data/com.wsw.cospa/databases/comic-db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.wsw.cospa/databases/comic-db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.wsw.cospa/databases/comic-db-wal

MD5 874b87f14c79aace48230088150de10b
SHA1 04fac5a4d407e1d1d19fd970f0196c0ac935a36b
SHA256 2701086c82be004636ef92fc4a808b26dbe015cc85ba54179dae9d5030e76a0b
SHA512 6cc118e14a39744a487b8d366f17594ada937210c33ceb07893fb4115a6a9d52ac155d29bd1feb2f6c8bd4aa7570ab530409a28ea5d26ac9171a9127d909065b

/data/data/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal

MD5 b8c2327d5e8380cf0640af9d0eca4990
SHA1 8d90bab314d2e918aa29c23698d04599db9ace25
SHA256 591c45d528dfe662cdcee2c215724aa7c405c650e1ff589c5689cfe75bbfaae4
SHA512 6d2f8642407855996535d23958880c81ca60999d5c1b422e14bb3cea36d23b16581fec6ffd0b3b844ef06501bce53b5075cc173b4fa1f699bcd6a029032e7fe2

/data/data/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-wal

MD5 2787bb712dc370293552a5d3f99aae7b
SHA1 28d901e4eb7aef768344686ecabe6b222f7e6933
SHA256 f5f126bb30d0fcb2854b73d9b0c52b52b93d70386df8e2d73e393a1dbb89de7c
SHA512 44ab3e09f567e46288ddaa9d4cb8769d52c2e4aebf4142934600bb8aedaac144c5915345e977d476b32f17f9a6bd78da4f5c5e752b6d15eba41fad268c1b370c

/data/data/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal

MD5 065cba3ed3bd1357d0c80e7ccf5e45ac
SHA1 8803b1e53c64ce11e9fd64440ae63492b63177e6
SHA256 ae15d1ec091632199d70803305c962d4608aada4bcf3dfc56561eaa0db3836e8
SHA512 c1ee80c4affc5dd4340fe926f2ab27387fd5ed1ea6170d442c59dd4a52576004d3bceb42ee5e58fa797ff02cea44876dcf388201f49de4a3f1bdc0cb86be1f88

/data/data/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-wal

MD5 26820555bd6281e9067949a932c7868a
SHA1 8d0063bca213fd92cfa907f250f3c138208c85c3
SHA256 125a1cdf9f661efd27a2d33c3f32b23fcb77989bc9180cae7210ed175abbb0a9
SHA512 370ab8ba96eb44c07274fa79d05b2d95d4dd06e40693dab5bddea989e5df17e8e1890d36b9626b9063e2da6d04e69ca0c16a3741c2a59e2fa7e7d05feb8f0834

/data/data/com.wsw.cospa/files/.jglogs/.jg.di

MD5 fb0715c350fe753f2e7740b53471e919
SHA1 7651696bfe3b1cc02125816cf8fdd9b4551efa0b
SHA256 3bf3e837eb3edbd2c513e5f1532b66cd6aab3663ddfe705ee78c052f88004c24
SHA512 2cc3176fb4af07cf1adb1fb594b9c372209f349a85d826e347556784ed04f94e99c088b1606d2cdea1c59a8a82d679ca3b42768d213d58b691eed7faefd2bad1

/data/data/com.wsw.cospa/files/.jglogs/.jg.store

MD5 0aa0789335b8846d593456b2803314b4
SHA1 e2383ee927f1f97423c407dfd8f147136a765e8c
SHA256 8526d0be07358e4b2931e8a7b7565e94843083825a59a22dd4453a05ff258bae
SHA512 e3fb558739a92035dc209ff1e4dab2e7f5f506554bdace45c0763a747750412e376f34f97313686434e14aa307166f39b98feb34bd692e092ef7c7521de444ce

/data/data/com.wsw.cospa/files/.jglogs/.jg.ac

MD5 d8b02bbbb5ccdcc6572471473959d175
SHA1 cd84a9a651db651572b636489f5e7dc1053326ca
SHA256 fb22e6451882db7885c8b8cd42afd6a0f18db24648a85a9ba791700cb70a53a2
SHA512 1f818b2b506e218e56f8a209fc76f83aba33e29241f977bd3e1833e5026123df1a45f7ec6010ad2a867cb8be0a28beddd874ee95381c6b01d53227913ff5db6f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 00:08

Reported

2024-06-14 00:11

Platform

android-x64-arm64-20240611.1-en

Max time kernel

63s

Max time network

133s

Command Line

com.wsw.cospa

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /data/local/su N/A N/A
N/A /data/local/bin/su N/A N/A
N/A /data/local/xbin/su N/A N/A
N/A /sbin/su N/A N/A
N/A /system/bin/su N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.wsw.cospa/[email protected] N/A N/A
N/A /data/user/0/com.wsw.cospa/[email protected]!classes2.dex N/A N/A
N/A /data/user/0/com.wsw.cospa/[email protected]!classes3.dex N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A s.appjiagu.com N/A N/A
N/A b.appjiagu.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.wsw.cospa

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 s.appjiagu.com udp
US 104.192.110.60:80 s.appjiagu.com tcp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
US 1.1.1.1:53 b.appjiagu.com udp
CN 180.163.249.208:80 b.appjiagu.com tcp
CN 106.63.25.33:80 b.appjiagu.com tcp

Files

/data/user/0/com.wsw.cospa/.jiagu/libjiagu.so

MD5 6e8ea47d2d8500b7fb8855394fdf0526
SHA1 d3c719bda605cd787c4acf30507edb76b7fb6070
SHA256 cc3b55086867ed7136d474a21b1359f49e6afed3b74fbb4ba5f11b36ce1f4d46
SHA512 385241f905c46ead517e4e0bcaf2fe00160ba0f7f40c6926ba288bf41d46e77a8bd63ec0a97d57a5b65cf6fb1f93b5f86f51d9cb24809ae934ebdb2fd49c0b70

/data/user/0/com.wsw.cospa/[email protected]

MD5 58843986370e2224c6fe1609460954e0
SHA1 8078d39fbee7c795c0db64389e28fb0122d9305c
SHA256 1042e13c5b24dac5632de33ff442790bfaed3627bd3e3dbcd24f0e9e1c44307b
SHA512 a033c27245feec1da660ed6c2beb4392f9e6710754b67561b0959c26ad5005f661e2829c523f9af7ea4e860c88cd0dc7f3d17f6ffb087d52eddf9b69c42d9b4d

/data/user/0/com.wsw.cospa/[email protected]!classes2.dex

MD5 f7fe0d25833ce464eb127a8ca669e628
SHA1 dd7ea1b57eb771cf00ac50217734158795599ea5
SHA256 46defe0ca7a20ccdf33bb816ed28021cc85c5e2fd43c0773a4d30273e7e0ae43
SHA512 dfd8e75c9b20617e9672c99d38fa6f1b38764e067396f4d0117193be3d91c605929daa4dc31780541ec65a2d31112ff3536bcefc95f0104058c6d49c5ed920e1

/data/user/0/com.wsw.cospa/[email protected]!classes3.dex

MD5 0483cef51b4a123f7bf73379e3fe1df9
SHA1 efecdfb1978a36354856690fb371529055be35c6
SHA256 ef666613fa7923c563c61424cb2ab23f89ad6a9c9671eef796148f54fc54fa31
SHA512 11c620e4b772f92ee0722a4c7acff1834fd59a1c375a3bd67ce978cc0403b5180de242fab3548a76723335dcb3661504dc2643c7bd159a5053c1f0fac9f2d7f3

/data/data/com.wsw.cospa/files/.jglogs/.jg.ri

MD5 cafe98b4e6483cdacd58a9948a9f87f0
SHA1 2febae28b30797729c017e49d0b47549e25090a2
SHA256 d88041d683bb89ee536caa2b1340ac8e595c098f32ecac6d14e53879af491441
SHA512 648f2bda78bbf13c2b03fad82ec583c4c1ad703883fd6a2bfd93ff703596be3c4ea71afd4a99cbf8ba31736411c68af71d3b057aff9af738f8ace47e9354a9a5

/data/data/com.wsw.cospa/files/.jiagu.lock

MD5 70cb6b47afd16bfc288b688159655713
SHA1 a75e3181e97d9630300f1d1e7a60186c635bc4a3
SHA256 f3d2524023a31e8db6a5426115f264b6d901045891c4b8172b144cbd754f4071
SHA512 499241e26e01859bfba673b7fe09fabc85aef66568c749d66fcfbf2a73055703e331bc480babb46aaffa1d6a30e02087ff17b214eb24e4fdbac73290acc79e2a

/data/data/com.wsw.cospa/files/.jglogs/.jg.rd

MD5 8cba015a2fcf12af673e136cb806afda
SHA1 a575a7bb7a95f634286e1a0f26956b45fca1d5bb
SHA256 9d765bfc91229670b774c84e045b1d32dd9d67365b11197716fcdf79541cb466
SHA512 b008415f45bb4bd1aea4baa80971e7491d5b53bd6fa4da2335cbd0b2152ede7e04a90217fea1d4fa4850371910d58339a24e873d87a130062bb41f7c4ce47b09

/data/data/com.wsw.cospa/files/.jglogs/.jg.store

MD5 448e391c59eef34ee1defbe4dee4c41f
SHA1 df1f890987371d7d8e6963c68b787856e42bc146
SHA256 55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549
SHA512 ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

/data/data/com.wsw.cospa/files/.jglogs/.jg.ac

MD5 20d83070d7a4036335059e003f52bf92
SHA1 19e1ddb4ba2c0f8560b63108bb98d718b6e1c502
SHA256 33694dc60e8959e16b242987e41a7eeaacb415c3b6aa200ef54421dffad26f0e
SHA512 fda6fd8b7bcab48433047319e89181a45b05d363d7d00fd77edb6afc3ab2d3c10319bcee123eb72a9395f4d09900fc605e26b45de3917236f7c9289cf752f55a

/data/data/com.wsw.cospa/files/.jglogs/.jg.ic

MD5 8761d66d316646eecaef5f2baf7554f1
SHA1 48e20c2d755957fefe12870be579fa3abd8b24e4
SHA256 dbccc8ab79e579286e86f31cff13d0ad3bf3594d61cdba4510052e4cde8bf75e
SHA512 004df6aa91197768a0722a4045b88aa433ddafda52da21eee36b9037d32afeeb6c72f4f1097083f7c1f982882c2028538bb2d6a84cc64b58cdcda8c0ae2da660

/data/data/com.wsw.cospa/files/.jglogs/.jg.di

MD5 699c543c458b56c7016365eee1008c61
SHA1 de838cb750b6cb88bef5324b1cb442e8f7a9b0d8
SHA256 4375f7443c7bc0eef9de9086dc749f994ef291c527118ab77e175cfeae0a45ba
SHA512 5db5e443be73d03b913eee3581c8d84ee815b9c09c209830c61c31df2720e684525a13d1dfd485a0aef7aa0a9d59f9c9e4dba0029139d2b740bf8008b714330d

/storage/emulated/0/360/.iddata

MD5 6d70dd8546530f73843b729b1461283a
SHA1 278cc6c2dc4b6348fdcc8cdec2a1ca70858c8638
SHA256 9002fe8e7ce21e8e85b1ae694a14e611fd47abe88c36c90c28110e59f6165eb0
SHA512 8c87cbf9ad4c5fb728d291a9a7e9b627387c409e0d4cd26a8014e3bce042a1eae45b1e893447bf3b09599b44e706ff5cb088bbeec4cb5a884e53c07095ae494f

/storage/emulated/0/360/.deviceId

MD5 4c4c5285293d5141f582aefa4e038669
SHA1 e01852a72e5a8e6f7d63a21426b515118196047b
SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
SHA512 097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399

/data/user/0/com.wsw.cospa/lib-main/dso_state

MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

/data/user/0/com.wsw.cospa/lib-main/dso_deps

MD5 8b0efd58fc62415dbdb202d1662989a2
SHA1 30ce1d9dbcd6a33bc0794158c5e625adcd076986
SHA256 bd0f28512c1e4d40eb7814defc768f02dc0c842fae8c5c635e1974c80f05bc7f
SHA512 3f2815db5c814ac0f9b8635dbee90c525de054e1c88b4a79ffd7a5dc586495ca6cdfc81a13ccd20a7f3bf34cc523c96a392fe5ed67d8cb3f840fcd91194a91b0

/data/user/0/com.wsw.cospa/lib-main/dso_manifest

MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

/data/user/0/com.wsw.cospa/lib-main/dso_state

MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

/data/user/0/com.wsw.cospa/databases/comic-db-journal

MD5 85ea4154e7577e99c32b60cac71448cb
SHA1 69043bd61a52a7dce737df8f94779f691ff6376f
SHA256 e0955ce04ae756035e28dedf68d5a520674638cbb59a4a7eb98a2c6e5b54d5b5
SHA512 de3fce16edc574ae7af6fbf102ebd8725af86ea77a1343d49fbe4948ac87092396eb1ba45b705d897752500e158f1528577c611387c7a52ffac2499ed38ffbb0

/data/user/0/com.wsw.cospa/databases/comic-db

MD5 7a972343b6ad5275e4498f5e8ff3f261
SHA1 35967380f3591183c16887f5c782140315a50446
SHA256 0bd490eaa56da3d0807aae83e32098a557e74871b768d9285c6d12b5fac7a368
SHA512 62c220b33a740a05bb39c744324b4400f6bb8abdd361b153ad48c52db27c3e03bd1b03430cafceb5a3163b737167850f69ea70834bf095e391471b0ef6235bff

/data/user/0/com.wsw.cospa/databases/comic-db-journal

MD5 4d910432e7a41ba6b08b3b3e3da01e0a
SHA1 b6e673d6548717b1e96f38ee1643602ff5b3c2bf
SHA256 dc8811ca1dffec58d9f7ae6cf09569256df6c67c30ead46b208b02b2add86ab2
SHA512 2282621ba90ff10a366239108a8a0484f76e9b6fa11f8b6b2a77cbf93dc82381d8aefa98c09755626d879516213d441e07411c2935f293d5220b66d4b41780f6

/data/user/0/com.wsw.cospa/databases/comic-db-journal

MD5 c49d33795ae65669c44dbd93a48d553a
SHA1 7398a37a25f92a4dbede133577d0acae16e8a442
SHA256 8de74f450cb36e3d05659427be2d3d967ef1a80f40350e433b30f81a63bec62c
SHA512 7b1f321dc36919065cdd9ec0efe0129ca71d8559d516d48326453de28bd6f5f35f651dc48270cb47c1317525e21bd7b5e1716d6b5f394ec4bf588bccbe903bdd

/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal

MD5 8f1453dc9334dfc93f33fcbb272b3741
SHA1 1d71f3501cd029478eff8132f85b1bd47edf0116
SHA256 b166adc54a3cc80d87da95ddd65fc13136c10df876bb9064e0c2b5ea0496ff23
SHA512 8d0837472b6bc48ffe491d25153678be319777ff254becafa265c3148d5ec12e19691ffa996568be9768849f6378ae6d09dbb220bf6064ade157b3ddb9661001

/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa

MD5 ea3aaf2e58436cec1cff6bfd244aa65d
SHA1 67755cd1f3fdb1011993ddc9379a4eb923b5ba0e
SHA256 bcd8bf55121227b922a38fb775521b9bfe0de068399816fb8133a1147621da18
SHA512 e77f18278ae9be9f7b8c8f82d62aca37e2aecd8289ebf6e0b020e6d5ffbafb6045db500cc76cf8b6f0a078d74eb7adec69302bff8ecd16a2e345a5fba0ae1d51

/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal

MD5 0472e2c3b87761baaa7efdf082c042d5
SHA1 890d6947f8c26ada3e83c7dc6569173716d8532d
SHA256 c2ee61120f2305dba1772266da7e814eaf14e215c23ed2e245cb0d5b8705204c
SHA512 ad03f3b73885dab23719e86a1678576e442d6dbea09364ce1bc36a4e66af904a894823cb6dff80615ee70ad2d7654a7f06ac6098c08cd367f7e964e054104174

/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal

MD5 d5b15c45ca0c51e8dd912394693fa449
SHA1 9b29412486587b0473834c3956b320c1e5bf9e21
SHA256 e94e8b3eae1762c782ff12ada535ccd7551bb5779a94f938f73ac9676ca7177a
SHA512 953c24c37acfaa5680ef8b015a4902830a32d03873b8560e63d6d1257982540c73df488dd69bae772279d0b03ddb3a0f85aec8c5998e58098a8dfb513def5e4e

/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal

MD5 894124363aa33a944ac9e118fea68f6a
SHA1 ce14a4f39fab450edc5d7c1ad8f9f81870f236f8
SHA256 b85075b132222f9f713fdf3a4ef8e81fc60e36c86d48ecbdaa0c1df7a3c37a52
SHA512 dbf08f7b664eaeb4d9f933b86e1c136738936062ed085732bbbaa77b6c8898ebbe412ec8f1fae1b18abe3c8eb9475e572f1c50e09d21f12e52a56e63edf48d0d

/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal

MD5 c586a1e91405d3809f929d308d14a2bb
SHA1 12f298cbe0142f76bd5ea2e9e07ef976108bc490
SHA256 55bc598c6e753db49cdf1f65a23a209f41c829ef60249b66dafae1535ebb6415
SHA512 427b7f475a5124d477c6b209ab8c05f6891cc2aa812ee1b158d39428b1ab39db616ed78a627edf168382d7abd1a891ee91cb7555578ca4fa3f6cd0ffda477603

/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal

MD5 50f8d3f658897156e6d0800ff7f0941c
SHA1 288ec4396860aa092a7a3c3e63de7465e1bf15b2
SHA256 cdb0d439a55863826c3746c45bd83581dedb6d5bd04f53874cef0d92862a85d5
SHA512 2039d59a2438c35921be20fe63e1c4932f2f719c54c33944d9e1c7fa002b95cf9d988ece424180e4d3f4beb68e8a9443f0867bf96a6bae0e2feec4ef857151d7

/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa

MD5 45176c3d17a8fdc95589913768ba3156
SHA1 8522ebe8e827b1468d1d6759b870f59c3c5691a2
SHA256 f66593ea341b34f023b4afe8c5b65726d05c721cbab7099c7239081a522ff1ab
SHA512 1e3efc725c736fb1c063d8714f3067a703be164f946e8d7fab0de42ea3234b34adca20dcc4da2f4bc8522e35e52ca42d4a48ef015bbce387bfd6a34e0b0af0ed

/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal

MD5 b6435dfccd19ff05474a3b64b43cb215
SHA1 67f53ad6ccd0d9bedf7ec49915a9e6a627a662c4
SHA256 80960fe161c63719a2c64124aaf4561fb1017dda009e101c7a9841496711ea26
SHA512 49d663ba55b06c5eafd3a9653b9b6c228af32300913e12f2fb8c2e91af389ff148215f53888bde4112362baa67383326a0778ed14d7952bb27e2e5983336e84c

/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal

MD5 323c473dc82bf41d11b2f4544c9c9d6c
SHA1 12862c7beb1c6f67253db203371ea7ab8c90267d
SHA256 ea82058024ec0c0f0481875e6b532a7bdd87ff7cdcdce8e079aaa906b9fbe972
SHA512 5a2bd797914f0c90fa3cda070d29ff7e9e29ec2fa96004e6f39604cdbf5de035cfdd4a0d018adc191b595c55ae4c513521f9ba53368a5f79384ddf0d47454996

/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal

MD5 2246055a78d204a62d53c5317d23668b
SHA1 b1933c459d7775170028a2e47120adfcbfce6906
SHA256 04dfe3ebd048729307a41251a30919fa15bd84106270f71d8e9edf78f284a6ce
SHA512 2c69b587a66270db74fe2c4043a094c4249b7737696ae2edf30a966551ba1d7397f6c5ee22565f998a7c47080be5b9561e31779c148d7c51086b24e525f79440

/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal

MD5 6f6e866e69e10dea6ec305665e9fc22f
SHA1 cf1faffcaf3c5f29dfe5e9631a7a35b26fd454f8
SHA256 35c7a901551da85c32ebec492f33633cba8be9244dd373ade99200a482766ff0
SHA512 2cc2db3e8723d2979a78738b8350f7e7883313c54bc49ab56363a8c2fc87c1183e7ce60fe563aa1ac13e2ba0165449af037dd53fdb5c138d7a2db0244a0630c1

/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal

MD5 83b3066af95ebbc9755befd9fa33a4db
SHA1 779456157018244dd92eaeec373cd5441eb6b428
SHA256 606b25fb2db7a07a9752c5dc155279f1478e88575ebce211d977c027ac78bca6
SHA512 e207c2a86f2a62054d1c1bc1662d56157ec7f73c597b6bc5f190bd5e4b9ce20a8af2f286ecfa00f995e763ef390ee22d1c16d048351a66ece289835e0ca025d3

/data/data/com.wsw.cospa/files/.jglogs/.jg.di

MD5 321c761dbae2c3c47fea7e45ba8d6f7b
SHA1 a59e8b8c71012cd76a148005d07f5aa471b414ba
SHA256 3ae6a56d04167a8f23cba2bbc819ea91cb75aa677010e556ef498d0b7e538dd0
SHA512 b47fe1992bbffb08da69ddf93e413d3cfa3082255fe986e918404e1cec95c26ffd3c5ecd8726a87c6369abdce159ad1f76985ecf9cb8213b814341d55f6232d1

/data/data/com.wsw.cospa/files/.jglogs/.jg.store

MD5 e59c60aedab6f3507857819f195531e3
SHA1 b52a8f794607d1a6b2f13a9568351158460368ce
SHA256 cf108828a136e2be9f9d217444e2269c743d398ab7b3490fe83bd943104b1950
SHA512 f29bb60c572e80958515c1ce0e7b340526dc7e439b1d96c2f022e4e0c770a52b3d6eb265187849782b2dac5529a9c01a2a1a6a24378132f6900fe3d8bfc03c97

/data/data/com.wsw.cospa/files/.jglogs/.jg.ac

MD5 d8b02bbbb5ccdcc6572471473959d175
SHA1 cd84a9a651db651572b636489f5e7dc1053326ca
SHA256 fb22e6451882db7885c8b8cd42afd6a0f18db24648a85a9ba791700cb70a53a2
SHA512 1f818b2b506e218e56f8a209fc76f83aba33e29241f977bd3e1833e5026123df1a45f7ec6010ad2a867cb8be0a28beddd874ee95381c6b01d53227913ff5db6f