Malware Analysis Report

2025-01-19 04:50

Sample ID 240618-g3g9xs1bqf
Target bb151dfbdcd91319b8122bca4f6c537e_JaffaCakes118
SHA256 953e26c9f72f0e49fb36a4bc19a13d0530f69e1dbe6bca26872a415d2c332353
Tags
banker collection discovery evasion persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

953e26c9f72f0e49fb36a4bc19a13d0530f69e1dbe6bca26872a415d2c332353

Threat Level: Shows suspicious behavior

The file bb151dfbdcd91319b8122bca4f6c537e_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

banker collection discovery evasion persistence

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests cell location

Queries information about active data network

Reads information about phone network operator.

Requests dangerous framework permissions

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-18 06:19

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 06:19

Reported

2024-06-18 06:22

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

132s

Command Line

com.ansca.corona

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.ansca.corona/app_pdez/ghkn.zip N/A N/A
N/A /data/user/0/com.ansca.corona/app_pdez/ghkn.zip N/A N/A
N/A /data/user/0/com.ansca.corona/app_oiuj/zkl.jar N/A N/A
N/A /data/user/0/com.ansca.corona/app_oiuj/zkl.jar N/A N/A
N/A /data/user/0/com.ansca.corona/app_pdez/ghkn.zip N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

com.ansca.corona

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ansca.corona/app_pdez/ghkn.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.ansca.corona/app_pdez/oat/x86/ghkn.odex --compiler-filter=quicken --class-loader-context=&

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ansca.corona/app_oiuj/zkl.jar --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.ansca.corona/app_oiuj/oat/x86/zkl.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
GB 172.217.169.74:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 api.map.baidu.com udp
HK 103.235.46.245:80 api.map.baidu.com tcp
US 1.1.1.1:53 www.baidu.com udp
HK 103.235.46.96:80 www.baidu.com tcp
HK 103.235.46.245:80 api.map.baidu.com tcp
US 1.1.1.1:53 api.is.139199.com udp
HK 103.235.46.96:80 www.baidu.com tcp
US 1.1.1.1:53 api.amplitude.com udp
US 44.241.24.155:443 api.amplitude.com tcp
US 1.1.1.1:53 api.is.139199.com udp
US 1.1.1.1:53 api.is.139199.com udp
US 1.1.1.1:53 api.is.139199.com udp
US 1.1.1.1:53 api.is.139199.com udp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 api.is.139199.com udp
US 1.1.1.1:53 api.is.139199.com udp
GB 142.250.187.234:443 semanticlocation-pa.googleapis.com tcp
HK 103.235.46.245:80 api.map.baidu.com tcp
US 1.1.1.1:53 www.baidu.com udp
HK 103.235.47.188:80 www.baidu.com tcp
US 1.1.1.1:53 api.push.139199.com udp
US 1.1.1.1:53 api.push.139199.com udp
US 1.1.1.1:53 api.push.139199.com udp

Files

/data/data/com.ansca.corona/app_data/settings.json

MD5 fa5e0854f190cb9048142343e5d78ad6
SHA1 97712f3ddf3d2fb0beee1e68493dc0a72587564d
SHA256 c26a695751953fee4a9e121414824a8fc3bdebfbcd0cf6de5b3700f846f513cb
SHA512 2126a0faf5d99a3b0b1040186f46bace4746d1ca9c03ec0228213417fff9af7784a85fa21a0982988510c2b52a6d8d3139e36b5f9906c77661e17b01916abae2

/data/data/com.ansca.corona/app_data/unixtime.xml

MD5 8864e2091b27461f82722ac18feecc2d
SHA1 7779df7cdacf3839e6f1b610dd695af453480519
SHA256 171a3bc04fd844c6d6d225db844ff42e384a91a28e2ca62717ba838db471f86b
SHA512 4d47a752b0b1e1fe66051bacdacf72968df6604485187c373cdb8c041eb8f54cb16331983f396bbe7d86677e4c99d83b5531808115c924a80818a6009e41e01b

/data/data/com.ansca.corona/app_pdez/ghkn.zip

MD5 c776f609a69900fca409a7793addcec4
SHA1 4337cf31eba61c68065f1fdb351b794562c78e38
SHA256 f55650d19fa63155ce6306e329cd1c7e754125707dff2d842fec46a7c9219e38
SHA512 a7b311d88d6d44cd45f6ab70ad14489cda4289f260dc8dc81e4c0c40bc9c04ce5debfbb89800e4ce0b8b81b36101c05b673089736d03544b2ed512148d82c4cc

/data/data/com.ansca.corona/app_pushimgs/adwords_bg.png

MD5 4b9b64c9dc6d13733a9ac3320ac9f53f
SHA1 a02218ada2417dd85a3f3a22db31d30c150440bd
SHA256 35dc398b4409f3037ef52c21e4674a283e1cc0f71894704a4583752b91fb0cf1
SHA512 b819d1ca851815549bff946c1950539db7d199b3b04be0f6a6aadb1602225e895ac7283c525733e9e421646a6f2da2b732ce3cccb8461e93574c04e5d64b31b7

/data/data/com.ansca.corona/app_pushimgs/arrow_down.png

MD5 db45ab95930456e6baddab4e6fcbe712
SHA1 fa0c152e3afd7fa7026b0f688a3c6ea2c27b53c8
SHA256 5c3755a2f79003a4702ee79232d59efad418aa83e30b2691256a44457b0c602a
SHA512 d658b23e0687867f44567ae4dddb1a01cebab15508032ff7336458fa226e592db84217c852eaaa2132226cebd4bd7f74b8144a78aa85f77e979a7a1f104b8582

/data/data/com.ansca.corona/app_pushimgs/arrow_up.png

MD5 20c4a831398dd9ebd8dba380a2e7857a
SHA1 c6db26860686a65f5f402d29d98b358630c10e40
SHA256 03353442682b665da8ccb439ac22407ed53cb499266361581a818d3b267b356d
SHA512 85ca28c7eace2766c4a5d8c8b1df4dc81cdecb241e8d129b9e43ebdcc2f3c7385aecf12afd02755bba850c19260f07635199ca606f32a8ea0d71355f64e4e423

/data/data/com.ansca.corona/app_pushimgs/bottom_bg.png

MD5 ffe93c95f1ceef187397bb763c992ccf
SHA1 6b082b7f6c55acd0987611b3b9a5aac9a5b06d67
SHA256 06dcc9066f53227b50faa763aed62944dc8d5a1612beba619caae2b1a81b42d9
SHA512 10693e4df14b0212798817d20cde37c88226353f4389968a81607fe7420244cabe2fb2074627e5194ff2c06cba0cb068598ab5078c0dbf8dbe4928f86ced6161

/data/data/com.ansca.corona/app_pushimgs/bottom_btn_cache.png

MD5 b08b3f807464a79d8a28b44eec61d5a0
SHA1 7855100f98a14220cb24a8e097c1aed778bf855f
SHA256 adda17ece90d03a44e3f15970f62c0aef32dbf3459fc47eb72914975397adace
SHA512 a20b7781df1b6636c4266011315b602b1a69a03656206232fee54e5ddfe85bf431301f9fd1727c6aacd0e2ecd3b9ca18c0c7880613bbb8ef7660ee864bbc6ae9

/data/data/com.ansca.corona/app_pushimgs/bottom_btn_cancel.png

MD5 d2135ade336215f3510780177806f569
SHA1 42ab579d5c377f0674fd749ce99efb20dd57351e
SHA256 790801d8fc1b026b2b1c919ee915e776a3bd77a231861d8cff5ce7812565096e
SHA512 741b4c2c730df14c2d9d61f3eb01a87fa06ef89e1c1b91da27b03c98a20ff7fe01fb47cd08234316abf597bec03ea3e4a770ff8799c9347ddd4e9e916e9f367f

/data/data/com.ansca.corona/app_pushimgs/bottom_btn_install.png

MD5 7f10a1d9c5e514050e22138d70d842ad
SHA1 2a58f5fb306f4f4d071b845baf84c0bb39ee4ad7
SHA256 e7758d23bd9ad789d81e7f9eef7e948a403609a4a28ba53d9b3124135ad796ab
SHA512 cc3186cdd32448ecd35b052b6aa7af6b189644611518f711bdf8ad1b29acab3c8a0e65fa736af500153ca281b1147e2dc005fa6799417799fc185ba6fd64fcaa

/data/data/com.ansca.corona/app_pushimgs/btn_install.png

MD5 dd18221de23603b78f421d0ba0f591c7
SHA1 c1806e627f1e71612fca6638e93894a00b092618
SHA256 aa4077aa3cc99ec30f27c07fcc11f8e8d48e5cf0cf786335c89a459a5a8949c3
SHA512 8aac08f0e222bfdf4d7800c90eafbed96ce47a93e71ec04234031da33b3aff981d3463a6fb8e66122d32848225fadb759e4c0b58f374873fdee2d9d157354e93

/data/data/com.ansca.corona/app_pushimgs/d_appsc_an

MD5 58dae109b45c2378d880225e9f746240
SHA1 e67b37d47c009a11c9b365d38a3692f6e67c606e
SHA256 afc834307f4d1bb9eaba3f3ed85aa32a616ebef7b32b14ba234926312ad0f2ce
SHA512 ca3c5caffe9340d2a39e84c8e7e2ad495640338a6d1d6ecafb4b935578b334fcbfdbbdbdab983c7b6559387cfd197cd8fd33c243d6c06eb9368c6f7e4ccf76cc

/data/data/com.ansca.corona/app_pushimgs/d_cloesbtn_top

MD5 6edfc3ccf80c5cb2c25bf82dd5e78c46
SHA1 0f71fe007ebb0479e42905c6a78f80b0a109a03b
SHA256 2225deaa4204ae88206589b390dd277c9e24ab0a68338cec19eae600b854fe32
SHA512 a8e4adcc0cd0867e8bb2cfe43a04c3a8e8a84de99ad7150c339c4dab1e81c8dab87af17fe7b7bbea41d54c6acd6214224f07ba456a8dc0fc8c33b3782e83ba4f

/data/data/com.ansca.corona/app_pushimgs/d_shortcutad_bg

MD5 66cfa171762dc97679085b770d8a1a24
SHA1 0ea4278905b9beff4cf8ab932955e720b7efd200
SHA256 7742eed2fc4c8437016dddf0af8b6b7ab44c8cb67dc2adb13f44ebd959cccc0a
SHA512 04c3b023abb743dbbf4a856c51d08af43d9fcc9f128073336ba4bb8149a9ce4d70f7cc50cc2989e59cd82339371345f02a341fb7abdfc53b0cb8c0680c400ceb

/data/data/com.ansca.corona/app_pushimgs/img_bg.png

MD5 089965b9fb96326ad74e361a9a524e4b
SHA1 528cc6c7a10de9f525919a477c9e20d6b6e93d55
SHA256 d7c9eec30a30c3da3e80d2f7db31ae1ceb542c590f5ce8abaa77f39a16a0cf46
SHA512 b19f99764693882cb845b024bf5ef42121826dc92047532df19ff3e236c5e5e57e1390b942182275cc906fea83c541190325d21c88f70bd1041288b17489a579

/data/data/com.ansca.corona/app_pushimgs/item_btn.png

MD5 c273f481a2774797a0f67a6f4a042bbe
SHA1 2858e907a559742835b1d820c8fc635ec5f7d094
SHA256 bb44dacdbda4803c00d0d7ef98376a2c3ad17d4c8b33084918a4986c744135ac
SHA512 75ee76ba31b62d0fbf0d17da7db4732664bf083e3848a1c38d82aca70d8fdeda54b3bef06c6df833fb9a4459c7789db2240dc886e52f2d82b50c464d505716cb

/data/data/com.ansca.corona/app_pushimgs/m_star.png

MD5 590dd3230f50ba57b7a828cf1ad04aa0
SHA1 d8cd7d9cca6d011d3d4f6cea8c76fc3c1a7898ee
SHA256 d67f2ece3ab36175096b96cf121f83b0e44d7bf96fc5c8315b0c26ceb6d53cb7
SHA512 449dd317e61e063b342fe5491f8f09344699ec92a7e46aff6eea231472c55a0ee772ca875f46900de7f20c9d760fe20a662aea42551328c0f3cefe9bfaf82b79

/data/data/com.ansca.corona/app_pushimgs/pcheck_n.png

MD5 1bbaeec81e97f3734c45574017b92488
SHA1 dc916c37bc512ca035adbf4504fad1a53ad1f6c9
SHA256 25db9414151862fb15fb24ec8530ecf1dd0c8b53664d2e153b042c24fc14e37f
SHA512 d630ba8b634d7ade563eda37b5c887ddc0582ff99346f19f6b1b933a8282a435cbe469f769788cdeadf35ee899f6fdb389222847eda76f3e101115901ad07675

/data/data/com.ansca.corona/app_pushimgs/pcheck_p.png

MD5 e0a4ce2b09acb7c9e83fc656348ba99b
SHA1 9713de8c7f8c3d8631bfe91a57738dc4627c72c0
SHA256 b41279960593d3a9212d4e3b34a712d957a809f6c0003f1c7b86445581d675f8
SHA512 ef5e23caa800f35cab588c5d0880727d7acb0ecfac1b274873ed313935d2f0f79e79ff72852b62e6956f7c1bb55de74dca75600b073002aafc498a9f5a9fd49b

/data/data/com.ansca.corona/app_pushimgs/pop_back.png

MD5 64e607b18ceed3c184658ad0bead2c87
SHA1 ce0da694a61264c3dc52a42c5e4eef67c267330b
SHA256 ad6e950cabd47d19678ed9e243a954c428e11aefc17b14b03929ff9e7379a7ad
SHA512 a37c72b611a02dbcf6621904e34bd80fa2f0c71b5ff0f229cff91794924d3a8907d5971bc3dddc8a81536e78ec7b92cc1ca4c782ea91bfd065defbd842cdf63e

/data/data/com.ansca.corona/app_pushimgs/pop_bottom_btn.png

MD5 153c4a358fd2029b62d88c5abc8315f8
SHA1 b8db469b4ed0798040ed2cd7618fb31c143bb733
SHA256 6d7b544ef6694a9440ab7b2fe902a67480f4cfdca37156b12db1ecb4bffd1945
SHA512 7cf959e5fa3bab95af3efe74e56b82d48e393b5ef1b733fd37e2f5f62611083fe58ace340a3b0bfea2227e94cae921714a82bcf64d1bb5834ca73ef088876850

/data/data/com.ansca.corona/app_pushimgs/pushapp.png

MD5 ab7f8efe5cc8cd8979bcc02000ab881e
SHA1 6e78655557838b3515a922aa7df1bf44f13ef567
SHA256 d749e36c1f6410195fa647b7b92137685bfe64a20b32e14283fe31217c4c3f77
SHA512 5410549889161c58e706e882befed71b2511f31e0196eaeb487fba4113f848e61110fe1b3edffd0318b010d9ff60179db861a4f55ed10c149c6aa6ec283802e8

/data/data/com.ansca.corona/app_pushimgs/safe_icon.png

MD5 5101a78d00419574d0dcc0eb1f4b75a1
SHA1 c4142d79270fddb27f24d6e8e8b61e9837b3de48
SHA256 abe1bd342d024dbe2e1e853af11ce74d2e3d9286a8e44c6d94b4b5e4e7abf999
SHA512 cbe4d2438dbde51d36c19d26afc826d37d8221bd76a6641e93e6c2e6e4e124fedf8dd5ae10c90c882ae0220ce4647d7dd469c53ba5a8c2769e0a4983c5df637e

/data/data/com.ansca.corona/app_pushimgs/safe_line.png

MD5 1533f88b71966664017deaa78437e057
SHA1 7b68a5bc7a6808a041c05ac7adc5da0fd378aecd
SHA256 ba11714200029dfc64b90b9953f80cdc49f30eaac9bbe8597d949f7a89b52b8a
SHA512 f04b79396404b4cf1cda6ad3ed7af3137b177d0da249d59a818c9a8ddb1e80cd98d078bfee9c352117f8c62303f08c9b3565bbd558a08d5aa07cf07527318728

/data/data/com.ansca.corona/app_pushimgs/sc_circle.png

MD5 e50c867a1725d1a77477d0a3931266f6
SHA1 1561a6d26dcc43254237e0dd99a8c1a8f0ad7d67
SHA256 0a549f08924e57ce9a5142fae8932efc57eca3454ae80ba8af57553f834be8be
SHA512 88faee49b0db9a401dee69f8fccb96fd2b671bb646a3cdb91d5f53a110e470d9fe027cd36684c77b0aed4e0f19d71522b1b88551ade135d5828ce4f41ad4c28f

/data/data/com.ansca.corona/app_pushimgs/tj_line.png

MD5 83f9aabf34554a65a8f47514703ea69f
SHA1 bc3097db92c0f1821d60779d9b1f712cd0cc7866
SHA256 a5d81d5357d00dcff6099ee28f989711e289cf1e41fc6ef0903640d5ee73fd6d
SHA512 11fd5b05b830a48f658a9767556b8dcdfefc864bbe0ce5278f40c272879326fd03100cf73e2d762c3ae674f2eafc2ae5ea0285e690c4c18c7721ddfeb447bcbe

/data/data/com.ansca.corona/app_pushimgs/top_bg.png

MD5 17f5c25477711a64b0dac419b8d68c0c
SHA1 475301f9d8143ba1548114d1de9272a18298a5dd
SHA256 b0e6d8458712cbb246fd4022cefee92796e55858a2c4f25cdec4dead894006a8
SHA512 09050759dca1837f59ab10d8c2531d986483ce50af2ab5038aefba3e5255fc8f67db1412f50717022b2c54fc39acc5ceab7ef3dcd51b38a61086ecedb885d478

/data/user/0/com.ansca.corona/app_pdez/ghkn.zip

MD5 fdcf0b12d188a3d33433449b148e848a
SHA1 22ff08afc2324fbf5b88afabb1262280a86a2526
SHA256 62dca0c6bb61014952bb9a750a80875f1a65568cfb5345f6d33f8cee79717900
SHA512 e2344b5ee5ebc70ee4a20402233c9f0ec8db014b372bd1b3d06abbe1dbc0bf54f1c8fb2f90998c5a06df2340f3afdd0f8a9aff7bb40d81891cb74ee3cf9fa968

/data/user/0/com.ansca.corona/app_pdez/ghkn.zip

MD5 b8d58db7caa34903f92aca848e961216
SHA1 d9c76024771fb7c5f8576d5e1a1a1a0788ff8a02
SHA256 ec1925acb50b5a0acd79835f59bfe1cde857adea85f216779fe4657b0d589313
SHA512 9552f649a8dccfcd6510d017415a0c1c59076f945ecbb405e54e2a2072d147459e1ce8ba4bf885b7d8912a4f8eb02f327ea54a0be977928b6b43a769dca77468

/storage/emulated/0/ddad/error/com.ansca.corona/log.txt

MD5 e0453f7cab0f3669d93d1250b2480586
SHA1 f677155e4b9502b656f6ecb152a8ff7334e57b14
SHA256 c4e6255117c8ce2987c9ecb3d329859f99de678a609b6ac384da92c1baaeccc1
SHA512 70c6d9a73b5af6d337a721f12e67128af929252238a7cf60f53db5c61598cbb62c8a4eb82250c36308b08afe0bf4d7d1ea06e1608faa8d9f752013a954912ed2

/data/data/com.ansca.corona/app_oiuj/zkl.jar

MD5 2dced82319ada0f7b5fc4484ed683187
SHA1 c81935fb12a63066b6dc7202362779a6ff7d3500
SHA256 94d0ff0dc7dde16eebcd17ebdd8e123e8aacc5eb0d4ef4a12b51444829def774
SHA512 5da03d171a51c6d26979106bd55d42c44545faae5a3000cb325b1132c896edc483d5d4dabee78d76c782292b992be36c19bcdf0920e68f209b6d07cf907b0515

/data/data/com.ansca.corona/app_imgfile/d_bottom_btn_cancel

MD5 a7481cc1f04ff397669d5313711676b9
SHA1 6a8a1755f8bae8c1c4236420de731ac5e6479df1
SHA256 7bb0b4de65d49b7256c1083332005aac1f40eb496fe16996657721570b427c0b
SHA512 6cad2566cc0c5b2247a2309180659a883dbdfd7e546c75bdb0683e3102ccc833d63255a5776a466880cba7f7f12666c493e84043c8512ab929dbf357c32609bb

/data/data/com.ansca.corona/app_imgfile/d_bottom_btn_install

MD5 6a976eab4bd6a204fff19f363a3e0fad
SHA1 7815e2d7905bb25ecec99c6491e05e498baefefb
SHA256 a2520bd431de7d71c9453f9e808369c694b1214b4d13759fc0a08d5af681f796
SHA512 8f0537ebd9954fe5792421f15e499c71e009d26aeac810672e8d3cce982c4291c64917ca36651f4c7f33f4bd32480c9eb3ee6ee7ffd82d2e08d8147d850ae285

/data/data/com.ansca.corona/app_imgfile/d_btnbg_blue

MD5 cd03c81961866339359a8862cd420751
SHA1 4356e958c4b333453a187b13cfb8e4951e85b5c1
SHA256 5d81cceefef430d84abee2aee1a655e975e638eb6e90d9edeaf70df18f761453
SHA512 29c6a83607ef938c8d74031781008075f9e29f28381893ce565d0d0e5e2193657264deb7752709f124bac8a7625ecda18a90763f8b8cccd48868105fde62846b

/data/data/com.ansca.corona/app_imgfile/d_btnbg_green

MD5 b61c2cbfc113d3080881c1a6c805de7f
SHA1 8bfb29fbebab3ff36faa5f6d19bf7bdf57608dad
SHA256 740a7a55675de72a6d165dd1aea7f15e6744f08e5131c2abea7e6e02ac4752c9
SHA512 7cb6ca09b180adeb87552b9b814ec50723d2f8e909a5aa1c3c63526bfe90043c0f6f97696b0e40d33c045a6d7f4b4df711ecda2a93839b9409f69c84491b3151

/data/data/com.ansca.corona/app_imgfile/d_btnbg_orange

MD5 144bfaa9628bdc547f92dd8ce04960db
SHA1 f60797400afdb88cc1a7b26eaaf5c18b7d34e3c3
SHA256 56707731bc7b76b806d9db7ec7e73173d0ba7c5acf22c8c040fb1bbb0d07090e
SHA512 071111562423e811333afd56dbd18fb68e0720f41936c42d266f70d041862560b363aa202ae24af40e9ca611d7f3eb996ee4184834097e85fbda1e2d36291f4a

/data/data/com.ansca.corona/app_imgfile/d_btnbg_yellow

MD5 c56a569d3e2cc40deb8ef6dd9c8273df
SHA1 fcdfdfa5f883afe7dea8a08b4e22d66b243065c5
SHA256 0e603b7797d42f1eadf5ea14499460e84e6525df6bdc4ee1464e00789c10c057
SHA512 b1549f4667c2765feb11d38469a5bfa4f599609ff519e65b73fc01521886cd57e7f30c2c43655d2b3af8665c77cde4f3a07e1e21f7dded059dc22ac60cbdb4b8

/data/data/com.ansca.corona/app_imgfile/d_btn_install

MD5 135b4b02c06ce896c0289c06931523d7
SHA1 219d7fcb9a47b14dc724030a5b22b00e4912c419
SHA256 7bc734fa69ef36df3ed4d3926657a52eee7f8448842586a3320804b7f86c47bc
SHA512 e9ef72d8a52cf365cc0d32d6ac9d333b3fc116b70e87d4279249efbcc0c57bae2951c4c6ecf2e675ab37f6ebc4374898cf75ca3ac11aa3286136b6770d680fa3

/data/data/com.ansca.corona/app_imgfile/d_cp_more_btn

MD5 a0314cf413a6efe118ce49aabe7d323d
SHA1 a8134a8d8506f5d44cf084b501a73fddd194fb8d
SHA256 3d723fa2d6bef03b2f44e09486edadd7eee392e14da4bc9435521fdb9d5a1537
SHA512 e5decc76e4461aa063571e45e9d1e47fcd8586311b726c1d1bb60e327c43ef8e104f4e1614e9ac656d5ae0e9095042e230f7245c7a3f0d89d515a2fad78046d3

/data/data/com.ansca.corona/app_imgfile/d_cp_other_btn

MD5 5b1fe1609131bc828527fc35dc4c7353
SHA1 39b6169e1e2a7fee0e56e421184d81f071d3693b
SHA256 ebc4e49b42208680f7d5b9ebae07bed1712a1ecb6443dcf5b09171faae0e0eae
SHA512 74ebfb919c0af6fabc52228d7b501c632c95d28b91e0ae87109d9da5f422471f96190858f26d097bc502a8e673ccf31e35ab2b15910f7a43e8c48fac64a0c8e7

/data/data/com.ansca.corona/app_imgfile/d_default_bg

MD5 67d8c02c18a4eebb21aa28ebd88d7a8b
SHA1 f31fe91485bba4da727e9a0d0525c7417d6c72ee
SHA256 7b341f9b1ab0a691029b44f9b1d64cf74fd72ad0c74772964645c79f687402d0
SHA512 73c14d96680105ce3e24ba0667cd2452848f9c7d2549e937667c25bcce01a4d9207a78f2dcfc7c09cdb39f87f079c7847ceacbed36cfae55013126ab3bdbf5fd

/data/data/com.ansca.corona/app_imgfile/d_install_btn

MD5 c64af13b874ab8cfdac99f000c29a3be
SHA1 e5274173c7721f8c77bb5da46fc94f195abb4924
SHA256 67af721ddafee67f3eea6241bcdb5b8c1315e8ed1b8dc852646cde24fe040516
SHA512 d59c85b4576152848427a74214c7b979c576f5cc6978430b9d7076f50cdf8957d8256eccf55aaba2bf7f80da2a7a2b445a26758aeaf3e889ae1c84a3fb2185c9

/data/data/com.ansca.corona/app_imgfile/d_listcloseBtn

MD5 6fb767d2563a35f3c0e362a5970ffe1e
SHA1 6d3a8fdbd7ced06a363517cd6cea7a7fea16c269
SHA256 534fe818efbaa752826c53f1b63d3ecc1b647c8a9f7970012e316cbce5fb5ae2
SHA512 ab989e8b01b9d397cb2968dc8191a9c2c6fdf19947b30b96cd5266afc6fc330a318de8c914d34adef98caffd151a0bc29fb130bf11c5638e97b3ff15c723fc2b

/data/data/com.ansca.corona/app_imgfile/d_listview_bg

MD5 28554ef38f282f89a2f3b298157fc984
SHA1 08147f2b5a83fd07f5acadb43598480a13d3fac1
SHA256 b4034e26cfd742433a0b59676bf73a78d93d413decc891abf3d34486160d307b
SHA512 cd31cd81a7c37155f540c1b636cad9ea198860952d79f8b3d39dac661c2e7fa82e1398830c7aacfa6904e4d4cffa6f5f1d906dabbf97091f3e38a65fb5fa51da

/data/data/com.ansca.corona/app_imgfile/d_list_title_bg

MD5 c34bb6ce3d7def12e8af79e87a6b5173
SHA1 99e8103027a7bba73b736fcded9d0d91b49e4ed9
SHA256 daf75ee4e642b335cf1918ac9678502bace139f76645eedde7eaca4f296b7e57
SHA512 58735b6034ff6ce1974aa0a48952100345b6bdf74a4dd083925aa87b0882e1931ff8608d03d0854c9de23ca409e5726ddc1e8313339181f57312bee0804ee2b7

/data/data/com.ansca.corona/app_imgfile/d_page_normol

MD5 2bf3d7d7ffe4a54396979c2802e5a0a7
SHA1 631def5dc6bd48080d51d3482a85c470b291c316
SHA256 ec1601e7e19b69d6d6bc8f18738698a6b4483a4f1ac546215dbcff9cc74acf7f
SHA512 2a9a95a9298c59a90b7234343f01b70219653e4d43217c83dd3dcafea84b96727d1e5f40ba035c36fb4dc6a83478fa66d545a2cf8221aa2da1ab9565b3deae79

/data/data/com.ansca.corona/app_imgfile/d_page_selecte_blue

MD5 1c4e3c1de688a5cde892bd74eec4bfc1
SHA1 bade0d4743822214421dc664449c0b0d94d69aae
SHA256 ee7abc5886a058b4436aa0a53c6be535fc0bd3a6832f2b0b0e611473667dca5f
SHA512 ccf419b266d7fcdf4c6696963c657f7138a59b06a4fdd900effebcaac0b162ddb5e9135f5032a33e2b3ffc17642065600d9b9292005e200f5cd8e79b17968f24

/data/data/com.ansca.corona/app_imgfile/d_page_selecte_green

MD5 9dfe941765a15b163eeb46b49cb4e89b
SHA1 caad3358c1706f28624e10616cf6d26a45b2dd5d
SHA256 d92d42135d59f97d35cc2d553b7bc79f19397a40cae9ac971a86def6fbc9167f
SHA512 0a38e4a6187fac65999a9a27ff4a917ab6dd023587ae5b0e33c95a502e7e93626ac3cfb48affaacc274b5f7fa118f483a627e70288757308041ac67e3337a4f1

/data/data/com.ansca.corona/app_imgfile/d_page_selecte_orange

MD5 ffaccc20bf244076988df00a6bc20b06
SHA1 4a7176527cca9e9a862cb12485cf02c49c228913
SHA256 71d16959b999e8251ea5ffbf0075a43724b02f85ca34e3ee82b31935537c9a9f
SHA512 dba973767cc9e9eec698232e9f7d057bdf5464c8d70fcef3e6631ad72d9e62ab4cc08169db2e3927e2f3a870787ee60bfb4b26ec1ed8c3fd30e84aa38afd65c2

/data/data/com.ansca.corona/app_imgfile/d_page_selecte_yellow

MD5 8487656fa992a7c3603773e0b1b1d7e0
SHA1 ac740cc2ce2ff0729b70c26c70ac0462072d1b81
SHA256 12b5a8c075e94cfd69d4a3ea6e62552d7e3e7e2ae5f6e69b7fc4ab5a6c9635a8
SHA512 b6be96693719978dabdaf05e3f733925b126959bf8ec0096775d76eeb08a6a5fd56c2ddb4697d81a8da9ef1e00524348c0ec7aaa36ac5302d89dd51db6f08fad

/data/user/0/com.ansca.corona/app_oiuj/zkl.jar

MD5 3ff0063df473f5d6fcf2f1f799754dab
SHA1 a9ae8a8368cb2ee55ad55b969baf3bad09efdcd4
SHA256 8ceedbe34b370ec64032cc7fc79b5db35651c7ce588a7ed9dfe875f92e8322ef
SHA512 dc50200ce87bb12907662379955af8cae9ac5ab4a03961efd0ee993f4b063223851b09296f887480afea78d52fc269f192c99776e2432a0935f189a2ef69be13

/data/user/0/com.ansca.corona/app_oiuj/zkl.jar

MD5 03b7ea6949dcc5cc792bc1969a072f9b
SHA1 0202683ee3cc34173a09f4187d387215904bc555
SHA256 c985a5b72ed8c3378fc41beddbcad955083d8076e325352a5a31fec948a32f7c
SHA512 7a61bf6229e761ef7c89a8c44f6fcdcf3f1f37a51e783b7eccc1d5a8e7dfa76c278873c694718a680386a68ec07ddc572a6d47de3e0627c3fc029c8ad6998f71

/data/data/com.ansca.corona/cache/.system/.com.coronalabs.corona.analyticsData

MD5 bc576e5ae7b94db0bac30e71f1ec92fa
SHA1 2e6daf6eebb3e3d1c025771ddef172850923e891
SHA256 5a519777f9cbf63b0da442de74a8534a37f05d3c0e90acd3372961e47de30026
SHA512 0ca55d75019307152ebd2b54b6dc425ccd9e738fc358ba5929d27cab4b0042129b3cb39f865731f98aaacb73eb449e6195c36527d2892b19b83019551d46aaf8

/data/data/com.ansca.corona/files/coronaResources/language.txt

MD5 a9b1e568d8df2436c6e73798d747cc9b
SHA1 982751ae5a36462a44a660a738c64050ddcaf898
SHA256 b28cc78508c6c6975f66c7c6130a1368b0eb50be8319eab92694952f4ddeaa6b
SHA512 96829184339011f8b2689be95bb2f392ad25a3cf4f6221b21ac6c49f8e4f016b92f945a558149f4756350c6194fa37190514f2d6389484814f2838f6c949cb25

/data/data/com.ansca.corona/files/coronaResources/language_en.txt

MD5 f1a56081aa2db23f1b87a549e441b3d7
SHA1 60e2c620d1dde0e9560d0074c6cd63de8e920529
SHA256 b84e14b5b73053bda370490a3f51cd5817c54217e514d07a82007c1ef3f4fff1
SHA512 b28e1aa51cfb8b4bd714319d9065f841e9407ef10b30d45f0a52dfcc7bc9e4e4debeee213f048e48429ee8a9ae9a648406f4580479eac71080b68e5e143159f3

/data/data/com.ansca.corona/files/coronaResources/language_de.txt

MD5 cc31fad1cc7826b36ce209b12066dd81
SHA1 89828a46e9f0fab701906aea96a025a46348f8c3
SHA256 b297801981808b561e54f7098a95ecccf856dfc2f0eaf8ac253e2a721895d559
SHA512 880ae044f3579af6a20b7b194135985d839accb324943a0a370d3f4accbcb661416b279a39e9d46c60c3e7d93ef4fbfdd6f6f053952bc62bd9a942cbc2ddc4e4

/data/data/com.ansca.corona/files/coronaResources/language_es.txt

MD5 e38f1ab52df09a41359f7c7be3922050
SHA1 615ddda358f66fe1c4db1d8b43aa0efb3399dc71
SHA256 acbb25253854e355c328613c98017809cb5e87c9a8e560b0bf25e3291c6d8472
SHA512 2a0e0374a33c54ee8c8e1207782dda0b2f10e9fb02ffb046331444bc2f43e077aee593deab3b01b743cd8ab792758afd3bee3e4aea7fb1caf4c6f0e875879b5e

/data/data/com.ansca.corona/files/coronaResources/language_fr.txt

MD5 485c10104e76799d3076bed41ff4fb1f
SHA1 e768bc265944dd721fb6d3dd758995c2cdcce4ec
SHA256 540938b473737d65480e3fdd1e080d824911cbce890f58dfa055f2390f3d1980
SHA512 7f09abc57387f0157bd34de8e3bada8b67dca82a5afb907b4952b416f8bdb7c22cc95a268e2a10d1b52b54b5aec3accd246dda7ca296b943f9d41e8943101421

/data/data/com.ansca.corona/files/coronaResources/language_it.txt

MD5 c170fa3cb51072a5c89d60853c313bf6
SHA1 39d203e5d79fef3d44fb7c87c21a13c5810d922e
SHA256 0ef65e04cc8c15b3dc26a5c01a94fdbaa60984902d5f75aa117f2dceb179ca2f
SHA512 63e08eb0dbbad1c84e3a17c5f26e6cf1c629d7f6939363d55f1691a77ed21a0045362dd520facc28f65c4bda66ed10667b1c26dcc8a6a21370906d767608df9e

/data/data/com.ansca.corona/files/coronaResources/language_ja.txt

MD5 9c194b123c710f063460d395809d99bd
SHA1 a4da46ba9c4dbafb36daff4bcdab599ac2763996
SHA256 1ef5d0ea5c424c80004884b464b4a0e02c97459d18d103aafafc4841ac821b1c
SHA512 76374b2878eca5f7823dbfdf7f3dc4ec67c3b732aad555e28148199848e4a44a293c4ad9a096a5b891c7028b77b9c7a7953d7806faa08607fab4183127b42bb8

/data/data/com.ansca.corona/files/coronaResources/language_ko.txt

MD5 d422b30bfc205c41d1f967d45bdae7ef
SHA1 c7932742bae41399324423187ad41ab97a31db30
SHA256 eaf9128597c92216feed9f0745cc24a5607385946f85f3b7361989ff28e0e88f
SHA512 c97892ab7b88d7a3a15cb61d680cbff54429b870a83d613aecd950afa801358320a1637b1899ee7c1a791ef59f1e1f2e5a27626013879ac540731e5867197b78

/data/data/com.ansca.corona/files/coronaResources/language_pt.txt

MD5 bff0cd7ce97507cd3a5a212c8f5fcbce
SHA1 30c2770d5615aa08af0bdb6bbf7db456d38f33bc
SHA256 04a8ae1c2d7fc08940342aceab0ac46b248c965fc6962e0c8900d397b9b91aa6
SHA512 6dd9d23f50d5b0fdd31fbc13d166477eab76e3ca3a4e2f2510bbf48a87b797931b68fc678ae41a5a6eda49fabaa157ddaa5beb04e3c05f905b1cc0e23b2cee41

/data/data/com.ansca.corona/files/coronaResources/language_zh.txt

MD5 3dfe72aa338827da5bea83fa64b045e1
SHA1 77191ca2e970b50e13efc4adf8286ac7bca8c32e
SHA256 1eba3b141ac845511c9a510f9302755c9ac858325ff46eb7d5be171da9f6465c
SHA512 99211f71c627a234f987b83cf173685f9bc3edacd8b8c251549badaa7b5459cfc9af0b20b81e8e1b8aed9b4c068e04e50d2abbd13e805f8f4fcfe305c25f3937

/data/data/com.ansca.corona/files/coronaResources/language_ru.txt

MD5 948db2fc78090e9b46d2f05bf3e4169e
SHA1 d3639d16fa86922b868aacda8707fcb8112eb4d5
SHA256 b3ed8b6c30a48fbca8a37c1444b28c6dc530a7e97f2cac16ba51110d20bff4d0
SHA512 ed524a35a95f86adf9c1d6b2c920cd4846365681cdaa128b7af32a831774cceccfd51a9cad934b730f1392f7bb7875f1ce22762bcabd9c563e75e214bc80a318

/storage/emulated/0/ddad/error/com.ansca.corona/log.txt

MD5 47d96c0af34c9be3e0a346f1d788e730
SHA1 419582e9393abace631acdb82d70a0fe71f315fc
SHA256 6337b232b2bab79cddb43e3d898012b36bf4e843f6352ceea293c8c085de726d
SHA512 406de7f3570dea79f3017ade185ceb929faf1371012c35c5dbb821acd3c50f02aa66c91afaf1f6493f13cd9334cce85fa4264f2b808078fc29b74d0bd1d8ad79

/storage/emulated/0/ddad/error/com.ansca.corona/log.txt

MD5 d2acc9f6f381c4bba921cb6ec2452bbc
SHA1 97e421ef3dde8ccc240e8d4dfe21ffd318fb1a93
SHA256 29e00d3edefcd30085416d64afc3ae8ad02a7baf46ffac54fc52b7ac9be576d7
SHA512 7bf1efc5614070071d8ed4527dbe42c888d90db27b226c6fde9090393e712e9bf05699addd72134f9e3398440f25c48dc6430adc51fff76da20abca9e61fa5a6

/data/data/com.ansca.corona/app_oiuj/oat/zkl.jar.cur.prof

MD5 02ecec29b39dab886d3a16029db3d4f2
SHA1 78adf30f9e24b9d6030b1c349853773a18a06fd2
SHA256 2397cf127553f18f991ee67a7017abadbd4a0c8427fa773e54d00ce8a9a3b465
SHA512 5e8e637c6714605c1a9eff3dfad6fe048b37b052196145863f61f44d143d1f2bf6dbc93e6f806706946709ee23f1541987aa0fc051fc24a0ef8293e2bebe97dd

/data/data/com.ansca.corona/app_pdez/oat/ghkn.zip.cur.prof

MD5 d273cd5cb874214c6913df4ef09a05c3
SHA1 bc9b10fc8b102300cd4aafa32a6ef48700faa85f
SHA256 304195403acc1786ac5e5ab5c874ef129c49bd80ef9f552b0bfb11ea51aee73d
SHA512 b82fb3f0a7be733a1125b6066bca899ea1f5f37ee67a5c239b28522c9ab4c0076efbca61bd713c826e25559dbd0cb19de913ae3f01a38536240cab794d917f51

/storage/emulated/0/ddad/error/com.ansca.corona/log.txt

MD5 0f16f70db422927abcb878957452ce1e
SHA1 79a54bc93fcb471d012d428dd3e330adb4672561
SHA256 21e20866d92021c21d1a548bf41474cd74751c09ab80c8760474bc7c7382b36d
SHA512 801bba5c3e4e8e3d135e3cff1b33279764a94b5a6c7235db15416e4413e07495b5ac643b3b4d5bef72e7fe24d0b7b5ee7f752ba77f8358110df68177a756f607