Malware Analysis Report

2025-08-05 10:12

Sample ID 241017-bfg3raxblr
Target 5006765c0d98565d96dade82dc43e72a_JaffaCakes118
SHA256 0bc5658a8cb733bf27176836a9cf34e267cb79d4aadd489c62984a4a52559212
Tags
banker collection discovery evasion stealth trojan
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

0bc5658a8cb733bf27176836a9cf34e267cb79d4aadd489c62984a4a52559212

Threat Level: Likely malicious

The file 5006765c0d98565d96dade82dc43e72a_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker collection discovery evasion stealth trojan

Removes its main activity from the application launcher

Queries account information for other applications stored on the device

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about the current Wi-Fi connection

Requests dangerous framework permissions

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

Queries information about active data network

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-17 01:05

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-17 01:05

Reported

2024-10-17 01:07

Platform

android-x64-arm64-20240624-en

Max time kernel

112s

Max time network

132s

Command Line

com.rbar.bxtq.qosf

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar N/A N/A
N/A /data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccountsAsUser N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Processes

com.rbar.bxtq.qosf

com.rbar.bxtq.qosf:daemon

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ip.taobao.com udp
CN 59.82.122.127:80 ip.taobao.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 api.adcmsware.com udp
CN 59.82.122.127:80 ip.taobao.com tcp
CN 59.82.122.127:80 ip.taobao.com tcp
CN 59.82.122.127:80 ip.taobao.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
CN 59.82.122.127:80 ip.taobao.com tcp
CN 59.82.122.127:80 ip.taobao.com tcp
US 1.1.1.1:53 ip.taobao.com udp
CN 59.82.122.61:80 ip.taobao.com tcp

Files

/data/user/0/com.rbar.bxtq.qosf/app_mjf/tdz.jar

MD5 30617d6621bcd972fcea53d04f3b2a55
SHA1 a0a51f60773e3a1eea2f929c8f1df896b6d71e7e
SHA256 157b006e48d74dc023d671b5a7e9e61f96853be434db43efa8754aecba50e12b
SHA512 d7735599a3186ba6ca0c6151299fc9353495e4cb4cf1b3a8aebfe6e0901e839f1027013aebb2d168c8fe2ace65fac6bbc89b56b8316e546bda879825febd1ad0

/data/user/0/com.rbar.bxtq.qosf/app_mjf/ddz.jar

MD5 656eec0445b1ac574b87e1bd3a98d969
SHA1 fe3e1ee6bac338416e47e90ed249cb82aeaf6bd4
SHA256 0817449409b55007ece8d2d25f6d4b075ebea09c7feabee79636176bb0794792
SHA512 9a2737d22a9e647eadf4752513df79fe960cb69ec9563a2d7f504b3e91a95a6081876ab068355b8db49c44ea8627a33ca94c0244c2909668bec2620dc71a27fd

/data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar

MD5 18cfdb00841ddceacea677d69a13ba5a
SHA1 df15b27afa69a8f4e0e74c250e56df55e5701172
SHA256 676ca8a391c823e9a3fdd7df70a1fc30f8ebd4680db0daff3e057cc401c9ad83
SHA512 83886e59ac0462888e9b82475ebaeca79dcbabc8a2a01a6217c0ca122e41c1d373fb878bf6e5e885b8459f259e834df91f2c8bf30a2a52824e298a65d6dda86a

/data/user/0/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 8def6261e15d73230e24d20e802c97a9
SHA1 44892b18c651024a438936204f2b72706e0e9548
SHA256 bbf6d323e2811678b49a8fd4eea07276786ebac298270ad57e912a7bbc78c02f
SHA512 0566e430a027eb0a7e17efcd21c445175aac14cdbcc3570a25c6065d9ebd3cad94763467dfb60330f60256fa2807352f2621415fd6f24d378b7e5d77126ed3d0

/data/user/0/com.rbar.bxtq.qosf/databases/lezzd

MD5 fdb8a92e5060ce104e8f0faca55a47ce
SHA1 270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA256 194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
SHA512 ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

/data/user/0/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 123bca74fd58395c39bd6775a307b38a
SHA1 0f27eecd12c47d8cf3e4cb53ff9874d376cfe491
SHA256 d6232e8ec2d02aca4802dd4ccae2b4672ff3dcd657932b6014ac51f0a22d41ac
SHA512 878c9381f95f33eec7af659a63afe6f262d130e60271f183c8381e39cf446f7387f0c22fe423ee5b9354a400087988592daae0b800156f97b7ddb3e2a4c45b3d

/data/user/0/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 110ce13a86aab4697edc502061c58bb1
SHA1 9466ded81bbf0949171230b8f9a31c205b2cbb62
SHA256 6776e7c222376e9277abe01365aca1071a0b155d25e0c7150562118afc959959
SHA512 f513d31eb06b22c9ebe1b9adc0183def3c2f77fc104223f37e76a6dba814f064aa441e540ae63a715c16a1df89f6d642d50d5e8558a7d272c07d4f8079b69c33

/data/user/0/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 4319d0ef0c640e3cc3ec1521d62e93a9
SHA1 dfa2421f38d85b78c4e23b24d1efaf5fd9367a80
SHA256 17fec161876c378687703d5c8bc629ecd70c567a740b6466d00c1a78b1645448
SHA512 fbacdb218196b7967e21e8a34fd88cf2fbd769188755381fb3d0c9e52d345faab072cb0fceccb3edc437452bfd7357472677111e2a39f3bfbe5e744568a7dbd4

/data/user/0/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 fd215937a375a244bc08830ab735bc42
SHA1 5f46d54c122c0d9342711cd69bcdc3776d6b2e7c
SHA256 8be09b9c72d976d4f704d17910fc19fb13f47edfe6c86441c374a80ec5bed686
SHA512 2064d09b0f7e88d20e6dbd870a78399b0d74f3963f28672efa183dfdae475ab527b90603242be8f64f6103d808c14ffa3ef66e2d3c2b114de3cff239115801ed

/data/user/0/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 824a1affc2c8068dc8285840a81afab2
SHA1 1c80f5c11cac248b10824fdf4f200be7ec64ef05
SHA256 efc40238636770877fd6c46b34e062e1cc6da4cfd1c209b61ad7bb3ce8782e86
SHA512 649933216cb1d1af332af1925772b54e02b8d2a79e953af8420e587c758c623f4d80f67947de3db4944d9f05605897f1ada4cbf98f4f302a23487628b57e79e5

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-17 01:05

Reported

2024-10-17 01:07

Platform

android-x86-arm-20240624-en

Max time kernel

113s

Max time network

131s

Command Line

com.rbar.bxtq.qosf

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar N/A N/A
N/A /data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar N/A N/A
N/A /data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccountsAsUser N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Processes

com.rbar.bxtq.qosf

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.rbar.bxtq.qosf/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&

com.rbar.bxtq.qosf:daemon

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ip.taobao.com udp
CN 59.82.121.163:80 ip.taobao.com tcp
US 1.1.1.1:53 api.adcmsware.com udp
CN 59.82.121.163:80 ip.taobao.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.206:443 android.apis.google.com tcp
US 1.1.1.1:53 ip.taobao.com udp
CN 59.82.120.242:80 ip.taobao.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
CN 59.82.120.242:80 ip.taobao.com tcp
US 1.1.1.1:53 ip.taobao.com udp
CN 59.82.121.73:80 ip.taobao.com tcp
CN 59.82.121.73:80 ip.taobao.com tcp
CN 59.82.121.73:80 ip.taobao.com tcp

Files

/data/data/com.rbar.bxtq.qosf/app_mjf/tdz.jar

MD5 30617d6621bcd972fcea53d04f3b2a55
SHA1 a0a51f60773e3a1eea2f929c8f1df896b6d71e7e
SHA256 157b006e48d74dc023d671b5a7e9e61f96853be434db43efa8754aecba50e12b
SHA512 d7735599a3186ba6ca0c6151299fc9353495e4cb4cf1b3a8aebfe6e0901e839f1027013aebb2d168c8fe2ace65fac6bbc89b56b8316e546bda879825febd1ad0

/data/data/com.rbar.bxtq.qosf/app_mjf/ddz.jar

MD5 656eec0445b1ac574b87e1bd3a98d969
SHA1 fe3e1ee6bac338416e47e90ed249cb82aeaf6bd4
SHA256 0817449409b55007ece8d2d25f6d4b075ebea09c7feabee79636176bb0794792
SHA512 9a2737d22a9e647eadf4752513df79fe960cb69ec9563a2d7f504b3e91a95a6081876ab068355b8db49c44ea8627a33ca94c0244c2909668bec2620dc71a27fd

/data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar

MD5 18cfdb00841ddceacea677d69a13ba5a
SHA1 df15b27afa69a8f4e0e74c250e56df55e5701172
SHA256 676ca8a391c823e9a3fdd7df70a1fc30f8ebd4680db0daff3e057cc401c9ad83
SHA512 83886e59ac0462888e9b82475ebaeca79dcbabc8a2a01a6217c0ca122e41c1d373fb878bf6e5e885b8459f259e834df91f2c8bf30a2a52824e298a65d6dda86a

/data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar

MD5 daa884f34fd8ae9dd3bfb6b119ff3aff
SHA1 7de35d394619e09d959ed996ad265702cb8b8efa
SHA256 c9c157972fb88b6be615c55598c6dd7bc36a518c2b24e8b6ee5fd48f532381a8
SHA512 dc316772998f61131936b0cb6058a3ea7f144b31da11bff492408fb03ef3796604a2f887670d160e1302253d2ceac4e1621f6d26ee4293e21856a862b4f4125f

/data/data/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 fbbfc8d3364d114ddff02c63d537b19e
SHA1 0900ff047e85b49d95a3650f35a08d3e1c094a37
SHA256 22dc3fd3979e94bb94841e2ce2adb95b204dfa6c3c7d7d0d040e2245b4844629
SHA512 197ef6b9030890f6641683f5cd3a676fa7262f96aeace177f404f31ee9cfc4c6fda144d21e12be73afeecd2b1412ed9cc6caa41caa36fe811b4815656d595ef7

/data/data/com.rbar.bxtq.qosf/databases/lezzd

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.rbar.bxtq.qosf/databases/lezzd-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.rbar.bxtq.qosf/databases/lezzd-wal

MD5 30ef74d44d523edc564a4ee0bf4177ca
SHA1 9c5435d68cf21c5ec77bad2fcbb459b762f605f1
SHA256 1ce34a0852b0004af5e4c24a923c6cb08c356cea4f2b61930c01881ba76e5349
SHA512 1afd2ce0eb9857ce8e41e80172499baa6c16fcfedb2ee0e6e2ac80066e84643b7bf7147d44004ee2e1087dd28c109ff46e0f3988816ac038c5c0ae77d5c466dc

/data/data/com.rbar.bxtq.qosf/app_mjf/oat/dz.jar.cur.prof

MD5 42142ec7935c88403db679e3312724f8
SHA1 00d89ed3350a52dc601d1116d9ed0de8a52be82e
SHA256 c0b8f1c9ba49c86d0b2404383ae5b14935cf336b9f7fffbf25589ad7c2672c98
SHA512 d9895a5d99704ba1e56f6179800a1e0f354ecd23767eabdf8815f4d2d203387781cac56fa8fd090ba8db8819180f7134bb0c81c0b9478d895a60e9d47d8a6016

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-17 01:05

Reported

2024-10-17 01:07

Platform

android-x64-20240624-en

Max time kernel

112s

Max time network

148s

Command Line

com.rbar.bxtq.qosf

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar N/A N/A
N/A /data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccountsAsUser N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Processes

com.rbar.bxtq.qosf

com.rbar.bxtq.qosf:daemon

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ip.taobao.com udp
CN 59.82.121.163:80 ip.taobao.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 api.adcmsware.com udp
CN 59.82.121.163:80 ip.taobao.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ip.taobao.com udp
CN 59.82.122.127:80 ip.taobao.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.200.42:443 semanticlocation-pa.googleapis.com tcp
CN 59.82.122.127:80 ip.taobao.com tcp
GB 172.217.16.234:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
CN 59.82.122.127:80 ip.taobao.com tcp
GB 142.250.200.34:443 tcp
GB 216.58.204.78:443 tcp
CN 59.82.122.127:80 ip.taobao.com tcp
US 1.1.1.1:53 ip.taobao.com udp
CN 59.82.122.61:80 ip.taobao.com tcp

Files

/data/data/com.rbar.bxtq.qosf/app_mjf/tdz.jar

MD5 30617d6621bcd972fcea53d04f3b2a55
SHA1 a0a51f60773e3a1eea2f929c8f1df896b6d71e7e
SHA256 157b006e48d74dc023d671b5a7e9e61f96853be434db43efa8754aecba50e12b
SHA512 d7735599a3186ba6ca0c6151299fc9353495e4cb4cf1b3a8aebfe6e0901e839f1027013aebb2d168c8fe2ace65fac6bbc89b56b8316e546bda879825febd1ad0

/data/data/com.rbar.bxtq.qosf/app_mjf/ddz.jar

MD5 656eec0445b1ac574b87e1bd3a98d969
SHA1 fe3e1ee6bac338416e47e90ed249cb82aeaf6bd4
SHA256 0817449409b55007ece8d2d25f6d4b075ebea09c7feabee79636176bb0794792
SHA512 9a2737d22a9e647eadf4752513df79fe960cb69ec9563a2d7f504b3e91a95a6081876ab068355b8db49c44ea8627a33ca94c0244c2909668bec2620dc71a27fd

/data/user/0/com.rbar.bxtq.qosf/app_mjf/dz.jar

MD5 18cfdb00841ddceacea677d69a13ba5a
SHA1 df15b27afa69a8f4e0e74c250e56df55e5701172
SHA256 676ca8a391c823e9a3fdd7df70a1fc30f8ebd4680db0daff3e057cc401c9ad83
SHA512 83886e59ac0462888e9b82475ebaeca79dcbabc8a2a01a6217c0ca122e41c1d373fb878bf6e5e885b8459f259e834df91f2c8bf30a2a52824e298a65d6dda86a

/data/data/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 e8ee4e487a1245781059a5286af2c208
SHA1 9ff57f568a71b08f4a7a4f9e1b5e6825317db33e
SHA256 46d8d46bf66c0edd4dd71b2377a67e86fb1a9cdf232964f88427810dc98b106b
SHA512 39388451ad24297dea0c769f495d16faf65a5d348511f9e4d40897d2ae426d27fd8066f0094dffea48f6787ac66bfed064423c59a0118b729839af88b239b068

/data/data/com.rbar.bxtq.qosf/databases/lezzd

MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

/data/data/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 549a16dcbd8faf85d6eaacb24be34630
SHA1 aaa1d0003911d553fce3cf4819a4542756badc19
SHA256 a4959e30f432b96602019394c840029178ab70a983c64bec88df07c96df62f10
SHA512 f4822cd56558e0f28af85adbc2a186a8cfd75e5228878255ed39838d88660ec8d92f16cf2249dd88eb83ccadcd915e00acb1c4835183d17c433f54907c5078db

/data/data/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 f5e0107df894b3b8c86756d9964777ce
SHA1 d610e86768437e2c511af9849343d124d3f52523
SHA256 316d3210135f2c10df9a67682984277f5bbd8db5086df12b30ac5ba4a73c9d24
SHA512 c6f5a0bb18ed8336799d5b136ba925bf42a94670ff25c7f371e70bb7f488246f8027c12cceae7bcd87f6214b1f1a5881a7a4e4de5a82aec0b2bb3360bdce0243

/data/data/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 393d213dbe39bf82a35056e55d0678c9
SHA1 2e8e1bea8d356d703ca052c1b2fd5f6295323533
SHA256 32c531a7b2b8e6c4cfbd506f7335c6a8968a97908532fc7e2b066ee69ef7d3ad
SHA512 89769d8dcd974fc8b172429dcb37a32297238df2156c3bd9e2cd8e1ed5eb76d0a8c33f9046dd72d15a8487649137eaad2f1528b568d01f879bcb478abc734daf

/data/data/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 14bc9e3f2fa71700a859c93425ffda63
SHA1 c0f440c2aed93ff24ab81c3cb782e945b4ad010a
SHA256 2fe325587dc37a1cf27fa1e30183020d5133777dc32d3facb568f366080f80f8
SHA512 9d4f40719d5f8e1275fac3f8512be37a8d1750a5c27d5f87dce2bb5d799f3c0a8e59c26624b8b7f4500eceeb4d3f568d199fde7f9910e9230b6c47530995b6a0

/data/data/com.rbar.bxtq.qosf/databases/lezzd-journal

MD5 838098d625ac2a14e25ecd5c7841e976
SHA1 d57db213c7f3e6a1687a8364bfc9631dea1ce3cc
SHA256 4f5933145b734e53918e0ee0d6e6b7aa3aba41dfcd5771342742de579aac5ca2
SHA512 ab34e449bcb041c1da31d27abeb434f41d2d521dd2a0d9e591fc29fb81ceacf3e0ba9f594ffc8b9879ac53ebd421aa70df765a2c53d7115c3d2708ad49416647