Malware Analysis Report

2025-06-15 22:31

Sample ID 241102-nkhajawjaq
Target 8535139e782e91ca1a80272110a540c7_JaffaCakes118
SHA256 efaf275c986c600620bd21851c23c6e03160d874de29e3d4322f73ba95f81d7d
Tags
collection credential_access discovery impact persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

efaf275c986c600620bd21851c23c6e03160d874de29e3d4322f73ba95f81d7d

Threat Level: Shows suspicious behavior

The file 8535139e782e91ca1a80272110a540c7_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

collection credential_access discovery impact persistence

Obtains sensitive information copied to the device clipboard

Queries information about active data network

Queries the mobile country code (MCC)

Queries the unique device ID (IMEI, MEID, IMSI)

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks CPU information

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-02 11:27

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-02 11:27

Reported

2024-11-02 11:29

Platform

android-x64-20240624-en

Max time kernel

148s

Max time network

155s

Command Line

com.holy.idiomstory

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.holy.idiomstory

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 oc.umeng.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.232:443 ssl.google-analytics.com tcp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 feedback.umeng.com udp
US 1.1.1.1:53 stat.gw.youmi.net udp
US 1.1.1.1:53 au.youmi.net udp
CN 218.92.216.53:80 au.youmi.net tcp
CN 218.92.216.53:80 au.youmi.net tcp
US 1.1.1.1:53 oc.umeng.co udp
CN 223.109.148.179:80 alog.umeng.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
CN 223.109.148.130:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp
US 1.1.1.1:53 aos.wall.youmi.net udp
GB 142.250.200.34:443 tcp
GB 216.58.204.78:443 tcp
CN 218.92.216.56:80 au.youmi.net tcp
CN 218.92.216.56:80 au.youmi.net tcp

Files

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db

MD5 ed1b04d64c7dd2247059911fde78eb34
SHA1 9ce8cf3053c2fd14992ffe482e08a429cfdd51c4
SHA256 d094042dd6d3d367e07b7175e07bfb3e8987b0a0616a17a48dba9726aca609f3
SHA512 62f9c58640e80eebae80efd6cb02777730c33ee7e7fbc619d63f4eaca2feb4884de9865cd673a54a3dc3934d4b23b825ff456d6ed88e80661bed5fee0f692887

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db-journal

MD5 4fddc65f77474764d2d635a219e90c6e
SHA1 3d794f66b9d7588fbd6efe11e0ee8d519f963d68
SHA256 025c1a46d4a786fc8c494e157526377e76619aefc02076881e3947c7292a5540
SHA512 ec441bbdc504037ce43aff122a7d601b9ea14c31492578d46f332f7def3e21dcd186590682eca2488970c181e133c45a7f91746972f4e353d34b7c2d360abab1

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db

MD5 2b83d5383ca922523a901489df28efb6
SHA1 a32c780ab8b0f0bf9f713c36426d38b5b8e4385d
SHA256 017e6cf34fff51ef6d9bf291e4c4eaadd546cc27b121ff6b348ee6fb2a5cfa9c
SHA512 f2dbaa36f1957fd150e2237f5aba2b6c632743130f5772cc0f3bc6f2292681e0088e218164933328319e6ec96e2b7daa103789a5c81cc21130fb748ad8da1b84

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db-journal

MD5 06233eba7b0f040d30ff098c970112bd
SHA1 46b4a46bcfdea25235e83b4a80aa1da9b39c7150
SHA256 4625a04f88091233aec6483e60fa5405c6481063be0dd872603eb3b30f394d08
SHA512 01260434e37334ce3423c07d0a1706306fa18dfafb66eecb5c02f1645c1a5d653da6ee549b24970e03a3df288fb135dff25c9381e00ea61f617bfae803d185c3

/data/data/com.holy.idiomstory/databases/wsUL1uCdKvjD-journal

MD5 226a1e1f3f590a18623164ec8f8a6577
SHA1 8b28407897b60633437ecee0a1febd944f01c65f
SHA256 fad2a6ef91459479a8e4294ba4820045656bd3e2c1e2b19edab5ee24874e804a
SHA512 6c8d5c4d345cbf93f55d846fede29e8a34ce99c8c0ec15b0dcda11aedf1049c0e647e5e519867c54281124df69e63d437b6f1c97f6c949e1cce8a5b57f3b23d9

/data/data/com.holy.idiomstory/databases/wsUL1uCdKvjD

MD5 18fe38af58e5f87856a790c33aa701e3
SHA1 c6891a756dd4fb4dc0579264bdeddae216b38d6e
SHA256 0406afc81c76b3b2e95bf4856a2bb48ad44ba02e4c45b45b64d1a495da518b4b
SHA512 0713ec95c92b5d8faf3fb30545c197c5fe1865f05e850f06846f35fc0b473d0f85cfb60572b1861defda63c52ac88eee9d4b71ceb184c5e1dd8ecb29333e1438

/data/data/com.holy.idiomstory/files/d929bb76e8110d1a70260af57b446eb0

MD5 bc51a59f793204e53617040d713c7232
SHA1 5920db5e438f7486bba3ed204dddf9206f24d388
SHA256 4ca23b0af17845231164e7d8531b7177f1e27afbd3e0f9b6fd4c2aae457363e5
SHA512 5ff5ef4057e87b6e8e2f0048694fb56eb86c81164ebc792706a0f328985c54f8fdc3851afe07559af875e9d108c608e03d84ab4c201b6d750ddd8c5008ecfec8

/data/data/com.holy.idiomstory/databases/wsUL1uCdKvjD-journal

MD5 b0253570ee1fdb9a15c629f231ea04e0
SHA1 b6b7de342a6e1632438568b0e16343dd9c43aae6
SHA256 e2b014a5693b94d55e72732f4716db7bc62d0b935952a734af60378bf5e8d16f
SHA512 ea6945c2bd866309e86a78e9509336a895a3a2f10704207d9871b99ceaefe333dcbcbb101299dd63a6c95cd1ce8744234114b6b70ee1252b67ef86a3b04556a6

/data/data/com.holy.idiomstory/databases/wsUL1uCdKvjD-journal

MD5 c6759f50f53ea55a47acb829d7b36c91
SHA1 806ab8005f2d1785d80932e5ee14de0a5531f522
SHA256 408807c82786feb9b79bd43f780cf5897f6c571f333830280c6b201e937aab26
SHA512 2b6bc27e1bcf0e71e929152f77838c11da122242af616b4f54ebf900bfab5ca57afb897e26b78a8b4062af6425c9a279ba9d1a41eafbccf2c2677356e3b0c580

/data/data/com.holy.idiomstory/databases/jqIqJYOT3JpT-journal

MD5 f1d6691291e67577474bd7a3051d43fc
SHA1 fbeff3685bd7d007d3f3cd7f17c69390f6cc4885
SHA256 4fa1128a6330dbc5c4ff17089793c93fe3cc527995fa263dc25077cb3a239056
SHA512 40565ce18ef3b42c51bc8ec10d16cf5ba65432886f87c2ed64b7a2de580a6a1997a2f4e1fca77d117d9b9dec2415e26d5085193364f154c1903e00fd8658d750

/data/data/com.holy.idiomstory/databases/jqIqJYOT3JpT

MD5 0831e7409f4719cf4cae2e154106bd73
SHA1 04f6b7592f36fc7c3aa8befb3ea6cc247c3b3190
SHA256 443349b5ad00c150da1f10fb05ef5905ea42f92826469a52bd24c9ccdb133331
SHA512 e2f7e79713153daecd31aeae488fac12415ee9792a749eb976ec9f210889c43eda42b53391bc2aa46a3ff59de3602865ca68bcc58af96894050718468e253796

/data/data/com.holy.idiomstory/databases/jqIqJYOT3JpT-journal

MD5 7c7644dce74a7e0a4a7db61339480931
SHA1 ea597bb6f16486f7fcadc6edbd7aa5d743cb7428
SHA256 5b56e51a3cb147026eadc1a9c26d7cd839dfb0d5bbc8cade7e6646a1ad72898d
SHA512 bbdb55e51811b1f8708fe7eb4f4061af9a178138790a4b16e235c8348b6f46d34b4857f6d7350141358261d4082660876cf84a1b99b6d8b04726fb43848cbe83

/data/data/com.holy.idiomstory/databases/jqIqJYOT3JpT-journal

MD5 d1ba5649eb914011f2d9502a7982e595
SHA1 60cf1b659d7aa1721987b848eba582fe6d911a93
SHA256 7c57f3c2de65030d55fa2ab36fc3357c68b8209ae636444aa5cd8ecab10efd62
SHA512 1a7650223491f71f6e3b79ed84f430fcf9735d2cde2021eb6555eab3a8491e29b9c3001349bd733e3a4638998e1e8f60666b5d3207782b85eb4d0091e9e8143b

/data/data/com.holy.idiomstory/databases/T1oX0rhhuXWt-journal

MD5 849d7605d7f327f304451b66b3f8a548
SHA1 938dc24c432cb99f1e083f845d66a65de49c6b3a
SHA256 38bed143848eb3a0b71c713c759dea4c4428ed589fe5cebe10442da13473417a
SHA512 722bdf25a8485a4f57a3e68a61e75a470149b164bab4435982aebd7a9fa5d8930f57cee20d110d70dd70374ec4bed40977e050afcc8861c84ed1ed40336459fd

/data/data/com.holy.idiomstory/databases/T1oX0rhhuXWt-journal

MD5 962154980a42da00ec526f1e7e54b091
SHA1 b7fd4a586e2ee58fd4fbf2bb38da6c78dd3541c1
SHA256 2c9c159e57283a7166c564651093c28a90eeda02abda8dc4a31d6b81a497f412
SHA512 a315b87ab4b96498f7f06b59c66e0bfe4a7ec10c9bcf0da81df912bb3f129ea2487c9323b51b1eea557ce9bf9efa8b5b5a7bcaf84497274a5f2aac50322af816

/data/data/com.holy.idiomstory/databases/T1oX0rhhuXWt-journal

MD5 b3db1093c6cbfdf5ff5c58e506746386
SHA1 7cca880c3e371a3ac0e70149594fdbc8eae24096
SHA256 0caac1cb520d61b2f6b49305f6e3f8611d294aebaafa51e41f8b7170eba28aef
SHA512 13342cd10156947e0fa220105843dbdd33f49f23eac493bdb84a24714710896d405d8488020d6bcb0578e796416ad438949f24740ac33b77e67c58756235233c

/data/data/com.holy.idiomstory/databases/P15pKIjsm64m-journal

MD5 69f68001b1bfa13ada375c6aef479b4b
SHA1 3b8a2ee47e2abe43eea43f9e5c40496571ff5069
SHA256 01a7593826ff198142a66da4ef580cc2dd44f0a8ef25a8c05aa9517b3e998334
SHA512 8a039dcfabb043877bba98ab19973d75afae05a38368ce48d11935589df1483ed3c9e8c750d653bc746676c1c0f5abda22863cb85aa9138c14ce2287cfd85dbb

/data/data/com.holy.idiomstory/databases/P15pKIjsm64m

MD5 653710ef7f6a06e00e981adb12683e2f
SHA1 e8a1718747ff359c3084ec2c0f7f2586119c90da
SHA256 e25f08c7a081b452f680b9b2b74bf4a758421833ff42f44a6ad6cd2510118dae
SHA512 f69272f26176434c5e66183a55e72a9a0c85b9c6006de33618bc652930d98890beed77fdb73cc422d3854336457b2af64e5ac7346fa06668ead7a0178af4cce7

/data/data/com.holy.idiomstory/databases/P15pKIjsm64m-journal

MD5 41f2fd6170a88f6f54e24db591a32aa8
SHA1 a22bcd4284b91e1fe7512f1c19445bb4e63bcd0b
SHA256 af7379679ee87ebf3c451d12697cf6ce1084ad29f3e97dc94b430efce652e707
SHA512 f9ef795f301f52c3c5d84c838d3010fcf04b26af6c5fa424b29bb9bdacbb0a89812a0fe32fd1a316d83ccebf78da3ce7a25db18831540c6350bb40d1d67cc96f

/data/data/com.holy.idiomstory/databases/P15pKIjsm64m-journal

MD5 112e706718d9e2671273847aca792e71
SHA1 1973a0bf991c75dd05c643366449f4332511e23b
SHA256 dd9fd68c11cdbeccd0bd16733e7691e70fccb46f59f514241af36756a4df1d98
SHA512 a1b0f68bc581c88800b28a443a9e4f64fbb8392cdd7f6c7d8e879328adb8ed99e8e036bded2b1bb1ca48870105cdf504e53358a7fc60953955cad15481ff6aa0

/data/data/com.holy.idiomstory/databases/XKwVoK0huy3R-journal

MD5 5bec4686b0690c6b14947c259d842a0a
SHA1 9b6a9d234f0f42f1b1610b476d8bffb2bbb52444
SHA256 f8174c05ea85c5dacbe78e238bcf3965119ef9ed5f38b8006fca6c437a13a188
SHA512 754a2dbde4d9db2be5801d3bbdeeacab268be800275ece7f13cfae16199dfbc8f338c5675e12327965604ad7fcef6b67c8365df57892c6031496574e32a9fbad

/data/data/com.holy.idiomstory/databases/XKwVoK0huy3R-journal

MD5 4aaa9850a9559a820184ca3897503a66
SHA1 b7cbf017daa0c3c589397f6f5961ca6ab1ea87ae
SHA256 da8f4e237d8e56f677cd67ecfbc3e4da5ee4b6ba56047bc933f8cee5ee528d38
SHA512 8a82a8c517859ae9553d72d2022ad3d010665515a4f8ba13c50d65142c193cff4e0b1c8eb8f9b054930aa864c47374d322bc5a177fdef7c18d6c98ff55f2352f

/data/data/com.holy.idiomstory/databases/XKwVoK0huy3R-journal

MD5 346b36da343b0ff1482d04c30f605fd2
SHA1 ce41aaf7abb069bef2ae89ca07c90f086b77ce71
SHA256 00631c5629ceeb024228fc2868abe7c3908b149f718c7a1b48fc435ab642517c
SHA512 8efddf2010dd8c295c7e85d58bb32cb0377db5976a91318646004aed00373b837e1a8725d839db43739a43d562837e45bf086837dabf4033b1e12c79faea3913

/data/data/com.holy.idiomstory/databases/wIU6pTyUBYWX-journal

MD5 d0521ef80fbd0fc8fcc4d1df0f1c81d2
SHA1 b68aa093522d27ac3c0e93b5463281098bf3c643
SHA256 cce39d87b9a2626ffb57fe03cb3e12f114672b0fb054f8a6829848611789e876
SHA512 8a5a684f7f0e6684fb6115ed0c4216173a4d92a4a1a48d55ed19e615809b74f3e4346ecea6e7a99d148a6ece6eee08b72ab341c63c73628cf4ec16712775d412

/data/data/com.holy.idiomstory/databases/wIU6pTyUBYWX

MD5 ecbff9653eef62492fc88d864bd03eef
SHA1 ba72b8a8e90d4264e28c94d6b6caf78a04a267d3
SHA256 7dca83b099edb9689164bedb8a6e99292e1dd02c63efe1671dc1275e4b5ce3c3
SHA512 4018fbd16e983db63f5e7d59c919c20357674cac3796aef290f4399e4e1d26e7842f8dbfa67d26a54ca8fdb82c583fc449fbc2ac39c0c8f94f454ad6c8a53c2d

/data/data/com.holy.idiomstory/databases/wIU6pTyUBYWX-journal

MD5 c1df64a1bcdadb0b444ade3f78a1229e
SHA1 a31819f095823ef075a62b92810b85b5f806901a
SHA256 ae9b0d53ac3a71c93570dc7423fe16a9ca049a6f761fa55fda64dd25575a7f1b
SHA512 d698177b170e931aa3731bdec19e65a21309ad6a8269d1c8a3bfa0534eab5ed1ad5207d9490e11556b03c0eb5cb67d074457d1740af02015c438ac241d100a2e

/data/data/com.holy.idiomstory/databases/wIU6pTyUBYWX-journal

MD5 90f6303fbc414220c45a9e45fe1757c2
SHA1 2438e2e1404fb6904aea0b4c28102b55ee15ffa9
SHA256 b8693e4908f2061978293b4cd430de79cfa22632b81921d25bf05039d8f1c119
SHA512 5169d4078a1c4b6ee7d9b88b0c64252eca823a100770b91fc6fe0eeb66434647cc591bc718b99989256175bf3d2d3dd0ce80d3d3a00eb66411df1cca2d1cdba2

/data/data/com.holy.idiomstory/files/mobclick_agent_cached_com.holy.idiomstory

MD5 b8a05582ac2d83c1853bb0ca03b5de4b
SHA1 bc043ce9af42884eb6204106f2f1eb3a973310ca
SHA256 808957ecba5c3f61ba0f922f9767367e745fd2290ddb98bd891ee96940ea496e
SHA512 c2d6cda53a0c6afa0edae8aa4d3e70d34738a1b7bd6c48797f8a28aaa71e1bf572bf86f6beee2c6d938c3491fda6ee71ea2e3f122bc001e65781ba8e99501811

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-02 11:27

Reported

2024-11-02 11:29

Platform

android-x64-arm64-20240624-en

Max time kernel

131s

Max time network

151s

Command Line

com.holy.idiomstory

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.holy.idiomstory

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 oc.umeng.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 feedback.umeng.com udp
US 1.1.1.1:53 stat.gw.youmi.net udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 au.youmi.net udp
CN 183.131.178.88:80 au.youmi.net tcp
CN 183.131.178.88:80 au.youmi.net tcp
US 1.1.1.1:53 oc.umeng.co udp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp
US 1.1.1.1:53 aos.wall.youmi.net udp
CN 218.92.216.56:80 au.youmi.net tcp
CN 218.92.216.56:80 au.youmi.net tcp

Files

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db

MD5 ed1b04d64c7dd2247059911fde78eb34
SHA1 9ce8cf3053c2fd14992ffe482e08a429cfdd51c4
SHA256 d094042dd6d3d367e07b7175e07bfb3e8987b0a0616a17a48dba9726aca609f3
SHA512 62f9c58640e80eebae80efd6cb02777730c33ee7e7fbc619d63f4eaca2feb4884de9865cd673a54a3dc3934d4b23b825ff456d6ed88e80661bed5fee0f692887

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db-journal

MD5 e04038c92aee7f93355e89a041bf2bb5
SHA1 294d505d59a091774263acd605c4dc9a3b241457
SHA256 9a7330395c1ab050839e7b5318497c11a8dfbe9b399469e10bda76f6dbb2fcfa
SHA512 85089b281095cf61dc1a4844b2c54479bb23488373bc4354099752f2ccf4a6f5c9b89088497c07c43e20d460c14f7c8888e837649039edeef727d3edcdeed3c6

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db

MD5 89cdb55eeb627b698027134f76fa8b93
SHA1 1f621bd7e22527063bb9b589b4025902a9bffb42
SHA256 5e375a1020a39d2043f58b30d028507cd666b30f99e9be8e7e975ddc69c6a571
SHA512 31e9aff2253286426d482eff2ab2bdfde950203169cc1a22d66f4aaf791824bdfe40d2cf1130ff8cf32216d75a50193f3198a2f212276edbf8d223087a653dc7

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db-journal

MD5 8fff10ab1f6c318fe97888fffe040943
SHA1 9f4cc53ba1a8cd396f0494995eae18ab9ebfc3f0
SHA256 289f1cd761612503e7773bfad39e785a92802facfea88d73b3f005cfc2926c85
SHA512 a5a8b5e1b92f98d473352d5b25b0917254be0902ffdd4a315eb34c238a786c2258e2847a7f95b9359184fb4062f1596fa23da4327c611df793e1655cad46b0f5

/data/user/0/com.holy.idiomstory/databases/wsUL1uCdKvjD-journal

MD5 1051904449b06368da66cdbd968f999e
SHA1 9a4fe719f3d6c33c52789aef459d35517985d2d4
SHA256 8e40dd484a6e6d1183717b9828261c6340862917a3b53d5b6fe05b6731b62ad9
SHA512 8329226b17b3ee0a084f1a7899580d6b1a42a271f9f9fd802a20f3afdce232f0cbba7ea55c162c7b3c4781c5e6ca4f4e0f94751d8df96f89e1f24ed0f17619b0

/data/user/0/com.holy.idiomstory/databases/wsUL1uCdKvjD

MD5 ee404ee50b0a8b608431c827eb7412d5
SHA1 2fcd5f95d113dc1ec7cef52833d0d86d31a7c183
SHA256 0f76a9ccbfd5c1ead7caad5059bc8e019f65d4de05a449bd494c9bcc89e1043b
SHA512 e33289ba9977eef8ff85098786b523cd2e1e7799af8cdbea36961f870ad717b63947c4dd7829b1219616b2ce0858fff2a181d8e4e52213f5ffd6894270741e0a

/data/user/0/com.holy.idiomstory/databases/wsUL1uCdKvjD-journal

MD5 382356c21d239cbf9c4a5e6aef10ffd9
SHA1 4af4bd1d95f7a465392b1fefac77808f8343a1e6
SHA256 b3c4c82e0c9f37be7bc3cddde5c5e5dc6e462b45be3575ff4e565695c8e459c9
SHA512 d61d320f615a9b9a78cd53555f5aba77c5ec775e9ee4cf4d24a0cd6368e025c439b38685ed8a7804c741f1f3b9dda50f7832ce13fd2f80ba2d9e309ae1125d76

/data/user/0/com.holy.idiomstory/files/d929bb76e8110d1a70260af57b446eb0

MD5 bc51a59f793204e53617040d713c7232
SHA1 5920db5e438f7486bba3ed204dddf9206f24d388
SHA256 4ca23b0af17845231164e7d8531b7177f1e27afbd3e0f9b6fd4c2aae457363e5
SHA512 5ff5ef4057e87b6e8e2f0048694fb56eb86c81164ebc792706a0f328985c54f8fdc3851afe07559af875e9d108c608e03d84ab4c201b6d750ddd8c5008ecfec8

/data/user/0/com.holy.idiomstory/databases/wsUL1uCdKvjD-journal

MD5 ed1586b009cb929f71db07d6466d7f99
SHA1 9ab93333f73cd9adeebf9600e02d7cf8d69f1fc7
SHA256 740bbd8e121fb5d0f6f48625614209b372f7b9a5a9d07d0cf526e0dbb92b7f75
SHA512 8142d8b99eaca94db31e0e5b00b9d1000991f81707f2e6da8a3c371b54d3815703a386d3d61970c0f6113c7cd2b935a852a7d49094fb3755d6de468eb8df6cbe

/data/user/0/com.holy.idiomstory/databases/jqIqJYOT3JpT-journal

MD5 753abac3e6559f930a302d728c3ccbd2
SHA1 cb2e24fef3a5554e9889f85fb081290d8f267f2a
SHA256 be6da4588a2ebb29db378f62a20044a36ee52b5bfc314383f94075d30df30bc4
SHA512 8a7b651821cd2827c1334f4f2fe7297eb04b422f4bdfc291ce84a99fa30007be4129b93157671cf6c08d04528fa79cfcb11b62318bca8f56e12dc243b0ee9338

/data/user/0/com.holy.idiomstory/databases/jqIqJYOT3JpT

MD5 025e56e140a8ad94151c4a5afd61593c
SHA1 bf9b5c8d9d7d7cf08821fbcf8f8dda5ce7e06eef
SHA256 ae00e644099f56a6cc0d1a91767c2633209a0bd06c7224a0d5abc0a2131816e1
SHA512 045a870d4d606dc7bbbd022b013c11c2f6ba2231fadbfa68a8496965ee80d324f737b00173950316eb43f49dfa2b9f4d1d26dfc0dc4f71d0e8459f60a32effb7

/data/user/0/com.holy.idiomstory/databases/jqIqJYOT3JpT-journal

MD5 deaea7d3e36c011bc8c8c331b3ccf6dd
SHA1 7bc55f21e70debdde64f3d9798892800325b3ca0
SHA256 07a61d88fa7e0dede9bebd5eb2b6539410799a1b420787c05ab8c4faa90e8df6
SHA512 0466507b5eb4be53907a8f4eb6d2af0cb835fb402047a4bc428aff3a0d4160dbe9203933e1b5002611f469382a2bb143829a5e04d95997eb6a3040c718551954

/data/user/0/com.holy.idiomstory/databases/jqIqJYOT3JpT-journal

MD5 38a11c26c50bb88f6c951565f3d7d9c7
SHA1 ecfd4bbd4644e328ce313bc4df7285bbadf58d74
SHA256 54cdbed458165eb09f2fb45384ffa1e8acf37d3532b984ceafea24132df7edbf
SHA512 e2cb1271f481d44bd20916e9f8c20feb8c0565dd9cb57b1ba653898f359b5c869a14943a9f62bdd3451d34b34056e4e62d33d4a4b3b67a90a193bb4c605c9ed7

/data/user/0/com.holy.idiomstory/databases/T1oX0rhhuXWt-journal

MD5 0e555e5d83fae1b027773f16d5e646a5
SHA1 a989ff6bf05b447bafe15bed5c782f9aff7ead76
SHA256 b6e35af28dcaf06937d342195ec4ceac69601ed59a0f9a52dd0a46a850fde9ae
SHA512 f9da6fa8687cb7e5e911a5cb745b8ad199291e776dd64ade167b1eec2863e10dfc4253084cc3ac8084064b87c2f93080fa74a663eca46136df8dd12adc469263

/data/user/0/com.holy.idiomstory/databases/T1oX0rhhuXWt-journal

MD5 904b33cf906b1f4616c5050d743ce825
SHA1 61be9f48da4dba31fafd0679629ab2e98f81eb5d
SHA256 362e3279b63e5f407faa9310a979ec0705bdf6df69746a15c7871ce8ef08ea82
SHA512 783f2672493faf4fbdfde2ed816cd56005e2b2ad05e7a3a4ac688f8d3aca444587cdd1e5e32debcdd89dde76c94bf132cdcfc58ad452765b983893731393a973

/data/user/0/com.holy.idiomstory/databases/T1oX0rhhuXWt-journal

MD5 da467e0521b903397fba5997744f7b59
SHA1 129aedb69126b0826803ea92ffe02f1b57236579
SHA256 72d65abbd45cc515436e9fd773ecd82258bdc72b28664a87bca7169d6c83980a
SHA512 672609a2143ce61ceeab90a025e1aed34cac1f712738c3ab306f9311c939a4db1dc4bac48d8001b30a71173fd1c591229f47c9f537b80f0137bc692579dd7eb7

/data/user/0/com.holy.idiomstory/databases/P15pKIjsm64m-journal

MD5 054bb234e618b636f539f23a70ff4ff9
SHA1 a787ba0405fe38d24eff0ac326a51e6c914ee56e
SHA256 9c6b0154e77b24f6543424eadfdb74907f28066b70dae7448464e826c4d52d83
SHA512 52d1fa7478cea704ece3f8447c298d71fe0f142c9b745d0a8dbe719b63e0cb11eed24427e2eedd376fb7949b141c67e185b224dbe3b10d03d3a1a583fd018537

/data/user/0/com.holy.idiomstory/databases/P15pKIjsm64m

MD5 e293bd58700e15a3e37051b1e22c05b8
SHA1 9ec1b070915b7ead90620e7c148ffad3a40c9ddb
SHA256 862663fa28a6147d3f73ada313e5471bd4da61592ce3ef63adc149dd5eb3852d
SHA512 ecc35d41e676a1f3b7a7c2577a92f3bb0d521ef371cfef94e0550d4a32a42dc0b0af0ede5cd1dadd378c35f0b9140d2850f7519ffe50f18bb109bad5f88539ec

/data/user/0/com.holy.idiomstory/databases/P15pKIjsm64m-journal

MD5 f1be317023a3a1fb3c4bdff1a66283e5
SHA1 01431b13a83b15377c89095dd604f51ea3a667c5
SHA256 e803738a3bc7792e71d28a93d4b61119720904e0fdd06e49c1562c52eb10b81c
SHA512 560156dff5e08691f709b2ae2d94f082a68b415eaecdf01aaad75be4d84cf5a7b073fd8d905836aa14f5c5d44b24feaf5fb3d1c7fd8d9d607aebd00d3829e40e

/data/user/0/com.holy.idiomstory/databases/P15pKIjsm64m-journal

MD5 0f67ee83909a84b05ab3543fbcf7de60
SHA1 4fc469a694f7e4598ef1096ccf6b4f06202456a7
SHA256 f561ef72b08d78d32916ec5708f49962ff720574c6447b2487018408e3d72d85
SHA512 0dd6b81a1bc1564626fdfb50067c7cfd15d1d421fde79f9a838fd81e6cd300ab5385d3d34ae856f1a570e354f3f8d83a65088dc35e7bc40f1d2ad8a2ed2ccd3e

/data/user/0/com.holy.idiomstory/databases/XKwVoK0huy3R-journal

MD5 cc3667dead69056de604b6d5f6fbe79f
SHA1 2297065b441665ca8420b8bd4a612ce808db93c0
SHA256 2995277ffcdd2db98be8d2dbd2993d875fee3dc3501d15ce3fece06b1eb02eb8
SHA512 86376ef7dacc7e82c92d54b6f968b488b112b3621c9013920dc02c922d3c4853b5b70bf1e0ea3d5683c70dc42bfba098961b8066ba80507ce3e0f120cfc9f454

/data/user/0/com.holy.idiomstory/databases/XKwVoK0huy3R-journal

MD5 85e226f3ace35352227a51a06e3f3bc9
SHA1 d7408080dcbf3737db12a047880c6f082f70c3a8
SHA256 72e6c34d0b483dcc17df729b89cfd5a128e926f496f8c3f0734b34b88e46facb
SHA512 aeb54332d5862ba0acd889ff456211dd630c3053597d6cee1381e7e9f51427958a9af8285e4594360612797a531e9cfa6789d2c91bb7ff8d3fafe2209f73d569

/data/user/0/com.holy.idiomstory/databases/XKwVoK0huy3R-journal

MD5 25451087f1f4da648bce7e37e1d42fb8
SHA1 dc2f29b167446f3bdac6c5a74dfcfb5d5f0286bb
SHA256 d60987371848f61fea7a9b701f5ef5e0f9055a0356b7d5ec70eaa38e3c2e05a9
SHA512 296b7e7e49774e94cc92c15588a5f8459382f45afeb613657745bb72f839e28b5b965412193473fa99ba9d172a532a746cf59bbaeb0c482878e08881d4f40413

/data/user/0/com.holy.idiomstory/databases/wIU6pTyUBYWX-journal

MD5 98bb2c0bd3a55d93313dd8a371593900
SHA1 645dffc8762454f0079560ed58c1fd8ffe07431b
SHA256 a9ebb1311cebc76b567a34872574d2c61f7529956c23cb0bcb263772daf63f9c
SHA512 d05dc823c93e4e8047cfe57ed0896f52082fbec823acf8152c8223ea205a8d2203cfd5f5016642c19dcfee74f0b91633eedd5eb7327634ed39d1e29ba5fd4caa

/data/user/0/com.holy.idiomstory/databases/wIU6pTyUBYWX

MD5 9bc818834bc3f0c969b4cfeb8541c982
SHA1 b9503bce4e2f77ceef0f1b9d430b750bdbef8647
SHA256 51ebdbfb7608ebbcc8a409c55d1bbc82b884480a12666540e8d9c96b368876b2
SHA512 b98335dc9164b7067956f311a94d2de9911f00de90c48f118c20870014f56df415acbf2b3b2619bd40a7cb33b4011d0ca1c6ca9af1d51519aa5136ecabbe5894

/data/user/0/com.holy.idiomstory/databases/wIU6pTyUBYWX-journal

MD5 09e41e0302c97151468250412051af19
SHA1 bc4d9bbebc622e40fcd86823a694c222f40dc13a
SHA256 2641c73a1d934a4b05ef361e6db9242bcc57e9376a4cd5f0f9efdf07c04e4b8e
SHA512 3b3cf9039406836abd42190607939e827db5926c49e09a8de28371a8616933d7922c9392b2fd6d81cdf474559fe760af4b1fd909f7dbc998da6b17f71a917cce

/data/user/0/com.holy.idiomstory/databases/wIU6pTyUBYWX-journal

MD5 c9065b328a1c67913825ba9e4831a08c
SHA1 edef33ca8011fbc158a22a89188cc2e44cbf2ae6
SHA256 6f5bad40a0dc72eee215a0b5369fdf4d8c653196ffe44e1af0b863801c7bca73
SHA512 97816298f1352002827ee215799a1c124dba86e2235c8df139f6cb3c877350adaf1082b7878f36e4137175435b05c47386a5341c58f539f7495dd5ddeaa8c83f

/data/user/0/com.holy.idiomstory/files/mobclick_agent_cached_com.holy.idiomstory

MD5 f8f46dc373717dee62d143abe3c16b6b
SHA1 cb25040474e133028aa31fdd9750d7f0b01be1c6
SHA256 0f5c21458cfabda1a5259e3272437094bddff49b9911375a4829fb9ff5d4864c
SHA512 00a3baf49d187761a4f22df3f1e0438d56acdf8f36467ec999f0c0a9947fe05e04b439e1a8ab3d4fca8c60517957dc071afd7dfb16b77c74f9408aa38182b57f

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-02 11:27

Reported

2024-11-02 11:29

Platform

android-x86-arm-20240624-en

Max time kernel

130s

Max time network

154s

Command Line

com.holy.idiomstory

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.holy.idiomstory

Network

Country Destination Domain Proto
US 1.1.1.1:53 oc.umeng.com udp
US 1.1.1.1:53 alog.umeng.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 feedback.umeng.com udp
US 1.1.1.1:53 stat.gw.youmi.net udp
US 1.1.1.1:53 au.youmi.net udp
CN 183.131.178.88:80 au.youmi.net tcp
CN 183.131.178.88:80 au.youmi.net tcp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 oc.umeng.co udp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp
US 1.1.1.1:53 aos.wall.youmi.net udp
CN 218.92.216.53:80 au.youmi.net tcp
CN 218.92.216.53:80 au.youmi.net tcp

Files

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db

MD5 ed1b04d64c7dd2247059911fde78eb34
SHA1 9ce8cf3053c2fd14992ffe482e08a429cfdd51c4
SHA256 d094042dd6d3d367e07b7175e07bfb3e8987b0a0616a17a48dba9726aca609f3
SHA512 62f9c58640e80eebae80efd6cb02777730c33ee7e7fbc619d63f4eaca2feb4884de9865cd673a54a3dc3934d4b23b825ff456d6ed88e80661bed5fee0f692887

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db-journal

MD5 a6a04cd7a847bd67073bc83e0e9026a9
SHA1 ff2fc5ba06b35f01cb6ff5580b57d09d07a29b32
SHA256 1d9f2fb8987825614abc043e625b8c2b27d296ab344fde9d103e6db6b5f496ad
SHA512 4791366e720f7215cd2fb64e2afa84a73e815511ba23588841bfd8b180101c0801876baa2acf38af3ed97b85e8ca703e63bce725f6dafff6265e38d8e127da50

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db

MD5 58525b0b4597b452992097a5f9b499b1
SHA1 e84670da63b7b0dee18e8bb8a2307e389f2d5e2b
SHA256 9cd7a77d3a7c9c98480fa3af1c0b8f08869762ec06be905eaad95d1e2c3ea869
SHA512 4516afca30c4f93eb590c5ccccadb8b4d967b4d21b3eb6d57f8e25bb1c793b6408df5d59c92e1ccf4a29b347361ba736fee0b971d22d7eb16d19da868ab4ac4e

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.holy.idiomstory/databases/holy_idiomstory.db-wal

MD5 fad93134f47e6a33971d16e97b9368fa
SHA1 22f8cb389c1221ef9d8eb1f4b162ccf2d42f66f9
SHA256 70b68770eaaece54842478834b7fa6f08bc1015a62f5f433f3a9ea45c9a4b36a
SHA512 ba5189c60297c3744ec64e2cbc7f016908150b111c793929e37b2d1cc1f289333989a969ef4cb5a6fcfacfae1dc4c26d913eea9a763edbf16fa20600abcf0a0b

/data/data/com.holy.idiomstory/databases/wsUL1uCdKvjD-journal

MD5 0a8b4e329b9c7b0c02c4bb2a73368ec2
SHA1 546545b3fe8bf4dea680a4eeedac1897cb707435
SHA256 117653834965796d8f94924cec4d2e9b1d1e600f9781738531940fab2b1c612a
SHA512 c7a8609ad06bc1e924f7c7cab6ea17f81820c2b0e64cc320f5052a132a9bcc64fa7510bf1b2df529fd20232c285e7433757af2fad89ccfcf0426904b6b691151

/data/data/com.holy.idiomstory/databases/wsUL1uCdKvjD

MD5 59413190ea19211285b5c0fed44c19c8
SHA1 ee67b7590047c3c17309f6e6eed48556aabe4c92
SHA256 3511c95f09883c65de19c3be645faa921aa3baa92d21b5c284133da349158e2d
SHA512 6a65fc51ea3e163ed1da558c2f4e911857ab4d3b15bc27135a4639e8fed9022fd6d89b4dd39a39b3bcc69060d7565f68ef23bcde4e622a2dd823e9fd217d314e

/data/data/com.holy.idiomstory/databases/wsUL1uCdKvjD-wal

MD5 3e57af5ec2fcead58a41e34dde161c96
SHA1 6032c4f68ad8de7525341fc5acd620a0d26048ef
SHA256 cae077bae1e285f617cee1e195109471883215dce5caf03f6fc1f1c064b26e55
SHA512 73a31cd9a696bfc1210046aaa838421e339165cb97ab7810cc6b6e9ba47bcd206b9a4f4916f852413a5b9c644cadd8b5de9eef115b5e1aa94f39fbfaf892fc82

/data/data/com.holy.idiomstory/files/d929bb76e8110d1a70260af57b446eb0

MD5 bc51a59f793204e53617040d713c7232
SHA1 5920db5e438f7486bba3ed204dddf9206f24d388
SHA256 4ca23b0af17845231164e7d8531b7177f1e27afbd3e0f9b6fd4c2aae457363e5
SHA512 5ff5ef4057e87b6e8e2f0048694fb56eb86c81164ebc792706a0f328985c54f8fdc3851afe07559af875e9d108c608e03d84ab4c201b6d750ddd8c5008ecfec8

/data/data/com.holy.idiomstory/databases/jqIqJYOT3JpT-journal

MD5 3461160b3d8002681b05cd1df9e12dd3
SHA1 fead5b48075b32279f136d855f4a6fd530f38be4
SHA256 b747e7a3f4600db4cb5e725caf9c69bd1f3e3bf3e259ef573e2f32edec1c6383
SHA512 5cfc36fa5bc0ed2b5b25ee6690597db586eaf19c36dcd9dfeead84955cbcbba0015d0c890bd99ccfda3d2cb2815898082bd9c31106e85f840d3370a84ea960a3

/data/data/com.holy.idiomstory/databases/jqIqJYOT3JpT

MD5 9c37108c041a67252d4fb5059436eb9f
SHA1 f65bdd652f9b2a098993d2aca0be2578e8eed20a
SHA256 f4a3fc85419d0e98a0312af88fdeadf75bd9969460820043559d6ee45e7ace55
SHA512 d7b92b0b4900439a28552339cf7e80e2937887c7de796e10df0bec393d136bdcdeae47991133a5c144547ac2ffe484b9c99e60280246858f6ae9b8529c5d8548

/data/data/com.holy.idiomstory/databases/jqIqJYOT3JpT-wal

MD5 167b4df5e556f711dac7694e8828fa4f
SHA1 661e8d64b6a71c21afaf86febcafba3a5697930e
SHA256 babbb5acbd4bbff2913e866d1eea959109d6916c0e63852fabe13b85966f1a2a
SHA512 cc84e63836969f8da6cf758d23da63def7888300c129338e5faefed21d97fa37859fe78bf27bf209117af4c471a508a52b7fa5755b3fcae7e37936bc6b047a2a

/data/data/com.holy.idiomstory/databases/T1oX0rhhuXWt-journal

MD5 c064bad85d4c102d83d8622050576f26
SHA1 9692e0587bac2adb265c5009460bdd1a34f55f0c
SHA256 1508eaa3150ad250f8506c29bb802f76066b5a26407451544f77b1a777a8977c
SHA512 fbd7f9174d2a7a64a9326459be4c9d99b9d1eb1c392224f41563f6d36564f739d153683e99e54fdcc5aa9bd76de65e88dc636f2c2294022fc5a5024c7d0fc488

/data/data/com.holy.idiomstory/databases/T1oX0rhhuXWt-wal

MD5 3f3f9dafe500bfffcfbc92c7ed2b91ee
SHA1 f7395433732ced49e6013b5a9d9ccde70ad26456
SHA256 e6bdfdf6c70e3861434333f20fae928b800c45909c3e234c74c48649c88836cb
SHA512 0fc882aee82d8878ad6c5df94e35e58e3c2651978b27c72c591ce952db90d0890b420c6e71a4a6d31d12d50b3e29eba8734c249d1ef4aad8fde6d3fe6ba37cbb

/data/data/com.holy.idiomstory/databases/P15pKIjsm64m-journal

MD5 552481da9fa4313a236977e222d0cadd
SHA1 d8f3e78be70a2909baf25fc8fe739ce724e04c89
SHA256 a5b77b51bb4f37a98f1e8e8069ff679da4b835d9e760cf29c9b1dc8077b53483
SHA512 68e6615f67d187ce1a44684a0e2bab5dd100f515e039a8108c9566597f83f37d7a202067028b0c54495d94f30b86ed45adfcaadb13c2549fb84fe07f7bc807bf

/data/data/com.holy.idiomstory/databases/P15pKIjsm64m

MD5 032abd6bc70ad7c9484f10a7daf57bc7
SHA1 12e3c03375192814883d5fd1671e2b0c64b0ae43
SHA256 9cc41eaf3228c605583528005cadbf69eb145da3943e09e3732677423dcbe976
SHA512 aa28b2d8e87dd6364e15b1c99c52758f937585c126cda7db38cd2b4e5fb3c3e5775a92cd1d5ae68b03a6c59e7473766d670f03e3ee30e8ee53c2bba1b73f243f

/data/data/com.holy.idiomstory/databases/P15pKIjsm64m-wal

MD5 b1c6b666eb3dc280f44ad385a7eaeb43
SHA1 2b57da35ffc002b9428fab890a653c544e9e97d6
SHA256 f7d1eb417551ec5bc5a638f09b4988277751075670b1462ac17c23012a846118
SHA512 2694303ace549dd89de14fe4f641383d98b4e9e631e944d50c0fccecc4f9f2d54a9cf876641ea50944fd4192126312f8649f610d963949b3b9b73bf37dc157c5

/data/data/com.holy.idiomstory/databases/XKwVoK0huy3R-journal

MD5 920175631bcbb77e679821435605822b
SHA1 eeba7088373856ec9d684cf5e1e671f2018fe424
SHA256 b0645cad7bc2c7d7099116211e4ac3bf6ca685b076f037f8d5fbdab42a9903b1
SHA512 bdbd74859cb2df1308b136668af6b7a0c8b05a1d08cbbe4b82e2bedb8eba09bbb20e10467c2ec406f5f2deaf3af85d1be8d1cef98d8e1729b131c1a79d4f5b0e

/data/data/com.holy.idiomstory/databases/XKwVoK0huy3R-wal

MD5 26113e8ae42335a9cdb94e788b3f570d
SHA1 d97a9a816aaef8825b17a3ffe1dd8b17ad0e8dcd
SHA256 adeba0e314aab1e4f3f244b22d370227d444a45ff1b7fed604c4757f38ecc3f4
SHA512 9740b4d4a1d50f611eecab57c30c07998dba89c752439b4b829ecbbbe8d597921360e3515654268b904b703a636fa1aa145cd879e189573b3cdbcb026e758693

/data/data/com.holy.idiomstory/databases/wIU6pTyUBYWX-journal

MD5 797af2f12574227a3722977ea247208a
SHA1 8f3f38fb9e64c21daf6a7695a6d196c93fd91a00
SHA256 e69164293134fda5e25f7940ecf9a4c28d5715a7b13ab8e3508086d5db8a189d
SHA512 18f63ed1f74f8ed7b2d5b619d52355f72166afab90967ee0bc03c391353a30e9e887e42e0e4ecd5002f27e2745ca79d88f8b1f36f9588a603052dc7fdc182ab3

/data/data/com.holy.idiomstory/databases/wIU6pTyUBYWX

MD5 3f46387c5a9161a06c35918e4715e9e4
SHA1 f03b4527b29495a3f50be85d6afba301e9e3f1c1
SHA256 687a930724a6054924254f945ae475e34ae87ebdc2054881c34317cd91d46ca9
SHA512 614fa11f57f1ddc2750185eb908a580f1ae1ea53d4f4ff6881610942a36554b918138af7103859821d90cef12ea68bcab1ca0e4548cc5a78ee7a3c658b37f3ef

/data/data/com.holy.idiomstory/databases/wIU6pTyUBYWX-wal

MD5 56881ab62bc5f56c42c0c010729c1cd7
SHA1 dad9fa826b1664cdb2c69dc855996f44d1d7fb79
SHA256 92f22187560b2959a1c0786f2f59229487151111654e0e25352d03ad8ee1501b
SHA512 28ed6c6f504dcc8d767686d098d11bf4cb0e97b914bd986f5979f6abfc94b5bc760377dd016cc9b7a8743be8aad3d1e3a81cf0b4211b55434757e06297191058

/data/data/com.holy.idiomstory/files/mobclick_agent_cached_com.holy.idiomstory

MD5 e35456b65a634c2415809226d22929df
SHA1 281023687ff4237d8646bbfe8e300fc5fb91d167
SHA256 da9c84aec47e8e7579dd02bb1df8473cef65553318bdd7fa55522af111a8377f
SHA512 49582a5a207fff8fc0a9f5f34c8413076d42065f77cb70c0984de6de4a1854a7a60160a820702508084714a4219ed3d4da3016f495fa307b6f3ab14b0208caed