40c21ecfe58bd9ee06dd8fa0d8d03f5a7700063e88d4067a4dd22a36da1957e3

Analysis

max time kernel
127s
max time network
150s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
26-11-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9eff202794bab810797698060e597bb3_JaffaCakes118.apk
Size

5.9MB
MD5

9eff202794bab810797698060e597bb3
SHA1

fd44ce83a00f1ddcf6c9879da2d0686ced36f28e
SHA256

40c21ecfe58bd9ee06dd8fa0d8d03f5a7700063e88d4067a4dd22a36da1957e3
SHA512

e6c6e55acb298eabd1c60d03091c6ef8521178e41ba6beb9f0ded78b94dc70993271529491d9639835052c1bf2c49de84a34622425aeba17dbf6acef2e79936b
SSDEEP

98304:POcjcu3Ng/s1FCd621aRT5JLOnbONlMM8V40ih2tU+MG/PGGi4OD2OvB9Eq33wm:PhjssDa12HPlGq0o2e+f/PGz/2OJ9E25

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs
evasion

System Information Discovery
T1426

Processes:

com.codernanmen.photorecovery

ioc process

/system/app/Superuser.apk com.codernanmen.photorecovery

ioc	process
/system/app/Superuser.apk	com.codernanmen.photorecovery

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.codernanmen.photorecovery/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.codernanmen.photorecovery/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.codernanmen.photorecovery/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/data/com.codernanmen.photorecovery/.jiagu/classes.dex	4254	com.codernanmen.photorecovery
/data/data/com.codernanmen.photorecovery/.jiagu/classes.dex!classes2.dex	4254	com.codernanmen.photorecovery
/data/data/com.codernanmen.photorecovery/.jiagu/tmp.dex	4254	com.codernanmen.photorecovery
/data/data/com.codernanmen.photorecovery/.jiagu/tmp.dex	4301	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.codernanmen.photorecovery/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.codernanmen.photorecovery/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.codernanmen.photorecovery/.jiagu/tmp.dex	4254	com.codernanmen.photorecovery

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.codernanmen.photorecovery

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.codernanmen.photorecovery
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

System Network Connections Discovery
T1421

Processes:

com.codernanmen.photorecovery

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.codernanmen.photorecovery
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

Location Tracking
T1430

Geofencing
T1627.001

Processes:

com.codernanmen.photorecovery

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.codernanmen.photorecovery
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.codernanmen.photorecovery

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.codernanmen.photorecovery
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.codernanmen.photorecovery

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.codernanmen.photorecovery
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.codernanmen.photorecovery

description ioc process

Framework API call android.hardware.SensorManager.registerListener com.codernanmen.photorecovery
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.codernanmen.photorecovery

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.codernanmen.photorecovery
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.codernanmen.photorecovery

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.codernanmen.photorecovery
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.codernanmen.photorecovery

description ioc process

File opened for read /proc/cpuinfo com.codernanmen.photorecovery
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.codernanmen.photorecovery

description ioc process

File opened for read /proc/meminfo com.codernanmen.photorecovery

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.codernanmen.photorecovery

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.codernanmen.photorecovery

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.codernanmen.photorecovery

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.codernanmen.photorecovery

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.codernanmen.photorecovery

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	com.codernanmen.photorecovery

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.codernanmen.photorecovery

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.codernanmen.photorecovery

description	ioc	process
File opened for read	/proc/cpuinfo	com.codernanmen.photorecovery

description	ioc	process
File opened for read	/proc/meminfo	com.codernanmen.photorecovery

com.codernanmen.photorecovery
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4254
- chmod 755 /data/data/com.codernanmen.photorecovery/.jiagu/libjiagu.so
  2⤵
  PID:4278
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.codernanmen.photorecovery/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.codernanmen.photorecovery/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4301
- ls /sys/class/thermal
  2⤵
  PID:4342
- sh -c ps
  2⤵
  PID:4498
- ps
  2⤵
  PID:4498
- ps daemonsu
  2⤵
  PID:4523

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.codernanmen.photorecovery/.jiagu/classes.dex

Filesize
4.3MB

MD5
84f4f36d3248ae53247de15fe04663f4

SHA1
187762d8d1e422ab8fdc7c8e8444670cdaf26528

SHA256
e4545587fee537ed66e4d12f7879ff4b07c2a94c4e81d4bc53d8c3a1de5f1fa6

SHA512
f640cce1f2be99dae25711fa2d0027f0862aa349aa156f8a8c019a80266d6ece5bbfb6a69295b9568d63448f12925f2ce78652f689eed6676f3eb50699315d0e

Download Submit
/data/data/com.codernanmen.photorecovery/.jiagu/classes.dex

Filesize
6.8MB

MD5
d290435d6e1a23d8972af1d041c079aa

SHA1
84e99cd6aef25a81c5c3385f899c2d7200870dd0

SHA256
38175d2c871aa5b94a87fc14440795e4efd5d143bafa5803af093d3c2b4c3114

SHA512
30e2445adb26e34405e0bbe3c68a3f7d563702624d3665746c8502112e5f9af9a01f7e1970ee995a599f977612aca0104c37591565e83eca2dc52e8a4d721ac2

Download Submit
/data/data/com.codernanmen.photorecovery/.jiagu/classes.dex!classes2.dex

Filesize
920KB

MD5
6948585d3f4628da8fe4b11f7e2eae91

SHA1
59f67e685139029f906abc0c8b275bdc0971ba57

SHA256
1fd78d38c2f68f5bcca42757e890b6ee27742a71ee602c240cfe68a9160b56dc

SHA512
319cd3ac5fc862947dd1e0742a0774313cd7934810d7417b01773f23ebdc6d2a796b5b9fa8d75fcad238a7ffbe73eefb7bd63445dd9108dc9f2f038b17a901bd

Download Submit
/data/data/com.codernanmen.photorecovery/.jiagu/libjiagu.so

Filesize
455KB

MD5
e5a53000766ebc433b27d6a66ec4f555

SHA1
2c8f53f1c03aec2005bcad67d731f07261dabde0

SHA256
78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

SHA512
370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

Download Submit
/data/data/com.codernanmen.photorecovery/.jiagu/tmp.dex

Filesize
284B

MD5
f1771b68f5f9b168b79ff59ae2daabe4

SHA1
0df6a835559f5c99670214a12700e7d8c28e5a42

SHA256
9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

SHA512
dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

Download Submit
/data/data/com.codernanmen.photorecovery/cache/image_manager_disk_cache/009c0c07b3d78e6cca1fa14089146abb2ffb23f538b6131247c3e7f88f643a0e.0.tmp

Filesize
91KB

MD5
0e530f5309bb43ec05e73cd0806c7457

SHA1
5db14488334b1e96f2ad5b0184df744d6344fa2f

SHA256
ef7b993d5d7cb7579f87414aaa14434207710a4e4f17b7f9a38e3aca152c3176

SHA512
83f8909e884ba117b9d435a77535758d66b0b476a65cd5a322969723fa4b747d663599e8cbaccc889db66d55182f40bacb9d5b4f9c937a13942efc396606e8b3

Download Submit
/data/data/com.codernanmen.photorecovery/cache/image_manager_disk_cache/1a82baf5d0ba4058dad02305b49c049d5d4989e0bd362328d781669ac82594e7.0.tmp

Filesize
78KB

MD5
406ef2ce7ac62965b770891ae98277d0

SHA1
c1df808b7c8f57aa6e562e480ae10630f750b466

SHA256
701b896c46bc0b46cc1ff6449812f3fb7741927de51c89e101d38728fc952328

SHA512
c05116207fc3818d0c728616a7de981fc8b651e17284eea15b6c414e1e6e8791337a28144fc28f6decdb4a91cf8d1021726d45681330c5470885e8af67a3b02a

Download Submit
/data/data/com.codernanmen.photorecovery/cache/image_manager_disk_cache/45647678c1a1af237b30dc7b70c3972b5696db74e932d68643a8fb5e28389db7.0.tmp

Filesize
54KB

MD5
a9c2c5153578278a469827132aa9c7c0

SHA1
2d6ee4092135b92d5dc085f1991e5801224a1279

SHA256
abe8000702cfc0df5be337b2759754f677e3238194187644fe542264a6881abd

SHA512
868ed2ca774ac66bb78dbafb3f75801362f7c6addee4f63c830d07e16db8df5971770aabe639169e74ebde7afb1d2c0103bfc58f1b35c50cb3762c9cb0da5246

Download Submit
/data/data/com.codernanmen.photorecovery/cache/image_manager_disk_cache/722d74a3139a9e3f8438f3fa313712010e6ec23ebf0a3b36782296ea5a76da4b.0.tmp

Filesize
185KB

MD5
9469b6afc0677139ee6f377cfed06065

SHA1
3a093f2d13032aa5e36acb659ff44f4e9197afa8

SHA256
7d0d377b95a8f91db18dd83507ada53ad490b877b7e38db995091ef9ce36fa93

SHA512
5fbf5017d3e1f3cf378555f4b0e14800961c331cc32da38b1dfd8a9fb6ac7aee33048f3128e5431d8deffcc8c28d677c5b628d5fc2b6ce8329e10f452267f321

Download Submit
/data/data/com.codernanmen.photorecovery/cache/image_manager_disk_cache/d419d1f879e1bd18886bc4ca847f009dcab6c8bf1d223001efbc52d43740f84b.0.tmp

Filesize
220KB

MD5
eda9942a3aeebc5deabd5caad8663aaf

SHA1
15e0edf7a3d0ab8bc402a75cfbedf5b1bdbf1d7f

SHA256
aae460bd59ade6d462a70d790d00d3561cebdf43bfa4396e941b195f49896cdd

SHA512
c1beb6b9c6508d74375b6b896d653a9d5220b21bd8f42e8443bfd75b1b2385cfe30f60182e1ace9d43972b41e435139e71721ec9545766a888166f2f8ba469ab

Download Submit
/data/data/com.codernanmen.photorecovery/cache/image_manager_disk_cache/journal

Filesize
1KB

MD5
b62bc19819b90e4def5439beef2e7a6b

SHA1
ecc288f79e91c96b95e954ceea1c390e06b0b28b

SHA256
f8f0b70a767442cea98147d2578df2c8d399f4182814c9bb407d93b4556aecea

SHA512
bdd84a636fc4a5c1536a393223b747c3733ffc3f406e7b2ca56c768f31d42f1d660a8b0d8b2369b0a4ebe1abd66d9ccc959b8506c8257e22b9762c5e79128aef

Download Submit
/data/data/com.codernanmen.photorecovery/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db

Filesize
36KB

MD5
0adda9c85a5e4808f5b1b74c0a8591a5

SHA1
5048107883ab1e345af9cf2e6849ce46e0e612bf

SHA256
1e17860bba2bb4e3e92df3890aa6dddc973d6602c71519a15556d37bb69de2a1

SHA512
646061d3d5849772511bd94e36ca2d775a9a672851629d1812942ec0f0f925714eb7d4ebac44889911320cb6710a2f586014f6b1e126739cab653c4f8deef2d1

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db

Filesize
24KB

MD5
bc7321e5c9549f69b70e9ddaf782a6bd

SHA1
123e75a0d04113753f56c5e4f7532d1e5fa3ce63

SHA256
f3912534172edfbd8727082b0d1469b8581222bb701a8c38b41aff6ab22820a2

SHA512
537fd0d6a39dbff659d81783ecd59dd5846d5b57e51269f2d1ecaeb216abfdbaa52772e6d075434793a6c269e0e8762493d78ac0560b271620c285ce9406ca2e

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db

Filesize
16KB

MD5
d380cfbdd39a3e84ec68eb265cf88db6

SHA1
8199e2b136cf6b508764a749b8e0a3380d374c7d

SHA256
93f1460cc9ce36e5333becae468dea4044d7c751d30f56ef90e48806deda3f25

SHA512
866219db44c602f0825b56fc293548adb6c96cf3030f5418142f032571fd6a94919633f0a08940233aa0f9dfc6edefd7c12bf14199823ba7ed811e4e74b94160

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db

Filesize
16KB

MD5
8267dd5ca534c59ec0759126cce40365

SHA1
26ecb148b7ba9a30bf9a8e62aad7086dafad313d

SHA256
c4e5b13154628bc16da6c97c72c166c7a606d3d344273732e0196f2dd0abb566

SHA512
d18c84d3057230c509afaa277b3c8c8e2c468b8c368ce1cac7869cf9dcb5eefe523a67586141448f94051de26c727e52b2ba67a7c827d2a2363f42813ab11466

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db-journal

Filesize
512B

MD5
94d769f114ca42a839c59a7339c4c802

SHA1
cc2737f03b48fe7f463361f1c24079417dedbf9e

SHA256
c69a64e7bcc911783445257ac5e2f59ab58f0c9cdef0c0dd43506816a44bc4a2

SHA512
094b7fe862353cdbf39560e84705eedc39472928d43f7a3480943ddc631d276739699c4f512904519c739237cacc70ea85028d0bd81cc8bc69ebbbbcaca60b73

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db-wal

Filesize
48KB

MD5
ddc69994882842ae650a7f6b9ac61321

SHA1
56f5398154913e3b09214e78317bd69b38d4e7d2

SHA256
3c819a9a497b588c92f8e88c927bc21025801c6fd419f9542f698260ab0add36

SHA512
8d762ad3690d773e0dad96556fb8c1974f849fdf76096c5d4e11df4ad4666791cd94a1e72bdfe90d837f70b2d0db03b19fd6f755cc01ea36c3d123b8bb4c9a50

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db-wal

Filesize
12KB

MD5
e5d1a6bd8ef08dd46c4ff62baa517770

SHA1
0056fbe6e34bf10636d532c7aea4d36ad4f38e4d

SHA256
09229a6d1159991901199b391d8287cd28d73d012515a458bbe903b37ad73f30

SHA512
b3359905b4361be4f3449d59cbb0067aa77f0f6ebf3b6dd5982ac5bc18334e8dc15726ffb05041b9e5e3bb14a91e0fedb00ee782ffba1c3a5f5d434de62f5748

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db-wal

Filesize
4KB

MD5
6487a3939a2a299f7d75e938096b04ba

SHA1
0f230394e0444cde6bc1c361e234b9fab0e74963

SHA256
d6097e8ef76cdfd627b30a7774fe114172308bc4bdfc87880b8b08f27fe12a0e

SHA512
cfd4197663f0c08529dcfba64ebd43cb3949c40d9f136a642f2fccdea05d6247cb3b4888a1fd7e93b94bb6c4216f8905c8f923cd2cf46ad81d2d44023516007f

Download Submit
/data/data/com.codernanmen.photorecovery/databases/ua.db-wal

Filesize
4KB

MD5
87f2c326deb0f4dee2be286ed4332fe9

SHA1
829ddd08671e42d1be8f276de2cc8040d5128515

SHA256
77b7f55b41277a4275b3a99d39552102f2e2f727f2d68b2bd3bd1736d394af1c

SHA512
59f122a6901113a478e9047ee590212622bf7624994472d3cbc44e3c72f6db00e686fc4d588b4a9baabee75dc8080c3d8e639cf45faa7dd0390e444c7354865e

Download Submit
/data/data/com.codernanmen.photorecovery/files/.envelope/a==7.5.0&&1.2.8_1732583704944_envelope.log

Filesize
1KB

MD5
c2fc85d6d19721372103443f80a89d34

SHA1
4ddbe53ace50fcb961bd182bdb1ea38b36ff3c2b

SHA256
fc210a83401ca90bea1b30462274318d705068e88b1f4eb3abdbafc737511668

SHA512
7c69a59ac7100be2c4c6937fa8141d33cf6df8f0c8995aac6d33f9ade19e335d875fd2c386542e1c661bd4d0144f5affc702c7c95a0a8ede49c2874ad45791e5

Download Submit
/data/data/com.codernanmen.photorecovery/files/.envelope/i==1.2.0&&1.2.8_1732583709104_envelope.log

Filesize
2KB

MD5
ff816851aa9918caa85d53e5a8aafd57

SHA1
984bea692ab36faf2d7817fed1712b7b02cdfa40

SHA256
f7d121b2c03cf5e914db563e7296692a73f27289dd797216f33eafeec8a6a27c

SHA512
dd06760d0bc370763ddbcb814b9e1fca3b3b22092c6ba8a4a702a4df5a8b687449de457331bbfc84c6338055d8c9a54947719507f7af88a5a60204f10628a08c

Download Submit
/data/data/com.codernanmen.photorecovery/files/.jglogs/.jg.ac

Filesize
32B

MD5
235bb7cf80ee889f86a3853411bde78a

SHA1
0a89c41fde4d9f8516de52e27989e5b2a8e36703

SHA256
ee9c265986aa6d28a708ef017f2253fe19ab78d5ceb00029432f07371a152cff

SHA512
04c1cc6aee97aa3edc682616baba4f7af100ecd66a9d730d528c9bdaf0ca0befc3f9ea51327201f9072380381c9a7042fdb77f9e71cc6b9f5067948af0ea83a2

Download Submit
/data/data/com.codernanmen.photorecovery/files/.jglogs/.jg.di

Filesize
340B

MD5
759198b7b9121100c2f24af4634d2988

SHA1
26998b026c21ff31346f18ddaf4910c3f0152225

SHA256
91e93e71a3855b1b1988a5ee47cfeb106c3f83fdbeadc25bce3890f8901499cd

SHA512
2cdb4cf0bcf5eaf22ac3c23e0f8785823686f410413ec4e8dd95e725ea6bb3bd2ad1a26f210833b7d456871a4aba7604eb7be85c229b11c1c97fe330c8a9085f

Download Submit
/data/data/com.codernanmen.photorecovery/files/.jglogs/.jg.ic

Filesize
32B

MD5
257f344c0ac7e462da6645e3cc70b914

SHA1
29755973b72fd65e96f92bfc5110988ae235a003

SHA256
663bfa9c576434d467cdf25320de126461fba73db34aa036c1f38769572a96ea

SHA512
f8dfbdfff80a727daa98d28a9dd2493e5f23c6b9ddfb8fc2fa3e42b1b39b686e2ae010573e27de0046b525a35c5d719f41fc082b6fca84aa5d13459c0c035582

Download Submit
/data/data/com.codernanmen.photorecovery/files/.jglogs/.jg.ri

Filesize
314B

MD5
7494903ea008644aee4783e6fbefd283

SHA1
afa17d5708c44dd68559470c20ec7273bf6cf081

SHA256
5ecd608a9ce3cc6695426f51261e5bd32e96a7f2c5847161ee1daf8e70233816

SHA512
f31f0346c5488a7f92c4d04ae7db0e5d7402cc1504066f38da59ce51b9f662f9d3735e0efb8828bfc128cf152c4a39337b1e9b0b33eea89881b87413fcbf0a17

Download Submit
/data/data/com.codernanmen.photorecovery/files/.jiagu.lock

Filesize
27B

MD5
05e0f57f942799d9e9b1511962080aea

SHA1
068ea34a94a2d721a78fa797c0d6fe90904797ce

SHA256
31c827414e6bfa9cffcbfd0a765ccd80cfe796a9d74fd5c162b8733a86c214d2

SHA512
18959ed0746d39b5272feb790cc9543f18ca3a652567128bc2d796909954d46cee0eeefd119c118dd2cd8676b0312382adf09309ddb09ec4e0f55b8e49782a10

Download Submit
/data/data/com.codernanmen.photorecovery/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
9db5f7694f8a05843a5f74d5aa99f11f

SHA1
a7fa50b559ea34d3e4abdda62514762469809372

SHA256
93808d0eb655469a6cd1a8061ba47e768856d5b1cb2ab8c0e730170d9a83340e

SHA512
a96279eeba8bb17f0edf3cd268f1ea16ebf94dd43fd4ef6a285f848eb01ab614e7dd47c17d619ff11f7cb1da2d9af8dd501912a414e8bc868d9e1b4683988486

Download Submit
/data/data/com.codernanmen.photorecovery/files/exid.dat

Filesize
54B

MD5
1ec9f0e58fc3c9b6f62cd723830cfc26

SHA1
cb47a2a36d891178bd818bc972484400ebfc8321

SHA256
b4c1536890d1dd584f870afdfc95c54ea0092ab5bb82a9cd57770a564aaaee3e

SHA512
2264bf78576f91d6996597e074ca03e2ff2e035ffa764f38b7efe08e236da07dcf795503ab83662b4d81773dbe9990acc52712d9612dd7635e8118379c2d6e62

Download Submit
/data/data/com.codernanmen.photorecovery/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzMyNTgzNzA0ODk4

Filesize
1KB

MD5
5c63b93040e3664b0a0e85ff4186d0f5

SHA1
5724f6522a7dc74457c69f28688270a462c24b1f

SHA256
c867e6ee6d047dec186b40274d9bcbce847886a7e2cc300b7ec7870efb90c3bd

SHA512
16df96ed571d55c3959e33a1f4b9a0b3f0129dd7aa719f3dfd36f8fb93c75a3739f2624b72b443597d8627288ac268ffb2524552ca8c4155f5c2b3bc926bf0d1

Download Submit
/data/data/com.codernanmen.photorecovery/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzMyNTgzNzM1NTQ2

Filesize
1KB

MD5
40cb79b823b944eb5bfc610b7a08aa79

SHA1
cc89db939db633ebdfbca099ed64253314975561

SHA256
bd71818441ca1d5b1add2cfb8f824500e5eb105558407c381fa02394d770079b

SHA512
af99f9fd3e97adf0d8534abbfa678cac055ba77a657402aad062f5c479a7573b5b723cab18d759249b347e8d38de3baa4c6db4d864172ad73e4f26c8b091f615

Download Submit
/data/data/com.codernanmen.photorecovery/files/umeng_it.cache

Filesize
498B

MD5
4265e52b1ff532f62e2a62d46bf45ed2

SHA1
ca22da8b2c679a5a7a7ae0a87d9d175582f0a909

SHA256
c8af0066a94982997b846f8719945d361873682a45fe7049fbbfbb2ac181b828

SHA512
0d19368a02d621f10b3d1aecfbc38f6e984d292850ae4c5b4b68e82c6408c9ecd72fdb7e6b0d86bbcf666944ecdb658f90e3b1aab985b626317b3c4b5757bb79

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
111B

MD5
f610f4e2d6106c619c2e960bdba39e7a

SHA1
96a945bc09c4d3d477e81e006ca5c6c17fcd564d

SHA256
e30d7bb1bd9ec573902ee9037857665b6c1eb05839f4c7173138d2e8454b5ea9

SHA512
1dad022c2ddcd351f36965a3176b6c256aba2e9a67c98edd97688de2d79426c784ecef078b1a82ad82dd5f95d17da8f2c3f55a5acb80b117aa9d38e8482b801d

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
213B

MD5
d9c0ed56932b8adc1d245ba28d855eed

SHA1
a8a79a41f4380893405e844e6c1bb878625c74b3

SHA256
f4fc96113be9be1e8b946c6a39dcb3825ce4cc5bad16c606d5d7bfb38d54730c

SHA512
e28ba0344a21a5933738559a04e66a9c3b2280e6c772cdd3994385a075fb967a626c5ba78ce5ed54adeea0494232b473e3047f87115d9eca1fd34443cafa0a0c

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
111B

MD5
2c0c826d9e83a4c18d028dfdcbd7ea8f

SHA1
a90890f611737449449119004a95b796d8cb6cb8

SHA256
5a4b4b262117e2a38ab0c9ee275999d31acd8474ca42b46c842f74d9b582f465

SHA512
203af619223d6bbf7c2e48e63c4e028f28de39e334aa1a10e269bef1bafd07515b475345bd9983bd2be62e3da2a55059f82464a1c563ad915e2d08211960bc04

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
167B

MD5
65cda7fe593d4c46a9a762109c30d532

SHA1
811a9caf390990977db19d991583ac10d199c9c2

SHA256
376bbc3f22a825a6e8234d38d83588ef589174d866998222458a563caff513d0

SHA512
d13ff30cd4b3c8fbe52c5ac440f0449a162c4a8b643ff914b6a7c8998af446c091ac21fad35e1b9d202ade77dbbbe448cb703d6da2561b0f89c7645381781b72

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
48B

MD5
1d8d16c4e3b19ebf18988530d9b9a757

SHA1
bc94c1cce05cd848a53271ecb9c5311e27ffebf5

SHA256
abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

SHA512
4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

Download Submit
/storage/emulated/0/360/.iddata

Filesize
32B

MD5
b768f046a2ae4fda1e1481b5c0ef1641

SHA1
05c55fcf6a372b940bca2d9b2caf80a597ca53eb

SHA256
352638a944f10e20d63fab74f82cdb66fe601be36c0cb73499c27ab2be376a46

SHA512
878d2d9676f24d997114c26827adcad7b883de0130fd6506774613939cae3a3bfe42185b1c977d8784826986feab904811cc54b64ac0f8a811d79cb042324bfc

Download Submit