Malware Analysis Report

2025-01-19 05:32

Sample ID 220928-kbqnrsgedl
Target b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52.apk
SHA256 b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52
Tags
malibot banker evasion infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52

Threat Level: Known bad

The file b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52.apk was found to be: Known bad.

Malicious Activity Summary

malibot banker evasion infostealer trojan

Malibot payload

malibot

Makes use of the framework's Accessibility service.

Requests dangerous framework permissions

Acquires the wake lock.

Loads dropped Dex/Jar

Removes a system notification.

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2022-09-28 08:25

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-09-28 08:25

Reported

2022-09-28 08:28

Platform

android-x86-arm-20220823-en

Max time kernel

2201368s

Max time network

138s

Command Line

com.gdwicoopc.mlwmelkys

Signatures

Malibot payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

malibot

infostealer trojan banker malibot

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR N/A N/A
N/A /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR N/A N/A
N/A /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR N/A N/A

Removes a system notification.

evasion
Description Indicator Process Target
Framework service call android.app.INotificationManager.cancelNotificationWithTag N/A N/A

Processes

com.gdwicoopc.mlwmelkys

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR --output-vdex-fd=42 --oat-fd=43 --oat-location=/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/oat/x86/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
US 1.1.1.1:853 tcp
US 1.1.1.1:853 tcp
NL 216.58.214.14:443 tcp
NL 216.58.214.14:443 tcp
NL 142.251.36.42:443 tcp

Files

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 20523fb5f80852f7d03b9ca83d6d62b7
SHA1 9423b1f76829b6052918e6346b58fd69782612d1
SHA256 dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4
SHA512 0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR.x86.flock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 20523fb5f80852f7d03b9ca83d6d62b7
SHA1 9423b1f76829b6052918e6346b58fd69782612d1
SHA256 dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4
SHA512 0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/oat/x86/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.vdex

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/oat/x86/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.odex

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 20523fb5f80852f7d03b9ca83d6d62b7
SHA1 9423b1f76829b6052918e6346b58fd69782612d1
SHA256 dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4
SHA512 0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 8f0101b8896c699c16acaa37a7343f26
SHA1 34b286f4121088c085e89411ac54a44691bd3e68
SHA256 6396aa51da3ec835e4f26697fbdd18dff5499878e27264a48221de05aa572aa9
SHA512 ce4ccc08254b228c498599cd1bd701ed9e248e66cda81ffc9115b062c461d9944d2fd2f9d9c90f5ceb7ee24db2d092d9a299efb00cd9020e545313d20a650af8

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/WebViewChromiumPrefs.xml

MD5 21223e9184445fe043476484cd8cb1f9
SHA1 2b4813f849121d60ba35eb0889080668bb62c778
SHA256 bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512 be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/webview_data.lock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Web Data

MD5 dc79f9ce5f3ab5270b33e61119dfc959
SHA1 1844bf222a5144b513dcf2fb50a18c011701c647
SHA256 47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA512 18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/metrics_guid

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/metrics_guid

MD5 2b384e14df744d35c4732eeecad915c3
SHA1 cf7273499c7ae37bea1af8b3e52bd19dea5d8e65
SHA256 4f43711078c05422fbe7d073775016af02a162e4c11097fe407391291724d743
SHA512 137a20f1bea19880e6caa9606042c430a7d2c3d89c79064afb6fb9b5aecdf30af6ee1a73a74c79601afbd35d1ac2c3ac43422db28556299935c0580ed32be744

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Web Data-journal

MD5 6c77829c77aed7383b6b5f837cb3b6f0
SHA1 a5660d28cbd5ff832b2de2fd01791daa1e2ffe34
SHA256 fa19737d9b34b27e27ee0a54f3f7a0a4df58f0b38c362013f19806e94610ba1c
SHA512 4db50a42bf5eda3075c80cce6584373d3bde65c41b938763c8f3269e884e893d63e94c768ccfd9741767cbfdc96e261c7eec59d55dc008dbeb9ba46559d1afee

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/GPUCache/index

MD5 93027d42b314432c4216e6cfca48b384
SHA1 43448dd8102979c3926828182579691945eedd4e
SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512 a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Cookies

MD5 cb7543c4df600f2af58097cce0e334ba
SHA1 83cc92f38c27fdb4fa519b1ce2f37912f24af1f0
SHA256 64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233
SHA512 ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

/data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/app.xml

MD5 5535ae3843517e6073e1642921beb1ed
SHA1 868e60832ea64690cb818624df595ddbd17cadc3
SHA256 074130eabfb009728aa65a15e3edd9c1014be0fcd761dc970163360444b7a4ce
SHA512 57b45ef51c396baad839ed4416537528d3385d260b3e598339c2a240998c33dd705c930a1178309a5cc2495f298fd0161997472f5cae463c22a1bcd74bd259d2

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/GPUCache/index-dir/temp-index

MD5 f277e7b480d6174d3425402fc1df1029
SHA1 3d0da4312fbefcb89551ceb481a3537b36c57f72
SHA256 80cbe1e3d9d0193854af9dd00b578ca7251fe44fc037acc0ce2a1ffcaf0157b9
SHA512 d993a9bb464ae67a3def3df8dc1ea35fb9c8604491a0f165f0267e74dee6966cffa1d2a05cf53f4b032875bf164fbbec29e24f61863d05a4f5b9302503ff8365

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Cookies-journal

MD5 cf14ccaf3bb836cf1d86abcb44b3038f
SHA1 ee27ca62753358ff6910c96e02f19a8012dd7e40
SHA256 bddf83e2a831dd95bef09b4610f0e85ddec0995fffec276734ea7186ba542468
SHA512 11164d811ffccbcc3bca95c6f8f1e685c74d975aa3d28fbb3755ac096b7daeedfe12bed54a7dc2f97d2cb1e4d1f114c17a39ab769b5693df7cc227a980aad5ae

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index

MD5 93027d42b314432c4216e6cfca48b384
SHA1 43448dd8102979c3926828182579691945eedd4e
SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512 a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index-dir/temp-index

MD5 28f0d5494842e4b8a34729694006d507
SHA1 a101f603236773472caddfdce76768105c486d2c
SHA256 9f04bf29517e6d0ae2f0eec5d402530180781abe3e7b82179b6a370e3b0d7595
SHA512 a6878e53ab3b35475da6c4cb68182803d8827f4a7bc02cff3527d34aef3f272c27da1c54c90f28d69d7a13a499e114984478a8de3d0657ae276bacb09fbfa1ac

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/90a55387e95cf3dd_0

MD5 fa1af7073342404710f39e5a950c29a7
SHA1 98d43655c18be2943910ce398dfe0cbe1c85d5f5
SHA256 8e962d5e0b2f6cea75abb3937eae09c04c2f7bc0142f31ad5711434b1cea2641
SHA512 e4eb93155fd1f164b217e664580e3a9a8be39ca88066e5c7472a76a30a9ab32a8733e7c5df255d2e44cf78072a9540584c63a0c06520982fc05f2038eb1bbaaa

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/f3337cb1992247df_0

MD5 446fc19d58a370f60f0cce237fa62c21
SHA1 7a5925cfc4ffc3c889ed1c9457c6a291917b1e6b
SHA256 c5e05dfc9119126e6b7e71edd27bcd5fc544e2a6886e9218c9eb8eba64610d51
SHA512 311ea799628faea00ead7a67c9f0a446b21d19bdcd4105af88cb592723ad03da1b71758a8b94f05f0235a2877d49f6fc7aca5526f7b58d61addb4ed4ed474774

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index-dir/temp-index

MD5 c8f8b8fc26c1599bbc1da6923a00e9bd
SHA1 31fd86e588638bef009289a2527dec7292b1a784
SHA256 6b72ed6d540bd3fe58a83133ff46c16c4ad8339f987dfb1837c769ffafefa45c
SHA512 90bbcb03ff145a9f13f8ae1f9ed453174b07f1c79901a209be8d2dc652902abb15599e97bbfc4016ec43a379330324996f2c0e9f70b717d5405e28c5b15ea089

Analysis: behavioral2

Detonation Overview

Submitted

2022-09-28 08:25

Reported

2022-09-28 08:28

Platform

android-x64-20220823-en

Max time kernel

2201371s

Max time network

157s

Command Line

com.gdwicoopc.mlwmelkys

Signatures

Malibot payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

malibot

infostealer trojan banker malibot

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR N/A N/A
N/A /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR N/A N/A

Processes

com.gdwicoopc.mlwmelkys

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 socrersutagans.site udp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 ssl.google-analytics.com udp
NL 142.251.36.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 android.apis.google.com udp
NL 172.217.168.206:443 android.apis.google.com tcp
NL 172.217.168.206:443 android.apis.google.com tcp

Files

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 20523fb5f80852f7d03b9ca83d6d62b7
SHA1 9423b1f76829b6052918e6346b58fd69782612d1
SHA256 dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4
SHA512 0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 20523fb5f80852f7d03b9ca83d6d62b7
SHA1 9423b1f76829b6052918e6346b58fd69782612d1
SHA256 dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4
SHA512 0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 20523fb5f80852f7d03b9ca83d6d62b7
SHA1 9423b1f76829b6052918e6346b58fd69782612d1
SHA256 dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4
SHA512 0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/webview_data.lock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/WebViewChromiumPrefs.xml

MD5 6ef709b8536878951e87c29a1518fc2b
SHA1 24376c70b00152501b3d98df61fa7db435339172
SHA256 10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
SHA512 96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/metrics_guid

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/metrics_guid

MD5 e5347b971b934fd43543f299b047a7d4
SHA1 9332dee55cab12d10a8d1be54329ed41ad9f43e1
SHA256 f54dc8c9ed129e2de964c994cf943d816542bfb21dee3d5376e5e32ffc6a6ef5
SHA512 26a38dcf73da48d687d26b707f941cdeee20ae3df258dbd371acdf050019e25707d8281d9ac02993624a95166b026fce5073b26ccbdb3a38a6a0227eae0cf31e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Web Data

MD5 b663831f8cc130493476d94f2d7a5330
SHA1 043a1956ab8e40821d67043f8a9110a8eb36fb93
SHA256 c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
SHA512 e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Web Data-journal

MD5 1f49d6b0bd05e41f98a2ccaa84ec547d
SHA1 8bee2163fa24769b7b362e2aba00cce89057714a
SHA256 789e157dbde37738d75e77cda73185e4182794d924ea6cfd8dbf1ab6bafb98f6
SHA512 bcf372489a3b2a3b23f4b94983e4b0560f6accdb816a47159d8a17898d3bb5430003e7cd958b739c828176a524d4a2d0f4ed5fd2be382ac98b7296352875c70e

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/Code Cache/js/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

MD5 314f90b7f00e4154d789870811f7d0d6
SHA1 a1dfad934a041a42e716330e48bb118e554ed57f
SHA256 2ded1e391c84fe1bb8f3b61b7132853ac05a7c0add5198aee0ea2110b35d71e4
SHA512 8d2cc3baf8d305129a2db5e4c9122af6e9608a461b518fa8e15f0333672033c69c9c841d2ac0a5e933500bbef6a2d55114bea995ccbf636a673f5e249c7e8d40

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/GPUCache/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/GPUCache/index-dir/temp-index

MD5 e0798fae5defa891c3d26695111d6f3e
SHA1 a4cb64a8e1ae7fb19caec5b84ad52f14606055cf
SHA256 1c2468d123bbc74edcafdf4a5fd3c774d9460ce72dc30982a8ea9bdac5ea0836
SHA512 57b5e5991fe729d1ccc88d36da7a4bdb70b603d8e1c5950fb1c11819f1e0acffcbc8d545fada63819147d0785027ff48df0db4cae5669e952f98131b66899a7d

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Cookies

MD5 9b23e6a88d5a95f155f205cb04b93cd0
SHA1 b62dccbbef087a0731f226b96d15d35d8aa5e5fc
SHA256 f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857
SHA512 bce5f25d98e2e8296c4101b62082dcb6a43902f3431ff6f725e41be6b9aece76e887ef94c4818baf4da845708fd76fd51c37fb6915710c870647593868f27482

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Cookies-journal

MD5 2f5d22d520d7b94549b86af519fdc790
SHA1 7ad88020a1ab6ac3b734b944805d2814258d79bc
SHA256 fca8f5252eff064d4331765dbbdd552cffe7452c2f61350123b11d24db5f7e2e
SHA512 eab86ae689e52a6b105d90fe1f498c0080d3e9a7315955c26867b75893369c5545940de7d9589de31c65e5eba84e6b03cefe4f26ebebdea0cc9582e7f9ebea77

/data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/app.xml

MD5 34cfb8689ac2e07222398a7f8c2a5409
SHA1 f344e34b44c9b0e5988d57b98e24eee633f1f784
SHA256 408a9d58aaade561ec8a541919f4704768458775cff2277cd7c91cf2aa71b2e1
SHA512 f4d3e5b9d614e23558ff36645a89a1661bb2567a9480146f198b1e85c4e6d4fdb59cbb0312c74c8fa9fe27bcdf017be1fd11dc52a7c5a2e3874a338b8d5f307b

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index-dir/temp-index

MD5 548ceaffe863ffe5419e9cf6f50c0dde
SHA1 aa919730e5f2d6cd252d9f52d5ab829aca5c0e6b
SHA256 eec6f55f47acebb54f67681f9ea8363d694a0a13eed567976cb05d7f103373a2
SHA512 a3940e0c7f3018b3e037251617c1cfcb74c095ec1510418be1d11535c1cec7c4e8ba499a487af12558880cd0f4d9be7f679bc59b6a5a4588dbd5ebdb4786ff50

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/6f618348479ca997_0

MD5 e9795547cc00ae409411e82ca1903f10
SHA1 5ed9899380d9cd15f1f500a45ede21ae652c162d
SHA256 585271e019a36961156dbee396c65fff31c87c30b59b082607958f8b7aa31a17
SHA512 ed3f425bb718a2636c3df681d25772658c0eef8be19506a5741fb16f543e09fbc70d25f45a8a3980a2f5c7b35b52c6f7333d40bac32a8c0641ca955966367e7d

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Crashpad/settings.dat

MD5 e5d10812438f9e4e0bc0501a0c702e3a
SHA1 a476985a93f11abe5139d2d1c3dd21ac12dc924e
SHA256 0ff7c0b19fcffc63200904c5407f60030e37efb2bbb730e20d8f3e388cb4ef24
SHA512 7a38147197f2a974df6fed78912d34614315a328464db80c5f993845f28fd00843db1758abf5192627029d8618953f9c5e560e09a5ae2dbf5b32f0be41d046cd

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/6f03d1e54403232e_0

MD5 4ae4e2a79baa13acda809fc8e2813945
SHA1 de74bb7635c0dff0959a0a1ab18a4c8b9b7a0f88
SHA256 d0b914732b5c3470250eb7816f58653d3a5c979eb83b5a361480d6bd2cd9a51b
SHA512 3aaf704bc65ee5cfc7026a920d1dddd9143b10b5f7edb17964094fdb81e3a5e4fba178987c6373ffcfad2d9e96a07d30ae647a3863c7d6005ef9c77a238a8e81

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/.com.google.Chrome.CZ5rwM

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index-dir/temp-index

MD5 6964d14eb271da652cebbbccc6f6e141
SHA1 9e07b42efb6c9626b95d0737e3fa8ba4b2b69be9
SHA256 a425608560b36fb0d8dde0dec2d44832f916e6a64c634443c50eb00b69c04c1b
SHA512 148df55095530eb049b0ef899e5dcb4843e48f8b39a300fe8f3994bc56164c92f5c559de0dab66032dde64e24d8b93d21d8fe7d63729d5ba2740dcb9aafad890

Analysis: behavioral3

Detonation Overview

Submitted

2022-09-28 08:25

Reported

2022-09-28 08:28

Platform

android-x64-arm64-20220823-en

Max time kernel

2201374s

Max time network

167s

Command Line

com.gdwicoopc.mlwmelkys

Signatures

Malibot payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

malibot

infostealer trojan banker malibot

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR N/A N/A
N/A /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR N/A N/A

Processes

com.gdwicoopc.mlwmelkys

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
DE 142.250.186.174:443 tcp
DE 142.250.186.174:443 tcp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
US 1.1.1.1:53 android.apis.google.com udp
NL 172.217.168.206:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 socrersutagans.site udp
US 1.1.1.1:53 socrersutagans.site udp
US 1.1.1.1:53 socrersutagans.site udp
US 1.1.1.1:53 socrersutagans.site udp
US 1.1.1.1:53 socrersutagans.site udp
US 1.1.1.1:53 ssl.google-analytics.com udp

Files

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 20523fb5f80852f7d03b9ca83d6d62b7
SHA1 9423b1f76829b6052918e6346b58fd69782612d1
SHA256 dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4
SHA512 0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 20523fb5f80852f7d03b9ca83d6d62b7
SHA1 9423b1f76829b6052918e6346b58fd69782612d1
SHA256 dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4
SHA512 0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

MD5 20523fb5f80852f7d03b9ca83d6d62b7
SHA1 9423b1f76829b6052918e6346b58fd69782612d1
SHA256 dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4
SHA512 0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/WebViewChromiumPrefs.xml

MD5 97ccd9a2b2063143df56b6937f961ca4
SHA1 5e78a91ae5df289ce83443cb7d5589dd3504fb5d
SHA256 248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd
SHA512 86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/webview_data.lock

MD5 6796c3c20277a3c0634772133ad329d8
SHA1 10bb89965b05c64e3a2845293ea106a20979b2a6
SHA256 f0ec93301a983c1786870435eb12b52d47c425c926a5a2c6b4944b48f9ebd921
SHA512 efdc5bf5d14a166611ff0971ce2614a1553feb7bff5211696b020eb52e389eb798d8ffaa62d3c205c2e392fc9e3a1e5f0c92d2c19d0c1708b6f4a98acce8ba36

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/Web Data

MD5 a48cd9324b1f8754b07f00d863b840f3
SHA1 11c6614775b35a58f440971dfc87c8aaac6d6173
SHA256 8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420
SHA512 35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/Web Data-journal

MD5 d55a683d698995b59107987fcb8082ad
SHA1 f8a5d4c0e3cf2fcbc3bbb1b16e7238962cc339bf
SHA256 69fdbd56fba377c6575d156fb81f4ed97b4f61d172c91e91457d1c19656d01c6
SHA512 50afb3da1197245c38695c075f18f7bc1c339d5849f360b36caf81527bfad2ab1d2ae22e9de41fa5e5db0883c52de1327f34949934c8eb94259fed6bd526e6fa

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/Code Cache/js/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/GPUCache/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/GPUCache/index-dir/temp-index

MD5 6d1aa65dc9dd0a50fd08aab2c1a70862
SHA1 bcd84c1b5d72b9151b80937bc84cd9cf03e53cc9
SHA256 a32915d68973205f92f4e36f1dfa7a59c23356d0aac11326ae0197bf3ed090ed
SHA512 2a22c272eca283a0ad638b3f750b9c084798fd4e341edf9b5107ba5ad7ce03af01970d9d1988e92ab84803fd9497338ce0b76c3544444e8405dc999c858c4151

/data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/app.xml

MD5 d36a3608c933b8a7f65fbf71cff83789
SHA1 a371a9617b8847cd13aa35fee53dbd042518563a
SHA256 617a5b8815357a4caab0b9f9d4d1e618709ef89ad7ce5be824e8cf5d181cadd7
SHA512 ab53949f41db9e21dc73271dbd0807b503894b7e63d1584fbc85d05d6cdc765997dfe112015913950ff9f10063c813a9cb0b916cb6df44ef5f481c8361a8b5d4

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/Cookies

MD5 dfb2098ca7b3bf16d6f5f1e7d3839af5
SHA1 ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d
SHA256 e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224
SHA512 fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/Cookies-journal

MD5 d605a14976357c4f86e2177b7f448c0e
SHA1 4d8285d1d3a022bbd2153fcd9bcfe567b14db424
SHA256 a220f04752dcbe5dcb8eedf2af5e79e6b1008ad7fa9a83de0e328fa788e8731b
SHA512 59dffb488b094895c216b9503ceb41aa3e4eed8326f7c40d02654f832cbe7ea4b6997db746df3fc9a819d90c3051f5c611a3be4b806261792d2dd0a0ae2cea73

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

MD5 19d9f2cb1f260b03bb026801934655b4
SHA1 8c4f4d73d0b8604c4528e4ae027d3a8b070baed2
SHA256 04555b1b8d23c9fb4c061d0f5e8696d402c2fa5ff10054fe6485c03d8335a07a
SHA512 4b8ad3a086175968d1f5184a5934e970e30dfe04b493939394632ce703fbd014913cfcbc7ca7794211759b042c3f29dbc3f8ede0caa8a9f7468c75a4f7ac6aa9

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

MD5 7a8602a45734b55e19d039be929cd43b
SHA1 5a1baa76f12f8dc3c690fe7dea7d6808b0304b6e
SHA256 3070c5368d6b35bd3bf88f2a38a9b98e9c1d4623f386174c34f14e4f2d67cfd6
SHA512 86075e0e56de350e4ea17ad08d63c4c5018b6b0396d5a20bb37320a09fa85ee2f239de4da571369cba685d65edb9bda5d5c5f5429f776be2ae34c5ae1c9de57c

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/566d3a0f1d25ddab_0

MD5 501d9efdbff4642458b7b7020f5ab69e
SHA1 ea10d4eb985b9e493356648b1aa9241cdef2c7b6
SHA256 10551277a8e54f50b2176dead5e9cc3356d7ea9cf3799438a6f5fe3a15f3694f
SHA512 baf371048ab5f07c14d37f42d82c452dd3a3c43f31bee9d2f2914c5e7c0ed7fe0d3e28c5af91dec917bd85bd98669b8b242b268d0395038233fff6c61013c90d

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/index-dir/temp-index

MD5 064c2679739550cffcbe8f7356638d04
SHA1 686bd6fc2a1218527d66022754ef2d2390a2f36c
SHA256 9a5a9b4296fca16829bddf57e5a3f9c226e4c912b58c095dcab8c1b920fdbabf
SHA512 aae97ed4cf7b4615feccf9248d5f2073afad11dd77667420114f7bb1f72829743f66e5b98cd7d76c9327826be4dd09539c7fa48e7954a697704096ccca0c53ae

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/font_unique_name_table.pb

MD5 f080fa2a56ab5479d58063e5ea871447
SHA1 4b3fd57a98916fa5784305b76ba30af26b5253d9
SHA256 0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815
SHA512 8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Crashpad/settings.dat

MD5 3c85285a9080d6d4e72bcf5bc889cc75
SHA1 9b3daadeabc051743e8103b0444768d7d4118b1e
SHA256 6f878e6adbec3080205186d432708c10c2ffb4f20dd58d2d09a854b71495d4a9
SHA512 141cb181daeeaef1ceb9d39af76c250226398b716327caefefd4ffa6c1894a477179b2179699625e2dcc9e401152a5bb3ec1a43d6f51f0dc6ad9f60d024ddd7b

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/b2b5ebb9f16e4982_0

MD5 0f06e4d83626b37df54b7e24157d91d7
SHA1 c521f7e95dbd37e9f12bd7b64b6f2e2948a58a89
SHA256 ee9b4aed29b831a6d1ab15cdebc589af2e5adbed580b875a3593836afddf08e3
SHA512 1919a9510cd3d126a3ac834a8063da506d3f9dae8be5382fed7f868714f4b22b655ea9cba8752f0b7a6773558248a65671b695a93d68ea04867e873d27e3d4dd

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/.com.google.Chrome.TSUcyk

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/index-dir/temp-index

MD5 2bb21cb3d9b77f5e673cc67ac4d3a78a
SHA1 a1a383d577bdb61bb40af7dde544229c0ddb8f75
SHA256 525c1e8b75f45ac29c2d2dece51731aae67ad6e25288f5b6f28199dcf9553a16
SHA512 39b5c785de0d93474fa23308ec4bba8935e3339404c8b93e595b790154e6dcf9f86034f3f09a16d7cb12a60c4f6e3dcc20b469dfb842b7659e12f0b542d6534f