Malware Analysis Report

2024-10-19 12:18

Sample ID 230917-hqa6hsga7x
Target 4edfda2401c48da8c0cf205daeafc7f2ece3044245333062f258961e21827deebin_JC.zip
SHA256 4edfda2401c48da8c0cf205daeafc7f2ece3044245333062f258961e21827dee
Tags
octo banker evasion infostealer ransomware rat trojan stealth
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4edfda2401c48da8c0cf205daeafc7f2ece3044245333062f258961e21827dee

Threat Level: Known bad

The file 4edfda2401c48da8c0cf205daeafc7f2ece3044245333062f258961e21827deebin_JC.zip was found to be: Known bad.

Malicious Activity Summary

octo banker evasion infostealer ransomware rat trojan stealth

Octo

Octo payload

Removes its main activity from the application launcher

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

Makes use of the framework's Accessibility service.

Acquires the wake lock.

Loads dropped Dex/Jar

Requests dangerous framework permissions

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Uses Crypto APIs (Might try to encrypt user data).

Removes a system notification.

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-09-17 06:55

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-17 06:55

Reported

2023-09-17 06:58

Platform

android-x64-arm64-20230831-en

Max time kernel

2716798s

Max time network

155s

Command Line

com.restbestczti

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

banker
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.getInstalledApplications N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.restbestczti/cache/ndyrl N/A N/A
N/A /data/user/0/com.restbestczti/cache/ndyrl N/A N/A

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data).

ransomware
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.restbestczti

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
US 1.1.1.1:53 16logites432532s.xyz udp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
NL 142.251.36.46:443 tcp
NL 142.251.36.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 16logites432532s.xyz udp
US 1.1.1.1:53 13logites432532s.xyz udp
US 1.1.1.1:53 15logites432532s.xyz udp
US 1.1.1.1:53 19logites432532s.xyz udp
US 1.1.1.1:53 12logites432532s.xyz udp
US 1.1.1.1:53 14logites432532s.xyz udp
US 1.1.1.1:53 20logites432532s.xyz udp
US 1.1.1.1:53 22logites432532s.xyz udp
US 1.1.1.1:53 17logites432532s.xyz udp
US 1.1.1.1:53 17logites432532s.xyz udp
US 1.1.1.1:53 18logites432532s.xyz udp
US 1.1.1.1:53 android.apis.google.com udp
DE 172.217.23.206:443 android.apis.google.com tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
DE 172.217.23.200:443 ssl.google-analytics.com tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp

Files

/data/user/0/com.restbestczti/cache/ndyrl

MD5 b0c8229ae4269d198dac8c673aedd0df
SHA1 3b9e5aafa3089f774600882e07a79a827f21e43b
SHA256 84d567023bec71b39488c7bac9a90d4dab05bcc40d1039c7eb6d4acac9163edb
SHA512 4478cd2277d89f6d82a81e858d39e0bc6dbae873678c23befe3eb55bb11a09207a9b34df8ad0d9d1ac7200c70b1252bee0d1e1d9e9a9edc6489999a183a2c0b8

/data/user/0/com.restbestczti/cache/ndyrl

MD5 b0c8229ae4269d198dac8c673aedd0df
SHA1 3b9e5aafa3089f774600882e07a79a827f21e43b
SHA256 84d567023bec71b39488c7bac9a90d4dab05bcc40d1039c7eb6d4acac9163edb
SHA512 4478cd2277d89f6d82a81e858d39e0bc6dbae873678c23befe3eb55bb11a09207a9b34df8ad0d9d1ac7200c70b1252bee0d1e1d9e9a9edc6489999a183a2c0b8

/data/user/0/com.restbestczti/cache/ndyrl

MD5 b0c8229ae4269d198dac8c673aedd0df
SHA1 3b9e5aafa3089f774600882e07a79a827f21e43b
SHA256 84d567023bec71b39488c7bac9a90d4dab05bcc40d1039c7eb6d4acac9163edb
SHA512 4478cd2277d89f6d82a81e858d39e0bc6dbae873678c23befe3eb55bb11a09207a9b34df8ad0d9d1ac7200c70b1252bee0d1e1d9e9a9edc6489999a183a2c0b8

/data/user/0/com.restbestczti/kl.txt

MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/user/0/com.restbestczti/kl.txt

MD5 20c40f660a648d4bc68ac42c37ceb102
SHA1 1dfa876cfec9fb84d7bb03b2502ae8b7745fc48f
SHA256 52e4f28f1ac5e8873a5e16df859958eba538ca25a93d1f1b45a2d4e0c32e5b1e
SHA512 7b3666a163f34056b65aa643654b0eb2456732d50cc2c98925d5be6cb2aff2688927ffc902642fe20c836c2167a0db982c836882ec6c7abcd712f71381cf84e4

/data/user/0/com.restbestczti/kl.txt

MD5 b42b684858d8d087baced979123cdf10
SHA1 cb141bba8dd312bf064f03f2a842bcf60250a4c5
SHA256 f443180aec38db87ed10838db3cb0abed4e10990a74eba12223641d7f151d069
SHA512 e421384c4204b5887a26c081725f93289621425f0dc5d2a149629d80d50907d0d599efe22c930bf019e5aa57123024e3f25dc0b7892539b803ce9856adfea659

/data/user/0/com.restbestczti/kl.txt

MD5 36e505d83549e41aa068372525a33c1f
SHA1 bcbe2b423f9094014f15d52ce58ff27ff83052d3
SHA256 85c39875319a1a2f9b18f509ed6a91606c2814577df21a9bfa250de82043559c
SHA512 e16e4425895b3c075559ac4b2ed27a5bb2df3501d7d709c43d69890c111ff4521c5c40787aedb0ef93c502b1ac821853987f96e6833a9ae08139b67262a81a7a

/data/user/0/com.restbestczti/kl.txt

MD5 5b3aaf92e5a602971d2177b20ac36191
SHA1 0a7190e68660bc5fc71e4f6b054ff4138b2d2ea7
SHA256 63d7cb7f63cc955204a568c2ca7c963146e435357d92ae1bd0cadc178b61b974
SHA512 480a49287feb85e837ede5e29290fb5c154c3bff7b99cc1bb5e1f63f6c1cfeced910483c324dff04cbd7910f6699ac893341f7010ca321a2b82428e3fa6f0d59

/data/user/0/com.restbestczti/kl.txt

MD5 a2327da8df0ebfdde9b68092a240e0e7
SHA1 afa5099d2b1b870f630fa7da1567df8d42f24c7b
SHA256 65b643edbbfa2557a189069b43841be683e277bcd59b2fad6741540b01268743
SHA512 110ff9fe68f4e0a2904c9b825dbe813faec3d1e347c3a81a06a26eb0fe2fb3cad5bc6b1e0aacfafccc18e9a9a66772336cb36bc3e1707b68049c5c3b4b95c242

/data/user/0/com.restbestczti/kl.txt

MD5 9d8fe67c32f9be2467f5e79c27a2ff40
SHA1 d06968ed11ecae98fcd8d9e6dd93cf61e33c7063
SHA256 89b9eb17b3d7af18e032d7c456fa5178112fe41b8d11b46dc368ca06a5f5540e
SHA512 542d96933d045e1e836831ea5f94f183a56619d70904682e410aa98298290c570475d8600372e881d1b9089be778e0b8243b8ed339d7714f943d21c200a713b1

/data/user/0/com.restbestczti/kl.txt

MD5 a2327da8df0ebfdde9b68092a240e0e7
SHA1 afa5099d2b1b870f630fa7da1567df8d42f24c7b
SHA256 65b643edbbfa2557a189069b43841be683e277bcd59b2fad6741540b01268743
SHA512 110ff9fe68f4e0a2904c9b825dbe813faec3d1e347c3a81a06a26eb0fe2fb3cad5bc6b1e0aacfafccc18e9a9a66772336cb36bc3e1707b68049c5c3b4b95c242

/data/user/0/com.restbestczti/kl.txt

MD5 c940e8fb2c998e74515692368dcadb6b
SHA1 964530b254f29763c03748b9efb586e1d8fa449a
SHA256 d5311b79419029b5ce1b44903f8f589094d4f151044dbfcf7cb76d22acf5a734
SHA512 9ced05b74ff3a86ceec4ef8deb220a03c9d8a78008d6e2a1fec721dccc2506f2d67fe3f3108ad54804fe254adc67361304d9e933dc7a11810881bad2b22dfcd5

/data/user/0/com.restbestczti/kl.txt

MD5 c4943c5bf65338e92b66426d2ce545ae
SHA1 140832bd9ba5614dee0e1ee25c0bf94b796607b4
SHA256 4d09520940fe8f6e28209d723b94e153e277340d614212d2325c03af369148d1
SHA512 9f80d4aecd9ca04f95e607e0c9a953f92cc79acf9de5ba9e2d9cca754e35d435b9e9ae024d118fdd9b8c6eb558478b035f7b9d59bece78059b75a975e9abd7d8

/data/user/0/com.restbestczti/kl.txt

MD5 a58394e04b3a4171d9eff4494c3bc7ed
SHA1 c8241b8f8ee593bfcb30f4f547a21f98dda98172
SHA256 7b2284bddeb39d35b78875e5fc410de586dfc2bf6e621bd65edcf9581456d278
SHA512 48889519d7867655344569868f3f1624a964e83cede89816a47f0203c71170810d8d1d9b6a027c41a2186f047b9ddad2e4e7369fdc21054fac097e5f3a8f640d

/data/user/0/com.restbestczti/kl.txt

MD5 b928ac19784d32b251c35b93c16c9e1c
SHA1 b4f0d9f5f4056befa3f502e6108f5f9d126a61b0
SHA256 bc172b6c075a4c5d6a6bd94e5d6d55b2f70cea4ae32faae65080e83eebce696f
SHA512 8d38caf18273e69e9bc8fd8ead84a4bd6ee2e6efad0a04b908698ad6d29c1a17b9dbc878fc26be6755e6628fe053fb5c6e5bdc58f87f99ba9271765dc56a24d9

/data/user/0/com.restbestczti/kl.txt

MD5 a0e21897a42a40309d073325e656ad0d
SHA1 f0df81e25eae15718f82bf7a09128ac67d5e2db7
SHA256 bcef8c1aa6123d242f77099570e90b35e66166d4040f164bf1842c4f9fddcb63
SHA512 12005c7ef82fcdfed049c3c71a5f38764e48b009856fd4ddf63add985b51d90e695d0c49353d5efcedb8bf9c58f3d65d5b3161475c1318d654bf4b513739d769

/data/user/0/com.restbestczti/kl.txt

MD5 b928ac19784d32b251c35b93c16c9e1c
SHA1 b4f0d9f5f4056befa3f502e6108f5f9d126a61b0
SHA256 bc172b6c075a4c5d6a6bd94e5d6d55b2f70cea4ae32faae65080e83eebce696f
SHA512 8d38caf18273e69e9bc8fd8ead84a4bd6ee2e6efad0a04b908698ad6d29c1a17b9dbc878fc26be6755e6628fe053fb5c6e5bdc58f87f99ba9271765dc56a24d9

/data/user/0/com.restbestczti/kl.txt

MD5 9c4aeca0a65db23d72ff3e71dfd7fc33
SHA1 350d59246d89876ebb71a8ce6a6b34c664816fdd
SHA256 100a522943b7466e79ed30ebe8ef78879dd6dfdbefd1ed173ccf0959738ae831
SHA512 12c215567be30d4023b082b4d66e982216b8181e93c35f5c53711944d185899a89f5533b9af951c64827d3251c86553fe7b656fdbf88cf7a3a9edaef456f3fc7

/data/user/0/com.restbestczti/kl.txt

MD5 9c4aeca0a65db23d72ff3e71dfd7fc33
SHA1 350d59246d89876ebb71a8ce6a6b34c664816fdd
SHA256 100a522943b7466e79ed30ebe8ef78879dd6dfdbefd1ed173ccf0959738ae831
SHA512 12c215567be30d4023b082b4d66e982216b8181e93c35f5c53711944d185899a89f5533b9af951c64827d3251c86553fe7b656fdbf88cf7a3a9edaef456f3fc7

/data/user/0/com.restbestczti/kl.txt

MD5 53890c5daf7441e77490c465b4cfaba4
SHA1 995c2240a5c905b5429cdb67f591ddf48ac30f3c
SHA256 1c1ff0e736fbec30e777276e2e818af6c620111752a53aec3627e5aab426e846
SHA512 f66f4cd6c216e5d0417454731fe85bd37dbb71cb812cfc2a0174a8fd514d4fcb9977c375bd37e353011e11cf3dd753eba4b71fbdba80d9b00488fa6062908431

/data/user/0/com.restbestczti/cache/oat/ndyrl.cur.prof

MD5 f4c0e5edc72493d291fec750ec7f18d3
SHA1 04ae7545fba83ffce3029697fdd72084165ae981
SHA256 6f3fb35aecf63026346d015652b727970f96d3356531bd0af9c3060a282cc09a
SHA512 e3ac748c3682dc61eef6f05507408cb23547667d5b6a24f802e17f072568e08950e9add7c1960de8f04ef70cee9ecd4908de76a9c268d01b83fe85c1bf46e41b

/data/user/0/com.restbestczti/kl.txt

MD5 c332b96b464e9da285d45f9b997d41c0
SHA1 950931e1bc7c925f018161aa415bb23e6bd2695b
SHA256 00a56fac400602d24bacc3c37a59323ea8ae5bb31f5c706578b82dca89065840
SHA512 abcef1a6a3b145ffb47a2cb431b39ff1e606b502301ebf8328475a910f9bb1b1057b668c8d83b1d64f0100b654d71d6ed3f726eff50a7f2e853b2b1809546b11

/data/user/0/com.restbestczti/kl.txt

MD5 4efd29ef3d117c149870654cfa1964e0
SHA1 93fbff39f9c81f69cdbdbc9ef0c53c5f858efd16
SHA256 2159877467132d3a0bb4d987394e8c03991286aa2b2aa230768bf74db5bc4097
SHA512 9baee77bc5483e4fd862af451f87ab186f68ac764f8b854c486b7934a0e45765954ab5684b958a2f3d4abc94a58ec52fea01f2353183fca8823edbedaeba4fa4

/data/user/0/com.restbestczti/kl.txt

MD5 c332b96b464e9da285d45f9b997d41c0
SHA1 950931e1bc7c925f018161aa415bb23e6bd2695b
SHA256 00a56fac400602d24bacc3c37a59323ea8ae5bb31f5c706578b82dca89065840
SHA512 abcef1a6a3b145ffb47a2cb431b39ff1e606b502301ebf8328475a910f9bb1b1057b668c8d83b1d64f0100b654d71d6ed3f726eff50a7f2e853b2b1809546b11

/data/user/0/com.restbestczti/kl.txt

MD5 a789512fc243deb19c6aea4fa0cb059e
SHA1 9d5776b7d2be186180f98753fe5d2c96daafbd4f
SHA256 0130256efe7ac5b0b59c42f841f787df5116e06bc78d21ae5c2714b46030bdc1
SHA512 d25c3ec4282ef84f54d5c5eb2f8682077b2658e83605962991fd9e1234673e60eeb7a8a0ca9c8b400dfa6b599888e6fd4b8ae1343b35d54ccb4f2c9df60e69d0

/data/user/0/com.restbestczti/kl.txt

MD5 a789512fc243deb19c6aea4fa0cb059e
SHA1 9d5776b7d2be186180f98753fe5d2c96daafbd4f
SHA256 0130256efe7ac5b0b59c42f841f787df5116e06bc78d21ae5c2714b46030bdc1
SHA512 d25c3ec4282ef84f54d5c5eb2f8682077b2658e83605962991fd9e1234673e60eeb7a8a0ca9c8b400dfa6b599888e6fd4b8ae1343b35d54ccb4f2c9df60e69d0

/data/user/0/com.restbestczti/kl.txt

MD5 7d979ce9502e9e793f93e6db9146daff
SHA1 1325973b6587898b55003d19c3dad03366af8b7c
SHA256 c2fba3d8585cd441d0192de6dbdfe760970a6c68855a0a390f0b20c377d6b70b
SHA512 2f415aa7186fc736a306cda5dbb72c35f35542418a2da739c2bd9db450006ea49093f2a78307ee3521ede694095d011a09dc40d8dddb2d7b62407431a997782c

/data/user/0/com.restbestczti/kl.txt

MD5 d17a860fb4e464902ef11c662835223f
SHA1 8b40cf2a8f336d91ebf516b7d682e1679d58cb55
SHA256 55aae6ef9b42e26b154f058242e935daf1cd87d37dd339e53d628853b0437ce9
SHA512 53bd94d7252ad5e2e919d40720ff9067ca40bcee7f60ee957414d9d6340ad28eb8e1dc5d87d0e46ffe999eaa4d226a5b34a69e97845372b650919e791c1c77ea

/data/user/0/com.restbestczti/kl.txt

MD5 b79b7c74cea154a962725876be294242
SHA1 1d8a677d75db12ae6fc9aa3555c1a957f459ebe9
SHA256 db129502057fca0276c9ef5f5bfff611349b7e1a637e681b24c39edabcfd9e78
SHA512 a6cbfa26139e01da530658697c792224dc18ac3cb12c36d724e4d5f7abaf7f2f3eeaf29c8c109d3f764cc4354c1b535260af0317983ea7c5dfdaedbedf236c77

/data/user/0/com.restbestczti/kl.txt

MD5 d17a860fb4e464902ef11c662835223f
SHA1 8b40cf2a8f336d91ebf516b7d682e1679d58cb55
SHA256 55aae6ef9b42e26b154f058242e935daf1cd87d37dd339e53d628853b0437ce9
SHA512 53bd94d7252ad5e2e919d40720ff9067ca40bcee7f60ee957414d9d6340ad28eb8e1dc5d87d0e46ffe999eaa4d226a5b34a69e97845372b650919e791c1c77ea

/data/user/0/com.restbestczti/kl.txt

MD5 100a1dde5d0a4540d8a2028aae8ec25b
SHA1 d69960569a324f5e31e74681e278fe7d8ac611bd
SHA256 b5611a1d0fbb9752b090ff1efeba1391d2d22b4922747abeb9c4dd67ed29ea29
SHA512 595e44409bc08eca7aaceaa0c0588fc75c7ef6c3162055536f6f8795e0bbfdb9ebad949ca8c5f8ab74660ba3d9ea214621a340b5569b0e48050ae18655c87ec0

/data/user/0/com.restbestczti/kl.txt

MD5 8ecc4e8fcd25c95c0992c9e6221b8aa3
SHA1 8eecf84199b7618eab5ba19c0f00f075eb1d69e0
SHA256 8396c5aca9fb1d0b05737d6af7ccbfe68f7d20db492e2e6fbdff1cfa16e1a0f3
SHA512 50a9029899899fbc28dba553e4a8d3a75cebfab3db16387770280bc03e3c13953bd15f73a4361f2cabf8cae6d6bed860e79d233604cf90980950bfe95cc600c5

/data/user/0/com.restbestczti/kl.txt

MD5 66943d8672d0eff009f546b00647b0de
SHA1 227fed995d8a0bdb42aec732160f82d228a1c804
SHA256 348e25a6d4d42c902c3a2e7cafb0bf068a6a94ad0529cd226221ab2491c0c9dd
SHA512 ff4e4d43d8fcf60ee722d1554b5736dad427147218c4a80d80ccbb25d92d282744f684a936ee11053eb56524ec0505fb8dd9fce907e9b223fcff858c8bbbcbcd

/data/user/0/com.restbestczti/kl.txt

MD5 d8a018e9edf8954c51a31fa7db939618
SHA1 2975ebdb4e06b8d2de37236558e7a9d141cec66a
SHA256 97aca33771ff4791d8aa36de2aacbc2eeb196ea28ea6eca5fa8b0887a28d0b04
SHA512 a42b8681fa8cf869a57fc9efab3188487309fd26ed5c345b5509fe752c597be7d831f3ea94dd4002efffc31d392c05c0adc29e93b56d9dad1ea9fc099733c86f

/data/user/0/com.restbestczti/kl.txt

MD5 6a213b41cb245c950159b39f92408a03
SHA1 c0885309124bd455353622a97cd9c3dd56070ac0
SHA256 3b3167b9c34c4661453e513a8ca8f1566a58325ab9410ecce1d4bd98521cc6e1
SHA512 6a36a2752926132255ab40076e672dff5566e1b8fb7740eb76a095763440d9bb4ff3f21ee1aff88eca3aa4c9363d9610f40a5969eb6f372f855863668df6149a

/data/user/0/com.restbestczti/kl.txt

MD5 d8a018e9edf8954c51a31fa7db939618
SHA1 2975ebdb4e06b8d2de37236558e7a9d141cec66a
SHA256 97aca33771ff4791d8aa36de2aacbc2eeb196ea28ea6eca5fa8b0887a28d0b04
SHA512 a42b8681fa8cf869a57fc9efab3188487309fd26ed5c345b5509fe752c597be7d831f3ea94dd4002efffc31d392c05c0adc29e93b56d9dad1ea9fc099733c86f

/data/user/0/com.restbestczti/kl.txt

MD5 c174c27d081651d2e435bdf435ce570c
SHA1 ceea05bae52285824543d5e789afbcf3e6b24e10
SHA256 3e30219738a4766001473fa7542caccef92ebd8cec4a391c26d24ad88a4a7e2c
SHA512 4538d91382aae2900704ee2bc74e5442ed4ad4aff47ae84d740175a12a5ecd268376a02fa71f21eda7387cdcd759c4cdf5b39b9bd186c79c32b6189d2415845b

/data/user/0/com.restbestczti/kl.txt

MD5 5e4b9c15216680dc0bf24afddee804e6
SHA1 84df75598e4b3c8db7202d03fe4fdab0b12b5213
SHA256 6b078f9f31a2fcd2c9be0e78f99b09ecd42b90871cc2d77d6b14ff35be847e8d
SHA512 8886cc4997dacee5f1bb7597ed879c4cb64d6c32011a4f7aa812007690151d4218875f865691b0ddcc0a1c2905418fd99b64ffd004a12892e70fd7aca1c195df

/data/user/0/com.restbestczti/kl.txt

MD5 8d7b6ca162050ab46378cddeaad831b5
SHA1 37f7a87c360114df49fe6d25b190c13ae9dd79a8
SHA256 7e7de3fb2be4b55654bc3c4e614d4be1627e9c683ab972b276626826f6e13010
SHA512 55cafe086144ad5bbba34249c66690cd3ff42866132639447d41347d852609c9bfc1f48682c1efd0652808fd25915e310be53981af3149bedb57c65706200960

/data/user/0/com.restbestczti/.qcom.restbestczti

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

/data/user/0/com.restbestczti/kl.txt

MD5 16788a1eedfeb5c699f22bd825345b5b
SHA1 ebc81d5da35a68c9b41edc4d8035401faa3685ab
SHA256 5469f8ff4006ceb7f6450bf78e431cdb7073ed6a1e785d13123af036de7a0437
SHA512 3984d61420dcd98d481210de924050e217b033070de24a07d0672c1a9ad99957724dc40d19676d9418e7e2085fec1a8981284072cedfd2ff81c28a3b9c030b61

/data/user/0/com.restbestczti/kl.txt

MD5 388742d05e079653d34f7cbaa9dc67c9
SHA1 6fdb237cb71509b0ce2bf2b7d68ab6b9fe14a808
SHA256 5516c3f87bb3d81101ff765cf527078a116d2e5dd81f3826dc32494dc499be98
SHA512 000b256588874c4c4a7091083640656db7ea887164595917ccab692005d7c9253f72d50daf47ba43098dbe2af97ea5e176d03d236c7dc63b285ffae42bef6986

/data/user/0/com.restbestczti/kl.txt

MD5 16788a1eedfeb5c699f22bd825345b5b
SHA1 ebc81d5da35a68c9b41edc4d8035401faa3685ab
SHA256 5469f8ff4006ceb7f6450bf78e431cdb7073ed6a1e785d13123af036de7a0437
SHA512 3984d61420dcd98d481210de924050e217b033070de24a07d0672c1a9ad99957724dc40d19676d9418e7e2085fec1a8981284072cedfd2ff81c28a3b9c030b61

/data/user/0/com.restbestczti/kl.txt

MD5 6169ae8771c9e3f950c8e5258c7027a3
SHA1 140adeda510d6803271263860e29545bcf4129f5
SHA256 64fc43733bdbb04573189321edf43b0016592378fc9ed0c4553f72fa023eaab6
SHA512 9570915fe0d7c40fd6e36ac5d4d5cc5ee1fe7f64ac31b3c68fd003e5317812f93a904b431f7a798d118ad18a6597898648e8ec1e985b71072ffb2a428f9cb290

/data/user/0/com.restbestczti/kl.txt

MD5 6169ae8771c9e3f950c8e5258c7027a3
SHA1 140adeda510d6803271263860e29545bcf4129f5
SHA256 64fc43733bdbb04573189321edf43b0016592378fc9ed0c4553f72fa023eaab6
SHA512 9570915fe0d7c40fd6e36ac5d4d5cc5ee1fe7f64ac31b3c68fd003e5317812f93a904b431f7a798d118ad18a6597898648e8ec1e985b71072ffb2a428f9cb290

/data/user/0/com.restbestczti/kl.txt

MD5 461d7813d13da9256ec3467617b1df73
SHA1 2d3ec04457cee5f96aaeee1c69f8d70dff919771
SHA256 30e9eaa6732d9658d03a141cb89e88e0b24ba292825d4bf00fdcd5e2976a1558
SHA512 7949e7fd075f72f94d612221ba1e6223035148a53f1cc49b7372279b5221c6891cc849f4341ea62cf0a020cd67890e9ae215e82049f17f1559e1042d7cb1db26

/data/user/0/com.restbestczti/kl.txt

MD5 fe5c6cff939f6a925255d6ce3228ff20
SHA1 4685feb291c65911aed67df3d5b3ec7dfb470687
SHA256 9dcacfff7d65bef64f449d79e70c210d0a9511010ce5b1e2be6c1bd5a0992be8
SHA512 93db92f0d3ecd25dcc509b934b9c9dca487a6fcffd18987fcee30f334a9d2dc4a99a00b3302300c16ee56919603411449bb8563ac8200687d4f29e89e76e7edb

/data/user/0/com.restbestczti/kl.txt

MD5 039d52becb022d9842356567ce874e6a
SHA1 e6f4350c083bec4490bdd1ef0cac61e8c541689b
SHA256 e54af5d16305a1b3cb0c8736ab7aa0db14bb3b4e970beffd452219295847e951
SHA512 f48b2efe2f0d10811d51d9f1a77bb2e1b7836b791f123405a0038f3a1cc9cdef5527b54c54dd159cba37d3f74197a2b54f8053d7df5fca43ff69445b89c12928

/data/user/0/com.restbestczti/kl.txt

MD5 a953fded626106b372dbf4629266046d
SHA1 be911aaa8ebb2f3ce117cc97866fa939dc46a76b
SHA256 d986f1966cf048e9761add12eec9b88421778f83d9706a48b375f4519125f178
SHA512 55d74dc406555da6a3953158dc6f046eecca2e1e77d9fe495e6b2baf158c61320f1530021da1b96bc1c1b9814f462a3923e89f80bdb65e46f2268d3b773ca188

/data/user/0/com.restbestczti/kl.txt

MD5 e58c7443c3189871fbd24a20453948e1
SHA1 c1e56e32116418cddba2e17b87ce9aeb28c95d90
SHA256 d02aabb7b710b6ee05eac7063d3a12cbb466aa07ee73be996771d0f520854287
SHA512 373ce8910de82adfedbe8380cefbae19d9ae4d9f38d4bbcbdf12bb035674a68ceb1d10fb22041fc67df457cf758c2998125d976422937504fce018462041ebff

/data/user/0/com.restbestczti/kl.txt

MD5 e58c7443c3189871fbd24a20453948e1
SHA1 c1e56e32116418cddba2e17b87ce9aeb28c95d90
SHA256 d02aabb7b710b6ee05eac7063d3a12cbb466aa07ee73be996771d0f520854287
SHA512 373ce8910de82adfedbe8380cefbae19d9ae4d9f38d4bbcbdf12bb035674a68ceb1d10fb22041fc67df457cf758c2998125d976422937504fce018462041ebff

/data/user/0/com.restbestczti/kl.txt

MD5 73a3ff60962c4ce85ebb6bf1dda2d270
SHA1 f4ecce8203cc9b137cdfa26354512e42c7821575
SHA256 bbae6953f7e6a71d71d4e3efb1e51e916977a32de4812b96927bd964249340c0
SHA512 005c1c26e773770ad2ae3de773afbd067b206f10c251fc7c566b863e811f32cdc41c454cf1b2630377365817ce31f844a5c2b3a99006ba339176088c9d6cd7f0

/data/user/0/com.restbestczti/kl.txt

MD5 7ae6fc4d4d7c705e679797b8e10ed85e
SHA1 24d5cf33d49cdd33ff378bb2ba5b09a4c09d83bb
SHA256 1b3935696906dc8a9793c803869c8fa5a0bdac08cec4d8d3cc4a9652bb5707b3
SHA512 9f29bfdec10871396f4d953a00fd3b1b5f0eb0366e80670cb04c04d17a4a8bda8d0c592759d147658e613bf82c850bcb914f539af4d6b7d613ae250346410d46

/data/user/0/com.restbestczti/kl.txt

MD5 f1ce9dbafa729156e15e433cf4f7e361
SHA1 40dbe8eb673bbd055902793b3cc1f42ba321c061
SHA256 b395bafa0c752c75b212141ba619a01661119cc7b4dcaed160c0e5c44c168f84
SHA512 29ab9d43495ee5d857b82b347398cb9e4f6a54f2e2bbdd9290fe1f19038afc2033c0f1897cdb14aa896d73d52fbdbc7c50fcf5df19a6550175903207d8c3d2c6

/data/user/0/com.restbestczti/kl.txt

MD5 7ae6fc4d4d7c705e679797b8e10ed85e
SHA1 24d5cf33d49cdd33ff378bb2ba5b09a4c09d83bb
SHA256 1b3935696906dc8a9793c803869c8fa5a0bdac08cec4d8d3cc4a9652bb5707b3
SHA512 9f29bfdec10871396f4d953a00fd3b1b5f0eb0366e80670cb04c04d17a4a8bda8d0c592759d147658e613bf82c850bcb914f539af4d6b7d613ae250346410d46

/data/user/0/com.restbestczti/kl.txt

MD5 1640e835971b27de104aa10563993d24
SHA1 c453d262c13d0875a7a3ebe7cc3209b4498cadd4
SHA256 5f794d050e78557a8df297f62844c622292488c2c131b0093d4fe32a209b720f
SHA512 b07c3592f6afa06708f9ae2d32d7e166b9c42c7f4e7881c87d58351bf9271b57651da287b5191e065b5ba327115007ddf641eb9c93097d6c51a599604a527e31

/data/user/0/com.restbestczti/kl.txt

MD5 1640e835971b27de104aa10563993d24
SHA1 c453d262c13d0875a7a3ebe7cc3209b4498cadd4
SHA256 5f794d050e78557a8df297f62844c622292488c2c131b0093d4fe32a209b720f
SHA512 b07c3592f6afa06708f9ae2d32d7e166b9c42c7f4e7881c87d58351bf9271b57651da287b5191e065b5ba327115007ddf641eb9c93097d6c51a599604a527e31

/data/user/0/com.restbestczti/kl.txt

MD5 4b33c0109dadfb764a57675da296a17f
SHA1 06ab754ac97892afd4ff675dea3a98f2f6be1bc6
SHA256 36132bf1fbf65807a2f83cbd6b4f3a134cdbd6aab70c8eaa445d1f1559b3ab02
SHA512 e89df8131e79b5dc769d0146172e47822abf2e20662a3623f752930da85f157cba934ade5fbcd33919e573335c9a851b5c2d1e0de2f1189ce94ebb1c7a38cfe4

/data/user/0/com.restbestczti/kl.txt

MD5 9a39201ce9ab33bc478e29aa0646209e
SHA1 42f37daf81fcdf08bbb4befa96f16a9b7a46194a
SHA256 7a2644e49b716c2d2f0dc733046f5a7c5f5d1da023f3207339a7afc4bb198ec8
SHA512 d8f3046263b769cb6c9185461eb0a1f6d6785d7c5d4e8880df378a8583e88fbfdad51e659fa9fd2c4c0dab670fb043d34a4e392edb1e0f8fbb832014c3fbe9a0

/data/user/0/com.restbestczti/kl.txt

MD5 5fda4643d2676797b6b6569fa0e324d0
SHA1 fa13d04d8d234803702539982534ad1562c49e35
SHA256 48b45d24490d859bb4696f4d4a2c4d2ec8b92922241326f0f28655a85561e522
SHA512 56b560ffaf9ebcd63e489eabf38885aea6c4243c7bdf6339734ce4774ccfcbdd95ffbc746eebcfe399396f48484a42fc7a472f7882fc188d0f2d69a00e770d0c

/data/user/0/com.restbestczti/kl.txt

MD5 9a39201ce9ab33bc478e29aa0646209e
SHA1 42f37daf81fcdf08bbb4befa96f16a9b7a46194a
SHA256 7a2644e49b716c2d2f0dc733046f5a7c5f5d1da023f3207339a7afc4bb198ec8
SHA512 d8f3046263b769cb6c9185461eb0a1f6d6785d7c5d4e8880df378a8583e88fbfdad51e659fa9fd2c4c0dab670fb043d34a4e392edb1e0f8fbb832014c3fbe9a0

/data/user/0/com.restbestczti/kl.txt

MD5 f9719341fb24054e5c90c210740198b4
SHA1 5c2c009b4617e1de78eeae22bb145fdaf07b36a0
SHA256 2ec136202166967b8b9223b0ef1d7506c537ab8bc26e1d1479c98551efea861d
SHA512 90ef0b5aa417f5cd4c82a0a108f6fbb96032cd7c4afdadd41e79cdbff9a166e5a59df0c267deba2d14bbdd053d48fb911a139b93187ecf127a3da720165c579d

/data/user/0/com.restbestczti/kl.txt

MD5 06a6921875a9e984760e893f7200251e
SHA1 3f39a62e176d1c6ed2987d0cfbc6230f7b744a3c
SHA256 29a90d16e93921d86fabf525151f124e1e257281e0e4f48bde98f188598637f0
SHA512 5f00eaac1892ab26fb1768dc9e87935d3924223d5057d11a071e390fd08fdd81d0791cc2122518cc429047710328b2a86f1285bcf494bde26f4eee35add999bf

/data/user/0/com.restbestczti/kl.txt

MD5 7867175322b0ece32848dfe7757c6511
SHA1 872e6fe48203fbb0074d3564f454caddf1b1f2dc
SHA256 97bd64866d54bc2485afb1ecc64632dacec3511f2983a1c3e58079bfa53f4076
SHA512 182072ba8fb33bd5adffb916a655c506837477f6cc612ea220dfeb771aaabb698fa8679394c936e0886615cb5bf12f4726b2f764bc268ea322290487de5b29c6

/data/user/0/com.restbestczti/kl.txt

MD5 cd6edcfcfcb5adc1be2787458a75039b
SHA1 13f6c0233b723885adbbd049ceffabbdf9fbc2b6
SHA256 5b925977ea51ab31bdf129056668437e6eb9bb3276e9e687628fc7747e597a5d
SHA512 9db52a762ec877ea7156344cabc896eeb48c9e503fa26a3c799e209d80d1fcc49011d0f4db2cb7426f347878298e488784f380576d2bfbbd4bd86ded6f040032

/data/user/0/com.restbestczti/kl.txt

MD5 791185a0b33333509a90a9bb9608be14
SHA1 06e5d03cbe9fdb2805aa64a536264bc7359e054f
SHA256 32ed63a3cf070f24a1d4df8ed731d6bda78242fd4a5c6ce8447f3cb555bf7575
SHA512 035db887f69749562abb9783ecfa2ea7021554cb4d6c9597a50d926e48c09271956db7719dcf7c80e19a285902c565298d561241c28b0a06eb879ebcb65f0806

/data/user/0/com.restbestczti/kl.txt

MD5 1763f46fe0765c6966322529d92161c8
SHA1 0a8e889772b84c4aa779fd80b533f89db7d00579
SHA256 0c3095c257f3378135a6f12e40dcb93738f4dfb6b334560c934f84c227cd03ef
SHA512 250a97a3abdd09817cf181bc1cda161f48d3ce71e415d879162e87d307a042c98265351ea70fd6b09ac1b09c9d0c2edad5f11275d0ed6707731cb03dfcbd56b8

/data/user/0/com.restbestczti/kl.txt

MD5 ef235a1eee1411d90c2011a1a4901879
SHA1 e1322f772e1e751caf123cc9cbea9b3d78484ad8
SHA256 e7de6a65b2b4a717f73d02a6d5b42954b0f0f3e2610390369c9e3de8b4e70678
SHA512 32a8fdeb19ba790a8034076bfca5900cb28e505a9728df38dd2d9f685f767d0c8bb02f20a43ade87c7e0e6c0549c8bf2994b30a071fb2a82553efcd8bbc6e593

/data/user/0/com.restbestczti/kl.txt

MD5 fd17119930b9893c9c7be60c763dede1
SHA1 0e07a35ac088d3df101623e91c741a4c05c36c2c
SHA256 cca96dee20d39fe3276788b08dd58ec3afe6cd64df7c49620ac4a33814394d82
SHA512 5e2a0b4defbb02c54113f30b42b360f94713634ab750d5fb3ca6fb532b122dd2c0c765e32c3e202ad7c2ad416ecd0c2de6b63ec3d83e4a97de381e1bdb3cf778

/data/user/0/com.restbestczti/kl.txt

MD5 f0d0bf16b34bc6e5121ef9c880f8bdf1
SHA1 37780de99a9b1d0b986635a49bb0c4fe4ee4b5d3
SHA256 fd0ee1d55a10fbda062a2b2eb7b6d95af357f0e71c64842d8429dd52b5a68034
SHA512 faa60f7061df0aa5e2bac68a10a12f33a11389b6048cb534cf895116907541c05ec2e768e95b4a840d89d520c68c5568a7e7e9b8280662e4d61f74d758c4d141

/data/user/0/com.restbestczti/kl.txt

MD5 3ddb99a26a1aa73cbe6c2c8db47039eb
SHA1 9e0056cfdbc24ec1ba9eb11b526f2868a0d97bb1
SHA256 155beb0274071b005bb774ec86da8a0419f8777917f349ee2b83ced8e6d837b5
SHA512 085fdd23e78c75f8945d39fe4fa74b5f2186b22d09d4df60c79015efeacb05b95947f3000395dff6105f9d45c00059bbdcbbafd2aff099c2816146446b244143

/data/user/0/com.restbestczti/kl.txt

MD5 371a7487bf77b3aed53e9605fa3521bc
SHA1 5ffaec45e35e13921c196023294b7f68e9580dda
SHA256 c7bb293296a8fb5846bfe587cf34a179889f4f31a728b2cc3376849af3d82f80
SHA512 15d6bcf615baeaf69bb7a541a12177d52d76703a7c6cca0d01297d48b85b7947bfc24c9dbe026539fb7fc5860307efc0a10c93fa56ba46828042472d06a8c402

/data/user/0/com.restbestczti/kl.txt

MD5 3ddb99a26a1aa73cbe6c2c8db47039eb
SHA1 9e0056cfdbc24ec1ba9eb11b526f2868a0d97bb1
SHA256 155beb0274071b005bb774ec86da8a0419f8777917f349ee2b83ced8e6d837b5
SHA512 085fdd23e78c75f8945d39fe4fa74b5f2186b22d09d4df60c79015efeacb05b95947f3000395dff6105f9d45c00059bbdcbbafd2aff099c2816146446b244143

/data/user/0/com.restbestczti/kl.txt

MD5 4edb7cd25f8455756fee86da38601ba7
SHA1 76dd18b3d47462aeffc78989f5f11999fac47c0e
SHA256 7a4fbe0a6760ed2ddadc8a4d9e823513da17fd895689f44cb7fb890c4a715c83
SHA512 ea035235db1734f71452be645d0a223305e24dc3a5c92a75fe51166c8589574384c845fb32e4df13f7ea3dcfb1f4feeac1150e6468cb02c87b389a13172cfdf7

/data/user/0/com.restbestczti/kl.txt

MD5 4edb7cd25f8455756fee86da38601ba7
SHA1 76dd18b3d47462aeffc78989f5f11999fac47c0e
SHA256 7a4fbe0a6760ed2ddadc8a4d9e823513da17fd895689f44cb7fb890c4a715c83
SHA512 ea035235db1734f71452be645d0a223305e24dc3a5c92a75fe51166c8589574384c845fb32e4df13f7ea3dcfb1f4feeac1150e6468cb02c87b389a13172cfdf7

/data/user/0/com.restbestczti/kl.txt

MD5 7547a8482de837ab589443bf585bab4a
SHA1 871e7998b2d4efd7149263d4ce9d443ef11431d8
SHA256 cd61dd55fc9fb592058753540c84b4979025ba96cbbeb6215c0d44418d24c7a7
SHA512 666de87e2841e5f3e60fb531f65e589269a15e643eab7c7e1331dfc40ed9c76be2f6ec098922367286fd43aa49536f106309e8a9bbc3cbb7f21273b7fdb7334b

/data/user/0/com.restbestczti/kl.txt

MD5 3849bdd367797cf986c408d71784181c
SHA1 c971ce6e6e514ba132435aedcc35330b6113eef7
SHA256 4dad7b22351323ec90e8c0e22db12233f2673a3f693977b926888e3c884ef8a5
SHA512 52d9e1630355b644ad6ecad38ceaf945ce34a9b3d6ab5711027e3c8aec5d10c3887bfc0089ffd91b9eaacd6bbd7c2036bc74665caa08173aff52a4405b0dc1de

/data/user/0/com.restbestczti/kl.txt

MD5 21a9c327e3c4088200b32f3c0262b17a
SHA1 dc95c6e5bb70a67d578549d02672f3da2cf99888
SHA256 5acee5cc9729500b6d05dce9f25af54346f70e3244b7a28d76437954906ee492
SHA512 4af6488474859ddee26bf410c1bef8b00c79daab87cd5c737ed55c55054562cd0a6bfa24ce28a1b244361809b587715663e047b7698eca6dad3476d1059a0c74

/data/user/0/com.restbestczti/kl.txt

MD5 027a3b1cb90cf25107be310d11969014
SHA1 747f5d4234c53d5c2b915660ed9ae85b3c06487d
SHA256 06a4b0a1fbee52a5586d38e73e21573a6017003098fc89c3f6bf9485b74091b7
SHA512 1ab6fbcfd9073b5a65e208e010a0aebd916ea4cf66352e8142603d0b204f67dcf023f6eba4a247161aeb73c58ea263eb10badef1d24c5340ea1ff8e824946240

/data/user/0/com.restbestczti/kl.txt

MD5 2e165df88f94e5cb0db5d2a9033015b7
SHA1 4ecbeb8fb362e2bb6d9191bda2f67840a641986f
SHA256 8cc6e9afbdd2472de95fc1ac5fa97538f2d6c260fb9107b47f9a405e16da139c
SHA512 2269cbc426f7297828bc7a21f0e84587c5db187202cefba802e8f67ab69377c120cc41a0b676e5e9c525d433bf91637edb05695face406f4c132d617f606b30e

/data/user/0/com.restbestczti/kl.txt

MD5 2e165df88f94e5cb0db5d2a9033015b7
SHA1 4ecbeb8fb362e2bb6d9191bda2f67840a641986f
SHA256 8cc6e9afbdd2472de95fc1ac5fa97538f2d6c260fb9107b47f9a405e16da139c
SHA512 2269cbc426f7297828bc7a21f0e84587c5db187202cefba802e8f67ab69377c120cc41a0b676e5e9c525d433bf91637edb05695face406f4c132d617f606b30e

/data/user/0/com.restbestczti/kl.txt

MD5 02b17c92ff62d35dc58a11e28e6aae4a
SHA1 046f46fb44aeceed5ee351a2aa3c0669ac5d29ef
SHA256 ade008fe1e1edec45fbd286c992afc7f20db9df330452d642613c7164f6fd547
SHA512 0a7430aa03b16efd70687bf94797df6f39c4fa186761149da09e25e1b37a7e2cce1bb91b911c917e5834fa7ab9699070d67b5e8a1736fb70b2072fecb399bfa7

/data/user/0/com.restbestczti/kl.txt

MD5 ebde48601ad857fa470ec8958961c86f
SHA1 f910355f407f2cf17f811e8017b430d080a6c37f
SHA256 7ea521e33846ba1f07ce6f8a2481946182ded334d5db851350730250283ecd76
SHA512 bedbdf86f87c8b8fe722eb9bc36636bc81ef46baae380628cf2ee04d852a4b72b7abaf3ae19e8d84577e0e5e83281407ef7c0310521fae3273ad820cc0697464

/data/user/0/com.restbestczti/kl.txt

MD5 6b2cb31ed8344feca5c98422849604fc
SHA1 efe50d92e08ca7c4fa4aaa4effa72f7a31b86df5
SHA256 6289ace1cda87a4504c5305865e136cf9cb5311832016ea64fab17866bac690f
SHA512 b69b6b3c3203c6f03c18e0debc258147fa3e0c7bea4dbbc5f80c91252519da2d926d9e287bafb7ad93739a48ef776ec9c97dd8e051dba9cf7fc30e685ca2e678

/data/user/0/com.restbestczti/kl.txt

MD5 ab0364bb94a239628170667041c33f97
SHA1 5ccaaba43955be90ce6a6ca282686c4307e4fa3e
SHA256 c41d16071867598cc3c0321d83e015ac9753b94412da2a99d7babbdae7bd4c59
SHA512 b4f7fa1eb489ca5dfccaf4929cad770a8bc5fc4275fab2a9ac97a76fb2baa0b67aa33c1bc7599184b95c2c3e7f13dec08f02bdabe4848748266e60ec51a8a8fd

/data/user/0/com.restbestczti/kl.txt

MD5 8c70cf0354ab05ba9b9e0b1fe51425a3
SHA1 c9bc5a1f608d9a03f06faae843091ce983326032
SHA256 13b296763b1ef0f7fdfded605885d4aad40e15d46675b8fe7293de749504459f
SHA512 aea1550e3a18672fed1d5a3c9cbff976a6dfae35c7dde7349bfc9418cc5323daaf62ba1eaa2a594e77d4dc4b2ee683097d1e9f26acbb5cfd9c3f519dfe3abefb

/data/user/0/com.restbestczti/kl.txt

MD5 7dd911c010ee3b29e2ecdb28e0742dba
SHA1 137c9799260ea00b374d67d2d85f3bbae3e98744
SHA256 fba90d66c67bf9332d29d27c607bae8229d6fbe890693f42e1fe42476e5ba2e5
SHA512 d643f43e3919f8a55c3b0692980e0c086229c87a13877ea156241934bef5f9ef6bcf7c35d2c4ff9695cd6178da8cc39f3151c4b2ec157e692b4bc17e0243d785

/data/user/0/com.restbestczti/kl.txt

MD5 1ca51ef9e31edef60b04833b82088bd5
SHA1 de013bfecf2b103f3811c398038ca173a70345cd
SHA256 657b1739de0a01ccc8c5cc3e339cbb4e13c63b4fe9a046520057e97f80bb9daf
SHA512 a2e38d4fea82c527de8def4655d888da506d10dad09b345eff84e6c1f8f00aa2006cd0bf372719dccfb4f300a6c3c31ef2f1b525dbafa716e19eab81c2f5f012

/data/user/0/com.restbestczti/kl.txt

MD5 87b18f7d31faeb0940bcb0ef19975317
SHA1 fa7cb35dc8557bb61d1660b10a180bacb5533f0e
SHA256 12fa1806fdbc428c29b383f86d9e48b259dd8b111c2f35117e08c1abf8517f71
SHA512 2c610be5d7974b55ecdd8f716c33b6564ab2104d9d807779fcd21ce1a808c38b0742aa1e5a499b9297bb738551222c96cf2fdab43798bd6308d79479813e1369

/data/user/0/com.restbestczti/kl.txt

MD5 95ffab5ffa2263cd868db02cfddaea81
SHA1 b715a34b8058a52a7fced5d1d3a803e95462231a
SHA256 faef7ab0a74b1d8888a3fbebe62e405f20b41e2d74447845dc9748953287156f
SHA512 7bab17d8a353ba40fd37876ddf91008d98d727ac60edb2750bd631a85571de9e9df445c75506246687eca1a440d6a34683d6f874e0f609debbb4804970ac515d

/data/user/0/com.restbestczti/kl.txt

MD5 5d221f53d25192617284b946606c5187
SHA1 585200fa4626cb8cf202952e61979566bf9511bf
SHA256 58878129f3b58fc8cdde5599de90821bbc7a47479021f2870e3af65c8e6ed882
SHA512 5a9406cb5ec2831ba4c60d9399d2585f7a78109d0ebdff33be0a7fc9894a8476378e139b68c05e76f70eeec1e890918e28a5c4bbd73e748053b06524fc47a49a

/data/user/0/com.restbestczti/kl.txt

MD5 87b18f7d31faeb0940bcb0ef19975317
SHA1 fa7cb35dc8557bb61d1660b10a180bacb5533f0e
SHA256 12fa1806fdbc428c29b383f86d9e48b259dd8b111c2f35117e08c1abf8517f71
SHA512 2c610be5d7974b55ecdd8f716c33b6564ab2104d9d807779fcd21ce1a808c38b0742aa1e5a499b9297bb738551222c96cf2fdab43798bd6308d79479813e1369

/data/user/0/com.restbestczti/kl.txt

MD5 5c00a0a515d13351d7bf1f6540b37ce7
SHA1 bb429e8ba7ce932565ca5e9855dcb3a8d08e48c5
SHA256 9cc9423069180282c801f29901f48cfca55c704223307fd03039fa31036aad74
SHA512 5b5c8dde4c1c9f191a6943fe7ef5f0c0cfda5f800c72ec1ed951382e3292062504b58fecff2a56b616ab5eb4d62b0da30d78df166f5c6fe88eb63144eb253b74

/data/user/0/com.restbestczti/kl.txt

MD5 5c446fd593b9de77e165c3bde0a63d36
SHA1 8a34dc4c1164167588e69fd49c6a379a59599615
SHA256 669601d6c5b55f598b06f49a6087d8495659f47092ea7003dd29a23e2bf25371
SHA512 ff4109fcc21ad4087b4e75d8fe594ab99fb22ded123a412e6c466bff24a83f393b2e6199e07716373d74ee0dbc5917b5a39bb13f222770bd6d3e6cf5b16e3e6d

/data/user/0/com.restbestczti/kl.txt

MD5 fc58d371bfe3d7d8cdba5395a9bb3e52
SHA1 b9699cde4618fc74a65cfc04d8c2d9f8d6eeacf2
SHA256 f2d72ce494cc591a41118a0dc9e829276610c5b885e432edbc3fa65da3ac1cb6
SHA512 886994bd48885a759ce34a5d578398a53d3d71e0977c6a7e73b3c7875c0e2eb63d2bf6769d70706257ba55ce8b85369b461207a5e74a8446c7000157f8c97953

/data/user/0/com.restbestczti/kl.txt

MD5 f2e4715edb443fd469c2f955744f99b4
SHA1 f68483518e681e50092c7f33c65629a90aa103b1
SHA256 da917ba770424c15ba6a8a0f2f581cb1bc6b4e05f223c425fcb9b611e19a050c
SHA512 33c3f2138f0d67de56cf1c87ebf9e0a3ffebfe9d190a89db2006f00df977f5d4112193569c50ae964265c9bf88ac52f25f88ec2206072ac30bcae917cf2d5f6a

/data/user/0/com.restbestczti/kl.txt

MD5 fc58d371bfe3d7d8cdba5395a9bb3e52
SHA1 b9699cde4618fc74a65cfc04d8c2d9f8d6eeacf2
SHA256 f2d72ce494cc591a41118a0dc9e829276610c5b885e432edbc3fa65da3ac1cb6
SHA512 886994bd48885a759ce34a5d578398a53d3d71e0977c6a7e73b3c7875c0e2eb63d2bf6769d70706257ba55ce8b85369b461207a5e74a8446c7000157f8c97953

/data/user/0/com.restbestczti/kl.txt

MD5 51e728b336d19559f2a3918b904f913c
SHA1 df65c103b78272269d405025cbad4f3370045015
SHA256 483492775c3eb2cdc2e32406638871159b25895d6df0fce90223159b7b42b26b
SHA512 d2c62ab2272efe7fd9b8d6c01f8ba07379d0d749236f79eadeab11e5807976c645bcf7ca9ac1dcabeca003484371b39a140359be09b5911c542e6bd12ec87fd6

/data/user/0/com.restbestczti/kl.txt

MD5 3501034eeb3755864caaa4647472e8c0
SHA1 e0e463e6ac480f3255fb372c09c4b62b4e6b7dec
SHA256 e49e057508d78613c9b482ff14ef4468a9b7c60ccb8428cdfb2c98d0dfa28dcf
SHA512 ce1cc3420efee43611a28880c5460cd3a7ed454abdffcb8b5c1ab41d7bb73bb4ce1b76428f6f0a78f47379bad01d6d792aa449c4874a9a60573efba81015e253

/data/user/0/com.restbestczti/kl.txt

MD5 ac29836c23d5362f14e1c5bdf98c3f93
SHA1 7a7137a3d26405912afd9fcbff16c6754292686c
SHA256 fc9f1dbfcedd28a410dff729784536c7cbaf5eed1f4aa41188de2a3ea45582bc
SHA512 0ac0323cc7ec5f8f04a99c73a094fab7675bbc0f1f7449cdff4be5b17e24410b8c957d098e7ab792041d5eb1f25c66b8657775856fd539a52ce627b7212b562c

/data/user/0/com.restbestczti/kl.txt

MD5 521f90fc6b4b9b78c63be0fc57245038
SHA1 e7e862a5244e673dce94ae2c87edc184457faaa8
SHA256 36f25fff5b850f5bc3fa48efaf0b544549d33ea124f0c6455d13dd654167afc4
SHA512 ded798b67e4ab62f04213e37af7075547bd846e80b830e7f60326430722dd719e041d378145237c30ca0eeee6221b006880be3e6b5096343ebe99bdcead50b44

/data/user/0/com.restbestczti/kl.txt

MD5 527221ccde6cd16a3f34e2a638fec14c
SHA1 8f87a54f2d433db176ade627677fdd7ee0591782
SHA256 fd8b764151a242fc862e39b58bef6357b15988507ac5133ccf2cb9e83d2b99ee
SHA512 f4385de5740f12e663e2fac7c679e06ae4545a50cf82b3832f6fe0909a4bf149c770749bf6a7db06c7153ee732e7b68a6e213ed2b2e35dd2cb11670572b6e3ce

/data/user/0/com.restbestczti/kl.txt

MD5 46d0aa82942bebfc1e2af018565a9da6
SHA1 1e847c22f3daa7706f80f9e8909b2fe0d67b355d
SHA256 47dcce1088e1346d1a82a2b37cc5852269c6c66f6c12ee2c4a7dd780aab7927b
SHA512 8b8ff8ac2d6f18f0313f895bd833c48e264be7f38d728f419bed0f28fb49d54157e7ed2b5d5bdc18c6e471865ebce7b1ce6d98fedb58ea0567c84f11a6174646

/data/user/0/com.restbestczti/kl.txt

MD5 5bb310c515ea565c94de001a8a35b044
SHA1 f5b7b00c44184b39f7bd341089716e3350e47396
SHA256 db62225ae1513cc3f46f072aafb839511e2de54565a3f4c9082801df72bde477
SHA512 c0135f513a6521079b1c4afce2d0062f7896097e990361d7de4d8a9b7d722ccb8ac897803b71f694ff57d84ae7974f2394b515bd2f4fc2bf5bf8cd295310f699

/data/user/0/com.restbestczti/kl.txt

MD5 54bf4f07a1bf6afaba613622589336d7
SHA1 0d3d17a98b7e80b18a1839bb4a301d5d2772e6a2
SHA256 b4550cb440686d481eb5a255e83c3f5bc4bc0567061527dc40dd7631b355e29b
SHA512 3c1251ff20c25d76c3d364531c1ce903714fd4fc69a94471495f445b7d7f067d67fff047f62128c0a659571e92560a33344f49a9a50ed51a57d44cceb3646500

/data/user/0/com.restbestczti/kl.txt

MD5 76573de52cd06c981ac8a06c37e8b0c5
SHA1 8c07ee19977af4561a89c258181ce21f9fc35621
SHA256 b09953f6b185629dd61142f8b22b15693f1d92306a896ddbb83c4c262f56a01b
SHA512 306bdf728eefa6d6efdcc86d9a7bb137f3d7beed5c61faf4ed6ed8c881068ea4fcdc31687dc868cc401dd019d053c3bab129b1b2574befddcb597cd436ff26ff

/data/user/0/com.restbestczti/kl.txt

MD5 99d9722e4ed2790aea0f6d94fcae706a
SHA1 0a3d875b89fde3937c59f72e0471a79fe391519e
SHA256 283ab45a4dda006c2ee811f2356ea8a000e58e6565f6548d89273880f0ff4603
SHA512 a05f7effce508810b4b34ed1e7c97ae92ce4e820d35cdcaf42aa08e84c75128df47e9027d982f284f9c74cabeabbbd499959402227203bff5618fcb3c5cbfdc8

/data/user/0/com.restbestczti/kl.txt

MD5 124e06546110f9d832ed10f0d807c3ab
SHA1 dc4905a5c39a799716169bfa2c0d5b9332f153ea
SHA256 6af4d7eaa24e4a06a6b44a9fc3c54bd810820bfbc2ec66b1559cbb6398b56fd7
SHA512 f1cc154a6ea1d0aa32ed3458619fcc0b8f80317b781efb37ddfed16e4f4101153c65a6c3ac8c472073252dc521ec958589887b40be150826db13f91d7fe94ea2

/data/user/0/com.restbestczti/kl.txt

MD5 99d9722e4ed2790aea0f6d94fcae706a
SHA1 0a3d875b89fde3937c59f72e0471a79fe391519e
SHA256 283ab45a4dda006c2ee811f2356ea8a000e58e6565f6548d89273880f0ff4603
SHA512 a05f7effce508810b4b34ed1e7c97ae92ce4e820d35cdcaf42aa08e84c75128df47e9027d982f284f9c74cabeabbbd499959402227203bff5618fcb3c5cbfdc8

/data/user/0/com.restbestczti/kl.txt

MD5 0d7112be7fa6e0a29ba55351bde805ef
SHA1 f2b87a49f431f8d3e0fa671915864a7132134019
SHA256 d3d46663b50633a7a2cbd0053105b77e940407f078c42927c5ec8cccc69bca5c
SHA512 04949a6be8743c8e9989c204e5e133b705b78885a6a4a987c817b486a0f3e4a3f39b65a2900d91713ef34267f62940423229dc731cc8bae6f6774e7e2a788207

/data/user/0/com.restbestczti/kl.txt

MD5 f6d6a1b1a053eef8af59a2bbce343fd7
SHA1 2498b0756e718ff58065680b0b4035d5b17abf2a
SHA256 9a4466342e37395ce0851c2bafcb807043a05c411573531ffcc8056eb72b16a9
SHA512 819a503736ec740ac130299e7bda67df5ee3b0c694cd3bc3b453663ff74898619c7967c02a116a67aef0a540fc3cba39de6593ef08a7744a983b6f9bbc9befbb

/data/user/0/com.restbestczti/kl.txt

MD5 c8876923c90cb4a065e1b108bed8c1a1
SHA1 bd4a2c0ad1c45e45b4649b764862221de7a289a3
SHA256 c0ee03714118ff2330382095feeacc79b2f7a1bdf79c6fd4f135c49868c24ccc
SHA512 c5e44b1bc7bcd83c991982b100499128a054a2252ab79bfe44ab431f636fb6555bc04358ce3bffd92553277d54cb9e43fdbeb12eb2061df0c2da15070d7402be

/data/user/0/com.restbestczti/kl.txt

MD5 9db18679212a24e9081905c493546e16
SHA1 355f5817f6f5710462c54d424850d9b467790552
SHA256 8f2681e22bb4b151f4723008c997d27b37d1e02827bd4994279d47e3c87a09d6
SHA512 fdc2e11283b300b2beef2781e0e387d546abb3097410a1e995298b61e2dcde310544f20daa677ce9da1cea9111683e7d461efe4e6a9671d88d50fffa0115625b

/data/user/0/com.restbestczti/kl.txt

MD5 c3873bf3bf575417dadfb93c6e86594f
SHA1 785e43c3abd3a490e4076f8115e0bef18877aa4b
SHA256 5f8be5f009471644e2561b235d8b4c67be239b914dfbe33492b1bb010302ed1d
SHA512 d7360d0a9d05e333e1d0206bcea81a862d7752d9fa2093284bb4e5a2ff844bbe59eac426bc9fa859f98aaf393ca8db119fbd8aa0fb3540804830a2763c651e36

/data/user/0/com.restbestczti/kl.txt

MD5 9db18679212a24e9081905c493546e16
SHA1 355f5817f6f5710462c54d424850d9b467790552
SHA256 8f2681e22bb4b151f4723008c997d27b37d1e02827bd4994279d47e3c87a09d6
SHA512 fdc2e11283b300b2beef2781e0e387d546abb3097410a1e995298b61e2dcde310544f20daa677ce9da1cea9111683e7d461efe4e6a9671d88d50fffa0115625b

/data/user/0/com.restbestczti/kl.txt

MD5 59748551ff47e6219fa4d8a93b525caa
SHA1 6b70d8f295c7d28e068a9009f06b677f632ac286
SHA256 18e7d038215bf48cb50ac31b53cbcf823519a7eb4002c414118a3218cb8b9e16
SHA512 fce79e1441ba4614c29e8a37e439cbbe913738298fa005ec166ee7cc34b09f4f36669c4b09c334f44b02b57d9fc030ca1f6568a9291f402365f3bf0c5bebbb81

/data/user/0/com.restbestczti/kl.txt

MD5 59748551ff47e6219fa4d8a93b525caa
SHA1 6b70d8f295c7d28e068a9009f06b677f632ac286
SHA256 18e7d038215bf48cb50ac31b53cbcf823519a7eb4002c414118a3218cb8b9e16
SHA512 fce79e1441ba4614c29e8a37e439cbbe913738298fa005ec166ee7cc34b09f4f36669c4b09c334f44b02b57d9fc030ca1f6568a9291f402365f3bf0c5bebbb81

/data/user/0/com.restbestczti/kl.txt

MD5 8b8104b1cfbe105a4dc55ac4da35e915
SHA1 d17f87b2bbbcf4e76fd56caf273cb5b2194fafef
SHA256 a554121cc8afce5c5a0984187a0428f50988962cdbf80ad2aca275377a4b296f
SHA512 6fb98a2127fdcfb2f97a9573a5a046597a7b2f59ec64734631bf5e0f938557c6f5c7339e245ebb8515e4a9917b90eca0bdba953c1b3a0e404f1afcd36111b78b

/data/user/0/com.restbestczti/kl.txt

MD5 f99d0b37e9844ef94e5190098c1b0ef9
SHA1 419bfddae50bc852a718d22211a6faea46e79e49
SHA256 f339e42c9c534eadd75838079338d69d96dd254f414c60b2657053328b116a25
SHA512 3abc500bd5023669edb84c8c424dcf4a176335484179679aa1d92f9817c31c17ce13961dac29dccd25c9951ef560b759ab9f907120e99fc0b408d79111a192a3

/data/user/0/com.restbestczti/kl.txt

MD5 2f2f9acbbd9e39097230487a30855cf8
SHA1 e6a1564fdf9074e6819a79ebe9161c56e2c14729
SHA256 734a44b3843da917fcfa146cc7cf1b7375b53842b0886ef3ccd7c2cbfa2039e4
SHA512 93cddad1c5733df8bbcb69a616bfaeaeb22bd75019394569c56bb3e5edb7db3343e8de467083960eed8dc0c23aa0b9acc7b89cebc369f46ee9e93d8eb74434a2

/data/user/0/com.restbestczti/kl.txt

MD5 954219026674dabde80c72c16de389bc
SHA1 5a2e7fe47d8642a3af94f9955541f73e7803a2ee
SHA256 7fd7e256396cdc6d4819a35d8e5d99ff1528ebf7aa20f0144903896abfde3cd4
SHA512 f292426139dec3abf692e62a23dc292d88224a90c89cf8d64fd8f7d774cd82ee0009752fd7081ea85b4424717baa7fe68e550a79e1ad63ca1dccd37e4940d729

/data/user/0/com.restbestczti/kl.txt

MD5 4d53a139ef3a855a1ddc7c0b759ac617
SHA1 cbc6812d39a43cc89ad837f698cc722304464c92
SHA256 a470114c4a82ff6c3e1e7a71e7e800252ea302a540c87e18244a1c07458848ff
SHA512 e30d85af9f7312bf0c7f4212a61778fd0b85c73e08c5236ba3db46d2a97c5b910565aa5d93fb3fb5acaf0afbcd4afd9f5dc7685218618ad83196c5e148f6f6ef

/data/user/0/com.restbestczti/kl.txt

MD5 bf481a1bd59f4a41b682572fc019b2c4
SHA1 a0341dcd21ff72ecd4ee14d83eaaf96ed1126006
SHA256 5760b6bf154246b99c082fd008401f778ca687aab9afc9a166c3523da21b59bf
SHA512 2e8b198e20d16a8d2443e31e7bd5e464f1cf40e82f202525664d3defcdf53b8d638d935439b9907013860e9f4d02c1b17818b1bd6568a1829374966801f38254

/data/user/0/com.restbestczti/kl.txt

MD5 bf481a1bd59f4a41b682572fc019b2c4
SHA1 a0341dcd21ff72ecd4ee14d83eaaf96ed1126006
SHA256 5760b6bf154246b99c082fd008401f778ca687aab9afc9a166c3523da21b59bf
SHA512 2e8b198e20d16a8d2443e31e7bd5e464f1cf40e82f202525664d3defcdf53b8d638d935439b9907013860e9f4d02c1b17818b1bd6568a1829374966801f38254

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-17 06:55

Reported

2023-09-17 06:58

Platform

android-x86-arm-20230831-en

Max time kernel

2716797s

Max time network

130s

Command Line

com.restbestczti

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

banker
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.getInstalledApplications N/A N/A

Removes its main activity from the application launcher

stealth trojan
Description Indicator Process Target
N/A N/A N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.restbestczti/cache/ndyrl N/A N/A
N/A /data/user/0/com.restbestczti/cache/ndyrl N/A N/A

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Removes a system notification.

evasion
Description Indicator Process Target
Framework service call android.app.INotificationManager.cancelNotificationWithTag N/A N/A

Uses Crypto APIs (Might try to encrypt user data).

ransomware
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.restbestczti

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
NL 142.250.179.170:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
NL 142.250.179.202:443 infinitedata-pa.googleapis.com tcp
US 1.1.1.1:53 19logites432532s.xyz udp
US 1.1.1.1:53 15logites432532s.xyz udp
US 1.1.1.1:53 22logites432532s.xyz udp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
US 1.1.1.1:53 14logites432532s.xyz udp
US 1.1.1.1:53 18logites432532s.xyz udp
US 1.1.1.1:53 13logites432532s.xyz udp
US 1.1.1.1:53 20logites432532s.xyz udp
US 1.1.1.1:53 16logites432532s.xyz udp
US 1.1.1.1:53 12logites432532s.xyz udp
US 1.1.1.1:53 17logites432532s.xyz udp
US 1.1.1.1:53 21logites432532s.xyz udp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
NL 142.250.179.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
NL 142.250.179.206:443 android.apis.google.com tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp
RU 176.111.174.92:443 176.111.174.92 tcp

Files

/data/data/com.restbestczti/cache/ndyrl

MD5 b0c8229ae4269d198dac8c673aedd0df
SHA1 3b9e5aafa3089f774600882e07a79a827f21e43b
SHA256 84d567023bec71b39488c7bac9a90d4dab05bcc40d1039c7eb6d4acac9163edb
SHA512 4478cd2277d89f6d82a81e858d39e0bc6dbae873678c23befe3eb55bb11a09207a9b34df8ad0d9d1ac7200c70b1252bee0d1e1d9e9a9edc6489999a183a2c0b8

/data/user/0/com.restbestczti/cache/ndyrl

MD5 b0c8229ae4269d198dac8c673aedd0df
SHA1 3b9e5aafa3089f774600882e07a79a827f21e43b
SHA256 84d567023bec71b39488c7bac9a90d4dab05bcc40d1039c7eb6d4acac9163edb
SHA512 4478cd2277d89f6d82a81e858d39e0bc6dbae873678c23befe3eb55bb11a09207a9b34df8ad0d9d1ac7200c70b1252bee0d1e1d9e9a9edc6489999a183a2c0b8

/data/user/0/com.restbestczti/cache/ndyrl

MD5 b0c8229ae4269d198dac8c673aedd0df
SHA1 3b9e5aafa3089f774600882e07a79a827f21e43b
SHA256 84d567023bec71b39488c7bac9a90d4dab05bcc40d1039c7eb6d4acac9163edb
SHA512 4478cd2277d89f6d82a81e858d39e0bc6dbae873678c23befe3eb55bb11a09207a9b34df8ad0d9d1ac7200c70b1252bee0d1e1d9e9a9edc6489999a183a2c0b8

/data/data/com.restbestczti/kl.txt

MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/data/com.restbestczti/kl.txt

MD5 f54867e78a704c2ac516d3817a145bba
SHA1 1689829a2c362f8427f13ce2fd808ceccbc755f9
SHA256 f0873026315f45f4c52fe57c463098968507c5eeb5d93104d1c41b7c91401c42
SHA512 752fa16acb2c4cf07e563ec5cb41e16d821e40d1c0ae3faf1f95d2ab8a6ab366e38e1601a8a24b0f0d33ff360aa7121cf6443fb22772cc680e55a71ddf526aae

/data/data/com.restbestczti/kl.txt

MD5 00c262e8359e7d85e26ccd86f9d3dd6d
SHA1 02930cc42701d4dd7b921fa27d2476cb32c849a9
SHA256 08ca038c3f956c2efa53b1d3e40172e07d4893d8a76c7c456747baee15ef9d1b
SHA512 0ca801c8858d6f9f8152f30adc299a605387f9975c7d75ec024eb553eae7e9b8b375f9d60445682f4d4061e33691ee0063b1ca1b80d2a0d2d8e2eda8475ec3a7

/data/data/com.restbestczti/kl.txt

MD5 19b0ba0dfde62ca1ef503ae7913a08cd
SHA1 317892f6c534c48b9a2a62a05f21f44c04b7bcc7
SHA256 ea0ab29b8d826856230c55466d6c9851dc71f40b94c82e0df66f540cc8109bae
SHA512 6fd3f8a32f882f0a2c913751789c4d2643b8129090382f1b3632d5cbb54bc88d119f34edc1ddc406897e50da15809c66dc73085f020766200bbb6fc520c4dcee

/data/data/com.restbestczti/kl.txt

MD5 a0e8ae9000f872e684057fd1dcb4f26a
SHA1 57a5db3de7e6266871740c6e30610e658b079db6
SHA256 3c39a1d237694581ec93341e90423eb532a23d60dc32457205a4c45688650395
SHA512 ffd19c708cd705e364370bb9d01e4ffae0ad2fa17f44583c8e0c0ba11ecc44af12a5ef733a3ee28a364b651e75779899b004b9f6066ac54001cbbb802ea1542d

/data/data/com.restbestczti/cache/oat/ndyrl.cur.prof

MD5 7e3fa9dd70a423d75a40c944c4fd0f08
SHA1 75946129208b57a7707d6424eda2abdcabc99148
SHA256 5fbc2899a05ffc416256a20d16298216cfbe49f43c403712d6d366435262c607
SHA512 1cbe5c801f97a3658fbf48c443f93a4b63baf9ffd1e6c65d415a7e895412beee7b6d81cc3f515ec513b401724a6d9adeb559e422b297f699ddd2b147c26acf8e

/data/data/com.restbestczti/.qcom.restbestczti

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c