Malware Analysis Report

2025-08-10 22:50

Sample ID 240108-evta4sbhg5
Target 4a69ebf62a54dcdea0a0677828fa1a5c
SHA256 98236fa9c330434da53e7dee5568213834921891e48b902a1a7ffa5a249cc4bb
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

98236fa9c330434da53e7dee5568213834921891e48b902a1a7ffa5a249cc4bb

Threat Level: Shows suspicious behavior

The file 4a69ebf62a54dcdea0a0677828fa1a5c was found to be: Shows suspicious behavior.

Malicious Activity Summary


Loads dropped Dex/Jar

Requests dangerous framework permissions

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-01-08 04:16

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-08 04:16

Reported

2024-01-08 04:18

Platform

android-x86-arm-20231215-en

Max time kernel

3880413s

Max time network

149s

Command Line

com.charm.guard

Signatures

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/data/com.charm.guard/.jiagu/classes.dex N/A N/A
N/A /data/data/com.charm.guard/.jiagu/classes.dex!classes2.dex N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.charm.guard

sh -c ps -ef

ps -ef

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
FR 216.58.201.110:443 tcp
FR 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ebjvu.cn udp
CN 112.65.70.244:80 ebjvu.cn tcp

Files

/data/data/com.charm.guard/.jiagu/libjiagu.so

MD5 d141f6661f27d70822c7021d752d8af6
SHA1 e545f7442dca4490cb67b745f6f13ed782b1971c
SHA256 e0313c66404c4fb7d023824265ae5a922079d422509d4b59c6fe45632c60146a
SHA512 0b2a4c540c077ed93561f249baa75a65344e75dbfaefdb3a68c0d653d79bb5152fcd42c13f34a87b09583f33f1a40231b4f31416b73c323859885374ca0667f6

/data/data/com.charm.guard/.jiagu/classes.dex

MD5 688d6ba253ecbaff84e7970eddec3b1e
SHA1 02ab62864f8647bf631423df3c526a1da2a09963
SHA256 c06d8c4096525f6a2ca432940fdf8c9bb0b2ac7d70bb1de245683d7fb53585e8
SHA512 807a776a26f829ae8dae0c84e6a8e0c25a4f8970a54c5c6fe548c8951070768abce0ecd7f72f6f0a532ea96acddbce7a1d3d664a2293bca6614ae6004c08a2db

/data/data/com.charm.guard/.jiagu/classes.dex!classes2.dex

MD5 13ed86c05ca106a5428b70bc954893bf
SHA1 f0a758c2e988a31417f02e3b251dc93152c19219
SHA256 2bfd6e69f3ddd6df6200df1e22640777ef24b23e9db2876b15fc573ed6d78852
SHA512 5d643a61d70e5c400f1810b59810fdfea88c6af14260bd30597f48fcc7dff3e54b0e3fdc4cf5c68761165f31dd837f4ea60e4dda806181414bd054dbc81b0190

/data/data/com.charm.guard/files/.jglogs/.jg.ri

MD5 b71e1a9c36f489ef54c180157dc6a7fa
SHA1 1daaad692b1990eaeff5b7a3d8d98a3c89f0797d
SHA256 6139314e34b30ea2b9c4fcc240da1f3beab7fc866288ff60066844a0c39d2f09
SHA512 260c48b963ac8cd6f47591c22c97c448c1f533fd37bf00d8099ba77c6a7c1d865b42c4a7213e615b8807f2d0c1e02bb160c9faa8bd2c4a21c7f44b62df89d66d

/data/data/com.charm.guard/files/.jglogs/.jg.ri

MD5 6e361bf28466b7a572f8f8a0c7f3e4a2
SHA1 83cddb5885925db23bc43b694ffa2b345a3086a2
SHA256 1ce4b118c7c0b1741431801caa29b1ffb0a1317d5656d81b8d77a7958c0c8072
SHA512 d704659e668ff4e0aa9e91639209af1cda4c7fb4e24254818d5a3a7402a8dbe91a0d7d7f11fbcccc51b04f31fd9cb7c0baee6b75b689ca35ed8bdde4e445cc15

/data/data/com.charm.guard/files/.jiagu.lock

MD5 a2039497f5f1795fc395402b35f77345
SHA1 91867a1fa8a3946d302b60e3530901d6b170e90f
SHA256 423ee9918acf61882eaf8f47d27ab3e14b44d08ef3a57cbe4350f620920e2e79
SHA512 69a53e2ebea3e1cf962c57f26f5c5e4030daa1af049312766bf7669a90074bbbca5a74b5cbc021879f574e6dc29b3bc7a5dc92d632d1e4fa061b6f5d327ecf8c

/data/data/com.charm.guard/files/.jglogs/.jg.rd

MD5 a8816d6fe3561e387d6fd23044e1188e
SHA1 e0de618f82e3ad480bdc20f513af276244d57c49
SHA256 c7d1475d480f836adb530f497b6597cd0e7150a3298999c834063fc80a113b8b
SHA512 d4f1e6aa335c138722406b7e8c74cc08547ae6e316a18cde278718bdb574a3325f9d9343a8a7cb02f750a726454ce8f8d53971dd65ce036f943c0cb259a9c21e

/data/data/com.charm.guard/files/.jglogs/.jg.store.report_cf

MD5 4814d63b5a64f7565e6ded7daea31d9e
SHA1 f12a30c5651faa9361bfc33843c816e98b3848a3
SHA256 745503df22304a5a831c8ad79268aa912c2b1a2d4426c7d07197b35844868392
SHA512 3472383463b64c42746f9c74b61f85244bccd3a52c54464fd14c1ae4d3009440219797bf72511cab8ce461b4f58e8a4abd6d8f20f57eda1ff45601e4bb18a885

/data/data/com.charm.guard/files/.jglogs/.jg.store.report_pid

MD5 a840c5a793d49940b43314608db57b45
SHA1 5458a7e6b39b0bb77b1a9853bcbeda0f108513d9
SHA256 e2b3869eecca6c561f22787253fa77ce5a248363a93e6ddd601cdd1ab1092042
SHA512 4f7dcc4c00eaa25d4f3ca04fbf9c3d9fda3349707c05259195de70e235b731feacea1df4986e36139003ba96466e2561eaa7f5526f7f3eab3ed59f76f85bca09

/data/data/com.charm.guard/files/.jglogs/.jg.ri

MD5 963d31f49ce46fa99dbc868cebbcb971
SHA1 35cd8d1db2f4c62e1bcc741711fcad761553ce24
SHA256 b585450b838a35cdc996ef20d8caaf64c850db81381e8435a8e50bb70abbeec4
SHA512 c616636fd3bb0ae57ebae7eea4ff30caee3a94cf7789389cfa1dc37c5d40a98093c0c64ef141d49e0c8f185e718b8233cd4934df4424bf3c7f739b7fbbc14baf

/data/data/com.charm.guard/files/.jglogs/.cl

MD5 069441a3fc54cca1712a2e5df80d7b6b
SHA1 5e91d593123d58d118de297409b7767186264487
SHA256 6474ce3dfa7163a26aaee71e03229676df925c40bc72b03be1d1ed5c24efdcea
SHA512 952e6326e9e036251e1a19dc320f2c9626fa89114edc500bf67d7dc53607b7610a998c982c0a14fa774b29cd4ea96e9649ca53942b7bdc4eabc187520aac7781

/data/data/com.charm.guard/files/.jglogs/.jg.pk.h

MD5 f309d61bff35f9e63c5af590672a0ab6
SHA1 35cee5ef1b511314be3d336828b9202e3d9f9557
SHA256 a157624741059cab581838aa547ada725c9aaaddbe1102a33b6a8931ecd9a221
SHA512 26305baeb3fd7f0e0a7f392360271a93555b488c141922416809cb30f0f851b4b9915b34a04c1f3384effa2f5ad60b43d7f3978d39170064c9ecda7b4b057d87

/data/data/com.charm.guard/files/.jglogs/.jg.pk

MD5 9e49174d58fd344acb6fdccd31360247
SHA1 7e76bd89096f9f1cf124c67b712ee9c7fcc80c21
SHA256 4d977ff2d95d91b6053b099bc0d33a0a07c005409f9f3e5e4a290ca4340c21db
SHA512 4faf1bf914445558ea5c20e5285c7861fc9432aca4a8ef961d3abd0060d6a9a9f0666c71016a8c92ea75acd6e85096e8f70a5bb937fa339c4bfd38ad3ab02424

/data/data/com.charm.guard/files/.jglogs/.jg.ac

MD5 b39e54e49797c995fe34bf62b4882d17
SHA1 e16add4955875311f445e47265d8b77aa68c8d28
SHA256 a63ba0873f380359a083cf4aa3b83dfa40039f38c0fd258ab841981ca5304dbc
SHA512 ff35617a848799607a044aaa2688693796c97740c3075a90802c9a6f3172d774a45f0021cdb37a943faec7627d52010f5381020ff3d8d0783823cbac30f7a7c3

/data/data/com.charm.guard/files/.jglogs/.jg.ic

MD5 f20f4961e89c23f712cbd9d6042b5977
SHA1 509b73c6d6faab2039b5605ee9cbc2aa2b13a557
SHA256 6ef19e2e20538b30345a82957d0ec37efddf22c017693bd2e26ffb99abc085f5
SHA512 f2c7d05d0d91bbd571441532aef3e25191fd7f8e246605a10cd73183ca7811ff98bdf32da77912d2e25dfac337c6c3ab16013af0d89c1774f12fdc1bcc20d768

/data/data/com.charm.guard/no_backup/androidx.work.workdb-journal

MD5 9c9d9e6553515a5140e46ff352c5241d
SHA1 bd92842d36a253a1cd2ee38e9f6bac56d1aabe68
SHA256 e54a390e144d688748492520825eebfeebc33e3c02872bf5c92d6a7e4458bad7
SHA512 934b67f7f95991e7d6e8a195c826e8d3c99c1ff77843ed346ec1255da568f84abed9da9718ad7218a6ce78bb948694302f797defae93e4d5c570864847291793

/data/data/com.charm.guard/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.charm.guard/no_backup/androidx.work.workdb-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/com.charm.guard/no_backup/androidx.work.workdb-wal

MD5 7cb22d73269127382dbbeb78a4006f99
SHA1 27a4f1a74e3306a06bf970cfc73f9e5d3a788f7f
SHA256 218dbcbe6e520616fc32d9598794407ffb02fb08feb7170e483fc20bf56a77d2
SHA512 ab3a8c09ac98a21a30ea4b1ad44077dde492d21a6196dff8175cd08f985425824ee2ae163b81ed55470a39cc3f9b9601b2df8535858c00a83086de48ca8a113b

/data/data/com.charm.guard/no_backup/androidx.work.workdb-wal

MD5 10d956cee9c784ec0f617cc3133d5486
SHA1 e4567bd0e8558fdb786ecc04c4203288e3dac185
SHA256 a1921a38d159f0e6cb6986c0201c1278372bc14f2bd27dade395386989789275
SHA512 3510cb4ff9748446938cd830b03afcfb3d565d8493e066827a0827379b9147974c1089b402206fa39edd602946ac6303faf1366383cf31934ac2cbbc4ab7e1d9

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-08 04:16

Reported

2024-01-08 04:19

Platform

android-33-x64-arm64-20231215-en

Max time kernel

3880421s

Max time network

162s

Command Line

com.charm.guard

Signatures

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.charm.guard/.jiagu/classes.dex N/A N/A
N/A /data/user/0/com.charm.guard/.jiagu/classes.dex!classes2.dex N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.charm.guard

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.36:443 udp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
GB 216.58.212.202:443 udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
US 162.159.61.3:443 tcp
US 162.159.61.3:443 tcp
US 162.159.61.3:443 udp
GB 142.250.187.227:443 tcp
GB 142.250.187.227:443 udp
GB 142.250.200.36:443 udp
GB 142.250.179.228:443 udp
GB 142.250.179.228:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 142.250.187.234:443 remoteprovisioning.googleapis.com tcp
US 1.1.1.1:53 ebjvu.cn udp
CN 112.65.70.244:80 ebjvu.cn tcp

Files

/data/user/0/com.charm.guard/.jiagu/libjiagu.so

MD5 ab3082f1b901e3e2018750e55d7116fb
SHA1 c92e11d792663916939846d0f23f4d2870c5c531
SHA256 2aa120fef404ea25119c4bd8a952e3cd2826f413e637892fe5e9be50834f70ba
SHA512 5741f99cfa0b9ed9af47294b344f6b8bb8b51ff1689c8e795d16163012ec63208baae4fb485cc4d976d82799a504d4f0d23b5d350041c8fd2506d3289727448e

/data/user/0/com.charm.guard/.jiagu/classes.dex

MD5 688d6ba253ecbaff84e7970eddec3b1e
SHA1 02ab62864f8647bf631423df3c526a1da2a09963
SHA256 c06d8c4096525f6a2ca432940fdf8c9bb0b2ac7d70bb1de245683d7fb53585e8
SHA512 807a776a26f829ae8dae0c84e6a8e0c25a4f8970a54c5c6fe548c8951070768abce0ecd7f72f6f0a532ea96acddbce7a1d3d664a2293bca6614ae6004c08a2db

/data/user/0/com.charm.guard/.jiagu/classes.dex!classes2.dex

MD5 13ed86c05ca106a5428b70bc954893bf
SHA1 f0a758c2e988a31417f02e3b251dc93152c19219
SHA256 2bfd6e69f3ddd6df6200df1e22640777ef24b23e9db2876b15fc573ed6d78852
SHA512 5d643a61d70e5c400f1810b59810fdfea88c6af14260bd30597f48fcc7dff3e54b0e3fdc4cf5c68761165f31dd837f4ea60e4dda806181414bd054dbc81b0190

/data/user/0/com.charm.guard/files/.jglogs/.jg.ri

MD5 98aec6859e5eb198cd2cf54c07bcae93
SHA1 b46369bead93e8b236f6d2cb6b2d60e5f7e49434
SHA256 c4f7f63ac45b5bbaa6e8dfd6ac3aae127d970ccacd521101b545a808a0527019
SHA512 a54b6ba9478262ff35e7602cde610218492bca1731661e781edd37ba48670f45cdecf6cc9ead013bbb16df42c8d8eb3d47c6d85315391bcce004969c534b6a3d

/data/user/0/com.charm.guard/files/.jglogs/.jg.ri

MD5 b6abfd39c0bb94a41fb781da2a42fb6e
SHA1 19495c6d8a6649c9db236651568503d8eb131ece
SHA256 04b2fc3e5a4ea99207ad9f615025586d693ed9c419b95a8658523ec5e592912d
SHA512 38b9e6b182ae8eb3d786d0c4328ff6281dbf79f923980e9d72c7ee9c9c55cf19d306a46b468c4c9bb3df07748819e6b1188e2f84afb20237b87ffa3adda259a3

/data/user/0/com.charm.guard/files/.jiagu.lock

MD5 14215ec964d6fa42efe5a29559e9a0b6
SHA1 5bceb8a86f50e23012aeadc969511e6f5bd6125c
SHA256 f4e91d7c2c0d56a6ef1954a80fa09c5d5555b7ba5e092df062775eea1a2b8ccd
SHA512 4313bea7f80fcee667a954b9f002a95f8014cf55aebc8d2c41ab6ab44101c3cb24d07ef11758e643a0885de312b6d086c76432e8fbe3fd3980a9fde0243e86b5

/data/user/0/com.charm.guard/files/.jglogs/.jg.rd

MD5 a8816d6fe3561e387d6fd23044e1188e
SHA1 e0de618f82e3ad480bdc20f513af276244d57c49
SHA256 c7d1475d480f836adb530f497b6597cd0e7150a3298999c834063fc80a113b8b
SHA512 d4f1e6aa335c138722406b7e8c74cc08547ae6e316a18cde278718bdb574a3325f9d9343a8a7cb02f750a726454ce8f8d53971dd65ce036f943c0cb259a9c21e

/data/user/0/com.charm.guard/files/.jglogs/.jg.store.report_pid

MD5 a840c5a793d49940b43314608db57b45
SHA1 5458a7e6b39b0bb77b1a9853bcbeda0f108513d9
SHA256 e2b3869eecca6c561f22787253fa77ce5a248363a93e6ddd601cdd1ab1092042
SHA512 4f7dcc4c00eaa25d4f3ca04fbf9c3d9fda3349707c05259195de70e235b731feacea1df4986e36139003ba96466e2561eaa7f5526f7f3eab3ed59f76f85bca09

/data/user/0/com.charm.guard/files/.jglogs/.cl

MD5 069441a3fc54cca1712a2e5df80d7b6b
SHA1 5e91d593123d58d118de297409b7767186264487
SHA256 6474ce3dfa7163a26aaee71e03229676df925c40bc72b03be1d1ed5c24efdcea
SHA512 952e6326e9e036251e1a19dc320f2c9626fa89114edc500bf67d7dc53607b7610a998c982c0a14fa774b29cd4ea96e9649ca53942b7bdc4eabc187520aac7781

/data/user/0/com.charm.guard/files/.jglogs/.jg.ac

MD5 b39e54e49797c995fe34bf62b4882d17
SHA1 e16add4955875311f445e47265d8b77aa68c8d28
SHA256 a63ba0873f380359a083cf4aa3b83dfa40039f38c0fd258ab841981ca5304dbc
SHA512 ff35617a848799607a044aaa2688693796c97740c3075a90802c9a6f3172d774a45f0021cdb37a943faec7627d52010f5381020ff3d8d0783823cbac30f7a7c3

/data/user/0/com.charm.guard/files/.jglogs/.jg.ic

MD5 f20f4961e89c23f712cbd9d6042b5977
SHA1 509b73c6d6faab2039b5605ee9cbc2aa2b13a557
SHA256 6ef19e2e20538b30345a82957d0ec37efddf22c017693bd2e26ffb99abc085f5
SHA512 f2c7d05d0d91bbd571441532aef3e25191fd7f8e246605a10cd73183ca7811ff98bdf32da77912d2e25dfac337c6c3ab16013af0d89c1774f12fdc1bcc20d768

/data/user/0/com.charm.guard/no_backup/androidx.work.workdb-journal

MD5 19a7dd6626ca4ffecc4a28f989eed243
SHA1 561b49a418fa8ade6ae9d7370db4b8afb05f680b
SHA256 e61252da465c133f9814fc8db4567d5c52a03b93f440d76cbebae8f53e361354
SHA512 28a61c731a7abebd17518d8ac4081615d2483ff5c474c540149f7181976a7572ea43d29abeda1a5ced59255b5a22f1aee0682c5a108f5587c64e8b087aa425ff

/data/user/0/com.charm.guard/no_backup/androidx.work.workdb

MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8

/data/user/0/com.charm.guard/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.charm.guard/no_backup/androidx.work.workdb-wal

MD5 c768b6e2e1108ac63874f3bc552ef7ec
SHA1 10d55aecd86f6b65167e018ed9a192bf88e393e2
SHA256 0e386aa37dc8b4ab44b38d16b9d9458634fc8db76bc13724bd503cacd7ed9ab6
SHA512 1b1c50a315798afe94cbbfed58901f221985a44bdad11352a8e15c535e43c4e63f0c0554226c2c755ff365898ab7268e1f6dd72789c4d4e9b58633332eccbcd9

/data/user/0/com.charm.guard/no_backup/androidx.work.workdb-wal

MD5 0de8e50d168d75acd25b81f70cc80473
SHA1 f1b9bb834f06e4876ab91c57b01d730f576df85f
SHA256 dfb918d0d0b103649842026c3d4fa93868b8c48d1dcf476ba09315d05a7b461e
SHA512 5c20d079525bada72905e28020a1e65efd12d70c79eee5232c21ed15687da43f614afca047e8065447c9b455909fadb9a67fd537c25f36f99730cfb11bfee3de

/data/user/0/com.charm.guard/databases/ua.db-journal

MD5 b107f28f89166699457285d18f687631
SHA1 e6feb909d8263233ddadc3c38169f921cd6e43ba
SHA256 2573c205fe200846984b807801ff108bad66e579a40277a66c652bf3b80bcd38
SHA512 90b6d2440866fd1a6c2181b8d139da3ab3a3f6319060ec311efb20e4a5a247796bb6ed75f69428fb55985d3cfdaaf39bafbf79321af408e9daa3aa0ff28b3266

/data/user/0/com.charm.guard/databases/ua.db

MD5 7922bb0ea4498ea33da5c1b9a76d1c58
SHA1 7b202fec78249284e1033287b14608dd8cf2b39d
SHA256 d0d533814b0aff2e6615d15e7c3379132321eee1eeec64cd01627006fc00d436
SHA512 020acaca076a37abf4784be5ecc7e53644bdce442d7d825b58149f000d1537e87f46b6b44a67ab8f7c8d7695715f8872c8496baba7ac18db09cad6446e9efbe2

/data/user/0/com.charm.guard/databases/ua.db-journal

MD5 57483f18966221de90a4f6cfcf8201df
SHA1 8a167a9550738f17ac9d73c189c9089d9a1b1387
SHA256 e2bdcfeef2928a5e7f86f8dbb029f1ee8f92b21367949e0b0cd3ea3b22e7bd33
SHA512 cee00cf99fe57afb2bf300ea4fd15a656f151700bfa1a08d18eb0e233c2af20492c532368e132d01bd48c365fbceec53c48894a55ddf314fe81ca8350a7cbbfb

/data/user/0/com.charm.guard/databases/ua.db-journal

MD5 99292ce9277934c4286043322a028543
SHA1 ba3a4405c7766c87b0bd6291492320ad8371bb41
SHA256 e35600730f66e00ddba58069c02f3eb29b0a4a81461e27106496775b199e4d82
SHA512 974051922f440ab880bcca17117a35e064cdc01c6a666792fe117f726eeb6f996af3d69853427508bc2a0a53c598636bb39fc948c4ad43f99c8f51477a89b92c

/data/user/0/com.charm.guard/databases/ua.db-journal

MD5 277d841c142fba86753b2ecb22d4066c
SHA1 7b8bf24685ee8f3fe9059031fb4714488313358f
SHA256 6a5d9a9b45613e26eb327c36777ed5e173d7d32346024d3efdf0aadaf3962511
SHA512 e6f18a83d7b8a8755a233199719ab33ad97dfec08e15ae26fe7bface4df7fbd9a94a7a4d0d3b812cc001df5144498bcb23109fd8bc2ba675daac5be0b96d24b3

/data/data/com.charm.guard/.oabugaij/.fsgkea

MD5 01abfc750a0c942167651c40d088531d
SHA1 d08f88df745fa7950b104e4a707a31cfce7b5841
SHA256 334359b90efed75da5f0ada1d5e6b256f4a6bd0aee7eb39c0f90182a021ffc8b
SHA512 d369286ac86b60fa920f6464d26becacd9f4c8bd885b783407cdcaa74fafd45a8b56b364b63f6256c3ceef26278a1c7799d4243a8149b5ede5ce1d890b5c7236