Malware Analysis Report

2024-09-09 13:59

Sample ID 240523-1ywrasaf27
Target 665c30775389ee045d29325a474303df23a624b0be68a606de388cee6dff7f28.bin
SHA256 665c30775389ee045d29325a474303df23a624b0be68a606de388cee6dff7f28
Tags
ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

665c30775389ee045d29325a474303df23a624b0be68a606de388cee6dff7f28

Threat Level: Known bad

The file 665c30775389ee045d29325a474303df23a624b0be68a606de388cee6dff7f28.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Ermac2 payload

Ermac family

Hook

Makes use of the framework's Accessibility service

Queries the mobile country code (MCC)

Checks CPU information

Makes use of the framework's foreground persistence service

Obtains sensitive information copied to the device clipboard

Checks memory information

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Queries the phone number (MSISDN for GSM devices)

Declares services with permission to bind to the system

Schedules tasks to execute at a specified time

Requests dangerous framework permissions

Reads information about phone network operator.

Acquires the wake lock

Declares broadcast receivers with permission to handle system events

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-23 22:04

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-23 22:04

Reported

2024-05-23 22:28

Platform

android-x86-arm-20240514-en

Max time kernel

179s

Max time network

183s

Command Line

com.musezurivowateru.fige

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.musezurivowateru.fige

Network

Country Destination Domain Proto
GB 142.250.200.14:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 216.58.204.67:443 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp

Files

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-journal

MD5 ee94e3e301b45bf771ac506e1b513102
SHA1 1a53130e0f8e8eeb5778d8d99d741a8324d0722c
SHA256 4f11f5d581e1a5a455244f155c271aca2a4aec97dcf49f1b47fd901fb5f89f74
SHA512 980c03ffd79279fe8a3025a50d8aec5f4691aa76da2b64a3b15a0dafd448cd2a83f8e39ee387f5601eb19885475ae0eb33cf52ef80a1e78e8891432252ef0e42

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-wal

MD5 b64327622bc36da8aa0d99670cd31c35
SHA1 6e8d6ae8b2174841a7858d25c297034737d6505e
SHA256 ab0e7680dbb87844bf2e219796cf886ad280457fdeb65f54408e8d824bbc32de
SHA512 cee536fa92be156791798391c4932eee0ce2d6f89129ca9d21e9ec50c00700048c9106f4c1c974cab88b415114c089f958dca068f36e76d24d3d640467a0092b

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-wal

MD5 0ebf657c65de265a9da2c2484690fe27
SHA1 098bd99aa22a2b5a2f14799b3cc9e080259d5e2e
SHA256 6796700a7b6587933b822ddc784012417670235d4eafa2c9fbe5c791c27b2749
SHA512 08091c456e024409541849832d9446e6e112a7731327450df8c839becebffb081ee58797783d96eb0d69fe146c612bfca1a65397e490c199af9d89b9dc83ad8f

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-wal

MD5 cf3e2fdfd9c99d91086784fd654e5ea1
SHA1 bc70f42208b2cc1b51db4f7b26ad394bb572903e
SHA256 77c78dd40e4b81e3dc6bf540703de0c85c060b78b7fd0df233617a29318924dd
SHA512 3fe9f4423ab3939837ab37ba7dd43c5e679241d3a932bac0f568f9c63cedddde3beef8ce9e596a2c32e7cd5c9b00a3a4d91c18dc28d9987379c41f22fd8bae53

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-23 22:04

Reported

2024-05-23 22:21

Platform

android-x64-20240514-en

Max time kernel

177s

Max time network

187s

Command Line

com.musezurivowateru.fige

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.musezurivowateru.fige

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
DE 89.116.27.45:3434 tcp
GB 216.58.213.14:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.200:443 ssl.google-analytics.com tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
GB 216.58.212.194:443 tcp
GB 142.250.180.14:443 tcp
DE 89.116.27.45:3434 tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp

Files

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-journal

MD5 5e268031a23efbc06a10ad485641354a
SHA1 a405a4e212ce06b910e5157fd0584918720d84f2
SHA256 d6a8b11ff6ca697a0560ac09a12d4adf8db13ccc67d428adb943fe8e2251588a
SHA512 ed7de9bad32f68a6ca6de80fd7088fbf21187b89051824b7c41b142fe971ce44209e3dfc4636bcac7fa7aea38f03286b8c1218c927bf01462b84c85c84e4b36f

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-wal

MD5 c609bc189c529bdf4a9000a2a575d1b8
SHA1 2e665c31ded541532628558ca35e308928c2984d
SHA256 e58cb95555eb31b818704ac1b2ff75aaf27cea6849bfb9b59ed9cd8efdbb8344
SHA512 5ec5d1a627b8257a36ca6c31664a22e617275adce4dfe739844ad948ef767a79c11ffb9d514556164582c6038064da72d77240f4a1094b7b89a8f6bbe6c72e95

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-wal

MD5 bbec4b0efeec0e90e90d6c3d764dffbe
SHA1 0084b393ef18bb84d94edd91607e33b98789ec5b
SHA256 056fab5254b26f50c9228972bc555d7cbe3e29ffcc71c53ae12cc4cc1a0803d1
SHA512 4f318508b9c974a16fd934cb3bba5b2d5028a6eef272aeec44f60b470062257cb2d5ca6ae137faff675443acf5f5ff7518c94a9a5cc76b1e0e1b9d5185c4e1fd

/data/data/com.musezurivowateru.fige/no_backup/androidx.work.workdb-wal

MD5 710bf72c8a6457f3357ca25cbb8e3c0d
SHA1 f16efcd4d30fd9d440022e6fbfa5df7d9160e7f0
SHA256 b18496a914b34bf6f160286bbee42cbb6f13a3adce45e275230192f67a8c79ff
SHA512 e1794eb6fbcdc7090ba0c02b567fcc7f3fe0beb5369f06b93edf448c8153ed2776b27f99c87e3944034d1a76dec6ed9035d7a8539d2b63a44576b00993c8148c

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-23 22:04

Reported

2024-05-23 22:21

Platform

android-x64-arm64-20240514-en

Max time kernel

178s

Max time network

184s

Command Line

com.musezurivowateru.fige

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.musezurivowateru.fige

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.46:443 tcp
GB 142.250.200.46:443 tcp
GB 142.250.200.46:443 tcp
GB 172.217.169.42:443 tcp
GB 172.217.169.42:443 tcp
DE 89.116.27.45:3434 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp

Files

/data/user/0/com.musezurivowateru.fige/no_backup/androidx.work.workdb-journal

MD5 d5c1d004a68859afa169a6b58ae253df
SHA1 2dc77965cca53665c5b69a80aa7d26d4e1e75b1a
SHA256 8feb0eb2f55e62a1a8d1ccfbdefc67ffd789d4c48a5436ee1e3f15649fcc4904
SHA512 cd317bda40705d0944cb8d25de5162931edc8a823054e5df82273d776748d183eaa891b460a162ead59e9cd9632cba38da2f61f6931522e3591f34a15b343547

/data/user/0/com.musezurivowateru.fige/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.musezurivowateru.fige/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.musezurivowateru.fige/no_backup/androidx.work.workdb-wal

MD5 41a7d03066386d264c77d1a4b2fe21e8
SHA1 d32c7aa924cdc26562dd5344a34ebf1fa967c3f2
SHA256 c53bd7ae22c83a04e1275b9a4e9eb4c07cb46b9355e91edad64b12026d311089
SHA512 48dbf893f16a8cab59ae04ad58aa4f742e75d7cedde7635826abf00d25c5b179ec2b8644f7cf62a56f8a246835716f31d973b7b20800b7ea432d2ca2978aa930

/data/user/0/com.musezurivowateru.fige/no_backup/androidx.work.workdb-wal

MD5 559d0f130ae8a204ff9e68072354bae0
SHA1 6723fef549f077f17a037b2fed02a08b7f1ec4bd
SHA256 769c25c0626a0108b943fff383bbc4bdca7941366ad27b9ac88790f3ff6ff314
SHA512 e458622e9034ce32b441b516449df3aaa7dfe7b8bab11730477a38bdb742e4ad674934de38de947fd2dd8cd1dfbad87b9906764303102f965201da0dc175d8c8

/data/user/0/com.musezurivowateru.fige/no_backup/androidx.work.workdb-wal

MD5 6cb7e31a746aa12b72e3bbf96140ed0c
SHA1 b0504008e719ae2584fa07fa4d237753b31b3cc7
SHA256 a451559c3fd2bba66b3c39843a292251ef33437af87868d6c74d6116c3aa38eb
SHA512 4bff5f1e99bf9746cead405fd05258c359fba24a6a23b28b4009ce7a6c09a6dc67d55aeb129f38e45192c7e3e1ee3ec2613468416ab5b1b9b40303ba61588704