Malware Analysis Report

2025-01-19 08:06

Sample ID 240606-kfa4wabh4z
Target Mech-Arena-v3.120.00.apk
SHA256 7abb6988346ebe05a68e5643f558f4dd11a263455be6075f5b97e88abdd9eaa1
Tags
discovery evasion execution impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

7abb6988346ebe05a68e5643f558f4dd11a263455be6075f5b97e88abdd9eaa1

Threat Level: Likely malicious

The file Mech-Arena-v3.120.00.apk was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion execution impact persistence

Checks if the Android device is rooted.

Queries information about running processes on the device

Loads dropped Dex/Jar

Requests dangerous framework permissions

Queries the mobile country code (MCC)

Acquires the wake lock

Queries information about active data network

Checks the presence of a debugger

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

Checks CPU information

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-06 08:34

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-06 08:32

Reported

2024-06-06 08:48

Platform

android-x86-arm-20240603-en

Max time kernel

179s

Max time network

131s

Command Line

com.plarium.mechlegion

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.plarium.mechlegion/files/audience_network.dex N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Checks the presence of a debugger

evasion

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.plarium.mechlegion

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 firebase-settings.crashlytics.com udp
GB 142.250.200.35:443 firebase-settings.crashlytics.com tcp
GB 142.250.200.35:443 firebase-settings.crashlytics.com tcp
US 1.1.1.1:53 graph.facebook.com udp
GB 163.70.147.22:443 graph.facebook.com tcp
GB 163.70.147.22:443 graph.facebook.com tcp
US 1.1.1.1:53 sheets.googleapis.com udp
GB 216.58.212.234:443 sheets.googleapis.com tcp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
GB 142.250.187.234:443 sheets.googleapis.com tcp
GB 142.250.187.234:443 sheets.googleapis.com tcp
US 1.1.1.1:53 firebaselogging-pa.googleapis.com udp

Files

/data/data/com.plarium.mechlegion/databases/com.google.android.datatransport.events-journal

MD5 f52974a815cf9bb3b3f5155a0bec2ef6
SHA1 9d0c8b014d67455a2b19e7cb31c663a4e6c3f643
SHA256 83d6bbe0d9080cd3780e299269897dcbdbdcffc23d0685ef8ebd3151a5c7f494
SHA512 54f331ea0feca8440283ea43c40217ede8fe658472355b2cc0b26371180b2d869b4bd74e169c090a8e0e8eccb35646868bff578e7eb03bffba080d65aafb5650

/data/data/com.plarium.mechlegion/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.plarium.mechlegion/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.plarium.mechlegion/databases/com.google.android.datatransport.events-wal

MD5 0c0cbdbecc9fb7dda1a7e1e57cd1407e
SHA1 7210d8fa9c0353db03a14fdab46e7bd668121df1
SHA256 ad0ad4eba11fd1aae954df941c9b8228ca7ced8411fa1f9c91f8cfcc7ec8af51
SHA512 32cff711ff9cf07679d7f48e3e54d3c87384677152c99b3eca87c18f197ec225063bfa343276b0a1b8d92295d3eb394bf2bcca96c7a25b69b6871257da0c3a13

/data/data/com.plarium.mechlegion/files/PersistedInstallation4649718221345303146tmp

MD5 2d452a368d1f6cc10cb26d238c5a7039
SHA1 917ac01dda1e783a46844c6040b0fac88d438583
SHA256 0bb3b91253dc7e59f9892bf7b3f070973fae307bd9bf0ad35b870039b30ae906
SHA512 06c3e6465c0d30dcec108d2dc26eb6744c12ffa5b38bd143b84dddbc7be40ba11b20d49b36b28db99ec12e6804d7775eae28acddd83359de1fe48605344817d4

/data/data/com.plarium.mechlegion/files/.com.google.firebase.crashlytics.files.v2:com.plarium.mechlegion/open-sessions/6661772D01C6000110CB1D3DA4707685/report

MD5 8d3144bc4a0a3af1e9a134fbb80eb2ed
SHA1 7ef3aaf5396daecde392c8c52f6dc742e065f08e
SHA256 e1d292be8ebb46f232cb07240007b7368b84e4a44fc17508efd8da5c52b43d9f
SHA512 2abfa057608657cc41e0d069a1b9d0dbd467274afa05add38505bb364cf28fbab1f7c70e68b1beb426b9f653de8ab1c1b08a1b07f0ad390f308f8ef08020b043

/data/data/com.plarium.mechlegion/files/audience_network.dex

MD5 9b8164be4f0ffaedadc82125e5346c14
SHA1 c4bf7a6383958b493ed5c4dd6a19862d366fca4a
SHA256 8e632284c9b0180ef28e309b4b0f282ef608cfb9d9046df899d8bdac227ea9ce
SHA512 352b3e9ef70839d0850ff7ca4a1f19f3df546412ae5cac1243a80588e573fea6371edd4c408a2edf1b48d70a10a5cb579513d3cd38a4b5ccf4b7528dd28704a4

/data/data/com.plarium.mechlegion/files/.com.google.firebase.crashlytics.files.v2:com.plarium.mechlegion/com.crashlytics.settings.json

MD5 57765b26e87caf01aa65ecf90bb50d42
SHA1 2529a8576c22ee1bf0e888ac28a59a6a94cccf13
SHA256 1158ba220036189e0785e0ab96834f9e6b441a172948542b7af72555d8e07ff7
SHA512 8e1d64f64fa83324c42ed7c844858e4cbc5dc5a5baa3b9f93fcd4996d71dc30b659915b4199365d2482dc2b4871dfb1a26485a5ad0343c55d84ac55ed2f05fdd

/data/data/com.plarium.mechlegion/no_backup/androidx.work.workdb-journal

MD5 af06941d15ab09677850a0ef04ce38f9
SHA1 76a4f0625bda29136f1cfd0b0f084165108fe61c
SHA256 f15e80cc2fe72a47243b7aa79b0e0bd9768a684d1004293de53f24fe0a8162ea
SHA512 a5d89af028f76f59d47833c09cc68b9124abf396c7fa127525778fcbf7fe23cacc51a2629d5500ddfad242d30aae222309d3ec876a2cfcb09b9280101138f6cd

/data/data/com.plarium.mechlegion/no_backup/androidx.work.workdb-wal

MD5 222e659ec83522004987520d22e0ee01
SHA1 a4fd9218701a68bb7d0e08780fc33baf323bf310
SHA256 b3cef9ed0735bc980060806eeaf5618524acad010c64b3e3593c4ce4375e87c6
SHA512 5223e668674e49cc7b65dbcd9dfd776ad9574c0b33c63ca24d857cb98ecc2a03a8393d2817f2cecb2a56f4f9ad8cde641a10c9622014fee5cfd2889e87d9b0e5

/data/data/com.plarium.mechlegion/files/datastore/firebase_session_Y29tLnBsYXJpdW0ubWVjaGxlZ2lvbg==_settings.preferences_pb.tmp

MD5 a65b9b3e4670dc3b48a9609f816ad531
SHA1 682a73f2c248815fba0cb50c45031a53d6f8dbcf
SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
SHA512 6c06e6791dd41c1c8d8e0246e9bf7fed81dbdb5e918e7dd78cc2af1f002f8a532ec28335b229a0ec5c1ee220861092cb1a7c7f4060663394e420d80ed391179e

/data/data/com.plarium.mechlegion/files/datastore/firebase_session_Y29tLnBsYXJpdW0ubWVjaGxlZ2lvbg==_settings.preferences_pb.tmp

MD5 06bd63584cc699cbc92ade3aeab0ac42
SHA1 e21167e5419847271e7f67b3b286916b8124165d
SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
SHA512 675f177e388425023df5e19cda634ab1e7673681feabfa7bb860089105353166491d15b8c86b5408833230dc5b0ac43e2b5a61e1d36ea0b40d6ce7166bfc385e

/data/data/com.plarium.mechlegion/files/PersistedInstallation368266068131997130tmp

MD5 1f77e14291af81a3797d87bf518bec70
SHA1 19491c8253c751230f6dd4a9f7ae3ac7af652c55
SHA256 5bdf562a4414cb436617d9aa2c275a51b86406155ec26568b36eef112596771f
SHA512 1b1bbe4f4f59f29666e292ef003ce7912d8c4ecfd0e9df1a11d28722d70d7e372ec6213d5afb1cbb430f1e1886a1c4206d3488d645d4793b1bc62dfbaf38b6fd

/data/data/com.plarium.mechlegion/files/datastore/firebase_session_Y29tLnBsYXJpdW0ubWVjaGxlZ2lvbg==_settings.preferences_pb.tmp

MD5 1fbccf7b936a9b713de5d42c6d8a075d
SHA1 7c8bbdf9151e7f53e2675329d471e552446e9ad3
SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
SHA512 b9177426b3facda6d86b5a83d05805a4dd2f5357d4979ca7282a13ce3f08ef7e7a0c5922675ada826bde264450b1b4ddcc54eea4de62249fd3eab1ec9acf32cf

/data/data/com.plarium.mechlegion/files/datastore/firebase_session_Y29tLnBsYXJpdW0ubWVjaGxlZ2lvbg==_settings.preferences_pb.tmp

MD5 14770edbc1290230aebe82f8dcc730a0
SHA1 f86874de3ff45c2dd7c982f9ada6b5fc979f082f
SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
SHA512 c6be6c93262e0c42527722af20fdd3be2c9936eb601280c36492e0bb2151bb63f88bfb150690ae361c75d01a33647c2440bb49e290af38c5c5af5a707320e3de

/data/data/com.plarium.mechlegion/files/datastore/firebase_session_Y29tLnBsYXJpdW0ubWVjaGxlZ2lvbg==_settings.preferences_pb.tmp

MD5 ada844228c330032508fa05e8112f71c
SHA1 e50f98d22bf793b7a1cec17ca0a5c325a493cc15
SHA256 aed2fb0ecc7ee2893ffea705f98007b132426e12927540c747b00e5a3a17a6d6
SHA512 c3b9d3737a4193e21f817020aa11b966a00bf92b4a7194389f99d9402f7012864b79d9d63014596cbe4880276ea7ab8cd2dd01fecd3713049a9a11d5b9e4aeca

/data/data/com.plarium.mechlegion/no_backup/androidx.work.workdb-wal

MD5 4731f757f170be0a681ab35f301663cb
SHA1 e8eeb144164db793f120537a6c4527204e78f713
SHA256 2a1e5c39067c720221c039514d417ba5dfe03decebcb8dfc33989381b6c434cf
SHA512 e292eb61935d80202d571fe8fcf17bf95f1393f461c94ca5b3bd7373102f81ecfe1fdaeb72a2162d136e6e5925d6117bb8250ba7e6a78583fe1bd0f331ea0ffc

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db-journal

MD5 86de150f17955d09fb4987713d621048
SHA1 12a51ea55337db285b0d3d3fd521c3fbd3a78378
SHA256 c57f4193b18d58714eecbfa6dc95c80b061e5244d21b9431c5995fdd3f49551b
SHA512 d9c50e9b27ed951c58f40dbd448442c1297bb41bc06fbb1f4da2fc0ddf5a5551fc80ccc5831382bc44f609af1f0682960008176487a6d2794e53fa5130361930

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db-wal

MD5 63a5407fd1437405945d1663e7ea922d
SHA1 9a16fcd4de6e8eda7997b9603573d5382fe9ab46
SHA256 e3fad9bb072ac2f2ce10da1f9d155d8bfb7c8308833e8608cf5014c09dfc9b9f
SHA512 c56e0a8ecb26397ac325b783356c2e1734e6d2be3ee65ba3ff65434b6c5eaa0af8023eea246a3e6f662c02fab58d441010a0365233df5309f3c89327d2bc9211

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db-wal

MD5 89100753a9c11af8e5bb7af0fbf13fc8
SHA1 cddab7cf7f92d6d16b58abd44a0e8de6a3bca9b5
SHA256 450c4b177d2194c8b0fe58d206f2eedeab0605b7c2f2f50f4f7d6fa643541021
SHA512 292d2c5f64633bb1bf80dc68cd1348c43448d37dc0e52f756d0800e62dead44193038a6b09b3da10e783cccf780e310b71d05ea15787958ae73025df0b98d3df

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db

MD5 7bee4ebade6aab981d1e7654b276de07
SHA1 a8d79655bfb36953009cac0fd088bed007c13e00
SHA256 de252d0bb42069319ef9b900c53328be760c4cf76ea529dd9fe9fed42a0b2b52
SHA512 ad8d12ae3c3c00cbf49bb0701a145800d4d38003c595af277813ac3ef74ee83fde92465085f9fdd44e0fc6d7252b78031fafbe91fd475608447816e70ab7436b

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db-wal

MD5 d2be4476b71882c700da8f8333c37811
SHA1 49ac60ee509c4ac84f31885bf26eea1673f6aa2f
SHA256 6a2db020fb8d82d7088f8fbdf30fcd366a596a34c601e632f9b59ff83080b4e9
SHA512 e642425947b15934b49daa56ff94d32b1e17c8fb56d2d6ef57a93870ca1803d1cbb084136061769cdb5ee1d5d00e23809a1701ee516a113719888bf846451b74

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db

MD5 e79dcc249080d040ad6df4937ab849a1
SHA1 3d129d4a7cdaf6ab4a5ebc145146a55f58cda999
SHA256 23b54bcae07b7717bf60ccbf665d9c5bf2583ad2a2dc0ece07e5b3506073d637
SHA512 2edcefadc9881d71a84333f0becef5ed364e657f64b085323069e5c33e51a74ad4187732f9ab9c9f7504eea4644f8ebc21fde34241853d47c1b16d85bf80fb6a

/data/data/com.plarium.mechlegion/files/.com.google.firebase.crashlytics.files.v2:com.plarium.mechlegion/open-sessions/6661772D01C6000110CB1D3DA4707685/userlog.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/data/com.plarium.mechlegion/files/.com.google.firebase.crashlytics.files.v2:com.plarium.mechlegion/open-sessions/6661772D01C6000110CB1D3DA4707685/userlog

MD5 56f1b377a193e2c11e29ffbebc44f758
SHA1 bfdb39b68b4c4f8fbd8f49185d4294f582140f45
SHA256 c214aaf0dc406d7d200d964e22666785aa7f37975af937c11d9ed8c434c5e1ff
SHA512 85f09b314f040e52985b7555a651cbc52de51ad725022cc2e12197aecf5a2cf6226c036ea4e9d879c1c6532c1a2dd730bec8a62927a650d1137e59c05b200a1e

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db-wal

MD5 0a92395d3e57737e23b86804427b65a4
SHA1 fa01154150a8a3dd1b9f2e3c25c683e717b05c6d
SHA256 db9a87105b94bdea646f588e38205a363202732474997136146f72b289860a86
SHA512 23fc9f72bd14d3c10ae7b8605b04d7c7c28ba1875bf40f94e27b3a1b4befd74c37bf033dad83138b38e8b3dc57d49fc43b80063e4663ce64a0b00d72908f1890

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db

MD5 a0328323e1f6adcc409b9aa7787b5c43
SHA1 dd9939c78e241809bda1f9bf13d33cad4db006d1
SHA256 04f2091f98567aed91bfe6044356fbf3ea8a569b12d0bc291608afa3e9ba8190
SHA512 127528ca9b224aee17b8abf1fbc5d35cb759cc8993fc07c81b212fe09e4849db72526cbdd5737b4255c730b706f9c9eabd0edf5427784f4b2c0f09db7537e370

/data/data/com.plarium.mechlegion/files/datastore/firebase_session_Y29tLnBsYXJpdW0ubWVjaGxlZ2lvbg==_data.preferences_pb.tmp

MD5 e92016857d979bd5b64ee95b990d0bdb
SHA1 951811fb42a642a74f5e471151ba88d00401d639
SHA256 f48eeb7ce4ef0dd2bc1b97fae3754afe3f6b9e3f8edcaa29463e8b56cefde3a5
SHA512 eaf027122a48ff0b424b6bbadcac5700726e65f40ec9fa11447e814ad9ecd866c04748acab9fd91ae17b98f8b46e9b5cec9c309a80f36ca393c96b9c11963adb

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db-wal

MD5 5cdbea4efaacd54bcd8b982531038427
SHA1 28f51505789c0c0561b71631b3392d94439465b3
SHA256 e321fb9fe1a62055cefe69839e41a3c0de9b2ab53284cc0a88f891e8962f0242
SHA512 d0aae6c80ceab5dc700e4153e3fc4a42a81e64b23db62bddd16ad2bc84aa9f77d4b674c8297805007c66379c21eb43fdc9d683cee10e3cbda460ac34a8c48f8a

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db

MD5 e0f273fe1e50fe310e41feea8044b794
SHA1 790ee8194ed6f9ecf305dab7cd64ace0cb7bec11
SHA256 1093d7bbb6ef9ee9559436ee54f38e90e8f743eb907356562a6f5eaee9646da0
SHA512 d2fb3633bb042475d4cc8f74f865d43e6c714d271ef34e863e35b5e6d3c67439234b95e3d0ff25e4d8f805ffce7fd4113e9dec5d19373c64c40f1b33130e03ba

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db-wal

MD5 d90b8105a6373b208e99f7c5b3ac00e7
SHA1 66b28bc53e672efd663bb6d5d42466bb201cfcde
SHA256 9187ab182eee25c63cd6a09ff39fef29e3b36c31fa129c9729bca43c91a7b1de
SHA512 fe4598796544191420cfce39901f16203f56b728a6cb339b02dce4074a94caf8ca2de6bdc84173e65b14777fa6605f7c98a328ae45f6ffc31ec32e09f7c914e1

/data/data/com.plarium.mechlegion/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

/data/misc/profiles/cur/0/com.plarium.mechlegion/primary.prof

MD5 d19ce5c5a5655a3f3b1dfa5aef6c2aed
SHA1 1e57e0ab35fad9d038d48b6dbcb493e8630e0431
SHA256 6db2c92464bac430dcdc3ae35ece82bf606ad9d485c5fa571f718811bf6fc7bd
SHA512 fe34a0e1a18cd00f3895bd9248f7e4d1ebd2948ced10bc30a51ebe657b02900d8ca464a2ef7d0001fb9c5277f740a56a21537f9e74f87c1195e512a2178100f9

/data/data/com.plarium.mechlegion/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 e6e63a2bd404033aaea8fe2b7ae90617
SHA1 3f95b092206faed799bb43968fb6955383915341
SHA256 4e8a166e1e0f018cf85d5da23f4bf212a37b066eb345a5e3fd39e4d682760b11
SHA512 547b784d088b60542068ad3007a807211c55d4e820f06b8f7d0a54065cadb0935f7b4216575178007af2eb7087b26bc288bec28dd3fb408d1882def7aab17419

/data/data/com.plarium.mechlegion/files/profileInstalled

MD5 27b70fe66f48064d4a2e24037083530b
SHA1 a5ba706753ea093df852ee8b341ca7c7876e13b8
SHA256 0e9b4c0cc47b3a1e735925b42c8cf8bf36b86ec8800ed7d7a3f2c3e47fece065
SHA512 21a7d9ae112427c174e8981a47e1b768bde0290d5e6e89cfffebb0ce0f54f364443a58e025597c112de27aaac9d99ec721323cb8c37e462852cc980d72c75aa4

/data/misc/profiles/cur/0/com.plarium.mechlegion/primary.prof

MD5 bb7123a7403b1afdd1703feb514b03db
SHA1 8f6a0aa5f137142d0e7ce23ac0cf1281b1863581
SHA256 fe5228db121c6584c24cb16568b1d2123cfe037a1dc1acd797704ef8dacab0ed
SHA512 5e4fa6c25e53d74722c90fab4dc3e6612ae83a88d2bf515e7fb0067792bc70cd67f9db7b87e81fc37969de88d8a35324f314ebcbc84effd365f1716352899fb3