Malware Analysis Report

2024-09-09 13:35

Sample ID 240612-xw68gawfqa
Target a1ec349f393e5b600905fa5d0c512421_JaffaCakes118
SHA256 7d7724c358e480136276f0d09ce84dfa5f434f02665c0917d8f41931b91c7d38
Tags
evasion persistence stealth trojan
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

7d7724c358e480136276f0d09ce84dfa5f434f02665c0917d8f41931b91c7d38

Threat Level: Likely malicious

The file a1ec349f393e5b600905fa5d0c512421_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

evasion persistence stealth trojan

Removes its main activity from the application launcher

Checks if the Android device is rooted.

Makes use of the framework's foreground persistence service

Requests dangerous framework permissions

Checks the presence of a debugger

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 19:13

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 19:13

Reported

2024-06-12 19:16

Platform

android-x86-arm-20240611.1-en

Max time kernel

14s

Max time network

131s

Command Line

com.hashstudio.eduwaves

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Checks the presence of a debugger

evasion

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.hashstudio.eduwaves

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.201.110:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.200.10:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/com.hashstudio.eduwaves/files/WmnhrHcDh

MD5 21d492ca7038b8c4ab7edf078dff735e
SHA1 1d4cf3cc30c703bf21b9c49c7ac2133e7fb1070a
SHA256 47a2c75dd39dc013c83093bc735b0e14641d926feeec5ab3b8b1ec02dad8913c
SHA512 0a04af9643753f2afb2451e2e09e05dc35c0c1806991ceae7216a14c0457cd8c954fb5bc6acf77d48ec1408a764b70b51ffb874b9173d0061b4e19952e8495fa

/data/data/com.hashstudio.eduwaves/files/WmnhrHcDh

MD5 35ae6a224f1ad5e20b5dbff7e0ab231f
SHA1 daf1f3d32c0cfa2deedbc42de824368099e46406
SHA256 77326d6e4677cba4f5803d7e4d84436fe8e9f56a04309c1d40324f387fefb4a8
SHA512 2ffd18bd07ac60e6fb16922c0cd7cb22abd7d7caefa18f59276ad031dd499cb32e64ff7fd1242a344e53af25a72a723de05c29d2240a9ebdd71e50fdacf29ba0

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F35E0227-0001-10DB-BCE797073A2ABeginSession.cls_temp

MD5 bade03e60d941893e45a8d50c9f46a45
SHA1 2438697c54f454d6fdc8267a62edbf81ba700bb4
SHA256 f812c585c53bae468e5dc2e7370650ecfba4e8bf6344c2aaaf35409fc5ac07bd
SHA512 c53492732a75968f4b795aa11db72eb376ef4bc33e8d3c5e136bd0aca831231c9acb5f6189f3738c3bff7fcde48575a1f6597a88e66bb367b945cdf91163a3b5

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F35E0227-0001-10DB-BCE797073A2ASessionApp.cls_temp

MD5 b3d9278fde8063592cee5f65f022970a
SHA1 378e74ec195b67a07dc0ded4db5a0a78be46da4f
SHA256 6094432ef7c43ff126fcabbfd8d9be54b142ea89fbea8bec260ed31136fda734
SHA512 a6a36d8b66e3453e712b0b061ae8cea9077b06cd930b77f2ccd12d81f1af4cc08833ad0ba386ac029e693519500c28154864bec8e501db60a14c13474fb35684

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F35E0227-0001-10DB-BCE797073A2ASessionOS.cls_temp

MD5 9b3d4522944ce6396563812bfdb92fa9
SHA1 6d2a6133c8f01938a48ccc77ef86ad8ca335c020
SHA256 d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9
SHA512 091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F35E0227-0001-10DB-BCE797073A2ASessionDevice.cls_temp

MD5 3264f92f8e55f03b7b4e3372e8d5a219
SHA1 3af9818dae50e5c95df3574a30891e2bd3fc0d75
SHA256 463e69373c91368f9f059f661ae3fee53e2cf1947d59efbf17ab9fe42cecf38c
SHA512 26a9edf51a87ed608def912fa4a2f723281bb3769486cefe9362536d0d8d68e465cfe54d298d8da2115027b97a856ce22b46b012df8859881bee138292dfa31b

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 71247391d5d151a87bf11792ae0ed040
SHA1 3f6d1ab86bca357d0c9ba421bc9b90ee9032fdb5
SHA256 c092d021c68570641cdce04f0bd10b1fe96264b2cbed340214b77832ddbe6092
SHA512 b1ab18132e98eea3039a53018e3edce566c65580604d95376c5b1b9319676e14d2a31286f0005ee53c8aabb025625d4632841e969520b64c1c2a437a40ea5570

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_bfe20266-9c50-4bd4-a8bc-abf3a675e634_1718219615761.tap

MD5 afef98077c305d64c11d6e2850f2ba9f
SHA1 75bfbf48747f2dc9b7dcb881f1f8ef0b1edcc0e0
SHA256 aae917e3fb85ddea1085efc252e3d4954877053e1dfa8767d033b304163385bb
SHA512 1721682e95e41c2e1d23b946d7aad9a62edcea1f87bdaad043527e7a3d6066eb0ecca5b758b32983d8db6da37c0bc5c5b18b689f6b730ec12d1d217e671e5ac9

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 7f47ae688f8e2d2d034d1a920ca5e6aa
SHA1 fe7e746b9383e8e43c527af54e3c4e3048081ce3
SHA256 0bf2c468658831f017cddfbafa362798eb1d2b24b1bad39b467897d4dd4f2f1f
SHA512 bfa973c1e42a20779da203590e1c45a4de7874f6923619c0d533676d47d346ad2bb56f57d866ba35778929627661833fd0563052f29444c5f1fd4320f8ca7c69

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 19:13

Reported

2024-06-12 19:16

Platform

android-x64-20240611.1-en

Max time kernel

10s

Max time network

187s

Command Line

com.hashstudio.eduwaves

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Checks the presence of a debugger

evasion

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.hashstudio.eduwaves

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.179.234:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.206:443 android.apis.google.com tcp
GB 142.250.200.14:443 tcp
GB 172.217.169.66:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.204.78:443 tcp

Files

/data/data/com.hashstudio.eduwaves/files/WmnhrHcDh

MD5 21d492ca7038b8c4ab7edf078dff735e
SHA1 1d4cf3cc30c703bf21b9c49c7ac2133e7fb1070a
SHA256 47a2c75dd39dc013c83093bc735b0e14641d926feeec5ab3b8b1ec02dad8913c
SHA512 0a04af9643753f2afb2451e2e09e05dc35c0c1806991ceae7216a14c0457cd8c954fb5bc6acf77d48ec1408a764b70b51ffb874b9173d0061b4e19952e8495fa

/data/data/com.hashstudio.eduwaves/files/WmnhrHcDh

MD5 35ae6a224f1ad5e20b5dbff7e0ab231f
SHA1 daf1f3d32c0cfa2deedbc42de824368099e46406
SHA256 77326d6e4677cba4f5803d7e4d84436fe8e9f56a04309c1d40324f387fefb4a8
SHA512 2ffd18bd07ac60e6fb16922c0cd7cb22abd7d7caefa18f59276ad031dd499cb32e64ff7fd1242a344e53af25a72a723de05c29d2240a9ebdd71e50fdacf29ba0

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F3630106-0001-143D-8032EA57C283BeginSession.cls_temp

MD5 7a77844ed7d5980daf215c4e2aa686d2
SHA1 f3410cecf2a50e0c45eeca712f3eb04b91fabfa0
SHA256 cab1044f25d6fe57b6b84a4ca85ab3db7f180488a790bb6589117a9172e18b0e
SHA512 d1a90335e51e0aba10362cbcbb30883a584f51180f612661b1d80e9335b7f958816a50c7c07754c079c0dceb81676a2d69ab7fed1a1323304eab52358436e8da

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F3630106-0001-143D-8032EA57C283SessionApp.cls_temp

MD5 9e73a6c0d0fd11e2cf6c4921d4c6e59f
SHA1 3fd162607a315d268bcb7cec3b99d573e1e39542
SHA256 851ae827d370a962344986ee0b792043299876be9472396a05d08abbcc577a90
SHA512 8f15df57c8ec398d4eeb9e4d877b43d53a53e6c760b2b6e9bb4580cd63a2a80d5696349afdc66f02274ddcfe5a95ba35d6a2ace3f38c65a27ae28e5171869d9d

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F3630106-0001-143D-8032EA57C283SessionOS.cls_temp

MD5 2566d27ce8c28d8961f082c375d7535e
SHA1 92fe585b1a2c9c523d2fa1f65ab5c1b6a1a6edaf
SHA256 5acdb54ddba2e264f6822fbdbc4e9b5158f57d43785c2f01d981956b18f7a90a
SHA512 1c70679bbd25a57f9ac02083d5af0fe72b1417cf3070a195497f03d6f492e87b1ed3f570de7ea7c814c995a1530e32610d9570f31a480648f4062e8d3287be8f

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F3630106-0001-143D-8032EA57C283SessionDevice.cls_temp

MD5 76909bdc456a04543ab0991ea2621c28
SHA1 6c58a7a5c6017006cdf6b3cd6aa905ba5e718d88
SHA256 1c17d0d03b5032a69a5333ca6e20cb501a56a7d6ae7da9cc71677a1a9d7d1d9f
SHA512 aeb5dbdee599148264c98636135072624ca492f35ad15c6a19b1e8ab8db6b071ab86ad609f93ebde4650c29c2271b8748af26073a11481ee44e2e1bac87799c1

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 138608920c1b19bf9af73e40030b604d
SHA1 55236e3e0cf63c570cff95e49f5227207acf525b
SHA256 374dbb5945892555f70c3c29b35f0e3884c88539fc791c70b8f8821f96261c15
SHA512 5b191a7e4c6522386649196ab5ae0d7a76d67a318e9ede15d905e902b4118a883a7b7098cfa4b1b0e2208502b347be4e6c8f271e83ea68bbc66270f8ac6d6ddf

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_8ac1d263-2a1c-4334-a040-ee84db5ffa08_1718219621428.tap

MD5 6e105eda9f7302c53249acee7d420aea
SHA1 d41448d179ceb52d8839fd6d0eae1e457499aeac
SHA256 6be63018d71bebeecf5642eefa4291cb9f542a9055a1cd04341b48070220bafe
SHA512 4a85c739b339b5db0d49fa1c4df39a2f59939d04a4721d0d26a98c551d917a3f773b7b589073922c4bc0ad75cd472494189927abf4082fe3073921166f07c61c

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 55610e443022df8e7ae9cf899edf6de3
SHA1 4ffba0f63b2121ff267f4a9ec2b413854d629338
SHA256 f1a2101205a396ff4e98a44f5a1fe16f0a60488fb900ad118a640514331c5c37
SHA512 113b880f967b6da60616ba586e555ddf8896ca208dd607e49c0b573d56da854c84473deab604a90c7f7a3da8a4558bdf8f1a5a889dff0fbbd9d3ae4233cb9971

/data/data/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_1b87b09f-1a58-49b7-9a93-486d32cc6a63_1718219626048.tap

MD5 4c0a3cc8f0f81f2d1c718d5561ad10ed
SHA1 eeaad61ce59dcf9fa97e5e23d4aa8bbd0a593a93
SHA256 3d7f27e8a4210a8b4a3f222c4a05dee4fd1dedb997ec316be87025c5459d8f6c
SHA512 4057be28bbe9200738ad645f66430339865ad3b47691eadd6db40ffa26a21c3c8044d44d674bdb018bbfe1aee2ed7b283564ad6f241745e49c57ef38c73f23ad

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-12 19:13

Reported

2024-06-12 19:16

Platform

android-x64-arm64-20240611.1-en

Max time kernel

19s

Max time network

132s

Command Line

com.hashstudio.eduwaves

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Checks the presence of a debugger

evasion

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.hashstudio.eduwaves

Network

Country Destination Domain Proto
GB 172.217.16.238:443 tcp
GB 172.217.16.238:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 172.217.169.68:443 tcp
GB 172.217.169.68:443 tcp

Files

/data/user/0/com.hashstudio.eduwaves/files/WmnhrHcDh

MD5 21d492ca7038b8c4ab7edf078dff735e
SHA1 1d4cf3cc30c703bf21b9c49c7ac2133e7fb1070a
SHA256 47a2c75dd39dc013c83093bc735b0e14641d926feeec5ab3b8b1ec02dad8913c
SHA512 0a04af9643753f2afb2451e2e09e05dc35c0c1806991ceae7216a14c0457cd8c954fb5bc6acf77d48ec1408a764b70b51ffb874b9173d0061b4e19952e8495fa

/data/user/0/com.hashstudio.eduwaves/files/WmnhrHcDh

MD5 35ae6a224f1ad5e20b5dbff7e0ab231f
SHA1 daf1f3d32c0cfa2deedbc42de824368099e46406
SHA256 77326d6e4677cba4f5803d7e4d84436fe8e9f56a04309c1d40324f387fefb4a8
SHA512 2ffd18bd07ac60e6fb16922c0cd7cb22abd7d7caefa18f59276ad031dd499cb32e64ff7fd1242a344e53af25a72a723de05c29d2240a9ebdd71e50fdacf29ba0

/data/user/0/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F35F030E-0001-1152-D457B280649CBeginSession.cls_temp

MD5 e383e49ee65782703e0ebae17739034e
SHA1 b440b798db5bffb193aaba99fc87ead8989702e6
SHA256 0a08308870f4df09e152d4580d92432bff963a666370a7ce413ef095190ffc14
SHA512 19a8f86e570b65057bff23f5bd197d41fcf4bb80792027c9c2d8b3630d5a214b0a4bc6cc2d9794c16e24c1b8cc62fc55520526b4fc3cb03afd51bb633607b50f

/data/user/0/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F35F030E-0001-1152-D457B280649CSessionApp.cls_temp

MD5 307945c22e31e2bd450f6110cbfaba52
SHA1 affed55386daf0684acf9989ca9d27e415703a12
SHA256 47625b11809c32fe1589151410014a4e88ef266d06f558f1bcb1fd2b13a7e7b0
SHA512 ce0031cbf7467fe86c0c1aa28ee249e7c22abddda2d5025a40af16ef97f344d5fc777b89ea2d8ab74327b6df6874e0c250f9312e85bd4c4df9e348c50a21a4ec

/data/user/0/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F35F030E-0001-1152-D457B280649CSessionOS.cls_temp

MD5 b3d9541cc92a9153d14e5160f8d8c008
SHA1 2e1ac80eb381dd82a03795b682f92020348c0113
SHA256 1ead5b213c87f182ffce484c34f7d9f140ad3425c0f303f460492efe8a26c56d
SHA512 78074409135a210ba4e1407ad9b3f784f5683e83aac4ce3482d4e8135425cf2b30db1ff5dd0041901c490a551a477237c6d255671c7b1fad74090980dcf3334f

/data/user/0/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6669F35F030E-0001-1152-D457B280649CSessionDevice.cls_temp

MD5 d3f1a7b65c375dd4772d04ad38696ac5
SHA1 a644bb22da7ae9f2aaa9a5f7710e0976c4a1afd5
SHA256 de8b20a035b859a564283e4ffbc97375dd7ca325a233145a3b83309554c2aa63
SHA512 b003f9b747e7f553457f0ae61107a9073c1cb6b1da542b9875e0163dfe31fe19e2d332a152b536b3acb424b3bdf34099a2336965ddcf195f7000502480ca7755

/data/user/0/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/user/0/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 b739ac6304deec17607e9456bff57f1d
SHA1 faf293f80c84487e92a0a7f776184b85de2aa3f3
SHA256 4269a0b58ca3f6d641fe345673e5f82052c736ef5c448c1a0d197ccc21c555e6
SHA512 7d4da2d472e718b3d983ea4dd31d4a44393ffd2ad15898761aef2270a36f29884383209839d6c63beac8feb5146ecb93d777f09bc01fd957719eae179b65ba85

/data/user/0/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_a0e5e2af-3b84-484b-ba18-724ea3d53387_1718219616902.tap

MD5 ff27ea3c1dbdc68b268e22c5714197ce
SHA1 392700f3a0e2554d977f46eefbe9fb8e99f94f42
SHA256 c16e5310d97f795e819ea63c771e4097860844187e788e607fcda9f82a68c308
SHA512 654c528794e000e41143faaf8d63338b6dddad59a3d8de4f3ae15a5f9543368c2464c3baeb85ff65c599939fcc996153be757aba0ac1bca666fa11cd82455533

/data/user/0/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 8d5e4b528216173c87f985015e6982a4
SHA1 7a959ffb9d50ce305344f8d6e04a2b175d8b94b4
SHA256 10986d089cb97c567ef6c813dc9cd77fe3c43b918302878e6788ae8a26fdf726
SHA512 020d4e7a1ad928d9a29359c42763e5c8482752f27e5aef40f2d2d0815f14d6dbc7da8a5b768c01ef78bb6730f80df8e17dc15bfb15dee906d3a8e0e32c8e70db

/data/user/0/com.hashstudio.eduwaves/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_3b91ece9-03c4-4e06-abc2-5af6387ad062_1718219631268.tap

MD5 b07f87847e43821213a70c9a16594584
SHA1 094816f44555b6b23ec528a45d5ee88a7fab1b94
SHA256 25e7cc5e42194b714c899b753d60c68cfa1b16c68cf5c84537666543f1f150b3
SHA512 6a025a0b92aa762fd6ad4ae262cdd3c8252ac3c792d912df76fdbac8b381e9ccf1b64d2b2cb5fe8d170cfe079a7e862d53452ef3b5d8daa943eee23b103a5a7f