Malware Analysis Report

2024-07-28 11:25

Sample ID 240613-3mfbaazanj
Target b63c624eb0583bd534dda86522478ce70e0f49baada414c2dcf2e08136f59a95.bin
SHA256 b63c624eb0583bd534dda86522478ce70e0f49baada414c2dcf2e08136f59a95
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b63c624eb0583bd534dda86522478ce70e0f49baada414c2dcf2e08136f59a95

Threat Level: Known bad

The file b63c624eb0583bd534dda86522478ce70e0f49baada414c2dcf2e08136f59a95.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo

Octo payload

Removes its main activity from the application launcher

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Makes use of the framework's Accessibility service

Obtains sensitive information copied to the device clipboard

Loads dropped Dex/Jar

Queries the mobile country code (MCC)

Declares services with permission to bind to the system

Reads information about phone network operator.

Makes use of the framework's foreground persistence service

Declares broadcast receivers with permission to handle system events

Acquires the wake lock

Performs UI accessibility actions on behalf of the user

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests accessing notifications (often used to intercept notifications before users become aware).

Queries the unique device ID (IMEI, MEID, IMSI)

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks CPU information

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:37

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:37

Reported

2024-06-13 23:40

Platform

android-x86-arm-20240611.1-en

Max time kernel

178s

Max time network

184s

Command Line

com.turnthingpcb

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.turnthingpcb/cache/ksubalgwyp N/A N/A
N/A /data/user/0/com.turnthingpcb/cache/ksubalgwyp N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.turnthingpcb

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 26fdghhoo11.top udp
US 1.1.1.1:53 6fdghhoo11.top udp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
US 1.1.1.1:53 3fdghhoo11.top udp
US 1.1.1.1:53 4fdghhoo11.top udp
US 1.1.1.1:53 18fdghhoo11.top udp
US 1.1.1.1:53 10fdghhoo11.top udp
US 1.1.1.1:53 13fdghhoo11.top udp
US 1.1.1.1:53 20fdghhoo11.top udp
US 1.1.1.1:53 11fdghhoo11.top udp
US 1.1.1.1:53 25fdghhoo11.top udp
US 1.1.1.1:53 17fdghhoo11.top udp
US 1.1.1.1:53 14fdghhoo11.top udp
US 1.1.1.1:53 24fdghhoo11.top udp
US 1.1.1.1:53 12fdghhoo11.top udp
US 1.1.1.1:53 2fdghhoo11.top udp
US 1.1.1.1:53 30fdghhoo11.top udp
US 1.1.1.1:53 29fdghhoo11.top udp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 1.1.1.1:53 27fdghhoo11.top udp
US 1.1.1.1:53 9fdghhoo11.top udp
US 1.1.1.1:53 21fdghhoo11.top udp
US 1.1.1.1:53 16fdghhoo11.top udp
US 1.1.1.1:53 19fdghhoo11.top udp
US 1.1.1.1:53 8fdghhoo11.top udp
US 1.1.1.1:53 28fdghhoo11.top udp
US 1.1.1.1:53 5fdghhoo11.top udp
US 1.1.1.1:53 15fdghhoo11.top udp
US 1.1.1.1:53 23fdghhoo11.top udp
US 1.1.1.1:53 7fdghhoo11.top udp
US 44.200.43.61:443 29fdghhoo11.top tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp

Files

/data/data/com.turnthingpcb/cache/ksubalgwyp

MD5 ce0f96ac96775d8c6e19bd32b397673a
SHA1 6c3e749563fa197ed52f1fdb93ea0fc5f52823af
SHA256 cb69aa68630bb648838bf713f4d3dbf76d0a86bcc0dea6853febe00f9f6ec383
SHA512 0f4bf6b55a323b6ac3e8e86718c37da65cf42e2c7150b1ccb52b1dfd68b7f37bcccfcac47d9ed0be4c4f156ccd83f7864d904192f9f3ff4cb29fbb3d5af681f1

/data/data/com.turnthingpcb/kl.txt

MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/data/com.turnthingpcb/kl.txt

MD5 4c2d6dd069d71c6ba4217781f93c1f38
SHA1 e3ce82e1a8f693ec5cd079d6b546cd1b56506aa6
SHA256 9bce2bb57b1e06ccb34713571c7ce9f5218507bd704a054a63bed2a05da7472e
SHA512 b33a7b5f6a5864f8dcf3e1aad405f033cff11d929be8245fcb7a5f6c81f0b8177f50a6fafdaf8d430d5c3ca17c541c74cadd1bf1b698aeb583bd21617634b8be

/data/data/com.turnthingpcb/kl.txt

MD5 9cea5f6f4fd6c467a42d3648b609b275
SHA1 d5c2f4decc145fbe00210eb7434acaf3ecd85a68
SHA256 14a7ecdf52105aa3cf438b93ccb1c4bb0f0cf12117fd39672c4ddfd20353116f
SHA512 cdaf3c67c1642e3907a8cbe2c58f992c3726370fe9a1858c9455bfcd5b5d328429edbde48f29d436ec4df90bdd375ff673f78a2aab1bed0faa821cedd90ff47c

/data/data/com.turnthingpcb/kl.txt

MD5 946e034b2e1e1e70113d4c258ba351d9
SHA1 eb2b2507fb5664c62c3b5145b1a50fd9ad940a57
SHA256 695e44f2fee1d386eb925313d2d247fcc53641a982f78cbf564041717b02da18
SHA512 11928f456851f6f21b6b6569cb3878fa8209acb0906f837b9eb5b1b0ee3ae75a44c5f77537d76c8c1cea3f63ea781d43ada12b6ab7698a312af0ff2a42455b5c

/data/data/com.turnthingpcb/kl.txt

MD5 4db567ac355319588e41c22aec42a114
SHA1 e80f56ad51b4a634e24ac5c4e7617fe343a6148a
SHA256 ff08de4b39e65e085f7db768bcec27f43cd4932c248967301effa054d492b241
SHA512 776874c453b60c6c46b86e5241f6ba7cb2934de408ee9d38a9068896923b2c8af922f817659c012a4eec411e9f6ad26cb6e6ad9800976846ba5da7595341fb00

/data/data/com.turnthingpcb/cache/oat/ksubalgwyp.cur.prof

MD5 762ec18db7de2ed3368b54566eafb474
SHA1 27b7f7caded3b1ac9ca9424f20c59297017ccab8
SHA256 41c2a564b56a801f452bb2ff85985203c53b6041f40e51d6ab1f810f8d3a5a78
SHA512 d0f9d206bbdfe8bc6b5938fa82319f1f75a4117a208e4cecffaaa464cc57af1edf870ab9d18d9bbda575e5c120a720983d329cc32c3c3719df5183f8eb5843d2

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:37

Reported

2024-06-13 23:40

Platform

android-33-x64-arm64-20240611.1-en

Max time kernel

178s

Max time network

186s

Command Line

com.turnthingpcb

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.turnthingpcb/cache/ksubalgwyp N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.turnthingpcb

Network

Country Destination Domain Proto
GB 172.217.169.68:443 udp
GB 172.217.169.68:443 tcp
BE 142.251.168.188:5228 tcp
GB 142.250.179.228:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.212.227:443 tcp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
US 1.1.1.1:53 16fdghhoo11.top udp
US 1.1.1.1:53 6fdghhoo11.top udp
US 1.1.1.1:53 12fdghhoo11.top udp
US 1.1.1.1:53 21fdghhoo11.top udp
US 1.1.1.1:53 5fdghhoo11.top udp
US 1.1.1.1:53 28fdghhoo11.top udp
US 1.1.1.1:53 26fdghhoo11.top udp
US 1.1.1.1:53 3fdghhoo11.top udp
US 1.1.1.1:53 30fdghhoo11.top udp
US 1.1.1.1:53 9fdghhoo11.top udp
US 1.1.1.1:53 17fdghhoo11.top udp
US 1.1.1.1:53 27fdghhoo11.top udp
US 1.1.1.1:53 2fdghhoo11.top udp
US 1.1.1.1:53 15fdghhoo11.top udp
US 1.1.1.1:53 8fdghhoo11.top udp
US 1.1.1.1:53 14fdghhoo11.top udp
US 1.1.1.1:53 10fdghhoo11.top udp
US 1.1.1.1:53 18fdghhoo11.top udp
US 1.1.1.1:53 11fdghhoo11.top udp
US 1.1.1.1:53 13fdghhoo11.top udp
US 1.1.1.1:53 25fdghhoo11.top udp
US 1.1.1.1:53 19fdghhoo11.top udp
US 1.1.1.1:53 29fdghhoo11.top udp
US 1.1.1.1:53 7fdghhoo11.top udp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 1.1.1.1:53 4fdghhoo11.top udp
US 1.1.1.1:53 24fdghhoo11.top udp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 1.1.1.1:53 23fdghhoo11.top udp
US 1.1.1.1:53 20fdghhoo11.top udp
GB 172.217.169.68:443 udp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 142.250.200.3:443 tcp
US 172.64.41.3:443 udp
GB 142.250.200.3:443 udp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
GB 142.250.179.228:443 tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp
US 44.200.43.61:443 29fdghhoo11.top tcp

Files

/data/user/0/com.turnthingpcb/cache/ksubalgwyp

MD5 ce0f96ac96775d8c6e19bd32b397673a
SHA1 6c3e749563fa197ed52f1fdb93ea0fc5f52823af
SHA256 cb69aa68630bb648838bf713f4d3dbf76d0a86bcc0dea6853febe00f9f6ec383
SHA512 0f4bf6b55a323b6ac3e8e86718c37da65cf42e2c7150b1ccb52b1dfd68b7f37bcccfcac47d9ed0be4c4f156ccd83f7864d904192f9f3ff4cb29fbb3d5af681f1

/data/user/0/com.turnthingpcb/kl.txt

MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/user/0/com.turnthingpcb/kl.txt

MD5 b4002303020246bbaf36d4f34bcc7669
SHA1 540062c15224b8d9d3d4d17ea466f2afed6dac1e
SHA256 de53c6109bf87ed8b5842aaee7191e972e5ce9bfc303e92e21435768b0268398
SHA512 36edce8f6d9aa66e187f5033bafab7b6499ac09444d7969788278ff5c535e293ee1c4acab69a64f83420337cc202a844426b674ec3b930a95bec48aec3305be2

/data/user/0/com.turnthingpcb/kl.txt

MD5 671fe105a53508f5227a25592534a6e3
SHA1 f00fd9ccd549c3e0dd75bf08498dcb64d3c51c6a
SHA256 effad4e5b41c2a09fd6ed300da8d50055cf84f3f378aa08ac1570f3b4e4635cc
SHA512 bfdca47359c0a81812ce6a427a4f06d5fa7363b14f02c584105dcf304712b01886cf6bcd2bd72285862f4755b4a5b0a95105f37638749765e49cfd66e9f8f2e8

/data/user/0/com.turnthingpcb/kl.txt

MD5 c95a5a3183a68d2dc505b46ce852f1c1
SHA1 a1cace2b85564423763957367e6ce5e79fc95788
SHA256 7aef3d748833517d66578d32e436e3bd3f8d36363e9cd7a6d4076cb6ddbeeb3d
SHA512 e1655db053c413ca0f43fa1e934e3c21c3360b293614c5b42e36028d3dcdf954767da5690721212555083d39c0f9bc90cca0e66f798ed6e18afba5a49be31d4e

/data/user/0/com.turnthingpcb/kl.txt

MD5 b4ea58d17320545a21e8d740c14c0796
SHA1 b6c0582782d894d83cb189aee8010dac87f5132a
SHA256 65f25d5f5686f9d295e53f21ed1c4979dafb10ade646e34835df6590fb090398
SHA512 835502a203f396c53a00b0733afbfa600a0631a7d111fd149adf68bc8223490f18ab557c7fbc79b1ee3f4aa05fa6ccd02a79ccbc25d04d68d4b62bc7bba76446

/data/user/0/com.turnthingpcb/cache/oat/ksubalgwyp.cur.prof

MD5 19c3a0a0de4acf5a415560040d99c4b1
SHA1 be72619f75da7c55f080812d701f02504a7e5317
SHA256 30ea3fad9177ae4eda6cb48d87c92d26f4631fd115f5c94f4149f72a2a61c91d
SHA512 562dfb25c1a4e963cec1588c58d6a2108a2dcbf4862185065066c86ff7e1b49e355ccf68c32f577ddec59f9db3bd570cb3b01777cc5aa2e3a3df9c3ba5a1d2c2