Malware Analysis Report

2024-07-28 14:41

Sample ID 240613-n7r39axglf
Target Crunchyroll-v3.58.1-(PREMIUM).apk
SHA256 deb2bc28f86b83ad8bb50c87c09abbabae2df7f14e9959b9c8cd296e0551e349
Tags
discovery evasion execution impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

deb2bc28f86b83ad8bb50c87c09abbabae2df7f14e9959b9c8cd296e0551e349

Threat Level: Likely malicious

The file Crunchyroll-v3.58.1-(PREMIUM).apk was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion execution impact persistence

Checks if the Android device is rooted.

Queries information about running processes on the device

Queries information about active data network

Reads information about phone network operator.

Acquires the wake lock

Requests dangerous framework permissions

Checks the presence of a debugger

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 12:02

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 12:02

Reported

2024-06-13 12:05

Platform

android-x86-arm-20240611.1-en

Max time kernel

50s

Max time network

150s

Command Line

com.anilab.android

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Checks the presence of a debugger

evasion

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.anilab.android

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 firebase-settings.crashlytics.com udp
US 1.1.1.1:53 update.liteapks.com udp
US 104.26.15.148:443 update.liteapks.com tcp
US 1.1.1.1:53 rofdedrawrofx.com udp
US 1.0.0.1:443 tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 1.1.1.1:53 time.google.com udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 aniwave.to udp
US 104.21.4.232:443 aniwave.to tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 1.1.1.1:53 firebaseremoteconfig.googleapis.com udp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 1.1.1.1:53 redaehtesyxorp.com udp
US 172.67.134.5:443 redaehtesyxorp.com tcp
US 172.67.134.5:443 redaehtesyxorp.com tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
US 172.67.158.177:443 rofdedrawrofx.com tcp
GB 172.217.16.234:443 firebaseremoteconfig.googleapis.com tcp
US 1.1.1.1:53 firebaselogging-pa.googleapis.com udp
GB 142.250.200.42:443 firebaselogging-pa.googleapis.com tcp

Files

/data/data/com.anilab.android/databases/com.google.android.datatransport.events-journal

MD5 088f762ad78e35d80895b8de4e6113a6
SHA1 813164e3a1e469e117d15831335bf222d59428e3
SHA256 2d7081810b3756c29799720a238829a6bdbe96c89e02840813d8d46fd76db1a8
SHA512 4b5865667e68447f9152c56062c30c414c07b1b29a660b4273ce3425a8db8356d8ad79d9a6d5736a5d67e02f59ecd5f8b4c9d077b95a61e9a860fffbb3641670

/data/data/com.anilab.android/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.anilab.android/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.anilab.android/databases/com.google.android.datatransport.events-wal

MD5 d9ffc650e929b99a78518643575c6bcf
SHA1 e246fc58ec0c67ded1c1602d442040c7a3ab8f51
SHA256 6395f493bb92280ebcec79fbe5eef45a4e37a227a809da745ac7b74cfe9630ec
SHA512 52ead7fa3e5c2e9ba41c534d4dc9d796a92b1c1f639efc57db409c7d1575ab420c684e2738865bd2e73d4fd5d8f35a24189c201b54619f0ae87f4ae2d799af33

/data/data/com.anilab.android/files/PersistedInstallation6802754400154843643tmp

MD5 070d9b95f4fc46fffc87423b92dab8d3
SHA1 f600b193583b4314d24574122f9a10ac4c4bcb11
SHA256 9f575dd79271e2be7d9fd65b31e5db04d6de60d7347096e02abff1c65d92ec8f
SHA512 80b7000f5966a1442a75d35b8db93e7f79aabc521d330b6bb184d7b499502e9ddbec8648df7ed1ce97c7c4e1a44c522f2a82668dc7e8bfb8b17cdae3bda005fb

/data/data/com.anilab.android/files/.com.google.firebase.crashlytics.files.v2:com.anilab.android/open-sessions/666ADFFF01830001105EB3E8FC130966/report

MD5 90da7c9ca3f98c86f2e610df0cf824bd
SHA1 e0e78b940cba71139566aa56b3008dbe1b2d1259
SHA256 cc9fd0882540841aede66a00f374ee19a57761acd5e4e522f0d7a0416af41bed
SHA512 ea79f54df717ef30244e69d4c0072f518720c393ea58b0c1562093bece7aef082a9197ec844b4ee432a06bffb36f6d281e4221a0418782c418d52cee3a5a5292

/data/data/com.anilab.android/files/.com.google.firebase.crashlytics.files.v2:com.anilab.android/com.crashlytics.settings.json

MD5 07c7f0c8ec84ab13a4227d9f3d35575e
SHA1 05e002a9c90cd5c033be24d5c571e06b63d71038
SHA256 31d9cc0812a99b68fa6444440f2dfb269e3dde6e915c134aa7a2944caefff62a
SHA512 11209d4416219e7502465f2423a1aa01a26d95d8ce5815c42c9e0efd370d5075b047014a3a105eb57be30d6a1ae3d4706d181b47cc456ba71fbfc823e15b5296

/data/data/com.anilab.android/files/datastore/firebase_session_Y29tLmFuaWxhYi5hbmRyb2lk_settings.preferences_pb.tmp

MD5 a65b9b3e4670dc3b48a9609f816ad531
SHA1 682a73f2c248815fba0cb50c45031a53d6f8dbcf
SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
SHA512 6c06e6791dd41c1c8d8e0246e9bf7fed81dbdb5e918e7dd78cc2af1f002f8a532ec28335b229a0ec5c1ee220861092cb1a7c7f4060663394e420d80ed391179e

/data/data/com.anilab.android/files/datastore/firebase_session_Y29tLmFuaWxhYi5hbmRyb2lk_settings.preferences_pb.tmp

MD5 06bd63584cc699cbc92ade3aeab0ac42
SHA1 e21167e5419847271e7f67b3b286916b8124165d
SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
SHA512 675f177e388425023df5e19cda634ab1e7673681feabfa7bb860089105353166491d15b8c86b5408833230dc5b0ac43e2b5a61e1d36ea0b40d6ce7166bfc385e

/data/data/com.anilab.android/files/datastore/firebase_session_Y29tLmFuaWxhYi5hbmRyb2lk_settings.preferences_pb.tmp

MD5 1fbccf7b936a9b713de5d42c6d8a075d
SHA1 7c8bbdf9151e7f53e2675329d471e552446e9ad3
SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
SHA512 b9177426b3facda6d86b5a83d05805a4dd2f5357d4979ca7282a13ce3f08ef7e7a0c5922675ada826bde264450b1b4ddcc54eea4de62249fd3eab1ec9acf32cf

/data/data/com.anilab.android/files/datastore/firebase_session_Y29tLmFuaWxhYi5hbmRyb2lk_settings.preferences_pb.tmp

MD5 14770edbc1290230aebe82f8dcc730a0
SHA1 f86874de3ff45c2dd7c982f9ada6b5fc979f082f
SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
SHA512 c6be6c93262e0c42527722af20fdd3be2c9936eb601280c36492e0bb2151bb63f88bfb150690ae361c75d01a33647c2440bb49e290af38c5c5af5a707320e3de

/data/data/com.anilab.android/files/datastore/firebase_session_Y29tLmFuaWxhYi5hbmRyb2lk_settings.preferences_pb.tmp

MD5 8a09443047cc8177c73d3ec58aaa47d6
SHA1 22abff63d7d8359d69352748faf81294198f2b11
SHA256 ebb00a758af9db44a69e7e8fa91e38e4a842a5c0cf53a42799474b13c5ad1d39
SHA512 61f5a47aea45b4c47b7dc198012b00cc3444dce2a7ac45b56cf19e2fdd9218b905a17046ac87c3167f463d6c8574fa072939e623055a633dc6e74f18223096af

/data/data/com.anilab.android/files/PersistedInstallation5107964199446745260tmp

MD5 bfb4680a2a37641c10f8ea01c1eeba79
SHA1 3331e8d4f9802a460ca2478524016fed0fb2847e
SHA256 e20dd6539ee826682a2afb54b8125f2b9df19e21e29bfe545987d54173af014d
SHA512 4b80b6607e8503eeeff401b268b5c15a28b900da1f7814567c6c3c4f09be21382b65840d53a1056e6ed409733ae851c008e81df75d458e54f875cb8284717f19

/data/data/com.anilab.android/databases/google_app_measurement_local.db-journal

MD5 82522811544530b7a40277a90f4c0b45
SHA1 4578fac73e4429634e69e4f7dd8774018813e222
SHA256 13723bc459ca720c2540cb05467c1c18d445a914ca346f947a7b1f8af6a88e6c
SHA512 f4f424bcfd784beacc50761416c162543fb0ddfb755578c764c71f406e6fa42dfe0d9e7ad596979b4797524846b817d6b2c7a85216a70ae3083ab53100da0400

/data/data/com.anilab.android/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.anilab.android/databases/google_app_measurement_local.db-wal

MD5 a0908489456f16cd8666b40e72ee20c1
SHA1 768ded099f9e81cfb23194e7c48ed96966c3e763
SHA256 7293bc62d919c34160bfb1570f62e9a7f8d43aa87af0dfc584dff69896237a4f
SHA512 b581b212c56b8131399204137462d710b5be27436e0175795806ceeb271ec2c87eca421778ab9795a9ff6757b35a7b08f91982e71f28c016854964c277ec47df

/data/data/com.anilab.android/databases/google_app_measurement_local.db-wal

MD5 c63eed55f3231d8ffa8d14ae096d9988
SHA1 426ac0a0fe7e5eea249a9e1e032048db091c0d4a
SHA256 101688fc889fb2d8ad1f55360173209967c886689a82e625c6cac3b9ec6a1ce3
SHA512 f574b6c285bf225225327c83765c98f5abc55d0af861ced4036df29e1d89d3beebc4867d61d1065960ee06851846cfb35b7cfdb2e263532c310e697f54113f33

/data/data/com.anilab.android/databases/google_app_measurement_local.db

MD5 776f50022acea00a63fb347889636843
SHA1 04585eeedf631e56baea04011707070595dd4261
SHA256 4fda0f4894b1e419d564969dd1a766a96ec81daa6b8d6de3769126269ca299c9
SHA512 121931dd9916650c5ff71b98cb0c6938ce0745e04b19b7bfb94e24baa6d853a7a849272cafe46d4bc4a983b007e0e2945b710c561ce9b04859f62ac9f9c0f519

/data/data/com.anilab.android/databases/google_app_measurement_local.db-wal

MD5 9ffa67af2e5963fd7596ef1b9d6546ed
SHA1 2f44abef1b79aa7d6aa992496eb74bfeb947355d
SHA256 478a104e35b92afbde1adb3ed45c2b42bbc3cdb6e3e86667405e1fa61e1718cd
SHA512 5af98a0da6af777bfa905382a8b1cf30978854ad2a9d526b364458d8b080a9720b4638d174a394e3180a6fc46685fc04fb60198a6aa39075038a47086be02575

/data/data/com.anilab.android/databases/google_app_measurement_local.db

MD5 1e33c6b10c6be0aacbf68216d8abd35e
SHA1 533598ad6983a9d75a77aafa122ceada60cdd90b
SHA256 319ecb80ea0e34ef0ab43984661e81c6bec501d72c2e86d0d1050cc2c0b95d56
SHA512 a6da45016dc677204a12ca27b238475202edb47c43ca3d9d0843be07bb7a325340ffe9b64f24e6aaa4ada469a38db18e5dbe6a0c61663b428e7eacb1c2ea6a42

/data/data/com.anilab.android/files/nwt.tmp

MD5 9e688c58a5487b8eaf69c9e1005ad0bf
SHA1 c4ea21bb365bbeeaf5f2c654883e56d11e43c44e
SHA256 dbc1b4c900ffe48d575b5da5c638040125f65db0fe3e24494b76ea986457d986
SHA512 fab848c9b657a853ee37c09cbfdd149d0b3807b191dde9b623ccd95281dd18705b48c89b1503903845bba5753945351fe6b454852760f73529cf01ca8f69dcca

/data/data/com.anilab.android/files/.com.google.firebase.crashlytics.files.v2:com.anilab.android/open-sessions/666ADFFF01830001105EB3E8FC130966/userlog.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/data/com.anilab.android/files/.com.google.firebase.crashlytics.files.v2:com.anilab.android/open-sessions/666ADFFF01830001105EB3E8FC130966/userlog

MD5 7d8988edac2473ef0c1bf14785b8c91d
SHA1 999defabe3216526233b479f50c09f2f0c454d56
SHA256 c0d8754bf0eeee771564181439eb0b72432605e7e691fa9c3a3420dc77e509e8
SHA512 226a71acc2f0ac37498970e762a381279aac8d624acac3d5795c611b159fc5eec2afab289cc00916dfb9f05b70ccc62a5063f41c7dbf1e34c9e26dc8ca2838a2

/data/data/com.anilab.android/files/.com.google.firebase.crashlytics.files.v2:com.anilab.android/open-sessions/666ADFFF01830001105EB3E8FC130966/keys

MD5 026d4f398c10c7f2e524188821c53ef3
SHA1 b22302e6e4e53b33d76f47afb1a94ccc5c63385b
SHA256 7c6e294cfd7b731f579ed3274282331053d7ade4dc276f5c63cf20a67cad96b1
SHA512 43894da81b9f9edcf1db8fde9579a2a836501368532b1043b171c8078fe885fe953ee5336bdf6561829d5ec4044c6e084bbdc4aa03f8a5d2c6f7bf400907415b

/data/data/com.anilab.android/databases/google_app_measurement_local.db-wal

MD5 1a688c62de9057c1b846198a75678402
SHA1 7c72bffcd98d1cb4fdc1e85e40226366b59c8a06
SHA256 338aa200fffc06da37986d82c0bbd3bf1c76dffbcd1634ed84ecdf74486b6bcf
SHA512 932af7cbb5e3a1efede92ed09020204445f9d4aae263101fb2c7d616261e7bb71e244d321f0ec96e43df69d3047cc3bd0960f3be8cc31530090addbd74cde442

/data/data/com.anilab.android/databases/google_app_measurement_local.db

MD5 d28b53deb0aeb4c48a75d8ac4b5791bf
SHA1 b3aa4e19fe27ef50f8ee83db376c4828d420951b
SHA256 c4f22ed31fac66f17bbab0d9f87ed430c97ecbee84010f92a23775d4b4dfb887
SHA512 3603fbee74b0f9d6e9a2f9648f7a78c64cbdf6806b2b8e59d4b3337fa3a2c44be6e8cff97abfaca2cb91977aed125cfacaa0de7bdcd69bf0dd3c4fb309e591e8

/data/data/com.anilab.android/files/datastore/firebase_session_Y29tLmFuaWxhYi5hbmRyb2lk_data.preferences_pb.tmp

MD5 bc00f7c84df8fd7e06471e2bf633fbd9
SHA1 1ff72297296c26b98e8425a6e88d2c3bfa181647
SHA256 5a56e340b18a3c5bb5e78e4aa87dc2bf78ed8b44e322e63e623994da4cd90f09
SHA512 a274380135152849c47b72027a5996e381fa16bb98464a2508bd36716ebddab7dbd280d35ddd8337a3863ab9243be7fcecb5dc114fb45504d30f86ea410c4553

/data/data/com.anilab.android/files/.com.google.firebase.crashlytics.files.v2:com.anilab.android/open-sessions/666ADFFF01830001105EB3E8FC130966/keys

MD5 8ed6a59031d69d1cc4a05ba796b95518
SHA1 587e9c60c3143f9323280434db4933ceb5ba2607
SHA256 1bd3ec659e306366460e5cf8a14029341aca6af9df6204efb88f760a2c0535a7
SHA512 efd1d76b3d85040c39ae0ea5e40c2a83ea84847cabfdc4cf1a70ab15987aeff318bd53d8706672ade3d0a42c5228e4f4163925ab364e84fdfdd219653535da93

/data/data/com.anilab.android/databases/google_app_measurement_local.db-wal

MD5 28e930c27a28d9b802e503f570c6c829
SHA1 40b8a10366046bb7af5abe9ea1ebb10001897f94
SHA256 952f5139562b762c7562139d283ec2b8a58bc2f0ffc2e3cd5b43a0b077044304
SHA512 bbb557acb65eb2ae13c06c745fcb5fb6ef12a605ac8c568d41132cce6815892a7fb3b827f0c1b88c5a831f7192ea7257171b0b1a53fe45b2c8b59671fd7d795f

/data/data/com.anilab.android/databases/google_app_measurement_local.db

MD5 547c12d0c5e2ccff9ef63bbbcc255f0c
SHA1 9b3aa171cc24fad0af89c260da0f46c4595dab10
SHA256 3c01024e3053f07aa69ab2ab281ad8219b2ef90ade9927cca925cb3f45c763a5
SHA512 9f76f96ed68d08bba80b8566eb22bebf8b138b4be2db9020f3f0f414667d73b181da45e9c576d4cecc107df40c6eaab442f138468f806528343da856acb590d7

/data/data/com.anilab.android/databases/google_app_measurement_local.db-wal

MD5 2307c86f6b2ec104d47b2b178f94e4e4
SHA1 cc6cb8a25142bc63d0d99f67c85306008cc7bb28
SHA256 122db5ce2749d70d1c454e19037a2fc7eaf865d41183fa7a02a657900e7919a4
SHA512 77b7dacfe525519fbefeddbe6978ebb6f7c8ab69b293947cd69a6460a534b747bbb9715e588249e1a16cc50948591cda7d1adc7811fa1e36a9f36957b519b0fb

/data/data/com.anilab.android/databases/google_app_measurement_local.db

MD5 44693692da738db6eb133cf0e4cde91b
SHA1 e6bda56494c325d8d37ad89552263ae85d9b0550
SHA256 8fe0ac9db76d4a2dcd3b3d54c0efedcd223e25aabf716506493d50e243a7a2d4
SHA512 b34ddfe1ae343b1b12f7029ae476a0ba8e1b4043ccb520afb412b3f71335ef679bf29723c9a5c00af7e922e9982d5b3af54b2ed779da8cb601f378e5b9d26be5

/data/data/com.anilab.android/files/frc_1:625497243390:android:9c537d76a9f1b911de6faf_firebase_fetch.json

MD5 f0bedf7a48387d946ad0298eaa46a661
SHA1 23bce4186ae2400f89ac28e37098b5c7a7fb4406
SHA256 e2e6d6479c8ce12357de6191fed5b8dd04078e172969ed704d69cfcf2d7c16b0
SHA512 564a8b064c655d68c4196fbf3d734fa73259488e5258b84f57cb79837b094d1ab7cdfb07132b5463519b6b0f6c0e3803cf8c818e71690aaa48649327753eee13

/data/misc/profiles/cur/0/com.anilab.android/primary.prof

MD5 f1dbdd9549629d4ac50e7301304211fa
SHA1 d48f879f876ef2bfd81639c5d5e995bc768349ef
SHA256 636634f2f4883521411087e50f4a69265bddeca801b3b81c01ba622c04e90b13
SHA512 7b9ebce43e6c4222ca2295907bdaffba297c1d7ebceeae1b76da68ce41e26644b0047a6eb1bf9acf73d3c2cb3f2d076acead4aee7532daf5d9d3e9e740dd2ce1

/data/data/com.anilab.android/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 c89e50555926138cf53921d690622e17
SHA1 ffa4b8d74fcf6bdedc00cb9fb31bd4da453da848
SHA256 b91af949bf94e445dd10ed8f0fa4d3df4968e272b3eeeaa6a723f36bb561316e
SHA512 1ad132c4618b50084375516f2b055514e74881c4423e8cfc09c5a22579883d58f4d692e872762d8f46e7b0a6719ab5edfc1d311d0a54a2444533cf60e9a636f1

/data/data/com.anilab.android/files/profileInstalled

MD5 329b58a00cb83fb13e6779596fa5580c
SHA1 58785f48f4866cd4526e7128431d75a7f504165a
SHA256 d8cde2a04c462ac1d491bea2dc843785b6527539b990616fe7fa3a555b338eef
SHA512 86c46918047f44aab0f92cbe46c92e4524870ac7bd5ae1ad2970f493449e326df8e55be57f5d92a682dfe2d884655263b6284849b6b5014ac4ddf59cc27df73b

/data/misc/profiles/cur/0/com.anilab.android/primary.prof

MD5 ece6c8731353522647c53804a62f9a19
SHA1 8db4e1d865baa361a8823b1eeb36346598323e91
SHA256 23fb640a7ebb893431cd9285a0ea2916f1a85173cfdc844e1a7771f58509e723
SHA512 9308e84c1eb8cacffb83ddf24e0b72c8775c7b2279690bf3ab34a9e32027e1f9b6fa9f403a36124f2f8cfaf7ae73e2bab94537ee45e4b66e2fa80ecdbea6a83c