Malware Analysis Report

2024-09-09 14:35

Sample ID 240616-2nn45s1hle
Target 9ddaa1bba5fd99393f212df4b1999c527448f07ebc9e26b291c3f1c02d5500e0.bin
SHA256 9ddaa1bba5fd99393f212df4b1999c527448f07ebc9e26b291c3f1c02d5500e0
Tags
hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan ermac
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9ddaa1bba5fd99393f212df4b1999c527448f07ebc9e26b291c3f1c02d5500e0

Threat Level: Known bad

The file 9ddaa1bba5fd99393f212df4b1999c527448f07ebc9e26b291c3f1c02d5500e0.bin was found to be: Known bad.

Malicious Activity Summary

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan ermac

Ermac family

Ermac2 payload

Hook

Hook family

Makes use of the framework's Accessibility service

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Obtains sensitive information copied to the device clipboard

Queries information about the current Wi-Fi connection

Requests disabling of battery optimizations (often used to enable hiding in the background).

Queries the mobile country code (MCC)

Performs UI accessibility actions on behalf of the user

Declares broadcast receivers with permission to handle system events

Makes use of the framework's foreground persistence service

Acquires the wake lock

Requests enabling of the accessibility settings.

Requests dangerous framework permissions

Declares services with permission to bind to the system

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

Schedules tasks to execute at a specified time

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-16 22:43

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook family

hook

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 22:43

Reported

2024-06-16 22:47

Platform

android-x86-arm-20240611.1-en

Max time kernel

48s

Max time network

138s

Command Line

com.jugocufojulixa.waya

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.jugocufojulixa.waya

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 null udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.201.110:443 android.apis.google.com tcp
GB 216.58.212.234:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 216.58.212.202:443 tcp

Files

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-journal

MD5 634157411b2e4e008837d483eb6c2a2e
SHA1 5a5a3bb1f88af65e2f1d2d0bca77fbea8438b602
SHA256 683e3f3c87779cdcb88cad57d74b95fda486810b352d434abae222a364947bd3
SHA512 fc808920a07204bacbe150fd717e2212c690b64279d4f02664524b46bd1d51b89fb5a45724136cd1601b696fc4ce4c71e5f8f9532566391e0e057d232ee3c86d

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-wal

MD5 a1a8d56d29679e480fb68d09c58c1400
SHA1 ed7ed58a4b2c1c68faaba2efd12d0334be6be5f2
SHA256 067c8d320e8192d6e6d4ef308e432d72df68af63fc0cca07c0129c5e8b8a23bd
SHA512 d6781143856d693230cecc3be28c674c674770fd203e73c3bd1f71f87a3f9b3fe67cd862b9cdedef80a7ea2670151df9bc297d8e4b1a80a6fbaaae72fe5ff9ff

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-wal

MD5 e6de645240a68cd8d505c37779e38ae5
SHA1 4f49d1e44dc6a1cf71fc62985c28050322d8d7a0
SHA256 da7eb4b635458066e6834e74c7803b8d87bc2ea2ccc9913d196f1333c3ee5741
SHA512 6e23a62014d9848b24a46a00db07024651e6a21b6d46942ac61ba7e115e87d1a86359e7b0b849eab59412b6d98dd9f6a17e7dae6e327efe873d611b2a16e3b8d

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-wal

MD5 2609849a2d3bb60a16971fbed9f51bbe
SHA1 dc6af05dc1cf7a360d901d59d19b988d830fbdfb
SHA256 f3f3972c8d259c39186c04c66d77a25d32230703d285796c1050bd931b5e6f61
SHA512 fadfa91c8d5b22e078070bf07f410bdab2fb7c60dd4825cae722abbcc39112a51fae10107e69ca603d5f18f32ef63c2dbd134884e589ebe9b19fc9bc5c23be30

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 22:43

Reported

2024-06-16 22:47

Platform

android-x64-20240611.1-en

Max time kernel

179s

Max time network

157s

Command Line

com.jugocufojulixa.waya

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.jugocufojulixa.waya

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
GB 172.217.16.234:443 tcp
US 1.1.1.1:53 null udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
GB 172.217.16.226:443 tcp
GB 142.250.178.14:443 tcp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
GB 172.217.169.46:443 tcp

Files

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-journal

MD5 5305b530c4a50394e410300fb759ffac
SHA1 f68f39488661d7f297b5ff180b81418030915681
SHA256 a466f47e41dff828c48b61b85aecac71e1efd97266023431a1356c1b033a20dd
SHA512 c2ca3cb6f5a1c75d1b7641958b2cdbc89067910912a0cecc1280093efde4e5874f4bbcb0d6299617b7f9542120088fa070202a33d6e164ccc15bf5ece802daa7

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-wal

MD5 a5a033bbba44e46c0457fe650606c04a
SHA1 ffd09f091cf02f0665836f39d12e669ef1bfeb20
SHA256 f18af368b237a8a48a372b7bc921ecaaea9e3422f0990ae763c8fc8d252f8993
SHA512 14942c1707ef859d8d879ea66f38e42abf5c6aed189c274a74f407c242d09e4864ca42022ede5cbc0a5441d6a479684d3a3dd6d9c4569156f7481c6c3201a102

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-wal

MD5 140b4386f5ba46ab640aaf2f6915b902
SHA1 3d96dfb519d460480de745f2bdc12fce461f2da6
SHA256 e02c6c7ed8a592a138312a82aa2fe0fc6da6db915d5b1579e9208474d6755033
SHA512 34f83430c1047a8e414da7d423fc7c83057b58dbde0f9d255ee0105f24b942c99fe7d547ed10be250a72a4fae7e6aaa7ae352b4aa0af6ea08a8fa292a401646b

/data/data/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-wal

MD5 a02de0ad3e3bd54f726dd5a8a58fef4d
SHA1 9454f1b850114e0e940f0942838af31d1294f994
SHA256 8697fbb63e52a3ee095e6e2575e119073cf064b76fc3b84988645d75f673ffbb
SHA512 60a7a4a70b20a1314f0b354e17c8e12b0950867e5b7442d6bb4d129a3c0565a92d6947837784d1b9e8876f6694b1f0e9d22a05ac080ad0a39c443750f1807600

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-16 22:43

Reported

2024-06-16 22:47

Platform

android-x64-arm64-20240611.1-en

Max time kernel

67s

Max time network

133s

Command Line

com.jugocufojulixa.waya

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.jugocufojulixa.waya

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 172.217.16.234:443 tcp
GB 172.217.16.234:443 tcp
GB 216.58.204.78:443 tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.201.110:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.212.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp

Files

/data/user/0/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-journal

MD5 fc2602bb2b86b84e948c093cbfa0d869
SHA1 c1738c427f8decb7ba4a2f704c12bea3fb857980
SHA256 990da6e3458b18d3e199df1dba74675400f697fe7c410c8b60724b6d314ff256
SHA512 13bc3db795463e696b93c22b151fe4f29c06a238eaa41de250d4219456fcf3982d02bc396677acd8742e0dae2c0862812aa4d4609f75957ed80a65ebdb21c974

/data/user/0/com.jugocufojulixa.waya/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-wal

MD5 ad901765cb9b7513e7f11bfa23fd1ec4
SHA1 b8b170135dff3940d937a2c0f9396f77d850a788
SHA256 a86e379474534abfacda3aaea6d87a74a0e5ae1acceeaa456e8547f2dc9e4092
SHA512 1d58af1b71461ebc4310880e0704d324ff8f284432db4cdae3bf251c562e351516efef703f421be8cec14bbca3e35fcdb78821e1cbfad73d20b2c478f7b97ce0

/data/user/0/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-wal

MD5 ab5336a204104e542666b6e4f36f3f06
SHA1 a1f4f05c0162a9fdfd1023367fa8caad0aa12cb0
SHA256 a221a4aac1ccbd4b9d11642b6db38c5356316904e4afba847128765d6445486e
SHA512 3294ae1612af454db0951e91d2e7326d59dd1011c16883923e4b67ed6433a516614121b6179f084b4df0f4ab48725d673c5c2567ba738e8d0c093179570e407c

/data/user/0/com.jugocufojulixa.waya/no_backup/androidx.work.workdb-wal

MD5 dac24a8ff66dcfb39e36cb2f760c4ee7
SHA1 710b347e769cc0b4a86e13639da7bd7e361c3ca4
SHA256 feaebd7720dfb84f8cbdc6f1f0eed7560e0acef8b05c9945670e01ea19615b9c
SHA512 808ec404523c2400618c2738ebfc15aa207fa8e9467471f501da8563b86ed458faa71748d9b602af4f128f59a2d0466c2b8acab243f426577b4c77eba12e34ed