Malware Analysis Report

2024-09-09 14:35

Sample ID 240618-xkrzeavblb
Target c0b49d35aba26433370836dacc9d3007.zip
SHA256 ef9c1ee9c06e8f6f92e9388e445d268072a321a4bf77704054dfdfbc68bd8830
Tags
ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ef9c1ee9c06e8f6f92e9388e445d268072a321a4bf77704054dfdfbc68bd8830

Threat Level: Known bad

The file c0b49d35aba26433370836dacc9d3007.zip was found to be: Known bad.

Malicious Activity Summary

ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Ermac2 payload

Ermac family

Hook

Makes use of the framework's Accessibility service

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Declares services with permission to bind to the system

Queries information about the current Wi-Fi connection

Requests dangerous framework permissions

Performs UI accessibility actions on behalf of the user

Requests enabling of the accessibility settings.

Reads information about phone network operator.

Declares broadcast receivers with permission to handle system events

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries the mobile country code (MCC)

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-18 18:55

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 18:55

Reported

2024-06-18 18:58

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

148s

Command Line

com.gohaxacupumasa.kipo

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.gohaxacupumasa.kipo

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 null udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 216.58.212.234:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.180.10:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-journal

MD5 78c6859b841d53f689bd25cbbad9df96
SHA1 962580c420b8be4c3b010e3e9aff4ff0691f4bc2
SHA256 7a58d8862eba04e470bb7103fdcb5ce0a36c542d95f6caf303268d52e1d531e0
SHA512 a2c96bf0caf4c791011a1c52636afe8ec8641b6a9c5c9da979d6864cc169ad20cb771de1e30612ff824072ec68bd14b96982610e00a59c9a7387e4acb01f5f60

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-wal

MD5 cef9379a7149b18c79826e34a92d7292
SHA1 67af7c0ec2c9f34c10dd79ba9af9f1a50cf19a6c
SHA256 37025f705756c869e2170c8c5f5a55467418d4400ef2e1c86f8e543c427c4225
SHA512 10aeca0c5ebb22ef7c1f95fc7882baff15733c98110f80ba85c1c8cb22e8a036744aa02584fe704a36ba759bcd95096a396707f6952b3086d5da0b5ed78500ae

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-wal

MD5 10d7b2db441b8fd780e694a792db603c
SHA1 a7345f007cd105a08a45880925117430164b2be5
SHA256 a7e6c786bb56114fa7b6cf3cbe7656acd1e9d33964946ee6b6542fbd43d0cf6c
SHA512 454003a6870dec58997c71098be447f0f4d027545b669e5b6ab6fb2f7df07009c88864f8b71e7e4d54f987de08fd435631f499fb05dac37666c3c1d740aa71f7

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-wal

MD5 889b80472bdd7d86cd0fa2b5c5e49dc9
SHA1 ee6b93174a4ff74a02eaed0598bd55f01d019e9a
SHA256 ebf50dc8f7610827dd5a4a73c9c00f207969a0a86bd87f37b352bd2bbc900b7d
SHA512 1c2bb13300f701be34112aeef1e6b1b9a75953ce214b82a9050c458f0488684a9edda3eeefc23bd3ff5781b9e07556894c124c93d5e289797b32a1ab56fb5115

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 18:55

Reported

2024-06-18 18:58

Platform

android-x64-20240611.1-en

Max time kernel

147s

Max time network

174s

Command Line

com.gohaxacupumasa.kipo

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.gohaxacupumasa.kipo

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.234:443 tcp
US 1.1.1.1:53 null udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 172.217.169.10:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.179.234:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.200.14:443 tcp
GB 142.250.187.202:443 semanticlocation-pa.googleapis.com tcp
GB 172.217.169.66:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.204.78:443 tcp
TR 91.151.89.217:3434 tcp

Files

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-journal

MD5 bb967b9499071c1ccfcce15e6ecc976e
SHA1 022b13bbe34fdabb7afadf91c97ec71fdc7ae561
SHA256 4c6b846c4f7235686249258c17f8d76183d4f2ddf1190c3b039c8c3f21e0f65b
SHA512 364770803cbd0925c2081b8c67113b66b0a98cf26ee7b300cee1c8d2a04e7c59d66eec0a2dc31cbf236c388baa64d142b35ae0cbbd7f5f26ea3fbb20d0e92b8c

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-wal

MD5 07903beb34b164ff55309e962693958e
SHA1 6f0cb1cd0eed0af7cccaadb525b89e2ccaf6320f
SHA256 6ea761d87aa1dc3736e39f70733b5050e48baf050d740c49f358c673b6693afa
SHA512 6b301bc95ff3d9810519161ebd47a0f928cedc7caf3bfd53eff91b34a058fa7f10efa4156568e1f7cbe06c136a4f33dee55c655b96df169b54c4026b13bcd034

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-wal

MD5 c4f27f7c37f295998a489850533a47d8
SHA1 6f49a51477d758a8f699a52e373af290aef38d9c
SHA256 efa565d33b00866db7879d434d66947d6c543522097c4e49d701b33ce7ffe465
SHA512 12015fa90d4e04522230f79ae1f4efc081845d3e5c912cb2ac6536b700f1b9a9358105239711e83c9dcb242f75e636c7128e2b68fc125e1abdfd0e890f2dba9f

/data/data/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-wal

MD5 496f446569babf9d3740c733b18d022d
SHA1 042f64294b2aa7c1b989e671ed0f9533a0e54e3e
SHA256 3cd8d36a549476943e9c0e2e2f6ba5ad02d4a93652f98dd1fb46c1172ecdb8dd
SHA512 0a7fe82ad9c8a4699119813627cb187006ac8044649a65c4f3092816393f1c7a92fd48ae57cd63354b3e8df0df919e69bf10c434903f85e10c38e58559329832

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-18 18:55

Reported

2024-06-18 18:58

Platform

android-x64-arm64-20240611.1-en

Max time kernel

42s

Max time network

188s

Command Line

com.gohaxacupumasa.kipo

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.gohaxacupumasa.kipo

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.10:443 tcp
GB 142.250.178.10:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 null udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
TR 91.151.89.217:3434 tcp
TR 91.151.89.217:3434 tcp
TR 91.151.89.217:3434 tcp
TR 91.151.89.217:3434 tcp
TR 91.151.89.217:3434 tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.187.228:443 www.google.com tcp
TR 91.151.89.217:3434 tcp
TR 91.151.89.217:3434 tcp
TR 91.151.89.217:3434 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.40:443 ssl.google-analytics.com tcp
TR 91.151.89.217:3434 tcp
TR 91.151.89.217:3434 tcp
TR 91.151.89.217:3434 tcp

Files

/data/user/0/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-journal

MD5 251c843f59b0652558a2c73f5a66312b
SHA1 fca200e1e292cc56b2f7d32a17f38821c9930021
SHA256 b0d6c6e3967d5aab10ac1565ffa512fcb214c73121735c40114dcb5f639887ba
SHA512 2599ea7f0575ac9e49f235f700af969f84f65a882e3eae176cb31d8b83604d4367ac555640326b03c6a2afb34f5e5a970e7946acd18a0232c3467de5338b8377

/data/user/0/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-wal

MD5 7eb7abd435b1a571d82cace864f790f7
SHA1 f6cae0b789d615679ca473ea5b7f86d6ec16d844
SHA256 c1434cab08784ed52a9ada9a6297e08f0159a9a11965d7d0495e11e4069de2db
SHA512 7f759e64f8e1fa785a811a417f779e429eb63a94efbfa44a687cf3296047774b7e9f40a10efb23456031f9a499a56688b7f1d382b5fe4d492d3031929b3519cb

/data/user/0/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-wal

MD5 60c7da9281e3af654b87f7d6ace52c55
SHA1 6e8b49dfe3648725f4e81ef7ca461f82c0fa192e
SHA256 12a04b02bf2db39c5c4924f65bdac370f1b08ea6d84848a20c906b6e1f0a90ad
SHA512 2071ca9faebbcacb6ed3d1b014c016168342168a38b556717a1db9616b89cdb1a8b4277226bc07dd00e6545af3e736074662533e8f9cde427495c547f5bd2666

/data/user/0/com.gohaxacupumasa.kipo/no_backup/androidx.work.workdb-wal

MD5 cb3a3b948c9d5bb48cac3d3b6b8eec88
SHA1 fbb333857e400f5cb11c2eaf0e1156cb9a738322
SHA256 0ec86e90502f0976e52ce9d1d91209efff63940c6c99ca7440819d215c90d0df
SHA512 69db60d1c5fefda45d567866368a9583902dab2b36fcd67e89aedc1e36f3a3f1d53702fe65b1becb217302d2d2404265c27445359a664897bb9b1b4e7d018e75