Malware Analysis Report

2024-07-28 11:42

Sample ID 240628-1xg7hstblb
Target ce3fc13aeb253e8fd12158b79d464706b733cc210cc0cd9495bb901f91b955f6.bin
SHA256 ce3fc13aeb253e8fd12158b79d464706b733cc210cc0cd9495bb901f91b955f6
Tags
ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ce3fc13aeb253e8fd12158b79d464706b733cc210cc0cd9495bb901f91b955f6

Threat Level: Known bad

The file ce3fc13aeb253e8fd12158b79d464706b733cc210cc0cd9495bb901f91b955f6.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Hook family

Hook

Ermac family

Ermac2 payload

Obtains sensitive information copied to the device clipboard

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's Accessibility service

Queries information about running processes on the device

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Queries the mobile country code (MCC)

Declares services with permission to bind to the system

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Schedules tasks to execute at a specified time

Checks memory information

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-28 22:01

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook family

hook

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 22:01

Reported

2024-06-28 22:09

Platform

android-x86-arm-20240624-en

Max time kernel

117s

Max time network

187s

Command Line

com.yosiwiyufuga.moxumoci

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.yosiwiyufuga.moxumoci

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 null udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp

Files

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-journal

MD5 19c55917e961c10466c0738734ab42e9
SHA1 a2fb9e7e0be67be2c90e18c9427a2457604e00b9
SHA256 9799589159a7f1a2d88fdc3fd0f262e113bdecd7d06a8223d87ae869c995f639
SHA512 8096cb958c380ae631bfb48bc95f324aecaf87d7d724a262ed299bd6f6bbd6331ab9377db81aab448091c2e3525b2df60c203a4fb3240d92ae9e4a58f7a5b9fb

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-wal

MD5 acae2d5273e11b8799fd15a4f8954fdb
SHA1 39e57bf1cdf2bd2b7a5d2fdc219ae189b5e0f474
SHA256 09bc2b73eaaae1499a0908916ab61fc9c145c81318ec7bbe4079f0d1744630df
SHA512 69f6de27fe9843c2e86e34dc3862c66d13b4b255395a354d5a55054733554e5d784d3c982d7042860f870c3546e3642f40cb8f30171f4849919ed99b58b4f80a

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-wal

MD5 fba82e33bace43d145e50debb100eadd
SHA1 30f3e24eab4ffb80aa347f1785e6f8ff68c629f4
SHA256 29e48c7883a1accb0ea724ae1548eb1e4db4e31334cbc5e8c54bc9c5f371b8d4
SHA512 504b55511a53cc1383641208fc1aa3f362edc8f87a418f33d5eb31a1015c2ff73cacee322976fc8afcc225146673331cd15ff82426e80eb6e443e7bbbf12d8cd

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-wal

MD5 73e6c7b5b80ea9737ae1b32a32fe382f
SHA1 6fa6f474c870b22efc21a809e8789780696ef5b7
SHA256 ec014e36591d0a5c0f520f3e7b0142e2cf95bc1ed590e5025efc409d0f2ffb5d
SHA512 0c7fa12bf5f8dc1ec27db9e2ea98b18ab23218fe852b58b5640a0373a6bf1125a133fe8218a466cdc92f92f694a4e18b99a39c98a1b76df5209fd1c27c58ec9e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-28 22:01

Reported

2024-06-28 22:09

Platform

android-x64-20240624-en

Max time kernel

179s

Max time network

146s

Command Line

com.yosiwiyufuga.moxumoci

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.yosiwiyufuga.moxumoci

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
GB 216.58.213.14:443 tcp
GB 142.250.178.2:443 tcp

Files

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-journal

MD5 2770edd16aecf3fd2a64b4d643f26820
SHA1 dd2063ee0de0d021f2b344d6c9fd755dccac95f2
SHA256 d96064a05b8e6154eb4520bade65e0300c11dcd41a9c0d155b8874e296580b7f
SHA512 dc3cdacbed407518283abc7e034821dbaf74535c08f78ad9b279d03c26ac154520780d4d22f1a582910eab470a63d4655df4edc98cd4d57a7822c00b22671df8

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-wal

MD5 2b534e2f23e851bad1dc81d41bf66796
SHA1 e2cdb09917d7fd24bb813f94dd08ad53d8673556
SHA256 0152a70adc123894cbc038955b06b88159f96c912ca9e5a042f5393e45defa97
SHA512 1daddedd13514551d20dc82d88962b49b37867fce5c45ef4977645877a98721e7ff31ffc32f0acc4290264b6b4ea3f25987e27ed582bd1fd50a229c01315960e

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-wal

MD5 eaaf96af99cda75aec862ae50eb1d08c
SHA1 b0a0b6be7ea3be6aec7b34b22535edf109406792
SHA256 b98a6d0010946a2ab6e10007e44c5a535a3b595613ede0041a3b2e3c1a272cf6
SHA512 f9c8f4ac2d698010bc7ce2dc9bcf3aa3e335d05a7ec309e36cfd25be8b4af5c035ace0ce305d68671fbcf0c62f1532c70356c57cb3fb04bfabe41cf594c5c94e

/data/data/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-wal

MD5 958314b28f824ace84cf5de85fce6f28
SHA1 fb344409afc3a290d065b8a33d49f4a83bae4f08
SHA256 d80bd546616fa5aaf75a57bd0052877a6c3683ff22f5e914c360a8e158d7072d
SHA512 2486c093018fd020b0617b8e330d1efa1448b1dba4742be50802d4f555e7a3b79596ba781a8932be64ae11f2be84db69d5e4511bbddc5689488fde2c77d2614d

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-28 22:01

Reported

2024-06-28 22:09

Platform

android-x64-arm64-20240624-en

Max time kernel

37s

Max time network

188s

Command Line

com.yosiwiyufuga.moxumoci

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.yosiwiyufuga.moxumoci

Network

Country Destination Domain Proto
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
N/A 224.0.0.251:5353 udp
GB 172.217.169.74:443 tcp
GB 172.217.169.74:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp
TR 91.151.89.25:3434 tcp

Files

/data/user/0/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-journal

MD5 4dd54ed7afb258591c83bdbf1b130ca0
SHA1 2241aabe8a6b0de4773bafea3e877cb1b0289d5d
SHA256 ec9336d9f0a55df7b228baa302a89c68fa079e76e9c418c73168d01fb1d5174d
SHA512 aedad95c7005af2aa2493593f491b0e808cbe2c3e1789c5346d3cf85b80f052e810d7cee004c7e0398b313813d05bcbd98b249d9d7caf2d32f7c8386821ec3aa

/data/user/0/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-wal

MD5 810132c916d614b96442e837903064b9
SHA1 69668635fc5a7a3bb03c8cb8d1736b8690d215dc
SHA256 d50ade2a2f45f3c157ec3aed2b313720a9191caaade743776dca2c2b57eca277
SHA512 1a85b7b80d22e6869b32bd8c7b9fcea16bbc028dccce9f4beab3339ea08c263236775385b8a11578b99ca9c94d6fe55020fddd0a61011f94a63a7e72888024ec

/data/user/0/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-wal

MD5 3f52d5edf5e8f5a18250e7faef16591c
SHA1 58e7d211348520ef64c71b72b9d9f461bb94b9cb
SHA256 a197811ec1ae89578af089986143ee63c154362f65165126e6f2a128f3170f86
SHA512 1ac1559538e340ca2ae4abd8e3fa842e759390dba1a41d2840aca471dca1f81cbffb13d6aa8596f268b5a61ace36b4ea44d567c0167712570295116123cb3919

/data/user/0/com.yosiwiyufuga.moxumoci/no_backup/androidx.work.workdb-wal

MD5 b245d3f8681d466e583f6d0e2006189e
SHA1 dbae92d135e9d253c8728829a2b50bb399946db8
SHA256 618ed7687ad21afbe2f0367e60a0b5f939594940396d05b5474840b742529e2c
SHA512 bc5e4e73e90ab21ad81208038b0e85dcdf7a52c450a3662b7dbacc8735c09385b474e5c4633dc149177916d2027cb9f86f44fda4bc318c2b527bbbf5ef5c4d75