Malware Analysis Report

2024-11-13 17:37

Sample ID 241109-1yjfzatcjr
Target babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d.bin
SHA256 babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d

Threat Level: Known bad

The file babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo family

Octo

Removes its main activity from the application launcher

Makes use of the framework's Accessibility service

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests accessing notifications (often used to intercept notifications before users become aware).

Queries the mobile country code (MCC)

Reads information about phone network operator.

Queries the unique device ID (IMEI, MEID, IMSI)

Declares services with permission to bind to the system

Acquires the wake lock

Declares broadcast receivers with permission to handle system events

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests modifying system settings.

Makes use of the framework's foreground persistence service

Performs UI accessibility actions on behalf of the user

Requests dangerous framework permissions

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 22:03

Signatures

Octo family

octo

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 22:03

Reported

2024-11-09 22:06

Platform

android-x86-arm-20240624-en

Max time kernel

149s

Max time network

157s

Command Line

com.nameown12

Signatures

Octo

banker trojan infostealer rat octo

Octo family

octo

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.nameown12

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
BG 87.120.115.219:7117 87.120.115.219 tcp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
GB 216.58.213.10:443 semanticlocation-pa.googleapis.com tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 tcp
BG 87.120.115.219:7117 tcp

Files

/data/data/com.nameown12/kl.txt

MD5 bfa4842ee6c4a6fc68aa9c3f591d708d
SHA1 2a00d1c3e18fbe8f57643de07b17ab2256befa13
SHA256 4966db4cce25a539da1aada19d8e3d50b68d897d4416c93797a351f3f6c90c82
SHA512 0267d575a9c7b802a846847e7b0ead4643100756c0cb667a52d434b8c398592d10ee082df3e210975f42f587d317848ba0cfbbe26a5295ed8d4cec7083be38b3

/data/data/com.nameown12/kl.txt

MD5 aa52eeedae7791fcab8f2d256755a005
SHA1 90e5787599cb5a823ec9520f160732b4ce50b538
SHA256 93bcc6d34dc9f1566f9ae474d49c1018bb70c3654120562333e0430c61c2a054
SHA512 cb5c6e2c972c458ad235d82287e31c9d6692f857058b36f4a2201071179f940977dcf2066776906680269b9b1d2e790417515efef568b814b6b44793b6e107c0

/data/data/com.nameown12/kl.txt

MD5 885e48f2795d59285438f584504f4f8c
SHA1 fd60e3dd9f84d7dba7de1330a48071114684e41c
SHA256 901dc169073241bac255486273ce3a474922d9ad3b19cbd3d361f3993ba366af
SHA512 187329bb52579c6e232c691ba5465e6539dbe8183985e17a771bdb562a906734f6c122eba8593317aec58c3f8eb0d53e90fe217e86aa30f51a03598a5e483ed6

/data/data/com.nameown12/kl.txt

MD5 16cb0a84e93b89ad649a9d92b87d463c
SHA1 71e07dc5580485982d40886674ee25c7dede4622
SHA256 4fe70f1e6b76de88299bb6c7f4017a9e0e834d3889bdd5a833f2dab6a13f497c
SHA512 1ec3aced83804fe71fc6e400edea011e99a7fb77db09808f448d2d4dc0490dffc335b6d8a40fafc59636b451e5332fe8dce3604c2279bc0e086fd5744c5054eb

/data/data/com.nameown12/kl.txt

MD5 c75fc2b0ca790cca0fc44a7fb82ce70c
SHA1 c31fcf3c9ced6017fa7244e65dba253aba5f3817
SHA256 e9ee6228e4da6ac4e7815f324df6ac770ab31e10851067fef9c485c8ffa63c44
SHA512 db7ac251ae3482590aaa8dcc13b90c38fae5c1e3016e8cc096abd9ca17bc0fee0b04c299723aa5c6240d52442ba09831a47c0eb3316772b4a6309cd8e333e024

/data/data/com.nameown12/.qcom.nameown12

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 22:03

Reported

2024-11-09 22:06

Platform

android-x64-arm64-20240624-en

Max time kernel

149s

Max time network

158s

Command Line

com.nameown12

Signatures

Octo

banker trojan infostealer rat octo

Octo family

octo

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.nameown12

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
BG 87.120.115.219:7117 87.120.115.219 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 87.120.115.219 tcp
BG 87.120.115.219:7117 tcp
BG 87.120.115.219:7117 tcp

Files

/data/user/0/com.nameown12/kl.txt

MD5 7eeadce7f53384b54b993aa9a34a6aee
SHA1 6e369bb125988ce6d611ac4f2360ec10d8819fae
SHA256 3c3453fa321d27f58b8dea15cc306015264269038c3dc6dc0bb4b77d7a23ef5a
SHA512 6499caab317f9762694a7ee3cc732bbc1f7f01e8ee0eec7ec5b6d67190027d39c460d16f146cf596ccc03ddbfa2afaa0cc370b98e75690e787b38b655277b990

/data/user/0/com.nameown12/kl.txt

MD5 514587d871fe6c91c9544a422809d845
SHA1 4a0f98776a72b92e12ff0c2df7d65944d6cfff4e
SHA256 fadc2db63af7c9d9c229be16069b7ad4f5e046f33cf3d47d194840e6d329583b
SHA512 f4c45626791b459e614822752ffbe3fbf9fbc377ebda4aee59b65b840f640b5afe0cb4d968ba00c97277576a7f5a71be1d245987fce8ec0831d7f5b5cf6db379

/data/user/0/com.nameown12/kl.txt

MD5 7699a32ccb55365eebc7b9d190e15782
SHA1 bd2df2bc4d8edff9beec54a160f4e2a254c14661
SHA256 adcdcf178eb302fc7ff1d53a7a2ba9faba93cdd97e5b6f85c6dee2a1d18afeb1
SHA512 9d4747b36f3794cb3516cf41c0a93829f4354c59f16ff085788d7f30f39dcfe4792054e36b14b81ce66b498a0fea06f5a505b86649deea4579f2909de16a0d6f

/data/user/0/com.nameown12/kl.txt

MD5 b2f7580739f84e04b3c8d07c2ceef6bb
SHA1 ea29b1116c21ce2ef3cbf0b68e030033a2fa8e61
SHA256 aae464456ae8e738840d256be449e60ce471db2368dd1106c9bfc03b5813c5b5
SHA512 04f36b9013fa740336bbcd1ab59bb3f4055f1538a4bf45be25f501fff5cef6de6f1e7f169b574c214c57e7f0f2f733d8f78a04d962316be38b02c062752461d5

/data/user/0/com.nameown12/kl.txt

MD5 779e4f5b95fadce30197587f7de481b5
SHA1 da4d1f68c5a5f7a017b4142558ba8d3713493df1
SHA256 a960b896ed5b479168e576249d3030b53d6a54f2dbb92aa5d9deea2c207e2141
SHA512 0f743d28ae2a2c28c7af57aae09f5c0122aa84527500c5319a45c8f6cb71e865ab42c45876839ba9fd1c28eff3462c89c84195300ce3d9f15f6a6d18e717cc60

/data/user/0/com.nameown12/kl.txt

MD5 6065d4fe9cf880dfe618f2bfdc309531
SHA1 89cac99e320c89a2f66556e915d4ec850caa9eb6
SHA256 88ab289bd5fe38c99f70c6dfec01beb5382f31130470214ac811c55a36939eae
SHA512 94608dfd17c8d9549e0ad4ba7706a240ce6dcc0c0f59855c61a52f6b9df2d91f9532b867da65f96e842cbca120a758ba57871ea71d1b41457851fde6e6eea688

/data/user/0/com.nameown12/kl.txt

MD5 3419b54885caab935151af829f720335
SHA1 9634306dbfe94e527119fcbf9f601c182d5d2244
SHA256 cb668dbb9a7d67cb713308162a8648a6ff77181f5de952a25d470e7ee32047ef
SHA512 07cf10a1487594ada8a99d7663fba2f41ce241135094a29605713587403035b9f82a55c4ccf6270422c50de327e328f446d676d05886e58263562ef1a2e73846

/data/user/0/com.nameown12/kl.txt

MD5 372465cf1db6c0c1a753d646341822cc
SHA1 c26b5125567a135687ee297f4b921c6948be0a68
SHA256 b58cfec47a61f25de2c1c5eade558bbcfe305313e563bfe8a41df147d2b8f621
SHA512 ee9d37ff2b880186985bb040306912e410daf49eb011e08fc587d7dff0adb1f4c508b12d87343ed53898053906cd1e334b40fbe8639378850f4fb9bb3784c527

/data/user/0/com.nameown12/kl.txt

MD5 b7813aac5f27e3985f7ad2f71a195c8e
SHA1 e5a26dec7670138f9ab66f8c64169b0f5df8e95a
SHA256 1362a7a5fad968e2b4476ebcb9d77ba415c516f9f3006472b6fb452346a7f0c3
SHA512 93051199836552397a87472705b4b541565f328ea25508cc647b7688db177061f5f2c184389e5d4554378006661ee906a336e03237d6d0be5e2f3d2f9b445e1f

/data/user/0/com.nameown12/kl.txt

MD5 64fe5443af4d666bb8708eb4ec5f1b94
SHA1 14ab3941e89c0f8750ff80a09a7972ac10a56f43
SHA256 92c1dc63789b82d5ddfffa9dc469e1a2c5700fcdd4d90461555124e226907be7
SHA512 60721e6ad9f6ba249ff2a892ce1a0df86cea15206e5e8681b3bf94a23de3bd06d234b03f1229ec9e8a23baf2372803e4c67b93f562ef70d99402e6ec571adb3b

/data/user/0/com.nameown12/kl.txt

MD5 548b3ca7fd5055cb102c957c3c303b50
SHA1 70ef5e4871a77df48059b5a672a6287ea1d07224
SHA256 2203cd282ec0ffd2f68ea96d34c63d860c1d6c92d3a0a1d0dc65b72414c7d257
SHA512 6bdfb1e7fcd1c62af18dadf0cd3c305fa32d8467116e6649861fbf691bcd1cc0eb02b0faffddadfa76971ffd952c0de27a770dd35d3e3228927066d79d1b45b5

/data/user/0/com.nameown12/kl.txt

MD5 03e455e7026c238a3a78c05afdd912bc
SHA1 1e951100c84b89f69b9d33ce5b92db6f223585bd
SHA256 b41ce80f015e578409c2161daf818d84389e992675afe28e5c2326322911903a
SHA512 1511a17cb5fc44692bfc845052a3a5a681f9f29e284e3b87beb942503f481020d3ee835e5b90205d2d72f261f4f049f9d6645929c5528a9e57f2208c00236a87

/data/user/0/com.nameown12/kl.txt

MD5 e7d0e028cf63ca34a2baea4307360252
SHA1 eb883a0dbe5b25e3e9d02603d4197ef4c1909f40
SHA256 68791b505118d18cb64e539d9fd0c0e5c0677ff37497ab7686e0b993cf1669ba
SHA512 e3f2f3f65da623bc7c36f923e61d0630018f229aac066697bfda685a7cef25ca1063e860b3ec0f0365fd775c814307d4f2916fea262e80e109df3784877bcb29

/data/user/0/com.nameown12/.qcom.nameown12

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c