Malware Analysis Report

2025-01-19 05:51

Sample ID 241202-t5ggmaslhz
Target NMail2.apk
SHA256 63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663
Tags
otpstealer collection credential_access discovery evasion execution impact persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663

Threat Level: Known bad

The file NMail2.apk was found to be: Known bad.

Malicious Activity Summary

otpstealer collection credential_access discovery evasion execution impact persistence

Otpstealer payload

Otpstealer family

Checks if the Android device is rooted.

Queries information about running processes on the device

Makes use of the framework's Accessibility service

Declares services with permission to bind to the system

Acquires the wake lock

Requests disabling of battery optimizations (often used to enable hiding in the background).

Queries information about active data network

Reads information about phone network operator.

Queries the mobile country code (MCC)

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Schedules tasks to execute at a specified time

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-02 16:38

Signatures

Otpstealer family

otpstealer

Otpstealer payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES N/A N/A
Allows an application to read video files from external storage. android.permission.READ_MEDIA_VIDEO N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-02 16:38

Reported

2024-12-02 16:41

Platform

android-x86-arm-20240624-en

Max time kernel

26s

Max time network

130s

Command Line

com.nhn.android.mail

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.nhn.android.mail

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 ntracker-collector.naver.com udp
KR 210.89.168.49:443 ntracker-collector.naver.com tcp
KR 210.89.168.49:443 ntracker-collector.naver.com tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 kr-col-ext.nelo.navercorp.com udp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp
KR 210.89.168.49:443 ntracker-collector.naver.com tcp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp
KR 210.89.168.49:443 ntracker-collector.naver.com tcp
US 1.1.1.1:53 firebaselogging-pa.googleapis.com udp
GB 142.250.200.10:443 firebaselogging-pa.googleapis.com tcp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp

Files

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 c129ecd5a23cff4601fa106d0cc461ea
SHA1 ed39c52d064182bb4b1e229eb3cc996d0141389f
SHA256 948add622517dce20c586e7321e1f6ba4730b61e2c0c45b8766d8ab99710f5f2
SHA512 e29e1462bd54c343b6e0e9c37020d45bb8b4bdbdb599b66af343c6f88e164910035915788e558121d37f88e247f17fdbaacfadd175b9689e85cc138052d81951

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-wal

MD5 8f4bdc58934e732534077f0e8432241d
SHA1 0289b39566c0f5a9e967ba43aff3651853846c22
SHA256 a0fffb179fccf78341a5ea575afa9195f859c31011c14f40b15cf18b9520ddc7
SHA512 ddee4541336376c713455a4b83db44877bbd6d7f794d2c71764ff60f50b385ecd0de95d43f534ba5e8a3caaac908961db28cff74de667313e572a55d46cd8629

/data/data/com.nhn.android.mail/files/nelo2_install.id_v2

MD5 7512e3a14502ef37ee9d2e360407deea
SHA1 3f6bbe75561e99a09247cad10dfabe261a7bce85
SHA256 6add396b2e6c06d10493b07f731f0c78c0e05210878cc52befcd1e38bd9c1778
SHA512 cba2c453bea33a328dde406a1db20b770edae9b86fc6b55a7d336d92b26687012cbac955e1678e7a86500656ed4fb4cfdb8eac1fb7615646fd796d1642eba54c

/data/data/com.nhn.android.mail/files/nelo2_app_version_N2JmY2QxNTc3ZDE4NGViMmExZThjOTdhODE3ZGE5OTA=.id_v2

MD5 1981f43a95da2edd63c37adec2eba4f9
SHA1 fcc74084dbc43d0236a40ea873bb395f6f22aa1a
SHA256 429b47a7d64d32ce8c93fd47cff30ae5044f9bf4e2c9cafdcb4cce95f62cd394
SHA512 bcf61bb81d2f273a3eadbc9801b3027ea28c202e16bf1f8f3f58e8ca1ee52e409e08ea843b734d2e44308528cf28644ccb5c24339e8bc332562faac54ca521eb

/data/data/com.nhn.android.mail/files/PersistedInstallation67889741637749492tmp

MD5 1a7d0c8bf3690d3362a7be1e44db85f8
SHA1 8a608864e20cb946d26f68f57cff287ef5cb2e7d
SHA256 047e6ec972358ab838a999933f76c8e160c05cb3a19dee357b0a9e9dc02c04dc
SHA512 59939acdf6161b6b951bff8fff7f88a9472ae76eb42b018a3cc19b083410ce7d1eb472ce281ce5cb2678694c07c9b5079111ffbf3ee9c515916ad742947c17d3

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 ffe40b4b04804242e9739d58fc6099b6
SHA1 defa47877162748221b75b6dc4513edc32e82b35
SHA256 e13c90814bc53a4809af59b077d459d266e277625b75980624c3a253fe07768f
SHA512 579c3bb955e9a01bc491e221521c0148bf21681bc280e8d8c0ca36511aa217fa00fad878660ea34c9d051f287cc8f83f8ec732e1010e4cd23e41b1170cdd9b45

/data/data/com.nhn.android.mail/databases/nelologdata-wal

MD5 5f9cdbe8be277f543ee193c6c466b650
SHA1 3a6bd973fdd0fd2d0e5076865d3b2ffebb0697f1
SHA256 a5e8c013d92fa28fa63647d9dd16229dfd01dbd33687369f5b4d9cb80c542adf
SHA512 09949b68acd8e23ddf3c53debb2a10a79284fde2ea67b9e72ef346f36eef475e342d3281ed431e5ac01a18c0d783b5935fd8eb97e8bb52e0ab1179f53f71dff2

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 a117e95983d6d4090fabb80e16cadc30
SHA1 473206af0ec1366ea396135d25c82e1b9dd1c5e4
SHA256 2ef982abd15a34915dd525052300c160a8399c81ae0398c2c3f5f3afe1fa94fb
SHA512 9ad1bdd4103378fec10d3f1bb8813f397d67fe254c297daea526711558a577f18a0d9382e332ce7f559fd72aa2f1168cd75512573dd49a0dfec0c19a36e10eb3

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-wal

MD5 cf09b23d556d5a4edb86bd5a8860e356
SHA1 6c81b33e6da869646d34cac4ad7b544b70bcc618
SHA256 c1c6748eb941354f5ce6f34d478c8c23b38f5283a9fc5f7effbf9990db018838
SHA512 d4b74e115cc789f395862561cf48e9d9c75d3dd9531be668106a0957dd0fd87b0eb0e9cd88f36abac397353081c49dd62616f5d3c4a984fb54fcb3c6652ee539

/data/data/com.nhn.android.mail/files/PersistedInstallation2905794492658697639tmp

MD5 658ca332bba48be799a248e642d37663
SHA1 364b9cb1d0558082b9d6f30453b1a3b330632d0a
SHA256 110c218a2ee30471b9ba6ba49a5a487adf3cecac657365981598e8541bc5bd27
SHA512 e19a4a566d3a6846aabb0c7da9342db6d74823f54bb64ce7f79fffa6eae87ddc40eb0e36b33fbb5e62703cf60e5a44e260b876e83594b19dd9180606c54e9a32

/data/data/com.nhn.android.mail/files/KeyLog.txt

MD5 97bc1e5a47d44e398bf9a3f1e38c1bb4
SHA1 2d90184bccc8781fb6e11264c4f3fb8ce4a2ab47
SHA256 f3a2228ea3eb9d99132635a29b27863dba3829440c87123ce27e9f445258d93b
SHA512 ff9fb91621ee06ab4121bf47be6138a19182da981b0ebe79f70c1bc5b354d9035ff4d4045e3695203b52ec6ae36490535e25474d7ec46fddd8db4c16e92a6df3

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-02 16:38

Reported

2024-12-02 16:41

Platform

android-x64-20240624-en

Max time kernel

27s

Max time network

147s

Command Line

com.nhn.android.mail

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.nhn.android.mail

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 ntracker-collector.naver.com udp
KR 210.89.168.42:443 ntracker-collector.naver.com tcp
KR 210.89.168.42:443 ntracker-collector.naver.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
KR 210.89.168.42:443 ntracker-collector.naver.com tcp
US 1.1.1.1:53 kr-col-ext.nelo.navercorp.com udp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
KR 210.89.168.42:443 ntracker-collector.naver.com tcp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp
KR 210.89.168.42:443 ntracker-collector.naver.com tcp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 142.250.179.226:443 tcp
US 1.1.1.1:53 ntracker-collector.naver.com udp
KR 210.89.168.49:443 ntracker-collector.naver.com tcp
KR 210.89.168.49:443 ntracker-collector.naver.com tcp
US 1.1.1.1:53 firebaselogging-pa.googleapis.com udp
GB 216.58.204.74:443 firebaselogging-pa.googleapis.com tcp
US 1.1.1.1:53 kr-col-ext.nelo.navercorp.com udp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp
KR 210.89.168.49:443 ntracker-collector.naver.com tcp

Files

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 f9a0a30f6bd0052be01786b024ae9f65
SHA1 5ef28dc569ed992a26519de0ec8c85e88a856956
SHA256 e0780d5c69d3aeaf08480353622d74d37fcf100d0e8901840ce9e5e50a9a274f
SHA512 4492496c5c1a49ad2ece7e63cf94f30350a86b2f67f275f0dedfa1c67f804b6771e9725fd2b7a2f8bd26a9107adc3194e01c9856622c696363321681c513d1a7

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events

MD5 3f6287191511878c981e843c1111f683
SHA1 2bf2674f1b72b07d87b3ef82171a8a7a6301ee70
SHA256 95a599c805c768e4e960e13023898dbb6b8b88f1e7585cbff2b351f43be4a121
SHA512 de38aae9e1382636d81d7612bd87ba0b9d8aacc8ca9e5a23e3ffa1b5c22d83609e000ec813f0f0f48ea48e8747437ffa3c1d59c6e24dea8c7eea300b353e2dc1

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 e94917ad5fab3a89e0f59c6a1991940a
SHA1 2a6b04a3067f30c1c156042f46a568518e6409e3
SHA256 f4307711f284401df53dd5c9ec2c39877d3b2a3dfca1f9c10331f0675bfe4a0b
SHA512 a262db0bcf89b7c6f826ce6607802f352531b776a4bab5442b65e22f4942e77a09ee9753b314ff0a2d9c6025df580350b055f6419f1956aa78b6a280823eb9eb

/data/data/com.nhn.android.mail/files/PersistedInstallation7601058090983848411tmp

MD5 4ff9526a140cd6511d1e055772a43c6d
SHA1 6fac38a6d55d2ec015ac9735797b6a5afc50b95f
SHA256 9fd829c9a89ff7977f13e94be3695c0e51ff3c9886a21600d5e3ffcc0b5737dc
SHA512 2daa33d2f24f4c505ed17969fa80c48c76e1e31e7b49170557a9d45a9f84a2ca112ba794b03401672906bdec111bbe9aa8bf1a1007a7aa7a75dd30ffb1960608

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 ea6e60659ecde60daeb25d6f00aef534
SHA1 5e1d19f75c1fa94b0a411f1039baaaa815cb8989
SHA256 4af6f593a6362c9a2392658fd701ba57f793c71f7c21ac773d064a2678a50d8c
SHA512 9d38c4a7a401e3269d7ade97ee057556b4b55d38306a02928b020c052849a076f0a4aabcc4c6232fb5968a23505ec25b191adde53a466057587a153d56c673df

/data/data/com.nhn.android.mail/files/nelo2_install.id_v2

MD5 389d32a57707a5eece449008a2e5c339
SHA1 e264df0baedc5d5bb87f841b0cdc68398e72fc00
SHA256 e2a26bccec4edf0680005bdb77690c90b8c8a52dcb2f6e7c48956d15a3212558
SHA512 3982d016b91c413c22039e85d950dc68c5899fe93869c3b5c517d0299de2f5833ee01cf0fbd9d9a477f40ec048807a7393ed64affd1bdee29595cf27b5360f34

/data/data/com.nhn.android.mail/files/nelo2_app_version_N2JmY2QxNTc3ZDE4NGViMmExZThjOTdhODE3ZGE5OTA=.id_v2

MD5 0d0d7f462c320c3fea2eb7e2c82b4f1e
SHA1 ea9a8ea3644b6d1f6c273a0357d49020122fd740
SHA256 0aa05848646a81868c6cc6c6374f6fe46a09d3d65de0a9ebdddbb0ca0385d97c
SHA512 e44d4ffb3fb6ac4265fa3faeadad862f49ca71e1a5997d1f6d0e5f3825d3cdaf07866a8a8048a2b7f4c177ee0a294db9b3c64befcff05709a29716a69764d0ff

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 654b80447f7f5122af1008e53ce1e703
SHA1 8c9922f2a1bc5e1ae270e73eaf513951240bdbdf
SHA256 0877b6d0155f847d44f26d2bf07f710ed0e31aca0a78399c2e5bf9193af74b1a
SHA512 e1ed44cc5a457757495745e9935c245dec48490e007ca7f7ff7148021eecc695f96030c09e7e537af136a46c2008300072bc482c3b8e993ad71ed7283b2b4096

/data/data/com.nhn.android.mail/databases/nelologdata

MD5 ccab8dd22b546bfc3712ee68d5898ef0
SHA1 6ffbf1b115404cb688ff295b2f19568a43f61fd3
SHA256 5197e3fd13099bf5ad70fbe7a23a88cf6e8789521fa7b6869ed87567d6a157a0
SHA512 dfae20103b1a2626eb0eb2808d1000241b9b0541cb26fcdcac6e45ec2fd36c48923c1af6cba6c4a94444d487ff46ccde9c84352912797e0d992da20dec966a3f

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 8641b49bfa0c7e9f3d9c20fc42aa4880
SHA1 7126052c8fef67ec155c730013058262229397f1
SHA256 dad608fb6914cfadea69917297f171ca60787e3b2721f8f99a1142b00d285e2b
SHA512 efc189256cae6dbf334150119a8a22b569a553ca07b64716a1f45e82b85030082f736dde33b9be8f4387b8db2b61041dc717fd096333a3c941b83a968b912265

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 d92129230e9ec44be0c244e9e1db52f5
SHA1 a15ab83612f823444ad38338fdcc82af038892cf
SHA256 44dd62309a043ea640c155775ecbda652198bcfa4f1892e41f5fc71744cdf80f
SHA512 02ddbbbbf9febc1dcdac39107977cfd7062e71e60467f063b57b2d1b356a0a95f07a44aba5d37d37d728fb43b353eb190af475b41268971433e32f29343b6b1b

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 275c684209a6c1e066c2a558e3de1170
SHA1 760c10827307b55a329af19008fc12028021b39d
SHA256 73133dc14b3dc43f092e7c64b2d3378b44aac043ec2c802a576bf1c4a80b3187
SHA512 e96e24db5660b6cb1c96e39cac07ddf1cacf2d76a767bb2de9a83c82ea96e9b97d10bd00d6fe8177112fc5421a6aca5bc6eb988d950eb2ab7ff19028ff579ae3

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db

MD5 4e349df828ab91fa72774f0973702f15
SHA1 943498a611fe61d52770d14cd2ee24391af7fb99
SHA256 662b958ba6a6f21ba25194c8ee81d721ecaeb5ef6e0321b014b1db930602566d
SHA512 f87669c0e572c38e6d8ed7f2c202577d43a65565e2e2fe36aac49d467e14aeebc91c5db612a71ee15e167b6d74600ff5bc5de5dfce968eb6681ccd835f76cdd5

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 71c4dbb0c6c3308f2d78ab418eb87c16
SHA1 f8fcfcaada7feadf23148d78ab41f4340d19a0e6
SHA256 19a63a9314eab3787b8bc3e94f89462b5adccebef28c52b94696823eda7926d8
SHA512 63aa0a36db0305ae5dd0f35ccd997ba260791ffbca87d642c30529780205775cddb363420d5f008c5032d16ac0edf374108c8f823cd965fc343212795dcba314

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 e4f5ac3a59436a05558fd07040e86b44
SHA1 0c88eca3e9b6859e5bc79d3d2c29fd4f3d20a88f
SHA256 e554e86509a0401ce231d95dc2f20bc8e24ba5a07cb269dd29cae11a6a4ff56a
SHA512 75206e4e022a874fdd9dd6e86082e2b744b3577f3bd4c7b53f73fb92e80a7c4828dc4c83132f7e1cb66e20c4b43a97a78d19d801cce36a35055fd2f6b0b08ec8

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 6275f2155cfc3ab7556c3f2109793691
SHA1 fa77979b72af1f1d4cac209a2513c9fc9fdcd567
SHA256 f12a9a73c27a011cc33d190ace6a8299493f0db1edb7ddbb827a9b612113479b
SHA512 a56eaeda9259ad1f0fcb9b9436d30a01945af2160407539b3d41944fd7d716a6fda78720a41b4d75625a154e806256730653816924fc7c333ce0270eb66ab1a2

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 af1f5f0915717ddf550df9e23047420b
SHA1 472a516283a8274b0172d80b631ab11cbfafc592
SHA256 3b306087ea7b7212a35a665335f87051520c3e3a7199af0c5f15695024e03b2c
SHA512 2de40050c8c64e899877d308561cd0ab1c5fddd632aba5ffbcd1c3294da04efdb6b99a6b5ea3a43e9e39cd7df8545604af4f84cead5cc6a4738afc1f48dd9dcb

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 2a3551c176fedbc299783177df204314
SHA1 11349a0ae1cadf48c129ae6d14347f3ab8b20e43
SHA256 1bd0c391c2916377c605633313130ce7d4fb996f697b8b31136dc3da35915355
SHA512 1e3271f7829c04ed9dcce155371bff18de7f385c7173c4815bc37d00dab641094bb8dd9b7f77d6d13b7acd37bd16de638f28041f86230d51381eee925fc5bec6

/data/data/com.nhn.android.mail/files/PersistedInstallation7208102891015614245tmp

MD5 9d6c73d6537845a84ef106f87a3ddb05
SHA1 6c88b1d1b5fc638857ec53f88b79001e131b0c12
SHA256 663dc055538046ac28e84354e8526bc600387c04355c7462b4119ee893504ca5
SHA512 14735229ec473ccec9cab5bc2f743e26fd530b8679b6ca5f2f0f096549e9cea2fefca11975a50ae2c2996407572c7c76bbcfddfd942e01d804b652fa034075d4

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 e06ed54e7cc9071f7b7d0fdd9a034828
SHA1 36785a5018845df21b7449370cda0a6a4555eefd
SHA256 8bd00fea0557fd1516089cf982171d7d4ee5c328c0a90e3ea9a504e24df36163
SHA512 e5db870d5ea34c184f6664a8deaf5fb1d0c362f89503719c90c8fbfcfba82367efe7c574f327026568d0a496afd042f3243763b29629f09e18a2549b0a76c119

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 ea54d26855f9a6342c1ef56dbb295a8a
SHA1 3fd88f73fe96e5c2aa1cdc9a594964f3f300ce30
SHA256 b6bbb8250f18d9e1862e4e68dfa368302e0f2c2c9ca384034d36f271c2e9b6d6
SHA512 6a625718ddde11f27e8ccdcc4f3889d4f0394bd793191ad2598c82436b870cdfc2a17bb5dda00f3690ab8d2b964d74ef7f7bff9a3e90e8ac0eada03e72739d29

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 2d7a816c4715ede741c3e18cf78505b0
SHA1 7e833e79d57731ee5f05c77c838c1d4bd5567eb5
SHA256 4f12477a93cb4948708cccccd4dbdb68eb502fcf270aea373aa6b115167d273b
SHA512 3a9703bcc16500cf96959f2bdb070098010560623486ea9fe76c3f6294ae72901d720989fdf3e0579fa65ce4661abc01105ad9ec381e97d4112487757641c5c6

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 288860e6ffa74fb72ac6ba68ef9fc41f
SHA1 83d37e6b0c43de3031a46251c2a8858c645d4a5e
SHA256 8a7502e32464ea8d0fd7cd2f0bf001deecf1af9a7af703e7d18d0908716659ad
SHA512 3bcedf9d224a314f881b831aeac227e785684528a901fc8dc061e0f507d61c215d8f803b3d2396312f487da86f97aeaf71037bff42a6f6beb365ced3fed31b45

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 ffc6d3af0396fffc5d516c3da4918a94
SHA1 3eb8c5837d74230b2339d3fe9f3f1cd3c8a880d9
SHA256 35f2a5e9f3844bc018d5ce4e6cb7c56b7a6fee7ac05718776fddc5710c136407
SHA512 b4d6f70f1000cf04c380b3fbb163935fdfde3f826c79cb3b826354b03c38711f7d9fb02b01862dc5145f1ca50214a82ab8d0c585e6d5dd06c716f593db3c7512

/data/data/com.nhn.android.mail/files/KeyLog.txt

MD5 4dab5b412fce73aa583d93b36f682b3e
SHA1 644211241fd20aaf90ef528fe2b096eee6d06883
SHA256 293516ad36d62cd7bedf6ea4cb8ecd7871b0f023dd187ce61cb6df6556e7d11e
SHA512 a1f440d464b0825c59bea441520faada7a01b1d418cdb15db6c89df8ffc38ca48eba358f2232869584eae2a71a66d056d2f90e1aeae92527a33bd5bcbd376a48

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 5b168089003542ed1a8a6e3d7f94aa10
SHA1 ccc96f9bff6dbbb57ddc31156394694a1e830206
SHA256 fcd089abbe5919b054f1599b29a892c48fd2fd3450a0a6f3eec8474e8066ba74
SHA512 a5dd01131441ebf4e73ab0acfa96843d77ff95516d1bfc7bbba89b5cd67f6afb4517f8aa5db63f7c2f60915b2770c2362f0f32460b8ba45fcb2175f69c5db4d7