Malware Analysis Report

2025-01-19 05:51

Sample ID 241202-t8talaykck
Target NMail2.apk
SHA256 63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663
Tags
otpstealer discovery evasion execution impact persistence collection credential_access
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663

Threat Level: Known bad

The file NMail2.apk was found to be: Known bad.

Malicious Activity Summary

otpstealer discovery evasion execution impact persistence collection credential_access

Otpstealer family

Otpstealer payload

Checks if the Android device is rooted.

Queries information about running processes on the device

Makes use of the framework's Accessibility service

Reads information about phone network operator.

Acquires the wake lock

Requests disabling of battery optimizations (often used to enable hiding in the background).

Declares services with permission to bind to the system

Requests dangerous framework permissions

Queries information about active data network

Queries the mobile country code (MCC)

Schedules tasks to execute at a specified time

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-02 16:44

Signatures

Otpstealer family

otpstealer

Otpstealer payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES N/A N/A
Allows an application to read video files from external storage. android.permission.READ_MEDIA_VIDEO N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-02 16:44

Reported

2024-12-02 16:46

Platform

android-x86-arm-20240624-en

Max time kernel

125s

Max time network

135s

Command Line

com.nhn.android.mail

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.nhn.android.mail

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 ntracker-collector.naver.com udp
KR 210.89.168.42:443 ntracker-collector.naver.com tcp
KR 210.89.168.42:443 ntracker-collector.naver.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
US 1.1.1.1:53 kr-col-ext.nelo.navercorp.com udp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp
GB 172.217.169.14:443 tcp
GB 142.250.187.194:443 tcp
US 1.1.1.1:53 firebaselogging-pa.googleapis.com udp
KR 210.89.168.42:443 ntracker-collector.naver.com tcp
US 1.1.1.1:53 firebaseremoteconfig.googleapis.com udp
GB 142.250.179.234:443 firebaseremoteconfig.googleapis.com tcp
US 1.1.1.1:53 ntracker-collector.naver.com udp
KR 210.89.168.74:443 ntracker-collector.naver.com tcp

Files

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 891973545746a69f331fa5be26305a4d
SHA1 b78bfaeb4a44cd380fb54ae2d850c749df2a7472
SHA256 fe4beb8cdcee219cf622af9d16a1cd7e3d6380559fc174bdec5c61c109588a98
SHA512 ca52c8e223539d7d8bdd55ad93cd325a6a6d5ffd3bb01aed5cae242f37e2bd171bc7707de62e613f44ed4033430d1a38819ab7e43d8a1e44494576995ff337f5

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-wal

MD5 126a02b4586202c3f8092f817e9dd5fe
SHA1 e87247fd804a87b5055fa57e7aeba0b6621b4e5e
SHA256 54a7b1ff24d603adeae7b9e4ac15f453cad18ce425d08b2991c269b3a1592f25
SHA512 6fbfad55943b2c54d82ede9825e72f9781fb8701ac94e46faf2ab670d945fd847fcd0b875e76735c37efe7499bf608baf6cbc9237a8eb576bbe16a58cfe2cf59

/data/data/com.nhn.android.mail/files/nelo2_install.id_v2

MD5 fe906f154e1c62500763d438c343bba9
SHA1 1bd6814adf36224ea5b75618f0a34d5572231138
SHA256 03676bcc2dbae8cbbfca4d5a22881606c34ce2a33d1d0391d1978bb5d7212bc6
SHA512 269434ada286221bc6392f833f44435e37b6c221f62b35dc694e280edd78304f796a696e2e10d78dfedb992cf8de772410fc9f6cc9a0922a23000e621e162569

/data/data/com.nhn.android.mail/files/nelo2_app_version_N2JmY2QxNTc3ZDE4NGViMmExZThjOTdhODE3ZGE5OTA=.id_v2

MD5 7c3e5d48b3b9a267165b196a1c3398da
SHA1 3684897cf3286f19885b96c5ad6a1440b790282e
SHA256 363c31b308d29270ad393d0e12fb523725722059e215a66e55b43c86bbe2c3db
SHA512 8891f068890ea900401b1b01dcd61424a9c3667007b69b7804dd1bf6bf6d0f67d9a7086db3b67b6840fdef8d1623630ab18d4c697ef78e63242f59ab5d39a96e

/data/data/com.nhn.android.mail/files/PersistedInstallation3731533823370437476tmp

MD5 493fd98029d36ff75ce822b6019f3eda
SHA1 d2651e22ba8e604ca903c01690362e42930fab5a
SHA256 d0ac19408e18860b20d735ab40a6ed6b5f97fd7d1ef4fef85f859947d08ee219
SHA512 4b7629b148b12c05535726fe09f842401a7e26f636b33a5af6019b98d734c29926776f57d3e2a2097499eecb786a362316b750934e15347906b356c72b3198b9

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 5bdec3a53f2cb7548860c556b9799dfd
SHA1 2e5770bbf22debe2f5f45872e9903df871bdf7cb
SHA256 d957d6cd2137b30be952d29cfb1722e12355d8e1aa57cc216b523ad6839e7661
SHA512 6fe7672c94ae8fee0998729912d074e80e4973367f4d936e8351f0d68e2c530e7ada823cf0dacdfa564c576814a1f4875052fb37c0402dc802c5543d14fe4225

/data/data/com.nhn.android.mail/databases/nelologdata-wal

MD5 0979bc0b8e91272593a1c3c885a7f8d9
SHA1 1d504273a95887520b542059b568de86599fa08e
SHA256 09c6ab392551b20f88dd9c597586fc6f8cd9eedb07836b679466a1c733d2460e
SHA512 a9e90509713d7c08725a0079efb8de16efd0f1ecb31124ac6cc7a64243fa426c5fa2de0e28e4e7482457f6202db8881846f1a9ad80190eef3739e2063b2cd41c

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 a3d0b93c19f80b8df8cf280eb7ba441f
SHA1 0fcab7dae11200448d5d9c62c328baaa12f0bcac
SHA256 8f21988e953e9c3b613cd654ef105509b48f0dac119deac72696745fe5c73501
SHA512 f8e0552ebf505d20d4f2bd8881cde66c11f1a5aca653634ac43823c6d0370d1c2be4d9ac216fadc6629bb427f1074d9f42196d8948ac4983decc4fb81912b222

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-wal

MD5 eae12d2e4d6424fb0654243310ce40f2
SHA1 89d77707d67e70508e58db4771a7af44ce258ae0
SHA256 fa3f54f30fffd41cc8de6550e85831681bdeaf5ea5c60997dbb48e1743ecdd64
SHA512 bc8e20f483a3bdbd94bb98d9f64b5ee3adeae753dfc106a3311761bea692ac97d350bde87a49d9aa2b06a436daf1ef9b7e1f4ddb837f9d8e090842795f1d6cdf

/data/data/com.nhn.android.mail/files/PersistedInstallation2165083206412007299tmp

MD5 d5037bd1b41159537c508e390e41d6d2
SHA1 7da008f42a9618600d6b20af5fe87793743c3b5e
SHA256 c3364cec22521520b0dc8395f70c8cfb131f73ae0941c0cb105a9b42f9ecec11
SHA512 962756e97d36de73018ba753e74f091e48dde6c9265dd6e01f3f68f9ad54b1d22976d5abf17f37cc0166de728dcce33c1e9737980b15c78ee2539586dfb52fbe

/data/data/com.nhn.android.mail/files/frc_1:129436326568:android:3fb259f21ca1e06e_fireperf_fetch.json

MD5 159daa1bacad77283b2d1217352ae70c
SHA1 4336a7e9647007e925ea49bf8fa4790aba2b001c
SHA256 1ef44c07b5f93c2f3691f859a45cafe588088c88f01a11f8a1089593ded14009
SHA512 959c9984796016516c2cbbd64974968c36d49b364c9b0db054c466c54b9c0880ca183d3b4fde65b8424583ba4c9d50478007f4a9230870586be16b0d0cc5a47c

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-02 16:44

Reported

2024-12-02 16:46

Platform

android-x64-arm64-20240624-en

Max time kernel

150s

Max time network

135s

Command Line

com.nhn.android.mail

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /sbin/su N/A N/A
N/A /system/bin/su N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.nhn.android.mail

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.179.238:443 tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 ntracker-collector.naver.com udp
KR 210.89.168.74:443 ntracker-collector.naver.com tcp
KR 210.89.168.74:443 ntracker-collector.naver.com tcp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 kr-col-ext.nelo.navercorp.com udp
KR 110.93.157.96:443 kr-col-ext.nelo.navercorp.com tcp
GB 142.250.187.196:443 tcp
GB 142.250.187.196:443 tcp
US 1.1.1.1:53 firebaselogging-pa.googleapis.com udp
GB 142.250.178.10:443 firebaselogging-pa.googleapis.com tcp
KR 210.89.168.74:443 ntracker-collector.naver.com tcp
US 1.1.1.1:53 firebaseremoteconfig.googleapis.com udp
GB 216.58.201.106:443 firebaseremoteconfig.googleapis.com tcp
US 1.1.1.1:53 ntracker-collector.naver.com udp
KR 210.89.168.42:443 ntracker-collector.naver.com tcp

Files

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 784b3d34e453da721675b8d5e4cfb014
SHA1 495b97fda3c7e39410c2e970d4d064c248b63e44
SHA256 68d61dfcc45a4c1c8d2fdc85b19abfb039a745f65ac52329f1dba9320ffac526
SHA512 c4249b1936c3c9cd637ada9c53397c657a38e9d9464d6face0197f2b1f2eb943b3598b238ed8623fe81c522f408519232c4f5fac16e05d3182efc8f48e093c64

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events

MD5 4b24670babf32a56d573a72721234bc7
SHA1 4edb1a8d774f854f07a47ad8d6d277c265decf79
SHA256 b49822d68fd64060d074c2115277d9d41929acbbc404b753c9688f8e9e7aba0d
SHA512 bf4fc3ab0072e0c450c0ab5d333c4295e40417dc8e865c82d2c3c238b6a92c73ad200f711f3a8574403fd42d128dabdd06639d108f883452d20b137453e494e8

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 76089d3e146945fab53d66ad0296aa09
SHA1 18244f263c487570d90e5f4250ef422da3b084c0
SHA256 909d0a0fcba8eef3633d6a137afac388b7f80b0ddb2fc6773335e94ce6b5c597
SHA512 0ccedb3a7d50423e0086fe713719b8cbc68221ee1c9f5b5ed48b1872094ba7709bc79998acec6b82f4d38f667a1fecbbbc268dddc172dfe1fe398962d5d68e51

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 60e1c7c73fc2bcc8ba2ae0f92d2eab6e
SHA1 3f061f238b526390b4cc3ee0ce478c854a69598d
SHA256 751738b9d4b09c84d8e7c3071ca51d747e19beb64861574b6fe36d27fdde4364
SHA512 e863a5e8a952a8c1311ac363b2dc98a3b44c2b1bd027140d3e551ef5c42f2f3eb7cfd63c6bc97f219ff052af5334774b0fcf1f9e2492f0873c73c1c1278e4372

/data/data/com.nhn.android.mail/files/PersistedInstallation409076022293040407tmp

MD5 f6a3415f1b5a7fac3e43dd53dccd7470
SHA1 7943d93be8b66ae33beed921afb1b899e8ea9ffd
SHA256 8633dd12bd5faa26903074b2da702e84678195797cb22b6d6f1f82dbe5a535a5
SHA512 08236761cebb16582de42689b6b0bffcbc4932e316123ce975c61fc93c0e6110f742cfb7c9e40ebe2bd9d0908720b397ea9a87dfb6a7768818c02d5b3459d578

/data/data/com.nhn.android.mail/files/nelo2_install.id_v2

MD5 48e88471afce3a0bfdfad478ddceeb06
SHA1 6ee9f844ace4897990687423554f65b4928ec924
SHA256 28d5575cf2326e75d8e305e6ce2fca800fa37a514e648fab6d5fae38d1be71ef
SHA512 e30c784246cd6ce14349ae32683dd9889543438c6ee2a782fb2ab6334db7f52c457385cb56990f1534873ff7622d97c9bebc36ae8630f8f0820195dcc7adda47

/data/data/com.nhn.android.mail/files/nelo2_app_version_N2JmY2QxNTc3ZDE4NGViMmExZThjOTdhODE3ZGE5OTA=.id_v2

MD5 7ecbe3396ec43cbcf5c79de348849b4a
SHA1 9473f9d6b76f0bb95b8f470d128db79b5ef47cbf
SHA256 a05c2d74bc02c014ed95ef04968b141fc63287be94dd6fe39b30ae14ec81464d
SHA512 af5f58616d08eb86790261966e5b9433b0a3dd281ad27623c5943f724f46effa56bea102fe6a4cbeba0d216e6e59083d4f5dd0c32b24e85cf72970a2b06c89bb

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 7c458ee87d6f6c5ede19df4d6bc54f9f
SHA1 c5cd3630a4bc3f7ef417900308eae281335a4598
SHA256 7e43b5488f5c1fc3fafb24b000d9d71fa67e11573dd3ba5b572407b2512ab947
SHA512 de5b23b55d5ff72bc86908f8f02a03e038c32319c93d8de7a7e4880243c740f7d236d55e622944e31c72977fea1a028ebaa0b0ae535a7394bfe182f1ec9fdaaf

/data/data/com.nhn.android.mail/databases/nelologdata

MD5 48395f8729b64ba7d60b576c33dafc05
SHA1 9485bdd3270463e46d75015c7621dd7cd328e7c3
SHA256 7a3ec50c0956e153f9e18e9aa71a2c7baaa5e6fdb893dc21f03993d2f022bd8d
SHA512 29da87a8d92ee41ad4fd96056a30a92ca1cc9001eb3f8cf987c47650d8f27bd85008bc5d732657b31521f9666edc2f280526a6b1a042dbb4e6e4d549960e0efa

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 3c58db1b5f64594260bd35b3be2a45eb
SHA1 b85de460d13dfd7c1cdb4c4e74eabce439b2c338
SHA256 8a872163090f98890bf32ca4c31bb782450857bb0b48268eb554f80d2b3b8fe7
SHA512 cfd2799dd46211af6d9fd50e8e25c8fdd8efbdc3ddfe4ebad292ce9e1b0c4830d18fe78e70d80af0d73af69e3e4fc927b25a370b8e2d053588e67cea75f53214

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 7a731c7967411c4bd7f359d27cbf61b0
SHA1 e008a364e6d6d323ff56aec6b572ca70995fd8fa
SHA256 f9500fc4f4e3cc5259c635f364c074c2a5156e9d2f2911824ec3f989ce4f9097
SHA512 9f3f04210deaf1ef671925d0b1fb64807aab45be01a4708c284d510c1b75ace3a46e3e3a2bb6eaa8433d109642f3663b52dce8f8773a8a4838263eaa63f5626f

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 b2409d179b6d61ece9791a3d6e12baa6
SHA1 cb4d205a4276030e40cbee4919a4d6cc0417b06e
SHA256 9330b88bcb145087746f7e51f9441877e2ae988e8b5c5d40501a5e9773728fe0
SHA512 3df08ba88f23711de0da321c47a2da65c4ecb5ddd54f18d6605772d0ab0d9ad31c28ca6ad3c531922cbb64eedf9f915090a48368edcb370389fea38287421668

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 7693fcd1afb6af0ba0ef749bfb6a0749
SHA1 e6e6211c8f5507dec6291b734fa15891436ae052
SHA256 259ed25f349d7255ec9ab868f871a7c8ea146d21280d4bc3204fec7046184118
SHA512 d940eb2c8f4b8ed73c748eebb6325c52b62ff300c23152823143631d3c2a694419593cfba7215b8db1be94fe11f069c3319cf6fd05c770c7c8838ad64e8183dd

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db

MD5 5573da219fa49b1aeab5a0a3affe5213
SHA1 dfeb15c487e3ee39a7d1ecd5e2f707287e4d7fc8
SHA256 1b61145db70260811f151a46615bf66abeb10a7465e381c8c58c9b4c899e52c2
SHA512 61121513037bc37c100245c7d2f5b96f59fe7fa84a2c42f8e3c33f87c58fd0d0f48895cf4ace218d45de5fdd2941e28d5b43cde41738d8b12d74fd30971d46c7

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 9d4cbaec7f8a9970ccf972d5e78cb22f
SHA1 fb6a2f925d6d6850e6035df9de42792c0836beeb
SHA256 403e7cd3840e9e00c4f990a6387f4116b433c2aa719e3dcc8574238830484a58
SHA512 84dfdf31635af20497a9e0813f86fd07e4795f0ed1a68844c11f9fb8cd33a83dcd7d97939f304ba663b0f02f30e725c20ae4f7e39ad30e492d917ebd8aad0f66

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 0ffd599f27ed241688444ded15fb1522
SHA1 27074e70b4ec9a6e43c106fb969cbd88ebdbdcb4
SHA256 bb0a89188c5d2ebb9b96a55682f5bc237f3cfeec99cc1651e7d4e55d77e128cb
SHA512 44cae84c03387ad913fac95c19bdb8188f507c08a90245300ac89f053ac2dd0f7471f9ee2e96dc042110e92fff6bab3a3bf6ecbb01db0156b960460a3ac74dc0

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 1deeee56669855c043f799290f3b29e4
SHA1 d5febb33edfc0ec063d03871d586a960caed1d8b
SHA256 1df15fde8a504b964cd12f4cb7852be32df11c9ed98c822f370d73493820ac82
SHA512 460dc55eb14bc38e051067d345d51ba7813432999e1b2793c0fc2f61e6aeabd69fd768f35de8fb7fa46a3adfba6151e7ad7237d61a57c5b594f34489dca1e6e3

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 8f3e142b62c6801859f1878b4f42826d
SHA1 71d2b0d7f9ae4557145b39f08b955049ff5f330d
SHA256 c7e90367de66e7c34c87331b0470c5569c9d5d4c404f19c442e8b4e7d27bab11
SHA512 d1af85016555921c30a03cf36d1c9360f02cac787eed043a0b6f310dd5e4a33bdfe458b0c497d523ed9f4aba99a862801118ddb15c6dd429521f1eb98f900418

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 9f8aea1e17475cc638f31140b96a0a76
SHA1 9ff0b95e572b1180f0185f3a778d8960c482ab06
SHA256 d6e3ca4a1147114682c348ab763706eb3b49d0a3212fea4f6f5e0dbfe43b89c8
SHA512 04133e96986434431df6a50fc11bf5b63be7a68502b83c354e89d3aec9410047ac8a410fbcb45df5b8f7ddb75d0dc81d3bf9fc7b9c0bcc79eb25637246fdd8de

/data/data/com.nhn.android.mail/files/PersistedInstallation7368214874313777391tmp

MD5 cd529324c0faffee74f2cff4fefc77c0
SHA1 6c8a0124cf6106975f10a41637aef405c8c4d43f
SHA256 a63593ae0c5850dfd820d5710e6b352da95165ab9c2b921ea55e5f3d4c857585
SHA512 c6d85c6eb4cb3b2f18e321ae0aa6241076e613110f2f40cc324045ac2e931f669325182d411dd44b922d3e66ac04773162af9a0ad853a59ad1e0735283430ef1

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 d4376b10ab7d7922cf1490737c539317
SHA1 4f4ef37693eab69c92cbe793521ef8f995c4606e
SHA256 a59211c891b0c2f05524c9da29e1c663a6e137a983e24645160a3d16148d0213
SHA512 c181e6bf0a667f943dcb5b6b74e7ccfc385dd705a6b41a5f6884298253d39ba912bc129311e0f46da0b7610975e3edc3f88776bcc69473432083bb398e9e124b

/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

MD5 2d5285006aa3e3d629aba05cb0d22d07
SHA1 4b2582c9a3d3dad08fc49aad6b11b47b354e684f
SHA256 3011c44fde7a2357461b8477128c09274214ad63dde18ebee232b92b53800138
SHA512 503a2840d401752b586005323439cbefaa5df2ee7c892330bf490404f212f037566f5aded2432cb0bb520020836810ae6b00f315de752d0a7825747c58267480

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

MD5 bc84eedfa9e6a8253c3e6e57fe78e177
SHA1 0404e585cee24f0b796a2b5350ee0985b6c370fe
SHA256 09111f5af3f6d9a6faa6afa574594ef8df20edf939d169704456ff053fc85ce7
SHA512 7de01d98a7ab2aeabb26b6863031980c8015185514802fee2893fe0630a4204e356311499fb79d915d21c87ddc7004bdb66728983424a6164377b261f0f64966

/data/data/com.nhn.android.mail/databases/nelologdata-journal

MD5 282e01656f44dcea98752ac403dce24a
SHA1 cfb6dfb44cc520d33ca5eed8ea0adda89d0a2b59
SHA256 1d7d3348519bf4dd3d4802cd228104010f82b153105d74829572409380d4c605
SHA512 6cdc0e01f1e5f4d28904bec5b9c6a8f34cfec4aad29ee88cadc5888aa9146f5fc0311f3043a3dbbc680ab19b74bf90d9135bb28c7a6ed9728637ea6566048ce7

/data/data/com.nhn.android.mail/files/KeyLog.txt

MD5 930e3ad1460ff9a2559c4575cfc8ea31
SHA1 8813afb0347a813ef338dc1ecadf26692eeec2bd
SHA256 262899f4c6bbd85e8799d3557763c4977ad0d1dfdc530d212b11c967ed54cf7b
SHA512 e1511aef6bafd2ab10b97f1864b4c23a31b0c2b61a909faa72eeabfe19c5ab84eb2206eeb4f4d0869bd0785aeaa3c65b50f3b29ea2567357c6fca18c4ce28f3f

/data/data/com.nhn.android.mail/files/KeyLog.txt

MD5 0d2a7820c9a40e76695ffdf9d8f417bd
SHA1 5cbd7f26cff7ca921bbf8211f2de098a1fa0c147
SHA256 b15f6440b88a3e0d20b44765e3ec472b787d90a192f3e3d0c609ad24ff54be46
SHA512 856c9f4335f32c452bd3f3c4393743bfae5e401a7f5e3e0a5314f28dea5107999005e01aeb2088cb55bab82f2bfbdb671615d7ae5dc9a4ad425a0ea47b2851e4

/data/data/com.nhn.android.mail/files/frc_1:129436326568:android:3fb259f21ca1e06e_fireperf_fetch.json

MD5 9061bb55968e7153c400586bbff81b04
SHA1 ee56ecf42e88701c706026eb96f06f28c1da8e46
SHA256 17f8568a1c1fd313605de1a72f742c91e8b68801f628da06a387afbc805ef717
SHA512 b6cc98fc1f659214c0662ecf2b4ffddccc39a2d5c5146371566c00571df556b539cb23a9f7b3625b1c59d15a76e99a44bf04d3b8c1d22c83f258f9e426480a84

/data/data/com.nhn.android.mail/files/KeyLog.txt

MD5 335bc5c9b9a25bf13b5f552a2857fdc8
SHA1 390262be27a4b7be1ebc7b83510e1890e30af954
SHA256 d72d300aafd7db418f26fdf2b5aacdfe365b8baa3aed3f8767ce547ad8df7a52
SHA512 54841324f6e036ecccab10baee3320e3862dd89a7253cb9bec10e0fa95448b465d10fb27decff957b1531393dbb849f8a5d319cb164f5c5b13e51c7d2d6dbbb4

/data/data/com.nhn.android.mail/files/KeyLog.txt

MD5 b44b154786ae9c2837c67367de1d1c9f
SHA1 0eeac3ab53b79a80c69993a406e105e3a5e138ab
SHA256 ad1ad7afc397bb1aafddea76f99e2878feb5b415223a9b3708e5167c54d3d9fd
SHA512 7d5cad2294e5a1e3a4d2a14421c3f1ae8bfb8c865c2f2f1d94c5e8d53654002a99cfb555e270f0c3a57558c27926870b33092fb11eabb566988a5e48f3aa695a

/data/data/com.nhn.android.mail/files/KeyLog.txt

MD5 329b5c2c7f64d17c8fcc50e94e93caf0
SHA1 66f892cc830a850d3496cc559a03b11a96315d3c
SHA256 813aca64356cff009b18924d03d4a507695c66a98862ff91f3beea7202c54a74
SHA512 03fda52d4087eec503004388fdb46ae4a31ace0dddb55aaf27b4090120f85b7931f91172db610772e170fcf11105fe4a556a6fd74eeb7f6605850063f3a7d23c