Malware Analysis Report

2025-01-19 05:38

Sample ID 241211-1ypyrazmgw
Target fbed19b916d8eda8dad98e7fdeefa153d17873ea89a8022b7fb27713d35c70ad.bin
SHA256 fbed19b916d8eda8dad98e7fdeefa153d17873ea89a8022b7fb27713d35c70ad
Tags
ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fbed19b916d8eda8dad98e7fdeefa153d17873ea89a8022b7fb27713d35c70ad

Threat Level: Known bad

The file fbed19b916d8eda8dad98e7fdeefa153d17873ea89a8022b7fb27713d35c70ad.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Ermac2 payload

Hook family

Hook

Ermac

Ermac family

Obtains sensitive information copied to the device clipboard

Loads dropped Dex/Jar

Makes use of the framework's Accessibility service

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Reads information about phone network operator.

Performs UI accessibility actions on behalf of the user

Makes use of the framework's foreground persistence service

Attempts to obfuscate APK file format

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Acquires the wake lock

Queries the mobile country code (MCC)

Queries information about the current Wi-Fi connection

Requests dangerous framework permissions

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Checks CPU information

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-11 22:03

Signatures

Attempts to obfuscate APK file format

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Required to be able to advertise and connect to nearby devices via Wi-Fi. android.permission.NEARBY_WIFI_DEVICES N/A N/A
Required to be able to connect to paired Bluetooth devices. android.permission.BLUETOOTH_CONNECT N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to access any geographic locations persisted in the user's shared collection. android.permission.ACCESS_MEDIA_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Required to be able to advertise to nearby Bluetooth devices. android.permission.BLUETOOTH_ADVERTISE N/A N/A
Allows an application a broad access to external storage in scoped storage. android.permission.MANAGE_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-11 22:03

Reported

2024-12-11 22:05

Platform

android-x86-arm-20240910-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-11 22:03

Reported

2024-12-11 22:06

Platform

android-x64-20240624-en

Max time kernel

149s

Max time network

155s

Command Line

com.vujabagocuyati.wejixe

Signatures

Ermac

banker trojan infostealer ermac

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook

rat trojan infostealer hook

Hook family

hook

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.vujabagocuyati.wejixe/app_gorilla/xPGXqa.json N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.vujabagocuyati.wejixe

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 digitalassetlinks.googleapis.com udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.212.200:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 lxkjpr1j.live udp
US 1.1.1.1:53 xvey2zq2g.pro udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ta3ae3ji.pro udp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
GB 216.58.213.14:443 tcp
GB 142.250.178.2:443 tcp

Files

/data/data/com.vujabagocuyati.wejixe/app_gorilla/xPGXqa.json

MD5 c48a60e4629968fa9efe55df6865e001
SHA1 bccdbe75e24c4e5fbf3e996026a52ec0009c3f0f
SHA256 39fcd857bc66ee755f66a0f06389d3b2076423376cfc6866e0d5ce64a69353f7
SHA512 aa8f54744ad7680f45728c9e22400fa1ce435498209021b2754af46d232eceb88cd59ea50dc1320a2567902eb7190e8a6e3621a9de2bbd4f787ce0c121499c62

/data/data/com.vujabagocuyati.wejixe/app_gorilla/xPGXqa.json

MD5 290ae55a788254bd37773ec9a2707548
SHA1 8110f939e3c58ac47e57955b4536e0eb76f9cb67
SHA256 db99ce74c9a14fcc3e4e346f6c58b9367b3b494e0517fcf26131f60023f472d1
SHA512 1fcf612cbcf7cda6f84135692d18e42eb7f3a8a52b1269a5dadae843703d94426d24c7aee2bd8220d6723750491dcb56533863cd932937104ef62c3be56d0588

/data/user/0/com.vujabagocuyati.wejixe/app_gorilla/xPGXqa.json

MD5 dd7e4d4bb72ce5cb0d760a7df45382d3
SHA1 7fb44158009796bea8275976c6d9c8316e72568a
SHA256 d53715aed3263cfd676a7b56df524b1ab0f874db139328083c0e4a079384f2a4
SHA512 2f4ac4b3cee6b7a7dfc43c687591cbf814a9f8e230e869bfc1dbd83c84c940a3525bdd5a9969a5c08d125728bc475ba3dfa14b2c937ebe314c5c05f15cb6ca13

/data/data/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-journal

MD5 2a5c9fce8f3b1c37bcd0acb3f3dfaa2b
SHA1 52e634c035151563d746260ff5f8599cdf1e4039
SHA256 61dfcc0f1189c2dff00d60e7ae2547006f5c80acafe8290a67bca057b611c83e
SHA512 f286702d51f9dacae2ddb5a29fca4895be88bc44fc146f1f695208c6099ced80ec9b55fb6cb35a54849f5c706bb0602d8e59176ff9aef7b8a55fbfa95d3003e2

/data/data/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-wal

MD5 18b190823f0363177ed6fa4615c539cc
SHA1 3872b58e6f04bc2811b327b8221e5992cb4e77d7
SHA256 8b43bdd34b9fd0313fe0b7392229ba7ddbf2789de51c2c65b4fe93fdf671c3af
SHA512 be9e54f30bfc9875c04efff3acbf513050d644737dedba5fea214392895d90b90db55995f2c522d2d62577ae45e8edd31b93498d85ba95904e728eb2f186bf28

/data/data/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-wal

MD5 908c61a1b547511d24abe52b89a51e43
SHA1 381de8521b374f9b0e3706c56ef4870ed36b7db3
SHA256 6361c337b476e42c349bd8338e4ae66a5f12bdbd9c7521b2fc016129872608d5
SHA512 0b15d715300e6346db795547b616b15535059ae44095a196050cac2eb85fa03d66ea1d0e5e87b00ad6836758c8c82cd2357607de6f06870370f672235fc6c09c

/data/data/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-wal

MD5 70294a43dda1eb58f4ba74e4bc2f41df
SHA1 503795c62c77a95521f08b4c75247accb1f10104
SHA256 6a888e040a12d0c1ecf2250baef5b72d409df98429ecc0162078c01af9524d43
SHA512 0160c2c088f1d3e54db4fbb19da679992e44c6d49ad23f794ec5c8cd3ded4dc373c45c8f1a371f4f9c5e301fe8de60ca6ec5cddcdeecdfe05167feb06a703e53

/data/data/com.vujabagocuyati.wejixe/app_gorilla/oat/xPGXqa.json.cur.prof

MD5 8bc8df381be44b6d6ce49b4eab2ec358
SHA1 09f93a6ea035f4166baf66ffacce0dea5924b65b
SHA256 19f0e6193f701a841ce80feef740bed179874ed260e4019888d3b48bcf646b6e
SHA512 dfe2603ec8b5acca8b2139b168ec3ef9d3c6bde7a866aeca8eca2e22003ca719ae87ba80ecf90141c03dbbcb8ef77254ed0531f3a551e2d3961c2e3967bab747

Analysis: behavioral3

Detonation Overview

Submitted

2024-12-11 22:03

Reported

2024-12-11 22:06

Platform

android-x64-arm64-20240910-en

Max time kernel

148s

Max time network

151s

Command Line

com.vujabagocuyati.wejixe

Signatures

Ermac

banker trojan infostealer ermac

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook

rat trojan infostealer hook

Hook family

hook

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.vujabagocuyati.wejixe/app_gorilla/xPGXqa.json N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.vujabagocuyati.wejixe

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.238:443 android.apis.google.com tcp
US 1.1.1.1:53 www.youtube.com udp
GB 216.58.201.110:443 www.youtube.com udp
GB 216.58.201.110:443 www.youtube.com tcp
GB 216.58.212.238:443 www.youtube.com tcp
US 1.1.1.1:53 digitalassetlinks.googleapis.com udp
US 1.1.1.1:53 lxkjpr1j.live udp
US 1.1.1.1:53 xvey2zq2g.pro udp
US 1.1.1.1:53 ta3ae3ji.pro udp
US 216.239.36.223:443 tcp
GB 142.250.187.206:443 www.youtube.com tcp
GB 142.250.187.193:443 tcp
GB 216.58.201.97:443 tcp
US 216.239.34.223:443 tcp
US 216.239.34.223:443 tcp

Files

/data/user/0/com.vujabagocuyati.wejixe/app_gorilla/xPGXqa.json

MD5 c48a60e4629968fa9efe55df6865e001
SHA1 bccdbe75e24c4e5fbf3e996026a52ec0009c3f0f
SHA256 39fcd857bc66ee755f66a0f06389d3b2076423376cfc6866e0d5ce64a69353f7
SHA512 aa8f54744ad7680f45728c9e22400fa1ce435498209021b2754af46d232eceb88cd59ea50dc1320a2567902eb7190e8a6e3621a9de2bbd4f787ce0c121499c62

/data/user/0/com.vujabagocuyati.wejixe/app_gorilla/xPGXqa.json

MD5 290ae55a788254bd37773ec9a2707548
SHA1 8110f939e3c58ac47e57955b4536e0eb76f9cb67
SHA256 db99ce74c9a14fcc3e4e346f6c58b9367b3b494e0517fcf26131f60023f472d1
SHA512 1fcf612cbcf7cda6f84135692d18e42eb7f3a8a52b1269a5dadae843703d94426d24c7aee2bd8220d6723750491dcb56533863cd932937104ef62c3be56d0588

/data/user/0/com.vujabagocuyati.wejixe/app_gorilla/xPGXqa.json

MD5 dd7e4d4bb72ce5cb0d760a7df45382d3
SHA1 7fb44158009796bea8275976c6d9c8316e72568a
SHA256 d53715aed3263cfd676a7b56df524b1ab0f874db139328083c0e4a079384f2a4
SHA512 2f4ac4b3cee6b7a7dfc43c687591cbf814a9f8e230e869bfc1dbd83c84c940a3525bdd5a9969a5c08d125728bc475ba3dfa14b2c937ebe314c5c05f15cb6ca13

/data/user/0/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-journal

MD5 d7ba492f300aca05fd0091c70c4b186d
SHA1 f06b4e9d76f75b658d9f44e1aa61d0cb8ebe6f07
SHA256 9b70096cee33bb3654812bd8b1e831fb7554356d6c12bc6e4bad5ec0b6b9ee2f
SHA512 311f3d900d9cbbdc6587b70ecc73a84986a6d8d3ca0e70cf7b604c6baad1418671ce2d6b09e0a05bf3be16a84b2b337951a93364c3bc01af276eb9a0f40d342f

/data/user/0/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-wal

MD5 7421e8d244e969c181951f1ca3cc8b9d
SHA1 1feec1175551d81a760dd8aaa75f273beb96b2d2
SHA256 745587dfd1e1544689fac876270c844c3f449bd9c4ef046a143ae3ff81eb5f41
SHA512 e04548e98f20ec4d6a7f258c291b315390f290ef3ae2960c7ccd3284d08aff080a76ff47c7dd4f8b701e5991ca1ee5a324cff5ac1888437296e670c7b5065553

/data/user/0/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-wal

MD5 f1d04305599a10d8a826a3619cced968
SHA1 6415c39a0c4d8038e92468f458fc2686713286ab
SHA256 c5f6a3c946449f67646f6d452a9fbf46f6123f9474606fbc5f85a2511abfce0f
SHA512 2c55a82f48c2a12efbd3e26023ae868ee33c108e3c936050521e8569852aeff231624c0ac4748182e7ec96b75a6ad8d30f3049b2ab2a271655d4689c71f5ddd3

/data/user/0/com.vujabagocuyati.wejixe/no_backup/androidx.work.workdb-wal

MD5 cd35a9dde4a03656021af257df1e17bf
SHA1 7957ff96f4e450909d6062453a6c8727a46c4427
SHA256 d9943ecddafaf04d72d7479292568d4aa84c514a810d0dbc8123f5d25ca5fdba
SHA512 f78626795fd48a69ba62f1553eabe1d07ec2f7c1c21f1a7888234103d8f2e9994d0849308afc23bf0cd5d6dce0c25141f62aecfb9722b1ce6d916376799528e6

/data/user/0/com.vujabagocuyati.wejixe/app_gorilla/oat/xPGXqa.json.cur.prof

MD5 6f46c7e38f055d50a76b69cd7deeed45
SHA1 4bba1528a5f4258f7b9c9a2d84c4e50c87590e1f
SHA256 dac77b100ec9ea4516f751ea3fae8541e36d9e12c1698fd010923de93010bb1b
SHA512 2c63c1bd57617e3dd4bafaf852806f53e6429b59a282e934d2f856b350562187b9ad37f5e0a4d3046a337861224e5dc38c723240e73d7d9d0adebb29f2483ed1