Malware Analysis Report

2025-01-19 05:37

Sample ID 241213-1zj4ws1nfl
Target 194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d.bin
SHA256 194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d
Tags
ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d

Threat Level: Known bad

The file 194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan

Hook

Ermac2 payload

Hook family

Ermac family

Removes its main activity from the application launcher

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries the phone number (MSISDN for GSM devices)

Queries information about running processes on the device

Makes use of the framework's Accessibility service

Queries information about the current Wi-Fi connection

Requests dangerous framework permissions

Performs UI accessibility actions on behalf of the user

Queries the mobile country code (MCC)

Declares services with permission to bind to the system

Acquires the wake lock

Reads information about phone network operator.

Requests enabling of the accessibility settings.

Makes use of the framework's foreground persistence service

Declares broadcast receivers with permission to handle system events

Requests disabling of battery optimizations (often used to enable hiding in the background).

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-13 22:05

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook family

hook

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-13 22:05

Reported

2024-12-13 22:08

Platform

android-x86-arm-20240910-en

Max time kernel

145s

Max time network

150s

Command Line

com.jedokuwafesewa.pobibovi

Signatures

Hook

rat trojan infostealer hook

Hook family

hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.jedokuwafesewa.pobibovi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
US 1.1.1.1:53 static.xx.fbcdn.net udp
GB 157.240.214.11:443 static.xx.fbcdn.net tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.169.4:443 www.google.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 216.58.213.3:443 update.googleapis.com tcp
GB 172.217.16.238:443 tcp
GB 172.217.16.238:443 tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp

Files

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-journal

MD5 02e405248a487cf2c94e404b2a229069
SHA1 55f3ba6b46794fa1403f53f68f44dd246f08369b
SHA256 84da9e0ea671428e7834357cbab54eb15d9a54a34e30636cd91a16f701d47e87
SHA512 5c58c17df4c72191386f6aa0d597c6ea6f001d0a616dff361a038ca381255ab8908745852475247cb8a666928ee5c2f760b23e6469d5a02c9229c45202fd034e

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 62f81514eaa0998108aa420cb42e484c
SHA1 aacbbe274a0806a70af9ac709f0e5b16f1401bea
SHA256 43e5fad7f7f972747eb505cbcc9e415a404e0736d5677df8abc36f3b525b9d99
SHA512 5ba76169bac1c66ddc23ab127959b772560c176b4933a993e3c66c29eb786ac0bbcea47e40442075beb3cc0e99ab4d351e7bea71e5d1fcbaeba9c0b15d983699

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 57c5e0ae3014b035e115ab1a4af999e7
SHA1 dd50d72a468f00c95bd6a53e2310c95b96f9f2de
SHA256 f320d62a3b2b49c7e925b9e962611946f6831dbc22a05425bdfc6bfa3a8ca375
SHA512 360eb8295eae6af78ad5470eb2eb47b15231824b5453d9b57f2aa0562097d4683b445efda6463b4fac9b1daf58f28a85c7f161fc28ad6ca067b6979e8a9a8c52

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 0ae38be4f65d941a731d9f7b19f4b8f7
SHA1 3bab9526cf85ea9826cf0c3f6160730729b5284a
SHA256 867a31d4fc40fac5cce9b0b8b6ff08b507ca302cc168aa39eefebe2a88ec6382
SHA512 388073f1e3347ddd4ece451a38703f8f26fc4bbe138afa7956e25c26773e9997e3f533cd8c9c936e60479da769105ebacb10a18c662a5b0eac48189c8cb6972b

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-13 22:05

Reported

2024-12-13 22:07

Platform

android-x64-20240910-en

Max time kernel

6s

Max time network

152s

Command Line

com.jedokuwafesewa.pobibovi

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.jedokuwafesewa.pobibovi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
GB 172.217.169.14:443 tcp
GB 216.58.212.226:443 tcp
GB 172.217.169.14:443 tcp
GB 172.217.169.4:443 tcp
US 216.239.36.223:443 tcp
US 216.239.36.223:443 tcp
BE 142.250.110.188:5228 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
US 1.1.1.1:53 g.tenor.com udp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 accounts.google.com udp
BE 142.251.173.84:443 accounts.google.com tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
GB 142.250.180.14:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 172.217.169.10:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.180.14:443 android.apis.google.com tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.179.228:443 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
US 1.1.1.1:53 mdh-pa.googleapis.com udp
GB 142.250.180.10:443 mdh-pa.googleapis.com tcp
US 1.1.1.1:53 safebrowsing.googleapis.com udp
GB 142.250.178.10:443 safebrowsing.googleapis.com tcp
US 1.1.1.1:53 update.googleapis.com udp
US 1.1.1.1:53 www.youtube.com udp
GB 142.250.179.227:443 update.googleapis.com tcp
GB 172.217.169.46:443 www.youtube.com udp
GB 172.217.169.46:443 www.youtube.com tcp
US 1.1.1.1:53 growth-pa.googleapis.com udp
GB 142.250.200.42:443 growth-pa.googleapis.com tcp

Files

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-journal

MD5 3e2d7cb19a12fda7c7ff9fd4faae89b8
SHA1 06910f67dd7fe8ba7defe7e5d5e3200286d61911
SHA256 dcac2de3d7cf23c01293cc5c25d6a6601cf7c56657e85f89ebc508c63b61d2c7
SHA512 a12d5eff871693781752e253f91c09ec1d8d143dbd57d2c9d85e4aab30b8d7afc8046c35414c7314c327c3af02e60adced98dc8bead06b16eacd0b2148de9ff7

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 f8855fe77f8db05e482ffb621777dc22
SHA1 bfa271fc1d4d569be14f2cfba3528e2c150d590e
SHA256 0536041037bea421503308db98fefbdd7d9316568a693fdc9d2679675a08e2fb
SHA512 aaba9ad7530c207d6c58096f5575fcbefd5d27d0915b26a71c93433cc122e15959bdd16a64314d07640f572d8d1a271a09ca5cce4779fc2e3bc80bed04ebe04c

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 00d49aa736ed4ef418a149ccf0b6f373
SHA1 537cec3f305ed61dfe733583e83c058aa5867698
SHA256 396fe6a57113defcf7388b324aa725e3c8d291e5a924def631abe5eb6f9ff8d9
SHA512 c37d48743ab688ece77f909496710445cd86367602586318e3a97ed099f5bc611b96a95e0446f98217527f11dc0a2cf6a93172a4402603dc8a04cf9cc072e136

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 7c846794cb29e9b7367d1a8eb659720d
SHA1 ccf2b4fa9d4ee38fbfdd55ed2b3c21e5ecfcc7ed
SHA256 5eb978fe70358af0142de435638a8771d9629865fd397bb0e4b2fd9eb82bc48c
SHA512 6f59ff1fc88edef68624baf2a37c1fa20542dca25e9080edac1196960746cc8fdf0e562bec911dcd727714d0b3792b4cf3c4ea6edf3fa198bbdb5bf7271bc595

Analysis: behavioral3

Detonation Overview

Submitted

2024-12-13 22:05

Reported

2024-12-13 22:07

Platform

android-x64-arm64-20240624-en

Max time kernel

149s

Max time network

158s

Command Line

com.jedokuwafesewa.pobibovi

Signatures

Hook

rat trojan infostealer hook

Hook family

hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.jedokuwafesewa.pobibovi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.40:443 ssl.google-analytics.com tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 www.google.com udp
US 1.1.1.1:53 static.xx.fbcdn.net udp
US 1.1.1.1:53 accounts.google.com udp
GB 142.250.200.4:443 www.google.com tcp
GB 157.240.214.11:443 static.xx.fbcdn.net tcp
BE 142.250.110.84:443 accounts.google.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.178.3:443 update.googleapis.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 216.58.213.3:443 update.googleapis.com tcp

Files

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-journal

MD5 f6ad0442c24515224e9f7e8b0c62d42e
SHA1 6c30fb7a2219ae37ae0e17e79232b63243871e22
SHA256 99d17f2371484973915c0af5730c07dcf1daecbaa3db795e392d79dca1953788
SHA512 229ef7b5921f3341768178f58f12b05bacf666e0de2211c07dbc013ac1a3a9fdf4b5e390d63a88a41aeca99bb1a80c0319e6d1dd98bdf673a1d8621478239a9c

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 cfe2ffcca54939a534ee6b48e040ab90
SHA1 0511aebcec96f55a527449016ec0196ff619758a
SHA256 f1effbb77cf754a80bb3c2f0dcf197d71fd49ce00aa178e14e5117856e55d2e1
SHA512 a4aa2f0c00fa65b55296c97c556f21ce8a80810f3efc31d90f62ea1c5901bd04a6327acac74fe15a8c7b5211d73e5c4bc9ccb4e93a98633e56bd08b96b07750d

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 1c329bd11c814836cd12a93fde1d75cf
SHA1 c0d75286d558d8faa41cff99f3401bbbe36019c8
SHA256 ded5422d898609f904676abdce15ba74bcc51fd060d1f52936bd08172d1ac766
SHA512 e14992d0638537d91072ae83e857ac0a62ef9472e42b7a97d1fd541df17220cd3539c44f49bac6681654b000e2b3752d3001a58d98f1ed62a44743790076b1fe

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 650371b6bef65c4db564fd65e09ca381
SHA1 142f333dc7f7ed993847c98c3ca86373dde2bf1d
SHA256 55163e8f83453d3dda6e93e765a1451f3ea256e486783d7064952c33e92582e2
SHA512 451037065a912294038d8859193778fcc28f24799829f6506eb3555da80c4478b9c6bac59dc4ac00bfb6188ea466d1bfaa25953295fd5a9e9f4d1e5549690282