Malware Analysis Report

2025-01-19 05:38

Sample ID 241214-1ze5yaxmep
Target 59342af50e9edbafb4e90a1c7fc31bdb462fe2b4f0ad28d0c0753d82986c85b6.bin
SHA256 59342af50e9edbafb4e90a1c7fc31bdb462fe2b4f0ad28d0c0753d82986c85b6
Tags
ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

59342af50e9edbafb4e90a1c7fc31bdb462fe2b4f0ad28d0c0753d82986c85b6

Threat Level: Known bad

The file 59342af50e9edbafb4e90a1c7fc31bdb462fe2b4f0ad28d0c0753d82986c85b6.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Ermac2 payload

Hook family

Hook

Ermac family

Ermac

Queries the phone number (MSISDN for GSM devices)

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about running processes on the device

Makes use of the framework's Accessibility service

Obtains sensitive information copied to the device clipboard

Attempts to obfuscate APK file format

Acquires the wake lock

Declares services with permission to bind to the system

Queries the mobile country code (MCC)

Makes use of the framework's foreground persistence service

Queries information about the current Wi-Fi connection

Requests dangerous framework permissions

Declares broadcast receivers with permission to handle system events

Reads information about phone network operator.

Performs UI accessibility actions on behalf of the user

Uses Crypto APIs (Might try to encrypt user data)

Schedules tasks to execute at a specified time

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-14 22:04

Signatures

Attempts to obfuscate APK file format

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-14 22:04

Reported

2024-12-14 22:06

Platform

android-x86-arm-20240910-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-14 22:04

Reported

2024-12-14 22:08

Platform

android-x64-20240624-en

Max time kernel

12s

Max time network

158s

Command Line

com.kuhihasexaya.gixe

Signatures

Ermac

banker trojan infostealer ermac

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook

rat trojan infostealer hook

Hook family

hook

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.kuhihasexaya.gixe/app_merit/ARcrM.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.kuhihasexaya.gixe

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 adsfgbkapmgnsdvbr.pro udp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
GB 216.58.213.14:443 tcp
GB 142.250.178.2:443 tcp
GB 172.217.16.227:443 tcp
GB 142.250.200.46:443 tcp
BE 142.251.173.188:5228 tcp
US 216.239.38.223:443 tcp
US 216.239.38.223:443 tcp
GB 142.250.187.228:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 www.google.com udp
GB 142.250.200.4:443 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
GB 142.250.200.4:443 www.google.com tcp
US 1.1.1.1:53 g.tenor.com udp
GB 142.250.187.202:443 g.tenor.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 adsfgbkapmgbrsgsh.pro udp
US 1.1.1.1:53 adsfgbkapmgdbshb.pro udp
US 1.1.1.1:53 adsfgbkapmgsdfbbnn.pro udp
US 1.1.1.1:53 mdh-pa.googleapis.com udp
GB 216.58.201.106:443 mdh-pa.googleapis.com tcp
US 1.1.1.1:53 adsfgbkapmgdsagbbs.pro udp
US 1.1.1.1:53 safebrowsing.googleapis.com udp
GB 172.217.16.234:443 safebrowsing.googleapis.com tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
US 1.1.1.1:53 adsfgbkapmgbrsgsh.pro udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.14:443 android.apis.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 accounts.google.com udp
BE 74.125.133.84:443 accounts.google.com tcp
US 1.1.1.1:53 adsfgbkapmgdbshb.pro udp
US 1.1.1.1:53 www.youtube.com udp
GB 216.58.212.206:443 www.youtube.com udp
GB 216.58.212.206:443 www.youtube.com tcp
US 1.1.1.1:53 adsfgbkapmgsdfbbnn.pro udp
US 1.1.1.1:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
US 1.1.1.1:53 growth-pa.googleapis.com udp
GB 216.58.212.234:443 growth-pa.googleapis.com tcp
US 1.1.1.1:53 adsfgbkapmgdsagbbs.pro udp
US 1.1.1.1:53 adsfgbkapmgnsdvbr.pro udp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp

Files

/data/data/com.kuhihasexaya.gixe/app_merit/ARcrM.json

MD5 1fa160a28f736d984dabfcc2cd09ed77
SHA1 58bf098563d578072b9d5594e3456bfff461de3d
SHA256 cb76ed898305a05558407559655a27601e63b6f1565df06cad7367932ea17682
SHA512 ab8f3e9b101e7b362d99dbbbea0a4d615f2136ad7474502645054bc1cd754e69640d32043107f3cfd2af4dd4107b87c8971886e93e05628324ce867680805511

/data/data/com.kuhihasexaya.gixe/app_merit/ARcrM.json

MD5 6547a676fa8dbfb050716dc06f96fddb
SHA1 b2b189921e46353fa24a06f8805cd056183deadf
SHA256 d059b3e479f8f38ee5b7135e1eb156dbe1d0ee57de2b32fa9fc2490403ea964c
SHA512 87ca58feda7c58983498fa5cb0766efb6668d190002d89f09e8d9dcd455da513a67533298763ca14fb223d22b4f1a0db69b48ef779a8a86519703a6653b26c89

/data/user/0/com.kuhihasexaya.gixe/app_merit/ARcrM.json

MD5 1274af3bac6bef94dfaa707bcea575fa
SHA1 99e5e67a2b200f07f38433148272a0f268a8fff4
SHA256 a3e065a84d59fcf71ab6a41d71aeb5ce7c711ccf90631a907ba6f5d687cd3dbc
SHA512 e2c09b21f47ae6ee3c3a8e2b494ecc7dade211082c7c1557e1fd75253702695e8c3b46a963016e2a576fc52d588e27f25a9376bbcdab497ca42a66c2c2bad4ac

/data/data/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-journal

MD5 d1a543b45933be516e59ab6416c58d22
SHA1 df0db693e32f20aba0f2ebcb26d7b43f90d4e778
SHA256 45bdc38fe5fe1958a761da878db3e2c86a38b240837c795f3b54c1b9ee664450
SHA512 5e10e9a663e4056c51423df52932f36587d9b7263997af91452123dc672a7e660c77aa4e3259e41c4a5a9db2666e3d80d9bf83b61c184d9da0a8a24c093e41be

/data/data/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-wal

MD5 9a42ee6a7bd894e44c5f2b9ebd1e27e0
SHA1 b8fd00c7228363ba05569510f1f398a22dea7e9e
SHA256 6b240c57e91b57c17d896a7f916a33169bbdf62f8e5d357cd9a4b630b9e7b963
SHA512 15ee1ea5d964a5a7326922b8564ac0239cafad96799443c5dd4293c0ec8ff798183aa6b9e4afbec65ceb266f2a72a9c86583fb9b32f1edb5beb4329812ba27c1

/data/data/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-wal

MD5 7a3bcd978b902b346bc530d181420b23
SHA1 854b38b9ad9427f734d928a718c9b53de945c1a5
SHA256 b976702cd06c87dc368780367f85bb3d0db9d89c40267b357a588a5aadf05d2d
SHA512 20b8e14abbfd9f0b511fa7fa5c48f456328a24fd2ac736a6511eaa161b25c1f109f8fd6b92e329e0ebbdd219837dd915032b57b73c137a7f1190819f3a6ac7f7

/data/data/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-wal

MD5 cbff1ddea791af0614a5c8932f184644
SHA1 a9737b827eaa9f422bb7f2e1053d1fdca16529fe
SHA256 ac538d68d63a0c008cfba0206abe567448a34c29feff111832f3af5e0f5de046
SHA512 fc4f9f44ca5fbd996681a6c98418aed358b6bd780301a86cefb6cd0003cdeb6aa610efbeb622566a8ffb9fb4447c26e0c3bab3ee360dd293b0ed05393cde3dc3

Analysis: behavioral3

Detonation Overview

Submitted

2024-12-14 22:04

Reported

2024-12-14 22:07

Platform

android-x64-arm64-20240910-en

Max time kernel

148s

Max time network

156s

Command Line

com.kuhihasexaya.gixe

Signatures

Ermac

banker trojan infostealer ermac

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook

rat trojan infostealer hook

Hook family

hook

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.kuhihasexaya.gixe/app_merit/ARcrM.json N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.kuhihasexaya.gixe

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 www.youtube.com udp
GB 172.217.169.78:443 www.youtube.com udp
GB 172.217.169.78:443 www.youtube.com tcp
GB 172.217.16.238:443 www.youtube.com tcp
US 216.239.32.223:443 tcp
US 1.1.1.1:53 adsfgbkapmgnsdvbr.pro udp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
RU 92.255.85.112:80 adsfgbkapmgnsdvbr.pro tcp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
GB 172.217.169.78:443 www.youtube.com tcp
GB 172.217.169.33:443 tcp
GB 142.250.200.1:443 tcp
US 216.239.32.223:443 tcp

Files

/data/user/0/com.kuhihasexaya.gixe/app_merit/ARcrM.json

MD5 1fa160a28f736d984dabfcc2cd09ed77
SHA1 58bf098563d578072b9d5594e3456bfff461de3d
SHA256 cb76ed898305a05558407559655a27601e63b6f1565df06cad7367932ea17682
SHA512 ab8f3e9b101e7b362d99dbbbea0a4d615f2136ad7474502645054bc1cd754e69640d32043107f3cfd2af4dd4107b87c8971886e93e05628324ce867680805511

/data/user/0/com.kuhihasexaya.gixe/app_merit/ARcrM.json

MD5 6547a676fa8dbfb050716dc06f96fddb
SHA1 b2b189921e46353fa24a06f8805cd056183deadf
SHA256 d059b3e479f8f38ee5b7135e1eb156dbe1d0ee57de2b32fa9fc2490403ea964c
SHA512 87ca58feda7c58983498fa5cb0766efb6668d190002d89f09e8d9dcd455da513a67533298763ca14fb223d22b4f1a0db69b48ef779a8a86519703a6653b26c89

/data/user/0/com.kuhihasexaya.gixe/app_merit/ARcrM.json

MD5 1274af3bac6bef94dfaa707bcea575fa
SHA1 99e5e67a2b200f07f38433148272a0f268a8fff4
SHA256 a3e065a84d59fcf71ab6a41d71aeb5ce7c711ccf90631a907ba6f5d687cd3dbc
SHA512 e2c09b21f47ae6ee3c3a8e2b494ecc7dade211082c7c1557e1fd75253702695e8c3b46a963016e2a576fc52d588e27f25a9376bbcdab497ca42a66c2c2bad4ac

/data/user/0/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-journal

MD5 dd4053e5dee44f7cbb39245a9a4232ef
SHA1 6dd39de031e2508f8f3d78b229d2ef0d188a5315
SHA256 69b9a08f2163dcc1fe0b1770444318888acf130844246bade62e425e2478545b
SHA512 239a234b0b1bbd863a99251c8ffe9dd4a7f247d12990cca0620c386353081f5a08b2e7b9e5a443c7195de8a8eb122649108db19724f291010ffcc5463382ff9a

/data/user/0/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-wal

MD5 fa5ccbb92399dd66bbc9af8cd11dc615
SHA1 0b5f4925b553be87ed79de1b69404c97fe358332
SHA256 a049fab4b731450fa2880e293e89c89ab17d2d1cbca500a7a3bedd746661f859
SHA512 cb22066f8bb93b0bd9372ef8826824fefdc895d187541259f8fd9f82288cd356de07509adeb9e09cc2f82710e6c32e7f08ac9a5b14593e282ce8bc8929f4bbe3

/data/user/0/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-wal

MD5 7bcd52f7b554a244687c0f28c0486452
SHA1 28d15c47cc50b8be621a40f7a8324689b3f95158
SHA256 8f3e246cc97d625d81a5f6b20645a645e8a1a570e99e863e9eceab5113065ad3
SHA512 6b92805f418684f9f11d5d5498c4c7037ab434cbf44657dd881caada0597a0f4278003b0816996b9cb687cd522241673965e2836f19f0e163198ed812d213bd8

/data/user/0/com.kuhihasexaya.gixe/no_backup/androidx.work.workdb-wal

MD5 f8723a7b8dcd5e56bd6b0ff2097a9a63
SHA1 45acfb9c29c2c936e2a54ff7ee856db2c0263912
SHA256 4c6acea844110601ba07683661c816cbc1535159554167e55c0cf7c10f229b37
SHA512 418a49f1d69fc314dd1ae816c38f9fcccc8756d2124bbd14867481dc28d992c183960f0b8b960cb724fb72578782db1258ab1108196cc1ec41f9226873a4db6d

/data/user/0/com.kuhihasexaya.gixe/app_merit/oat/ARcrM.json.cur.prof

MD5 f59bb77de5bc8ca032598b5ec9121a76
SHA1 3d47ca4b819a44c474abe29ed2a99f5231ceaa75
SHA256 ffc23c6353d74ccc84a9dba1dc5892466c0c5f2b69f8ea1cdf10160c2f651cea
SHA512 36f194839c5c3b31da8b818fe6530ecec3d72e1a694d53170fe42b0e1386b2f8ba11535ec43096c985c6bd640fae005ea42db01e8cdb832bfbc9366fa15a59ea