Malware Analysis Report

2025-01-19 05:38

Sample ID 241216-2h4yeaskfz
Target 194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d.bin
SHA256 194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d
Tags
hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan ermac
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d

Threat Level: Known bad

The file 194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d.bin was found to be: Known bad.

Malicious Activity Summary

hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan ermac

Hook

Hook family

Ermac family

Ermac2 payload

Removes its main activity from the application launcher

Makes use of the framework's Accessibility service

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests disabling of battery optimizations (often used to enable hiding in the background).

Queries information about the current Wi-Fi connection

Performs UI accessibility actions on behalf of the user

Requests enabling of the accessibility settings.

Acquires the wake lock

Requests dangerous framework permissions

Makes use of the framework's foreground persistence service

Queries the mobile country code (MCC)

Reads information about phone network operator.

Declares services with permission to bind to the system

Declares broadcast receivers with permission to handle system events

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-16 22:35

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook family

hook

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-16 22:35

Reported

2024-12-16 22:40

Platform

android-x86-arm-20240624-en

Max time kernel

146s

Max time network

155s

Command Line

com.jedokuwafesewa.pobibovi

Signatures

Hook

rat trojan infostealer hook

Hook family

hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.jedokuwafesewa.pobibovi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 172.217.16.227:443 update.googleapis.com tcp

Files

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-journal

MD5 3bd4e9f0d6994cffeabb279daebc32b0
SHA1 e88fea0180d9e2e7df10df7312a45b20ad881443
SHA256 9f63c9f1f6450535df8f1843645b2c3b9b5ced63d6157784efbd7687dba48d11
SHA512 a8fec0bd14c8d5513a7be6530d9c63579cc00b83930330b7e9b71eb8b1e912ec64938a4b88ee4959d0dda996e3b0c4d504536a34b5d2caa1455ecd849391cd67

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 59b22255762d122be1a0c71a41ff3923
SHA1 6e01511da80ef661e3a4e11a8374e5d54adb30e5
SHA256 b4aca964a6c19c3f003031545846d04207d89d9cb2a4c77efedf17fe05ab0e0f
SHA512 099e918aa64655c01101c7060bef033f053a3d90abd82d582dec8701fe936a20a6d5e3e46d60cdbee8a0c95b0fffaab1d719b288c2def3426b2f3e76682e1437

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 add270e9a0b8ccfe7b6814ebf55890c7
SHA1 f9ff76ca06ae44ceb6e1949cf6f8be3fb2311232
SHA256 75896c2d2cdf1abdbb4502f667ded5aacb6297081363e79f8e7cca6c2a1e1433
SHA512 fc80015970e8015f93e5d550efb894035267418ae21bf9e43f09741f6e71c8bc42256aa917ecbe280be366525b5d5f539949f71a55f36dae591d04fc550b33cf

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 76debdeabb89d3fd5fb6ffeffa4bdb35
SHA1 1f511a564140e45694c8f07abc9b9ab8c6723a5b
SHA256 cf5ecabf23a0cb91c7ce8818a3874c5bf745f0e0b14fb0f6271748b8dfdbedcf
SHA512 5df060e3bcd87e69207dd0e3f9bc4e46df02a0fa0a2e70536b591d9a599732ec6c98d579c7e7a95f3d8f92d9aac130db1942439ff49e0f1076e445717ecce9cd

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-16 22:35

Reported

2024-12-16 22:40

Platform

android-x64-20240624-en

Max time kernel

149s

Max time network

157s

Command Line

com.jedokuwafesewa.pobibovi

Signatures

Hook

rat trojan infostealer hook

Hook family

hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.jedokuwafesewa.pobibovi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.72:443 ssl.google-analytics.com tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
GB 74.125.71.84:443 accounts.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
BE 142.251.173.84:443 accounts.google.com tcp
US 1.1.1.1:53 static.xx.fbcdn.net udp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.187.228:443 www.google.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.178.3:443 update.googleapis.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp

Files

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-journal

MD5 012ca7da7186d9c54921ae121c4945d9
SHA1 43e334539905e1ae65f05eafc6015951f6f38f92
SHA256 543f4e9a1fdac633200c84efae7ae31b996b417944129cf56d6cac71afb0ab7a
SHA512 06301d88e07a35f7e0de4c0eb6a7d9baca73e552b0f0137699e83b46595ffbc52ffe66acc1c7d5c1bbf77f2ccc951e63335dac830c956483ff3bca26eca7e8d2

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 0c44b44f00f1036e09e397db82ae4ad5
SHA1 1cbca722905014be3938ab75b784a6412fa0437f
SHA256 dc02ea785dcab36c04f0a35b1be962a92b866165c202f1b9bbcc1d7dba19e755
SHA512 49308b02d94c438614dcd422ca9f68335513b253534cfeeb561001b2e458c8962376bc1bbd9eaa10d28236fe5e897aea8aa150cd2505f0ce0cc99e420228b6c7

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 af7a6e60e5f8c475169ee7e718d1c0a8
SHA1 50d5216de520ae523ad64f9f906fd0c0f9623030
SHA256 fdf5f2a1e603fa81cf3a8f5ba33c562ef16e6c49ead31a56d008c614df99ad2f
SHA512 3d7c0e55e654e54e80fc3521bccef11f7661750d2f1ded34dc9c28d102c9c314dfd2282446dc0028e94935bc72e3b99ed1f8b78105eacfcc6db6d4db771785ea

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 6ec12a2281c20a829e7763f0a626650d
SHA1 6c5b66d95f5c19a3c81c65dbac89f5f612b1eab6
SHA256 f4795b5295816ddb5a70d91936101d609d300b6f5053462d630f07402cf8f83c
SHA512 b57a12d15403b5b1533520ef9302fd97d33dc8bf020f0b5198fd8342c720ec86a82aa0ac67d4f67b07ee2f9892dce10d66f8bb9a5efbd8b13cde344035559372

Analysis: behavioral3

Detonation Overview

Submitted

2024-12-16 22:35

Reported

2024-12-16 22:38

Platform

android-x64-arm64-20240910-en

Max time kernel

145s

Max time network

158s

Command Line

com.jedokuwafesewa.pobibovi

Signatures

Hook

rat trojan infostealer hook

Hook family

hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.jedokuwafesewa.pobibovi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 www.youtube.com udp
GB 172.217.169.42:443 tcp
GB 172.217.169.46:443 www.youtube.com udp
GB 172.217.169.46:443 www.youtube.com tcp
GB 216.58.204.78:443 www.youtube.com tcp
GB 172.217.169.42:443 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 www.google.com udp
US 1.1.1.1:53 accounts.google.com udp
GB 142.250.180.4:443 www.google.com tcp
GB 64.233.166.84:443 accounts.google.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.178.3:443 update.googleapis.com tcp
US 216.239.36.223:443 tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.178.3:443 update.googleapis.com tcp
GB 142.250.187.206:443 www.youtube.com tcp
GB 142.250.187.193:443 tcp
GB 216.58.201.97:443 tcp
US 216.239.34.223:443 tcp
US 216.239.34.223:443 tcp

Files

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-journal

MD5 7fa505e283a643e2ebb0d40da5f78afb
SHA1 5d6eb56a9b6fa2cf1691efffd4733377fe187e97
SHA256 0d516e646624f6208b36c90885e3ac4665c02d2565677db7cc0f687bd224e22c
SHA512 ff62d181900bdb0a870e10bcff84ae967d161f3fb44fb360758be36cffa129171f950a28fda39a69efb5d35ac0d3f76468bb038a1598b25d5ffc611263ee9075

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 073634244d5a093587d76bf4b8c9fae2
SHA1 c9e89b1bd7b8bcd5be858feef9f1dd5e12008f28
SHA256 1495cf9cd2818aa5fd1f518e01ed54c90c354ad707bb9f15b72f507f57270d82
SHA512 a1f13587a4d3aa99a070040e277928bd5ae61a0b1a6d04d85531d8d259243750d23d5d1394c18ddd6bab20831f084b2bbb1b3e3c9e5e52e857397cba263815d7

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 60e01757c9a6e7acd49c43f72621edd4
SHA1 a03399ceb5bf646be88801d5d0a3da4a2d72ae6e
SHA256 57aa40fa668f08674c0ea4a0fad625baf83a5eff2fe3f6cacf25d77a634ed39d
SHA512 a1633b925a513a027cb78e7d111ec22b19ebeb6abf0c728da62f3cef5cf139d0eb83c52386afd60f880e871418c95c3c2113a0e3dbd464a0c454f416fb871958

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 5972a9718cd60c5d37e47916bda2b75d
SHA1 f2474da1b054dd14f5c8ec633975685390693f17
SHA256 6d6233a640681efde3847ab210bfcf3d916e459e07e17c49c6a40b1f406eec3d
SHA512 2fd296b4c294b8ea979ef2ba126d4309cec85c7e0f250f2c79e9c0c979a67e1f7dd2e70b227d54f76958c6ba788e47813ca4906cf2243259a04f5afb6e733979