Malware Analysis Report

2025-01-19 05:38

Sample ID 241216-2hw8kasrep
Target 194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d.bin
SHA256 194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d
Tags
ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d

Threat Level: Known bad

The file 194aa64a8107412e8f6442f7addbadcb9e544d25b9915ef534cf175cb6e60b3d.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan

Hook family

Ermac2 payload

Hook

Ermac family

Removes its main activity from the application launcher

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about the current Wi-Fi connection

Declares broadcast receivers with permission to handle system events

Queries the mobile country code (MCC)

Declares services with permission to bind to the system

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests dangerous framework permissions

Reads information about phone network operator.

Acquires the wake lock

Makes use of the framework's foreground persistence service

Performs UI accessibility actions on behalf of the user

Requests enabling of the accessibility settings.

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-16 22:35

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook family

hook

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-16 22:35

Reported

2024-12-16 22:38

Platform

android-x86-arm-20240910-en

Max time kernel

145s

Max time network

152s

Command Line

com.jedokuwafesewa.pobibovi

Signatures

Hook

rat trojan infostealer hook

Hook family

hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.jedokuwafesewa.pobibovi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
GB 216.58.201.110:443 tcp
GB 216.58.201.110:443 tcp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 static.xx.fbcdn.net udp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.178.3:443 update.googleapis.com tcp
GB 142.250.179.227:80 tcp
GB 142.250.179.228:80 tcp
GB 142.250.179.228:443 tcp
GB 142.250.200.2:443 tcp

Files

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-journal

MD5 10a373545bb3ada85520df7e99a872cd
SHA1 cc5b1a6260b9c660b160950680cd139bccac7c08
SHA256 47f81187c67c960cca53f48cc0420316b79e2b5e853301a8f9cb499b1c6ebf81
SHA512 26160acdd7b7741cddb6b99093fb43278c6289ed4edce80638996ef7affde9d75d9ecdb2c1ba9a369e6317392b5933c49066fc7dec62a64787fc3bfd02b7f378

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 ea00bc1df04d47f2b99f37970d569440
SHA1 cbd578df1bd4ca5f4aa49ceb2028d2936834b5c8
SHA256 984abc59e2a43d1cc70157ac1aeaacb6eca5d82b914f42c8710325f4d8400d4e
SHA512 7358116e06f3eb28847ca7c803652de9a10c29aef34c6f1f77ec2ef66c47b0a5f1df7493b7e1c0db960278cc57c8468238a700e052f681ef09f520e1c98e05e0

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 9f37a4be72f1054fa9dfe6b1761038fa
SHA1 77b3ca4f09ac0f510d9465c1a091ff8e7ef88a7f
SHA256 cd3421dffa71a0daa94d9e72a5c28fb2d9666b49345bdcec26babda16f94f3f0
SHA512 cb32fdd43aa3a7fc506301083e17c7a1211a4ea6f1138ae42f4e671b444e8e6c79395e48b274ed194771e8a45e5baf0f4f8a108c94039ff247d56b112ae8316a

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 c41fd0d3851448da744289a5db5ee84d
SHA1 676d4ecc30a6c5e0bc99fe9aa42a31cae926fd49
SHA256 92a65e652e09549acf0e6fb175cef03e77c29e5ac428d69b4fa81aa9fa770766
SHA512 332d8dcd2988e77acdba57b576665948d95c0cfebd4c8ece58c794a82facacd65e01e1b70e00723fce191d9239a259e0aae69ea19bfdbda43ad32729990b397d

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-16 22:35

Reported

2024-12-16 22:38

Platform

android-x64-20240624-en

Max time kernel

148s

Max time network

159s

Command Line

com.jedokuwafesewa.pobibovi

Signatures

Hook

rat trojan infostealer hook

Hook family

hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.jedokuwafesewa.pobibovi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
BE 142.250.110.84:443 accounts.google.com tcp
US 1.1.1.1:53 static.xx.fbcdn.net udp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.169.4:443 www.google.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.179.227:443 update.googleapis.com tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp

Files

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-journal

MD5 fc14dd1307a09fa889bedecae4b50115
SHA1 943d2b87e0a2d5379efaf1704938fab28c83e565
SHA256 301a4c714793b2cae0c93421a3c5f05ebb1d7f9b8c132c8cb6c5acbb9886ea96
SHA512 8418b462428b551ce2c0669b5346d1adc40442ec739332a8d8dd87d4324adff298d7dfb0442fb96974914e28011c9aa315c83e81ca0867b5eab10d321e524670

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 19446c8b3da5ced750994eb2abe7f0d7
SHA1 9e57a4402ac143683ea9ed5ba1725f08b850fb02
SHA256 e0b3fb692c65b7eb8472ea90da4d7498d6c2144dcd630653646776e63bb486af
SHA512 4c796242cc24294a05d334f12e0774b04c90592cbc4cd56800048e95ac15e706f802c574646a522679ed242259070f0793d2808d2800334537e8399054c0796e

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 a9d7245b17c45b8256f5c1a063f0d761
SHA1 d15182ea15d1e3e8f394f917b9e46509dc169bf4
SHA256 813b884caaff14a971bd56d59286acbf76329baa19c331bdaa396443054542f3
SHA512 dbb45ed02071e7bdb46c453522619e57c6897ad40fef44d9f49a7b07f9659a7c0168f303fb1bb6c6d4d3ee10a2ada17fe9ab657dc332202f8444853768c99501

/data/data/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 4841ad7d8bb1b494fe009e8636da67d7
SHA1 6f4336b048a56d35faf14cc63f0f652a4e0e0ef8
SHA256 e7c96cf5edb5004b516185dd1ad0e97cc2243b9fc92a82584066d86af7e802fb
SHA512 effed6cd1227ae769fae42c2fae6546104ce5dfce3b148c49f0384b95c87acedb61c117f84c6c6f6cf79baa7d6b76603ab7771e4bd0939af4887c0b4f49c1855

Analysis: behavioral3

Detonation Overview

Submitted

2024-12-16 22:35

Reported

2024-12-16 22:38

Platform

android-x64-arm64-20240910-en

Max time kernel

149s

Max time network

161s

Command Line

com.jedokuwafesewa.pobibovi

Signatures

Hook

rat trojan infostealer hook

Hook family

hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.jedokuwafesewa.pobibovi

Network

Country Destination Domain Proto
US 216.239.34.223:443 tcp
GB 142.250.187.238:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 www.youtube.com udp
GB 142.250.178.14:443 www.youtube.com tcp
GB 142.250.187.238:443 www.youtube.com tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
HK 39.109.117.207:3434 39.109.117.207 tcp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 www.google.com udp
US 1.1.1.1:53 accounts.google.com udp
GB 142.250.180.4:443 www.google.com tcp
BE 66.102.1.84:443 accounts.google.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.179.227:443 update.googleapis.com tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 216.58.201.99:443 update.googleapis.com tcp
US 216.239.32.223:443 tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.179.225:443 tcp
GB 142.250.200.33:443 tcp
US 216.239.32.223:443 tcp
US 216.239.32.223:443 tcp

Files

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-journal

MD5 b2f23659ed103b82419c5120bd02eb30
SHA1 c59b95b3b7d14fb037cf408c4fbe65bcbe8a8e14
SHA256 1ee9dad41d75bf20dc86dc9f7b9916ceddb679e24805aadd5ed6da17d6cd6ffb
SHA512 a11182242a830f982eeaf071971d927e2df7f8eee13e580608d5d79cd75317b66bf27ab00c1501084dee8a7ac39137874896bd5d156d2f8fd1ec746e6c134007

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 183645c029a34e6f45ff05a28de97f86
SHA1 442b4d99607394033a92c11f5b3e84cff721b5b9
SHA256 16162421e4c5de8142098ecaca2c1b2a1582e15485cac6f540dc3f23d60b0299
SHA512 f9bf49f00b350831e1fb52eac9334fe989dd83df2d8f8d7a42008547d2f95db9445e4f77e4d77ae7af2bb91a75c96903a2d2997a2d00f3d0cedebb90f2c4a89f

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 b0e910f66e43c47b85157bf20998a064
SHA1 44d6a087e3fc9d2f016c7223afc54b915c8a5609
SHA256 33247bf04ffc1ae5eb7ef5402c9d9d64c481a0fc0708c4552c5881af2af324d3
SHA512 44599d38f17c07444d9ac6a72ffe631569cd865d1546535be714f4a9379ee37ffe101e3bb26dbb39a70da720d549be01a8ba7855b57aafd22c324269d52b3e20

/data/user/0/com.jedokuwafesewa.pobibovi/no_backup/androidx.work.workdb-wal

MD5 cc92d84d166f017992b7b9f4af417566
SHA1 95630ccea67bef9d34fd2bff9e91a8c844308150
SHA256 e061aecbf946db553b5e4ebdb17ef684dfeca301eabf181da0e00272306b0e5b
SHA512 eeca5c001605a52c6b1f314b884d046149c7da5c0b0b1f12c6aad95e8207e7dc0a99e00249e9b64be53f0056a5efeb73a0121dadcd5948a09374cefbd96fbf55