Malware Analysis Report

2025-01-19 06:25

Sample ID 231220-amnnfabehn
Target 73aa7241675739ae3b789413223280322cd8fd42333136de8451b5cbf429d00d
SHA256 73aa7241675739ae3b789413223280322cd8fd42333136de8451b5cbf429d00d
Tags
irata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

73aa7241675739ae3b789413223280322cd8fd42333136de8451b5cbf429d00d

Threat Level: Known bad

The file 73aa7241675739ae3b789413223280322cd8fd42333136de8451b5cbf429d00d was found to be: Known bad.

Malicious Activity Summary

irata

Irata family

Irata payload

Reads information about phone network operator.

Requests dangerous framework permissions

Acquires the wake lock

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-12-20 00:19

Signatures

Irata family

irata

Irata payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-20 00:19

Reported

2023-12-20 16:32

Platform

android-x86-arm-20231215-en

Max time kernel

2282912s

Max time network

145s

Command Line

ir.shz.shzkisi

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Processes

ir.shz.shzkisi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
FR 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
US 1.1.1.1:53 liveumusk.cf udp

Files

/data/data/ir.shz.shzkisi/files/PersistedInstallation4268674334780608887tmp

MD5 2c0ebdfc21f870bca7e7d205d4192cca
SHA1 65cd1bb18a41c5bc086491962b805fa25bab7ec4
SHA256 b600ab54557489989b3322493bc4c8a6e74be33eb727de5482edca687c225464
SHA512 8c18ee8f172fd0c6fa58f06e9381402bddba345129ae9e9458639a2ed989f6098e22b341b4eec6fa724fa4dfed7c2edf65effef01024b57bfa6a68e06bbf4591

/data/data/ir.shz.shzkisi/files/PersistedInstallation9211744475485277161tmp

MD5 8b0a514223e5247cb32630340ffc39e4
SHA1 32650dc4c9e48df2d271f322b56799f90a7bd6bb
SHA256 7f112a262fadf4c81d8c1b7fc7b7b654f15d285a9084ccfaab02700b202e82bc
SHA512 4dd4ed575c2f62f8aecd10e1f18fcd62329c886987ec91cfb888b10a3f020a39f1a80261d1f7fb6f709f93e2fbec714b91f74324ef869d5bb94da24ce827c31a

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 a520517f016d5a27ef4cb2828e79a8f6
SHA1 f4f89dd0b3bdfdfc08e0cb71378f5175b57774b6
SHA256 6581867ca17eb57c8309d21266868ac75b5caf7895d55985cfaf8bd5b5a0954b
SHA512 1d29062d0c1867558dd04ab947556c292de0584207b352cfb2f3dcc4841b5dc10ebf1844d0486e359a11a1bc98c119a3abef4956c575620988e0070cabe33273

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

MD5 133ad611bd4f1a2b59e2b61e3e3e5bb6
SHA1 d10e9e742246e189c7486bedee3e50f6ac829a5f
SHA256 ffd13e4df7aa792156e9f79fa2f833b520a1bb3faf4f267da2541113030396ec
SHA512 eab0d989a3ec02927e9a14d864345a163313b7a948851bd493ea44ec6e5429ef11d0700edab3d98e04ccc6ae1ec403921b8dc7ad806b0d21e8baf55a66fc3ae4

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

MD5 d37abd72ee2f814a753538f896efd232
SHA1 d3e734bde42bb947db292bbff850c169510ca440
SHA256 81df5f399a6ed15c8c28459ebe4338a96d2252b10013ce788a3ade28a1924fdc
SHA512 2a8cd375338e63d0ef6288656c3dfa319a4336162ffcf63ef1afd6425202b45f47ab975849848af1b19a8dfd8a46eca3f589b781a18953d6c5677f340db50cf7

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 7a82dcba0f313ac419258e72195101b9
SHA1 da25d6515471f150027ce99475bfa9445a01da5c
SHA256 50d1dc0cca9d2d4705ffe2bec5213ad3bf78f7d4df8360af5ca09de1aa7dcf89
SHA512 3da6c0ee65e433a801f238f9982b1398fbdabb60db85fe578e2043dfd9dfd10215fe7810c627b9c2723343fdb708fa937dfafe5467accd4ea79a02884cb9791b

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

MD5 e2f974f92dea33be5cf0a9f9b46783b7
SHA1 669b2b72988d730fc2b7ceb49760fe6c6ccd3c7d
SHA256 bdb478ee0641d13a4d28197a44312670e130308cc42a4ad6a64e449a7ef9fd6b
SHA512 7ad19546149f49706f7b60644b9d4024ebba46ed09688ed1f73e379e09459bb9be25348b1269c36438353c57b47634b717fc5dce8db5b63197e2d5e225f9577d

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 14229be06fc2bfc0a7f118be54c19eff
SHA1 f8eadc95604f43bd229d5b3f7d9ba7aa995a5476
SHA256 04be1c040107039e7b10af4e3d875d31c56d47103b6eb8eaa0879400f5f0abcc
SHA512 d5e6f2a2ccd90273edf37628fce9a20507e19876259c064b16854b6c814c886ccb39d8d9197cd717552c00915bf2fbffdcb94e6092e1499679af3cd7d7ca0304

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

MD5 f7c52b4cdec5d656f30d8c7c42aea1d4
SHA1 511d31bb7535813632a659ae36e3aad69222f47a
SHA256 2ef0cd2df0e196498dffd2d06e3b130a0f4f04dccc6a5f8599a81ffcd8c1e7e5
SHA512 8737d8a99824c99782580a03f4072c118a786a91378bdc4ec6587d3bb82f1e3fa51d918d570e66784e4b461cf3d7d8a0bb794cdc685930527d12eb85074984a6

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 9c2203a6460a63a399cde961cd18b926
SHA1 ca296395b7aa6b2f998e5cf3323de48b8b2b2676
SHA256 0665e58613d7ba14f3ff602105092fba3ed236b9d50b16aac15a46a4dfa1d2b7
SHA512 e27900b988d7fddd72bafb844305352c03f71f778193a06df1006563cdf61fd997f4ec2ebe304c8b961f8ff62cf44f25272e64ac465e32c7ef1d1432d03d5f47

/data/data/ir.shz.shzkisi/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-20 00:19

Reported

2023-12-20 12:56

Platform

android-x64-20231215-en

Max time kernel

2269806s

Max time network

153s

Command Line

ir.shz.shzkisi

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Processes

ir.shz.shzkisi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
FR 216.58.204.72:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 google.com udp
US 1.1.1.1:53 206.212.58.216.in-addr.arpa udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 liveumusk.cf udp
GB 142.250.200.14:443 android.apis.google.com tcp
GB 216.58.213.4:443 tcp
GB 216.58.213.4:443 tcp
GB 172.217.169.46:443 tcp
GB 172.217.16.226:443 tcp

Files

/data/data/ir.shz.shzkisi/files/PersistedInstallation2452976321891243247tmp

MD5 747487af9e07110914abb9cf101d6dbb
SHA1 bd89b9308c94afc61500594cd118212141597a11
SHA256 50a4b17943554b08a00c48a80042aa61bfee9dba6ff77deff148e05b47f6d436
SHA512 91d097e55fd2975fc79983f05af83ed4100fe353b0de2cc90ba6fb5e5fbc1ed053342da1f6ff241ba35ddf0acdb44aa6e53486e57c6143c52a8697b29715f6b7

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 4da3cf9c57c31be402f14c4935baadd1
SHA1 bf716f33facb2eee16cb9d901cf578794ac9db56
SHA256 d4d332165db3291b33a28adf8f34567fcf9850094ae1c55faf358390e324d49c
SHA512 63ada931f40f053042e6c08112e8969428f124959c92f364a84acdcee66830b72c603189f47aa81a20d66c1300543999ef6d5bdc2d4ed71d32c1bb29082d4927

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 b1631bc428dbc3d98899e938fd1a8b9e
SHA1 592c8445406c0dd7872db2a181425b99e3c0fc25
SHA256 a3abc7320cccebc530fabcb38c8ef966720e5371658e5140d576622a776e92ad
SHA512 165bccaf8bdb42ef7a059e558ed9bfdcc483da32dd71f3af5166e70ef7903ea53ae5b68a22bdd6337277f70469155352dd9cd1595b0a7d93e1b9c1629cc2e337

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 29dc264b3f2fb988ae6be7e3742d1277
SHA1 07afd2abadbb47c12493915240ea8eb246c4d258
SHA256 57d147559ab347649a8bb7257a18d9fc0cdbd23bea5328b9eba22143d586f052
SHA512 0e15cf53865a884855d354f145e6cd5c43a354f48c059693f201f5ae44d8d476aef9923c445d56373778aeb0822d2d49e13eec9af641dc60748e149699148c34

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 2cc96ae4d58464b9d5212e06e78957b6
SHA1 9b043e08ddcc6bf19c0cf169bcaf84341b9cbd62
SHA256 23120e0cafb21fb50dd63a70ef85ec964783706d579adf13182e4ba00a69b47e
SHA512 89b71d9c97b8e806f9ff487f8466632d6ed617093ef795fb430cce89bd93210febd106467db153acaa4caa7adf587c83248c5a0b354fa62524427dba5f9d70af

/data/data/ir.shz.shzkisi/files/PersistedInstallation3771171985417464790tmp

MD5 8f5481782b938f049315416eedfb18b2
SHA1 1e9e4889e8fc79f2ab31333962e6ef807a23f82d
SHA256 41749381b23c7f12a512058c9322ebb2f6fc3df29349c5f298ea36b8cee022c7
SHA512 c8db5885bb44a227245d0c42a6cf6e05efa13c23f2f49b438afcebc4fb1b1b391a79f58d7e18f1bae7cdbae320cc24c7285dc622bac7d8dcf546bb1ca632573d

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 0c31ba3fbc244fd47949bef01dc8cdd9
SHA1 a569c9292a42a10f7c701f7104dce5d2b920a486
SHA256 965bb4275b5f906f8cc388647eb7767e4aebfb0fe0e7b990c1b85c172d8243f2
SHA512 0c0fca041c70ee6825abca9d4a86c7064c36b3958d91edbf18d131846704dd7072287d3c56d3069a1f6a57394f64d9b89b7b361a16376f0a9ca28b8f94bcfb2d

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 3c04f101518ec1b6e31198e9db46364d
SHA1 38673e10828bc32f3bffc46505087c2ed7755a66
SHA256 c9e4898b687776d2a49358fd6aa7c86b8c4229e572441a8025d1584e781aeb00
SHA512 dd787684b05c77b25acf6cfc213affee9aafb66623204e4501e82caf8b7033eb52c53dfded0947baa7fe7aae00f23ac53442104f16f48a9982cb0ae0b9fdcbad

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 d9b6d6eb7b163912d2aa84d94f809921
SHA1 5a9dde40c620a8ac3c2c50d12e62aa8d8ae57b24
SHA256 6d7738f0b781b1c5c0107dd5cdb60843dd910fc70664acd94a6468f293558925
SHA512 d8363958f8297a4cd18b2722ec5f2848b6cb52473fcd9d97206c02db5767803cbc1e2c9918531c67cd9d426a93914d67abc1d180652ad1a9af7aad73c42d6ab0

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 7fecf84ac0619d8c62bbaf6df7e98647
SHA1 18410f97528eb46f651ed7e011ea3845913b3d31
SHA256 e3b1da4886d132ea738f42f4a1a4994606b693ba8be13a1099d08006a37ec3ed
SHA512 9c9a12c085cffe7cb2e3d9d81b794fdecb276d83dbd0135f2da0a7c5ec627120c826a98127910857e35d28530d0cbfabd3f6906dbc78e5d9829d779e0515b029

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 fa37bc1253ce8f606821d88811c20709
SHA1 3bf8e270ba1c3dadacfd9eeda79f76b4de9b6481
SHA256 b588d6a23c4aadfcd091857e67f6a88e77c0bfd29e59045b4d2e002ff2451dd7
SHA512 76e3f5a766009c8cddff042b54f71d042c2510694c363c9ced15600ae4803a24caf4dce7ca71b909ed37861bd3512230fbb5ec3733c27c9a191af3a69964a9ac

/data/data/ir.shz.shzkisi/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 ea9bf9415a33dddaf0c76f30a2f75d5c
SHA1 0b571d1d6d534a288046554b5004f9f11c1159f2
SHA256 e83fe37e4e47b49ad7bae2d346ce311ebbdb7c19cef1893b4cd70f5656f68779
SHA512 4f9ec39083aa4712ac44dc0932355357746dbde0c92bc61afebeac7b2cdd275777447ecd5fd301b0703389d4c6aa3107ad5468acce0956a785492d24c4bd4576

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-20 00:19

Reported

2023-12-20 12:57

Platform

android-x64-arm64-20231215-en

Max time kernel

2269843s

Max time network

146s

Command Line

ir.shz.shzkisi

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Processes

ir.shz.shzkisi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 172.217.169.10:443 udp
GB 142.250.178.14:443 udp
FR 216.58.204.74:443 tcp
FR 216.58.204.74:443 tcp
GB 172.217.169.14:443 tcp
GB 172.217.169.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.213.14:443 android.apis.google.com tcp
US 1.1.1.1:53 google.com udp
US 1.1.1.1:53 238.179.250.142.in-addr.arpa udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 liveumusk.cf udp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp

Files

/data/user/0/ir.shz.shzkisi/files/PersistedInstallation2995789771544114375tmp

MD5 e630d410c271c3422c6a7329882556d1
SHA1 076bbc72899b9c07531bb2f3e54f19e4ac59754a
SHA256 87f9731da53dde243402152d9bfa95141b99c98ea24e3fb32e8f7329e3a75796
SHA512 3c62a9a7db577d4448760646c2f2ee4c37c199f1a9cb53b81c66cbe451426275cf9521f0a908d01eb2d9d6353af191a34d6e8564208da8f6be19c412f2df6532

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 c8a1939839fff2da6dbdfe3e2172cc57
SHA1 45f98029cfce02fd394dcb9146deec05257e44ee
SHA256 1f8e2315200de022a3bdbd69cef7707a69298481746803386cfb8348985d450a
SHA512 ac364306188c45742db0167f5a27f2a65c2d23dddf237324cc8664b7f1110ba674591443a70d597f1fc7b186fbd476a1cb8b06faf7d54baec9e8c36e656c746b

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 171aedf968e17a2744d2585715606cb9
SHA1 bbeddeb3b89fcf809619c35b4a318a80e7d5b029
SHA256 d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
SHA512 78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 cc55c6dded807ed4561c480ce6cbca12
SHA1 2b85dc47847dc79db89a42bf5c5ab151d2d647ab
SHA256 7a59bf6c3d6a4f34151a52aa38260515a93460645772d460a0cf1b1b7e474ec0
SHA512 b267e6dc2f19886bb04e8262255b54fa8530201839551f43a4cdad2beb6e3182bc5ae002c682205cf67b71c62bcbbaa3e1b17512a4dd80e76583746048b2f137

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 c32589fe54cf6707bf5911248b44e956
SHA1 6e8149c7c13fbdc394e27fd559c3ba18dd114486
SHA256 6f0c87b3654efbbbe899790ec08508ff920917ffb78d520668d8c954f19c11a4
SHA512 71e4bd958831e51d37cf621b1a12f655eb6dc56b1077420ab50347a5ae42a30ad6321f1325b08d1b48b90618d8c6fc661b56a0aeb7e7a801ccf8ff73bc8c3554

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 f7ab5029ab5b8fb8d579ec0987711255
SHA1 0fe265d888da5aa1d9f72295ebaed954a001f131
SHA256 0b8dcefcb3dc89737b40637ae32897ad669247ad087163f3da90e228fba41fe5
SHA512 af92bd769d452ad0d534cb7ae715bcc923cbd1a5ddb71f7031f2db7b24e1495f3bdb9986a4ff77fed3da8510376e14482cbaafc982c364a0a22f1fd6eb927f06

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 ffa4977bb7aca37a0aefd4b4f1beda8c
SHA1 431c476588176e3d17e114bd7b807449906c13d1
SHA256 197b7022b49cd37bb6cb419179706afc0d1852403c1e9a7ea6958d9bbac45e34
SHA512 69681e1a5f82c1d44e20aeef22b2cd9e8765f57eaee489cc30d88dc216cfc425389c83db5b927c40a0a31e2bc7675f377bc8e295b5f0238db5ab127ac3463bfe

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 c611f76b66ec17bd446bb3bd675da576
SHA1 005bb8d98c8bcd7d924fe5dbd5faf3fee2daa5c9
SHA256 035da5d4c66a35900a8214e7069f0d180f05404466db3421aa89b4d0e9b46149
SHA512 44552beefb2c300c032c30a00a13267ba48a620703249735b3b2c2c4de4043aa053d16aa01dd1ba42b5f18283ec2e82e938d5d817973bc8cc336ecd2189972a4

/data/user/0/ir.shz.shzkisi/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 782aa4c0196fb60c605922a331234fc0
SHA1 d0b7a25dd8367f0af5818cce7bb8a0e25191b3ff
SHA256 770fb0cb25ea6fa7a9d0b6473c83b3069c51d9fd214d3b9f46395a7aefc1baca
SHA512 e56f31fb2e6b8a11661a7badcd26cd2ae9fa7fcb09018ad44b8ed01718709c16461160ec272deafeb29b8d0c89d443fb5aca8ead5b3d59dfb6f7daeb158d4135

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 de82e2c94d2718988804b035a46d17b1
SHA1 705f5ff19093ad209f2a666085d6ccaed3bf58a4
SHA256 29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39
SHA512 68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e