Malware Analysis Report

2025-01-19 06:43

Sample ID 231220-f87lbshae8
Target 87f30af436938f2a776e7d2020457ea5599558e401a3389faaa8b5414e6e2721
SHA256 87f30af436938f2a776e7d2020457ea5599558e401a3389faaa8b5414e6e2721
Tags
irata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

87f30af436938f2a776e7d2020457ea5599558e401a3389faaa8b5414e6e2721

Threat Level: Known bad

The file 87f30af436938f2a776e7d2020457ea5599558e401a3389faaa8b5414e6e2721 was found to be: Known bad.

Malicious Activity Summary

irata

Irata family

Irata payload

Declares services with permission to bind to the system

Requests dangerous framework permissions

Acquires the wake lock

Reads information about phone network operator.

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-12-20 05:33

Signatures

Irata family

irata

Irata payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-20 05:33

Reported

2023-12-21 16:06

Platform

android-x64-20231215-en

Max time kernel

2367614s

Max time network

153s

Command Line

ir.stop.devsalmedime

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Processes

ir.stop.devsalmedime

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 google.com udp
US 1.1.1.1:53 206.212.58.216.in-addr.arpa udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.213.14:443 android.apis.google.com tcp
US 1.1.1.1:53 madareto.xyz udp
GB 216.58.212.202:443 tcp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
GB 142.250.187.206:443 tcp
FR 216.58.201.98:443 tcp

Files

/data/data/ir.stop.devsalmedime/files/PersistedInstallation4709790877777503384tmp

MD5 f5de6b2eed9e1f6eab5d5566bd11300d
SHA1 3de192a1f9e0fcee6183e7b8c6d31346c5a9ca6c
SHA256 f05f42e60b71d08d035f02a48fccc90b228643ef329b9b53d0dc70da79bd373d
SHA512 860d1bb68bc9ad6f9ea045226b874b82d5faa163eaf9f1a4f83067e7f9d2666c3bd81a78aba814873acc513b81d050fe0e496e6132b24cf952eb7a1d89cfd364

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 72a20fc0943b3f90843b6d6f7a112fbb
SHA1 9303527971cfc2abc0f75029ccc1d737f8f5cccc
SHA256 64088da7cd67055dbf583b8beb5f853dd07d7141a3aa95a744f5942367c61c2d
SHA512 a9ff1fcbc6d9abdf28cebf219df299207e7ae2d3224432561ef551e6187fe8f8557b4e1b7f3c3f821302af97da8c8aac948eceaa68c1e0c022742191dc2f0f48

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 188c0542bc062e48b614e5ca8c1081af
SHA1 0eb9b89a5c92957cd1fe748cc063b32853339774
SHA256 c1ccc325c2699ed7f556cf171566317f706a911c4d02b1644a2a7908b93da58b
SHA512 62a67f2c56bc3b40d49c80094f160d355a8f67130e1924109426e0481008bc2cd11a9e2675a901abd03cad1e7fe0028031e20d826437edcf35b6f86e2499c2b4

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 22d02613a234b1ed6a2156cda622a424
SHA1 03b039cb13f73a918948646d850801f1cef28260
SHA256 63a85c76a7a4b4e3cf6c87c1b34c552ec90eac1a5a621c87b148a68ded7cbcb3
SHA512 e21e50f2ed0546752ad584e4bd09cb89d2170651b3c9d6b04fc6a7cb829196cf64820809cbee0562eda1864d35c4a1d3b92831d5748665d2cba443eea4d26152

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 ebe02f3265927727f5665efcbaa4d41a
SHA1 2c3328829dfe16ca9b37a06c47d4f18ac34548b8
SHA256 402581a84da715e9a4c28260543d741b4b46a37d60b94a1c4e5abd037df3e9cb
SHA512 c0da7ea5d7bb3cdc6e37336d851c2e093012e382de1dd0136326d120ba24e90e64b23397b0abfd7c186856bba292dcabb9434ba22a9129d7b71b3b2609adb660

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 18b0983f244cb66c091a08f8482b4746
SHA1 46328f970367369c1eba5d6839ab6bae03cf680a
SHA256 7b1a4d613b72f59ca9831f0983030b520f6faa3a05e96415e23dfd17f19fa730
SHA512 61291f7f0bafea917cd40237a6347bc2a47bac4419889b42b54803f4af6eed87beab9fd5855e9051cb04ff8bcb8274f3de8f3706e2b66a62b039d6b8d2fc47ce

/data/data/ir.stop.devsalmedime/files/PersistedInstallation6751444062557309813tmp

MD5 9add86141d5fc1600e2b6f8c5369148b
SHA1 fb654e321cfbe68309bb6bbcc4e327165e2b2ed6
SHA256 1b4fd4b1c5c4080349df0eb342ae5698055d78676c595c29966bbfae76960c4e
SHA512 6ab18bcd8a9162a767cb2e8560d95aed346c8182807fe1720ef94ea3e73959156eacb52a2ce7cb77aab3ee30ee9e47e999d5ed8551d71da614872f478d84bb44

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 f7b04317802ce46cd6861c74bd6aa62f
SHA1 8abc45f70c61abf442886a202dd07a6d7cd0f7f5
SHA256 8c67bb4b0adc0b664a90c4f21704ae6b8d0f84d71a1e53e84ecf08f32672adbe
SHA512 16e984019413290c1501317c9472c474b84d1998b9bd571ac15ce3440251db421e688d93da789dec66857f7a25c531901cf6ec98e28d697349ffb07fa2deac97

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 c16d5b1cc63ad212c98532627d90ea42
SHA1 b95a1f831279aed41bac297e353d63843e1f74dc
SHA256 a87e40a42a16867c7d35a82e2337a786336813535016ccb6b432ec6d2fee1a70
SHA512 b68409daf34a0552edc6bd67f848bdfbed7d89b1714a5717bdbdee07aa47e50e4e552d78730a27b2aa129c1c79ef47291c86308f5d295480125b1aac8523ebc1

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 40162eab57c91d1087b2445146ff02e8
SHA1 0fe680f0caccf2f615de915ed495cb4f05830ca3
SHA256 cc1a7dcaf1738fbfc7f36b121010156214104cb39fa856945847c97acbf3ade9
SHA512 66e4e8f79b9624a14465b3abcd32eea175c749c1efb488c02301f78993dcc383886d37188aaa9032fb4e3982f0babb3a508bfb1f83a9670b01252b50e58e061f

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 13b5f183e633dd60c4109217cad746e1
SHA1 949addb241a5bd81cd6f48df772e1823d344cef8
SHA256 8f3aff9ed22802584336e7bd3a464fb0ff7bef6f12c3af923884ceea85afe527
SHA512 79c9d0effb34cce306e7aa22c9d1cb597a4cd86ea853888889a717bba79419b92408c6406e1f8f0b5eb2a7a1903621a6b6ad240319da7047da321ef28bd16658

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 21c6a750146979becdafb98bf580768c
SHA1 8d2e28a689ff0cedc293f57527bf1d85f0c9d61c
SHA256 ee840a5a3a6be4a849d4fa04605aaef718f1181b9b5aeec0e82739d52ab60637
SHA512 d36dd15132e49a95cbad8a2e5ce58d958f34da6639ae4df143f7bc59468f40582fee207c8c00c59b8f788b0b745b9b8ff59f3a8e83838451232a5306fc3c041a

/data/data/ir.stop.devsalmedime/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-20 05:33

Reported

2023-12-21 16:07

Platform

android-x64-arm64-20231215-en

Max time kernel

2367624s

Max time network

139s

Command Line

ir.stop.devsalmedime

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Processes

ir.stop.devsalmedime

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
FR 216.58.204.74:443 udp
GB 142.250.200.14:443 udp
GB 172.217.16.234:443 tcp
GB 172.217.16.234:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 google.com udp
US 1.1.1.1:53 238.16.217.172.in-addr.arpa udp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
US 1.1.1.1:53 madareto.xyz udp
GB 142.250.187.196:443 tcp
GB 142.250.187.196:443 tcp

Files

/data/user/0/ir.stop.devsalmedime/files/PersistedInstallation2016176232205025532tmp

MD5 0b7cc2c869fd957bc6485d1eb95e44f3
SHA1 9cfb53e364838412eea026dbb25b466cd6c24727
SHA256 3c1da527bb1fd699cc4ff15e393897bdca920edfad579af788924154d0fb47c6
SHA512 850b6dbbf6fd88bc4b9d7eff1d52710b1feeaf851772e01ab5552025e63552519881c68751057aa3fe48131afea6b5b581c179ab8f5d9696da0fc4e786fefe67

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 f1eef4456c694bf025c6602cb6292cd0
SHA1 ee6402c93eda4a5070c3c2b1a049a3b9ed56b285
SHA256 0ff000108a7a20baf1ba2dbb458c0f413f9494985a993fd57f4ae9827676c1b8
SHA512 5798466e03c16402c7111c4eb9e563715c100906bc578339c3b7665dcec15193f5c660ba973dddc8338f477a67c942fc1e791141e35b053c3da5ad528ea09312

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 ebd8ebfb249a0e13ff12c1e8d3237f93
SHA1 a4b3c0e8487da366429f8278da6854161729cc53
SHA256 d7c4cb5e8fb235c850912fc3b525f6b3edb05a5602930d22e4796d8e054c5db8
SHA512 5e9dc6689cec8f46e78e29bdb373228c77d159fd7051e5c7c0b44eb9c84ecffa5b16529edd5e8dc3fc33dbe9482d3b21ae6a67a6f1a756aa55f405ae12c90e4e

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 7327729bc929831a08cf4783461a8111
SHA1 e4b326d83b9a621de1c65a48db95a8bc67dc737a
SHA256 97be80c2d632ec6decbc4afb18d9fde90859e135fcff855461dbe13354500f42
SHA512 445cb40ced1a1c31f59f502701b4796a0a9ee6a87770ea53823c40840caffeda37651c582e557a7d381d8df8dc4b3324d3bc369525c7275f6f607ae2a62083dd

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 abe66d62c9f7a4a72120e74b4da25661
SHA1 28867b93ee0e9c054512e0bcee46a9c52721823c
SHA256 7210533ad4c12d5b927f08c841fb031fb6eda9879ad6494dd77b94236adcf678
SHA512 784c372dc2c069a0d56dd36b6a4e624962c0d7289802166d34aa249aaff9ea5dfaf017dc3c8c5eee253a0157ad5972df7e59bb6a26db58b2d8f65fe0f2080756

/data/user/0/ir.stop.devsalmedime/files/PersistedInstallation6775005264479175643tmp

MD5 732afcbe94df1162a4cf55c7ef309247
SHA1 d192778fd6ad8fd9108027c301518607a45e0173
SHA256 b2de2ae3b24cb33bc9b0444a776447e8875d091953dbf5383ee8aff5e915d1f2
SHA512 a68d350689e733ce02de2e7ecf508d88bfc7a848475b90f6e1180148e7905b88cbc4dc39d13afe40e7fd3191e97e3de11467bf2589b7f3bd4d0e2894b85c3d5f

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 9b7a165649e04c7d380438b4da122e67
SHA1 d79ff0e1228ba071f8921e6fd9653726e2f74607
SHA256 6e10feeef9e5ec1fe89f38416f18dffa2b9dd80130416b69e4ba5bb15115a72a
SHA512 b79ca3228e4359a967f2344de468589227cb4acf0182b457b041e6a5ee233d2e5261d1ee1f23296d5f13965f2984b927dce3180c6df4f73983de388150d0c273

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 81a892a0b521df06077dde9c44f47b6b
SHA1 d8f51d863da761df2ce96f4b7c00b55490827b5a
SHA256 a002233dbe4e3bdd809fadeab91114481d19285a9d65582950028d295bfad2d5
SHA512 225368304b0b780ce3c9170194d46e0aff4ca87c58b043f2a773e341f859bdae631aaf2b70f0ecbdee7fa4c337f2c19fea703af307e8bba0ab1c74224a39536a

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 b1f3d841354ca66afe99c34fda53c400
SHA1 7cbd4b5b875e774aaccfc14587d5759db1ffe416
SHA256 7bd7e4bdd0d4836727fda0b239b9ae2d22776c6fbdec6e7c7b3c8dd0286ebb3c
SHA512 67f1b13b5cf4fe103c921f37187d8704e6f4a25ba09bb47fcee9743f9fc81e95233f4e2e5fe1c5058b97089e1fb2de4598d939477189a12c716622c2dd69ca00

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 5b22398585fbd1a9147625b95bcea08d
SHA1 b3bf58d412c82cdf75bc15fbf3d7bbfc574be94d
SHA256 475018892d5cc3c543a9f8c1a52a259a4a7154144d5cbe238e479665d87f5692
SHA512 d623b5be9bcc79b9623e7bcde6cabbd6e634a3e14f3be3e52959c56784b8119b436cc686527378c05edea8c049ca0916e4b3486e878ada5c727b84d6748eb9f4

/data/user/0/ir.stop.devsalmedime/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 f17284d2f571e7291c818f3159229f6f
SHA1 e4af4847b3f6703190c038759017ef2aff74f056
SHA256 febbe4286d1f26ceac6ae424a14859c2637fe4692ddc52edf61fe4b9962b3ae1
SHA512 7cbb8d5c15a99846092b759426c63314a7da6f6aabd9b93a07f3ee073afe4b4efc8ee86efdd6343aa9e650370c415051b561df2798050f42340ecb8e71fe6a73

/data/user/0/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 de82e2c94d2718988804b035a46d17b1
SHA1 705f5ff19093ad209f2a666085d6ccaed3bf58a4
SHA256 29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39
SHA512 68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-20 05:33

Reported

2023-12-22 23:16

Platform

android-x86-arm-20231215-en

Max time kernel

2479948s

Max time network

129s

Command Line

ir.stop.devsalmedime

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Processes

ir.stop.devsalmedime

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 madareto.xyz udp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 172.217.16.238:443 android.apis.google.com tcp

Files

/data/data/ir.stop.devsalmedime/files/PersistedInstallation8893207870275790095tmp

MD5 05a1666db2ac9ff2523d47ef22b5c6b5
SHA1 45f7372da22e9bb4754d8bdebfb4e82b2d12dd85
SHA256 8fdca2d952678fbe7a55cea97d05f09d62fcea5293fbfbbefd782086d4232a4f
SHA512 994bb179aa68294af274caaa63837fd9ede88b6a6d2272068bada4e742feacafb9b83bf6f6214cd455ce199646c2ce01a659a3d628d1509f7e7ad7adf2dcadad

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-journal

MD5 ba88e7676137a55661c4c9bb5f765523
SHA1 bec57bced05c178ee1afe5b4d227612ecc9190f2
SHA256 53c35afccf45bada6d0f1d61702acc49ecead15d5cbf96f6e9b4700933e9edd0
SHA512 3e0980a296ccc24da9c56c65c8a98374212ffddc30afe37c43b9854762a847fdf3ca1d50d132c757fe72111d87a64748f25f11e6358a280c56c07f9752cace24

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-wal

MD5 db2d61861a492e34dfddf39d7edbb252
SHA1 4b919112f9917b4704647d65f2f2e5a28a4ad1e6
SHA256 3b94e5e0243af03c6ad673dd1798063744a5ae4635ff83b6b7dd783bb973746a
SHA512 22d70d6077f3acedf6f0888ca07d8b546455a1d146fcce0fc3eeacb39bc48a18ba343426e3f5a9722e102dcc6dfbb6ccc3eba1d1ff5c41a980eb9661730b1bd5

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-wal

MD5 b754cd475a75686b7e3f1c342ecb56f7
SHA1 b942c2ce3aa0be1ffe17f34577d90df378b46d43
SHA256 965de7988c15827763db9a549176c01404ae749a69bfa7525a3766a4c6a13518
SHA512 30317c67707de8404702c6ed27f25fbc7e6124e121e030664225d16674dcd5f0328fe71ae5964095ac8149caea1db31cf77bbae8e4c28c797e757aa0c8d91d01

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 35e762349fde4fa7681c4f537696963e
SHA1 77e638480283eeda652a12addedbb03435e9c663
SHA256 88580392e09d4f67febba2bb19757b97c54cdf01c8812b95f14c55374ca358cd
SHA512 a27e876d494eeb85b657993b864b83226d3daf58fa7b819ee0c7bd3b36e06e99b2856600d0cd166801925d8d1d5063e665364ca69afe6e633141525ca6dc8c7d

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-wal

MD5 182e6ef5b60a2ea9f2f7aa27d5a9a838
SHA1 af0aa1fd18f907705dc6e484a5d83ee2758d70dd
SHA256 d6b710ac579a97eefbcc16a96ecf26e970f3dda7bef1353863fd88f0ec5edf6c
SHA512 6b7787c69540a71fbe79682b4ebdccf8b6e2fe8d5566102be4b881dec8e839f8479238ab0c91f64a783abd7e80fd38c8c1e8ced18375ba20bb1abcb41749132f

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 1ace47e0fd67d566ac7613cb3f9946b4
SHA1 e0d2e274bfc4f169c6f2d6753ee90ba9e402b20b
SHA256 65cff80747a14fdf1f2f0f1d2588d31c138d9212f18f6887b7c85f93cbdca113
SHA512 9f251de021eb9b4d5283711c7a4cb32c88bd4d1245e0ba1be73d612e0f940bdf535accf930f3a68ac203d952a71d8fd3532cb587114115772e51a8196a6da72f

/data/data/ir.stop.devsalmedime/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-wal

MD5 09c6fca11c768c01c447ff467a64b5c6
SHA1 8dd1c200a2960d500fdb3e19e374005152117ce0
SHA256 c1eb84835444847e62c66994b5f6df7af5eb92415078b73ec11b389cae3e29f6
SHA512 b985c73bb78d679afe09412a89a7623dc932b7376b0b47c62719d53ef1522798c1211f7eb0e9b5f0496fdd97a898890da4aee9dc134683ea98c1598a5b927f66

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 642443082eae300f667fb8b7a2067daf
SHA1 53fb5041f90d6413a5e9e80ef8db9d5905995895
SHA256 f4b9bc8e186e3cda15b0ac17163268424fd05fd703317ba8453118a42fdda754
SHA512 154826aa45aba26141ce562e524bdeddfbda15560cb45da632f9bfc8b65c79e94d0c757cd89d0fe3274df591a1bb79ddfc4e92b6e7c7ad30614241e778559ccf

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-wal

MD5 9512d972a318af3b5c56cdd128a09101
SHA1 a4ea600687a4fae2ed5727888b6e3b5164592a92
SHA256 7c0e90483b11b13094fa757bf45274e00ca1514a49eedf61b34e813b8b55df67
SHA512 7379aece4543fd237d15f80ee2f896a116364b8a196eaf68f34c9a940361b33782c26528ece288c78436d9e3f420396e85d770d392774a5a3c7dca4be267e242

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 2bd97da65a0319ee61d8822f38c5170d
SHA1 e6e1c9c8279ed076175ec29284e6bee3db40501c
SHA256 28c029f82ac422b7e9b2d27dc3653639672924c954f53bc6da13377b74304fad
SHA512 22f7ed5703e9ac770ba56caaf5faa537b4fa68697cd232366f31e6519cf6621409711b505c5fa4706aa5df436b2ade1e6ac80b5762afa1f1dbb0feb0f4186020

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db-wal

MD5 95979e3885776f06b83f549c1c8e165c
SHA1 a4d7572555dbafc5c0566b1e191c15bfbd1a37df
SHA256 f664869806bd9228bd5353406cf35cbfebdb9645edd2891a03275741c3a049b8
SHA512 ec92a4153ca02007fbea4d141d2b9d77f1598bb887e95b30f1caff6eb70ebc2bb2c58335e452468d4814e49ec009b32c4395b7020fddd5fcb0187bb292001820

/data/data/ir.stop.devsalmedime/databases/google_app_measurement_local.db

MD5 3e881d9a01ca707bed38018ac69f4518
SHA1 5820f9351d7cc8082de6e5686eb9f8fedf6fb830
SHA256 4a5bf9bfe9b032546f886dd5fe6717de78716734aaadab620c0444ed6df5151c
SHA512 8f0395c94b3a449f3c61e7117f400c7b8a12c23d3655be6772bce2c8aa0ec8d8be8000c5cd2c6e10b334ef54a4add5583717393c3239da80c334c45b8b392db8

/data/data/ir.stop.devsalmedime/files/PersistedInstallation7562353433509433613tmp

MD5 3a525aa984f268b2c29605fca41d448f
SHA1 e21f856dd06d1f0a160b4ce9d3106b2d79a83aff
SHA256 ee20d058c965887e047663c28f2e2b4e4a7908991eb61d28147ed3ea27000ee0
SHA512 739fd7b7403065051aa255b323dac17a9b211745891dd0cc2d027a31c006049206753339b31ca4b236d976f87b8512565bc5a4983352c42f9623bb736313c67e