Malware Analysis Report

2025-01-19 06:43

Sample ID 231220-jv6nnaafaq
Target 91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3
SHA256 91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3
Tags
irata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3

Threat Level: Known bad

The file 91f989ba53006d7710488227a800a5ee28e731cbaaa4ba71c5ab4f30c743cfe3 was found to be: Known bad.

Malicious Activity Summary

irata

Irata family

Irata payload

Requests dangerous framework permissions

Acquires the wake lock

Reads information about phone network operator.

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-12-20 08:00

Signatures

Irata family

irata

Irata payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-20 08:00

Reported

2023-12-23 12:10

Platform

android-x86-arm-20231215-en

Max time kernel

2526253s

Max time network

129s

Command Line

ir.shz.shzkisi

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Processes

ir.shz.shzkisi

ping -c 2 -W 10 -v google.com

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.179.234:443 semanticlocation-pa.googleapis.com tcp
US 1.1.1.1:53 google.com udp
US 1.1.1.1:53 238.16.217.172.in-addr.arpa udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 liveumusk.gq udp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.213.14:443 android.apis.google.com tcp
GB 216.58.213.14:443 android.apis.google.com tcp
GB 216.58.213.14:443 android.apis.google.com tcp

Files

/data/data/ir.shz.shzkisi/files/PersistedInstallation1897332867107058135tmp

MD5 8dab578a1da0a47f33518fb9aac3bcdc
SHA1 888ef8767223c93d952e0346cc28a0edbaa76d42
SHA256 bc08d3c984bde9d4296385070c3bb942db71a8454ca7861fb84dc25cd270cffc
SHA512 a319d3fd926e604c365e45a2db4df1649062ec8d7d9de3b4e524a264fcd49f79968905e87805d15b5fd8826004ebd60e5e0d12d64e6ff2733d638146027717ac

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 3cc4253aeba7188edf875464647ffca6
SHA1 bfb314052d83c890d60a3fd1842ee42365ef6803
SHA256 342945de78d5eaa5e437776bbe67fd9883c72ee33ed4dfedb31de3c776d973c6
SHA512 0b18401b586f892e4e67edecf18fdaf2d2b4f3c4e3e36020983dba33bb35fbecbd7bb127751d2b9551612d1f5e70e5081da8a0a5e6a825a62133e2882d2c5ba9

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

MD5 97e69dc95024126d8e9db41dd2afdd35
SHA1 7aa1a389b5e09222abe4634c094375173a660159
SHA256 ea10f8498bfb6e5dc7cd2c2369de712db63def8b6cde4ebda058f62a20f8083c
SHA512 77d425146740da699185cdad625c68534dcfec46125940c7071545fcf099c56584262b4534e1b092efacbd28de6f2b980d4f64a89e1063e435ebca0f701ca644

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

MD5 81d6ffb9473469608ce339d15e498d1a
SHA1 e49cf2132da89a12f8b4b9832007f75451ad87dd
SHA256 84db91131a57377d2b6b324da9efa542e527ac01895efc10613ed6b2e60a8298
SHA512 f6c74e87e7311d639e1b5d45b85342cf640bd11c45a67638d8096a3847489d831a96032ebc38aeda14bd9f9867fd9f0d5d3f070b2f0bcf69af2e1feba0eb625a

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 b92215515e13ba85c90b89b6b06ccf33
SHA1 15eb7d2a9f76ad350507b782edfcded4fe3b5ae1
SHA256 514cefbdba34b364de9fdf9e7e61f5d76c09e481593d966f4d1fcb2c22a2d95f
SHA512 83715b4a151002c7f8f96542d6862ea2ce3e36a63a5ee7616ab91cb882f83827b32b3f954c100cecb472339bbe2e124d848eb73cb77e1aa5bf9723dc3cfa1a17

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

MD5 cd3722b0371059f9231f555ab6160a2b
SHA1 32f50d419b0707024b1b76567350bd7b52ae6e66
SHA256 39dac7ded603506a378d17e859e317e33afeaf8b87c338a4e34e32befc15f78a
SHA512 bf7de429614aadc3ec48ba4e7e60f34a40260e003aec9f406caa778b5491af9748ecef7d5621920639d54a37910528f82b2bebd4be28dfbca4c4a34f121b9b0c

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 47d3ebfdec2e2b8ba03099ff08ebab35
SHA1 8b6a4bb26565293805e50d1f1c8298ee388e1b28
SHA256 e3afb603925d6cf05843b5d2fc1bcbb44b9f1fac0e0556c8135a31d4b792b89b
SHA512 e0283ab95e6dc85b66a37ea2c3a8796fba97d4dca6f7f872deeead83980ff1e18cf69ff1713e73d008b6da7e0656a5647abfcad431fcdbb2557fe021264748fc

/data/data/ir.shz.shzkisi/files/PersistedInstallation2673337136038570279tmp

MD5 0f2d232835d9f2b58b8d11b4737d8226
SHA1 eba0e1d3d7f7f2e75aac821c5590383c378be795
SHA256 13b64708efed5a069ece1070a5227d2a2441a65b9f6ee27a65792f5c25056061
SHA512 7c6121fee3ceecde569ad0f7a7f6e085858cc5c77b1116e1e61ab8b569d5c5cbed7a19c9757035876ee77a5e0bdd1aaa3bdebe77e1ea841fad2943537347e9c8

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

MD5 e461d0182b117c3b7c99b329aaa4e957
SHA1 02358e68cbd5b2311188ac92c953824663a1fd3f
SHA256 78175c6db1eb6ec6297891a927c6dacfa850dafa62438e5aba73b26c159d1e27
SHA512 bf8187d73f51eb0cf5075d0cfa15425052af6f5654792756b5e064817ba4ffa7b36ab4aef2054c7ba33edecf665c68dede252c2bd955219d1efab696162aad64

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 934e884430ef65ac180ae1baaec4f3d4
SHA1 29f6b8f29ca6641735200c52d51f8f24f5cf8ec3
SHA256 704322500c7a13db61499b3111e4b79ef18f8e067db029fba18f9a1f4b911962
SHA512 c751abd912081c52ea454232ec76b7045d3bbb6e3de76d59243ff76b6e49657f3ec9e22eedc07ddd0faaf8abf7b6a6c2ce1f97f6b20d625a33004204346219ca

/data/data/ir.shz.shzkisi/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-wal

MD5 6be4163d9903a99c0abd77ba41533593
SHA1 afb6d689d243d40365b43b3ec9bb3914fbcfb7b2
SHA256 ea977385a07e3d3bb3cca0133034db719897b425b0db4de118a64b1c86baf27f
SHA512 e78ac5e7c9fa53edc12d6ef5948abca887f2b4cab93306c1e9385bdeb9bd2beb7b1e57fb289fb54703fefdc5e25c61486dd2d8ec67f8825a53952bdf99a2295f

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 49cd656e318f3bc867d250c75d4dbd64
SHA1 07fa43c2c104a8c90b80052ee445339e39aa8821
SHA256 99ec7a270e33b927516b88b87794c262f4536d9c145408184b616ab1bd7f867b
SHA512 a622607c2115e2269f0ce2280c71a7f07d2bcaee17657290b57d26e682a1c044066e254779972cd70b9d1aedc1faefadc2631d342c763bb84364722c3b16b00f

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-20 08:00

Reported

2023-12-22 06:01

Platform

android-x64-20231215-en

Max time kernel

2417667s

Max time network

144s

Command Line

ir.shz.shzkisi

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Processes

ir.shz.shzkisi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 google.com udp
US 1.1.1.1:53 14.200.250.142.in-addr.arpa udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 liveumusk.gq udp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp

Files

/data/data/ir.shz.shzkisi/files/PersistedInstallation1235741758899635544tmp

MD5 a436f05315effbd040d47650d6b31fea
SHA1 96b775e1682b1e6e1ef427f2e5f7e6aac4107556
SHA256 5a8ec5e7628329ced75820a474ff41d124bc0a34ac4012def5c5fec9cc1d5b0f
SHA512 aa762ecb81004be62bac20b8f7e4fda6d4a3ceeb9728704447fa77cbe3ce2a29745420596e1d44b156dcdf7cdcdc04022fce35e0ea9c01a353324759b2aa8687

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 0b982b830ebe6cccbf91d7b86715ab68
SHA1 80a113bc10aef1de3fc15314118999daffb4414f
SHA256 fa00fb5e0ef96d9dcc049909d5685486355cb4c3ab9196ebc766aacf26af8794
SHA512 5436f1995b2d04e1938facc4392cced9c9209b4415ccd3f9cee1c6e6f650aad3640fc0ddd7a46ba0f1e533ca08b9fc76e32e9909b1d9ee4387b5c5f0e73fbde9

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 4581424d7c72a660703cf0b798474a96
SHA1 61b9de8946688c0a2a1ef6fe8af961b59920b3bd
SHA256 69c73cf0e72abdf6a4a898b3b7e1333645be9bc3f95c6dec3544de9a3b641d58
SHA512 2c36cf9758ac349518bf1ab3ee335944e5a88e38faabbf270e1eb50f276837fa689f1778915a646621342f04d99d53cf84d5d5a795dae4125d36bdf69efd505d

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 6b63d9e9952178607a95d093f779cc49
SHA1 3d03fe7200c701f22bfabdc51c3cfd0084b1ed69
SHA256 1cdfe7b80e3601c9de5ce32020e70b76a818e2a80c6c11548a9648e97ebfd43b
SHA512 1a8458281e0589dea80dc74d6f3ca27739f14678c9c6ec5b6efa154349c88e11be6ea496c0862127c4eeb43189f2549572ffbec06cc9b2ec0d2280008eb93f48

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 0b0fb4f179d40c66a468f8a5aee00daf
SHA1 965ee3845ce26aeda46759ebf5bfd5df936d8a3e
SHA256 ddabf265b78d1703d72ee39e1e551260251d57f34225a0f7f83969d59c077d4c
SHA512 109daf80291fe4a40098e094f607dafe61c2baa7bd1f85d8a0fd990bdb350495bf0a7faabd88d0d107c2117b566a31b7210a2152b51ecc39c897f3873b05dbf7

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 e57e0fefe9a317208962d0c95da5c60a
SHA1 a01609d3b6c03613a65fcd3b3cb0d457c35a78bd
SHA256 4d9b313e980be3e0b9d291403c2f3904e363bcd37106049e3684fbc370ec064c
SHA512 574a63a979fa2c27938b0c9d2c56077084bf0b46449dbd94b70672c3a4efa97e08426421f5ea65de6ded519851e61127d21728100d783c5172bde35530da04e1

/data/data/ir.shz.shzkisi/files/PersistedInstallation289870927398142445tmp

MD5 337e64f94ce1b2cd3c3bbfc7ad8ed49f
SHA1 e401db4c23812c1d76563a7eda9f206d6e3f2bf0
SHA256 a16643ca89f65f9bcc255a31aaf71af5f7e4e6ca4d133430436edf9e2ecf09d2
SHA512 589191126168a93ec6301e2fd42b72a0ed1b3c797b615eed78c4895494c3d5b094b2c822a65903033683678a91821f1b4d302963e67d37f24a4434c5036fd297

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 1fa98c733009911d56d18b561f91cbb1
SHA1 23dba325ba187b02763ec0fc7954a6df1d17823c
SHA256 f48d4e0895fbd9b0bf206e4bba5f8b91705e42dde243dafc3001321e22eed618
SHA512 98585cff1a7229eaa2c1450a8f74931bed66d9747e61a75ba6df296e42218b4ee78cdfac93ee75d8f65afd2129fb686b76ae8b703d0361f07c333302246f2908

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 516b14023829ae2d7574eb2672f6ef8f
SHA1 972684ac15e70e8b9ae9977afbf0f9e5ff197bcd
SHA256 60f156000d988d54bc3b8689ede426bfd45b0b74d4b1ab9056240d0eb69a312e
SHA512 854f9b41f146f354cf4dc0e26b397f78e1e05210b3232a149b38350e8354502557b58d6641bbd9a627ca566d7ad7cbe787f55f23dd4302f2c59008b51db1c954

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 1e6e26031f0e8d0393a6e358fe53d46c
SHA1 88bb1020ccc9989786e366e01b3414239da506a8
SHA256 6c1bc58219f34505cd10fb8fdc1cd07937c215aa74023502ee3c81182ab20a50
SHA512 e3f8ffe3c072fa1965ec52eb2029365837ca68b06b33fdcfebc46702134b5d8625f603e229c75ac0d70e863fc001104bf831e739db975597a199fcbc721d3236

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 9d37e64d9fe9d3dce8ea7d920782df38
SHA1 ee725d1604477814a765098ddf13129a4f26f0a8
SHA256 feab75bba2d5f6983beb6ad63962c230bf69be778c83404cb939e50aec4fd8b5
SHA512 0a22af9c270752771392191dff4c43047af08519a9ef8322b3e56c56ebd4593c9f7c5d66f811c62e543d59063cb5ca3043df0138de2f59ee9c8f6666ec295ca7

/data/data/ir.shz.shzkisi/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

/data/data/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 61d72101b517e47012d8e3368c913d59
SHA1 90a79557568f5de397995346e7331a4e951c8a50
SHA256 472e3c056fa98132f28d993dbc0ceda3ca472a5e559022107fb748ac86adaa91
SHA512 843fbb9ac675238293125bc116d6c4b8ce5f05444349e0127373d591b4858dbe710fe3345701a3af2f9f2ee221fa1747de37da788e0413302a593fa1ca311c37

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-20 08:00

Reported

2023-12-22 06:01

Platform

android-x64-arm64-20231215-en

Max time kernel

2417854s

Max time network

149s

Command Line

ir.shz.shzkisi

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Processes

ir.shz.shzkisi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 udp
FR 216.58.204.74:443 tcp
GB 172.217.169.14:443 tcp
FR 216.58.204.74:443 tcp
GB 172.217.169.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
FR 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 liveumusk.gq udp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp

Files

/data/user/0/ir.shz.shzkisi/files/PersistedInstallation4400709229183772796tmp

MD5 d0d824a437b4ac41617ba2afd16f1aff
SHA1 023c5055eb0d24bd85f748abc7ed1cbc27e199ab
SHA256 e5e264a272775c07ae893e090556ce8125a3cc5373de6a5b8e4ccdae89868a2f
SHA512 ff4f964819db5053780e923d3c594f4306d3d9ba05081fdac67582bb86a79e8e9e3ce988116d95b6cae63e81f513fc3009d75a44679551e884d277a9d56482e8

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 1e372e37978575b52eb09594766b6130
SHA1 e0ee4f9b94378d9fe0f89b2d5453fd94a9732123
SHA256 db788690ba98e50359aeb9ecff7743a452c8af1146089beebddfbd7a17341161
SHA512 421f28cc357d626961f7e706516ada7d254a8cf4f3ee6e3a76b68929696fb85b78ea96ce315e251c0d133635b1937df642dff477813658c4d9196d55fedba6b3

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 3c0d7bedc43b75e48f8f830d68f7afc1
SHA1 14091391657152c503c3e35ec74baf78bb3e94e9
SHA256 66ff6eb707fd01f43b530f11f0f8a2b1d37ba9afd1c52779b00c4884e28506e6
SHA512 e888d1a877d2d957be05c56095f9a1c7cee5e7985b3c8bb07fe1f32888ffd90ede8a1559a0df33403876209891810d231bb164750b93e2c6b9d72d6fc486c2cc

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 181b6709156949ca4956ff1afda7a7ff
SHA1 21f86e42af4587f25b2fc89f1c4ffd8d3ceea521
SHA256 830d03bf50d84ba2f359ebe0cca7da6bfc418c9a99f8667707040f20f0e3d8d6
SHA512 9c56e4deb794a3fee394b0c7acac64b84a7675fcd2f58b15ccad5cac304f63b78f62e2c5de4255003563884882751c9c0fe1f08ed52a7343ee0c21c2bddc755f

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 6bbccec7dc9719205cf6f820d3fd0bd8
SHA1 6e676fb94ca8e734c6f4e42eacc0562af94e3507
SHA256 013137d39e37af0c2c38980c37aee54978a1514ad158f5e5758977be520c2b84
SHA512 ba864be2a0f2bf66e37af5975267d75634ba36a9eeb3a98b126fc196d735ec1636dd29bc508d58e5f0504cfaf99bc06703e5048676c592fec84cf9b6570c1cf9

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 40976f1e1560578aeb45b73ca93f2f9e
SHA1 b8557bc2b07fceed823d596350cb515463e73161
SHA256 da37afaf01f16e5712d78f6d808340431e2dda19170e21b4c2a703ac5965a845
SHA512 859034b16b66b7ac3dbc4588758b7d076b8c09f962b3b29327efd2fb9cbf21ec1ca5cfc63c5f05375c93e29aa6d87a6ff65669342f99744d31600a74343597e5

/data/user/0/ir.shz.shzkisi/files/PersistedInstallation5407394114468268030tmp

MD5 d8304b09442dec28b0190783cc4b7ab1
SHA1 52593864853c5d9c6a70fc2949110a6e0eaba92b
SHA256 2b015fc802858c1c5f04e9b369037be0fb73dd3a80faa526cc4926c73f256d05
SHA512 7de8723a25c627edb2d20d0949aaccd5b71d98f080083b9f8ce3e2e4913d7b2e7423d3cfa1efab06ff7b33ad934fe55ffbf022f645fdad4186007c512f8c6e0e

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 279b51c09ed26fbeb88fb3217ffce46d
SHA1 05cd1d90fd4fc62bad30043e9dd456b5979b0ca4
SHA256 0adc4fbfa23793bde47f88d509d542d1aaaad01db177766b6355c8560bd0e18d
SHA512 755c80e8dbf742696b2a33f2cc5710c2dfde664f3ae7984eb1a1d945eae1c65c407136d9a490ea58485ab70b985f7c5e3643c46634042330d40b729a1443c7fb

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db-journal

MD5 3da9da705866ec7d34bb30e3b3255cc1
SHA1 98589173d4791b5399ca22801a23e01ad68ae6be
SHA256 55f71aec4fb956cdf4b34ed834a5dae4b385f29fffa51556410ca2d5d15a8550
SHA512 872bcb4b3e51ae66127a0b3c9319ff41ce85b75cd51ecd63897134144154b620bf957c1a0b14ca18eeb33b774ee91732b8e0df7ef4f49ec7a2e4ce6694aa5c55

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 a01637af42cb7c3cc54c3e13846f4831
SHA1 4f2cfa4d399faceff37e6aafa40774b6ed5edaee
SHA256 40dde49646ae88a8dbd9c1d72253dfbf1b0a49050f0dbb809a120c80818ec326
SHA512 6f09d769e41059b1d850e85ee5582596a012949b3207dd408ed3ee38010295aa17058bd9de8066f1e329730fe8b4c832bff2206893623e0effed5e962db690d7

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 242035f89eddff91e4809137cc27ddf2
SHA1 5a679ce7541bcc323707c4c4d227a18998420b21
SHA256 ac6eaf3902644599597d138159e764d8c4084ebbc5b01a3694c43f7ff2749b50
SHA512 d51028b43d65eab44af6daab0c8a42d46e7a1c21e97c229420806b4385c84174b4ec3bfdfc5bcb3d043eaa86aee87f39d4090b83ae390796f3e048ef3ab31bda

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 47585688a9318b7fe7fef5d68bbd8e35
SHA1 902114cc08a6eb8ff22c4fd4a943a05f8f2f0d10
SHA256 6c1032f3a48a38191e9f3ebf880f33c612b351c92017fde48a20083cb02f9383
SHA512 e0cdec1b17ebc9dafa5101f191255a67c8a83ef4428d6f61fdc4b4eb71c1d214af8e489f594d0a6da8d0657c75f638393f4c08ea89e6ef3404cd94f7683e2174

/data/user/0/ir.shz.shzkisi/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 18bea4d1602771ccfc7bb6d540d976b3
SHA1 2c46416dba70a3f1efc35e90e90c077502d68575
SHA256 e72832bae1616a111a405000181fcc8c976b7fb49a59dc9cb982cd655d6a6974
SHA512 ba65962b34db74d9f66bd982aa73818d9c13246c7d26a3643842d535aa1a226c5517c6f72abbf6ad42f66cb6c93c18fc9f303040c0e6c6457afd0b557e273978

/data/user/0/ir.shz.shzkisi/databases/google_app_measurement_local.db

MD5 de82e2c94d2718988804b035a46d17b1
SHA1 705f5ff19093ad209f2a666085d6ccaed3bf58a4
SHA256 29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39
SHA512 68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e