Malware Analysis Report

2025-01-19 05:52

Sample ID 231223-p7d23achf8
Target 192c45196e16b48a464303d8be1c4e0385f2028e9f2c9c08ed7e1da87032d457
SHA256 192c45196e16b48a464303d8be1c4e0385f2028e9f2c9c08ed7e1da87032d457
Tags
irata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

192c45196e16b48a464303d8be1c4e0385f2028e9f2c9c08ed7e1da87032d457

Threat Level: Known bad

The file 192c45196e16b48a464303d8be1c4e0385f2028e9f2c9c08ed7e1da87032d457 was found to be: Known bad.

Malicious Activity Summary

irata

Irata payload

Irata family

Requests cell location

Requests dangerous framework permissions

Acquires the wake lock

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-12-23 12:58

Signatures

Irata family

irata

Irata payload

Description Indicator Process Target
N/A N/A N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Reported

0001-01-01 00:00

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-23 12:57

Reported

2023-12-27 17:08

Platform

android-x64-20231215-en

Max time kernel

2889826s

Max time network

172s

Command Line

ir.iut.polo

Signatures

Requests cell location

Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

ir.iut.polo

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.200:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 sdk.cheshmak.me udp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 1.1.1.1:53 srv.magnetadservices.com udp
IR 178.216.250.25:443 srv.magnetadservices.com tcp
IR 178.216.250.25:443 srv.magnetadservices.com tcp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 server.magnet.ir udp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
BE 142.250.110.188:5228 tcp
US 1.1.1.1:53 www.google.com udp
US 1.1.1.1:53 www.google.com udp
US 199.59.243.225:443 sdk.cheshmak.me tcp
GB 142.250.178.4:443 www.google.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
GB 216.58.213.4:443 tcp
GB 216.58.213.4:443 tcp
GB 142.250.178.4:443 www.google.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
GB 172.217.169.46:443 tcp
GB 172.217.16.226:443 tcp

Files

/data/data/ir.iut.polo/databases/db_default_job_manager-journal

MD5 04918c20cfbd95fed674acdfb7c476c1
SHA1 53e36b177612672bade3f6b9f0b9e03f91c0a74e
SHA256 afb440ec3f2fcc919b9bb840175dbdf85a912464b516ef50044377fc4bc50ca1
SHA512 b74203ef6a6af100b2c63640eed70c558505c29c2c042a7092f66e3c979a6685bcf479a39a6339b126e091eee70b47e2700d54898c95aa6c75254ff930575eb1

/data/data/ir.iut.polo/databases/db_default_job_manager

MD5 ea628e04765adaf4238a5dcdff4bbd51
SHA1 a801947619ea8c368efe9c006a324dc6339ac60b
SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
SHA512 c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe

/data/data/ir.iut.polo/databases/db_default_job_manager-journal

MD5 92c488642d8b81a206b2b533f6409e9c
SHA1 84bb9437b54f39942a701623fc2d337b014e4f3c
SHA256 a3d9f4d51e6a8202ae9fc62c1734cad3c2185206d56f0fc1c98351728ddf641c
SHA512 8c0d09b5dfd240c4a8df54934b53c8fb3a2d11ab571cef2165ff433d0b6719d51b46bd75b8915d304627e277ffb09f0bee22971862c0817c540c2caaabd43436

/data/data/ir.iut.polo/databases/db_default_job_manager-journal

MD5 48944edb27a494dd743e63e4e740dfa9
SHA1 88f70b6afb98df1a116a36d6bc68f582af15ca08
SHA256 7422254727d3717c85b836c277a1b1a92b341517283307e23a0e275dede41dc6
SHA512 94595b4c6c620fae1a17e846d9f9e702529e650166ebf516dfe63bd254485a07dcaea5f21cfd2065d1462b374dc460b4f311e0722f70231587398003f2b6a474

/data/data/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 d0d2532c1bfd60db6ce11d6e89a216c6
SHA1 9ec197c218a17879a11544e168da46e548dfd646
SHA256 4e757874ac5d3d5a719b6674858d47bc011d9e8b3665534d2bfa2a4b18eff8a0
SHA512 68a06cce9e74aefa44b7346dfec52a2a980e5783b96764c4be55201e55bd7e70ef531b57814da7c3f509a9d00e5bdac91883a41bc6ad977afefafe66ebe47108

/data/data/ir.iut.polo/databases/evernote_jobs.db

MD5 12627a2ec645c4a4bc50dba5903afd59
SHA1 504005c938517e61bcf68b65a055c2faba635c2e
SHA256 f177ffae9650eb4f407c2d9a510bb5a5abe1ece2fdfe24effc62478a1bfa5903
SHA512 7ff69589296e02383a217373399e75d8a82fa17146e4273f4c0eb630f096dd9f394a3324d60858b02f7e5cf177c82c6d966f5cbedb68ae6a98df7cc851b79cfd

/data/data/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 2299ed66bc340b25ce50db094b2b3772
SHA1 7284ae95559ef19c0347312e9033539c45ec7d54
SHA256 afab511852a5b2b8c3938047f99de4f0c44f3119c0d84d11bc667db4cdb3028f
SHA512 59def42acf8e192000521e12174704080983c9b226b7836bdc734b3b139ee0c7c2bfa189b10623a4ce6e1569d9cc8c6c3a808ff2e243f1e12d1f6d91ba01bede

/data/data/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 5baf0f36165660649fdda2e9a08113c4
SHA1 10be86b813609549a8e259ed267b8a41e93f3ffb
SHA256 245a65ae858addf0bb9a3de2eb438b38dd8ce9c046abe262ba2a11eddcf7da72
SHA512 24ab22625411eff2c753a3e4f3d5e83ea0cb46b486b804b16db552d6c96cbd152d47d82532a3cdb7d6948f29ca809f0059d2a910c51f6a43ce82e9575278f3ef

/data/data/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 cafd88b0d31accb6421ace297042d857
SHA1 da396c3574c9fcddb30402396568b9b67f7d7b3d
SHA256 e7c49bb7dce3d19ce61d28a1255f1af19cb3ba93235273645548cf1eda486224
SHA512 bbd89af7145d27e25f1d0425b4678a948f9783aa10e5546d616dfb60f06df00035318ea4c6aa496167d828904289d3b02dc8e02fd3401ab576913ac13f31a39f

/data/data/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 debcdd0abf0b7e2190627b72062cdf76
SHA1 333268cbf1ad96e4914dfa3634d32c9b7b6af96f
SHA256 4006f42f2ebdf3847f282a4e49672524c13d3c1677393797e2fb087aa8aef866
SHA512 f5e25498f65682a8e290e4ee65faa42c6e1b92912c1ea9216dac0bf001393bc92a44262bb046784c5e3598c89964b1da022e2df2278bc7c1519f86d0cd554aac

/data/data/ir.iut.polo/no_backup/com.google.InstanceId.properties

MD5 ecb790c392fd12f01efc5563bbcbc2c4
SHA1 61d452e3fd4aa20ab0bf2678d55c07a8e7705d4c
SHA256 9279dbda5fdd43ffff0dad1373380d063070b545e570c9590c724fcb487e657b
SHA512 84a3c32c17e7fe117a8bde95ca239d0ec26d528d245bc314ca38bb96e8b0d689ffa1d5ec1bf046cc1e371278ee6b7be99eb5f9efd8f52f08f7ecefd709cf0e13

/data/data/ir.iut.polo/databases/__pushe_base_lib_db-journal

MD5 e6eb7c4861453c0ee9daf310451d6f0f
SHA1 a6824fce9f7c995f13ecb34a35df4d7e2f6c00a2
SHA256 021cc4a5a0c1abef484a081178ae6133c68ba9f130403c563d5d3a7d37bb239e
SHA512 3febffa6bec9eb100aeb813b99bbd366984db70fbb7c8aeebffe569264131e73bf35bd24c043a83fff95083fb1313de07a6ce0566b0b7cfe1c498133436e2557

/data/data/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 3231b70851094cbc4d8c9022e4eb6f94
SHA1 26f776f88491e887bbf33810218f498a28726fcf
SHA256 7298142b33c32f25c10c1d4aa37b682956959344e8ca84f9cb2c516a7cd0bc08
SHA512 7bb2e62c22b0b93ad8f4e149e9678bdf4b2f5a185df8aec04dd937b5e4a36324c7de47ef5922c87465ad41bfaeb685558deaf3e21c0e6db0149a4225cee87630

/data/data/ir.iut.polo/databases/__pushe_base_lib_db-journal

MD5 402506f1a4485db27f53c993d9110d71
SHA1 8fa65510b7461ca319d92b76ecc89543301640b2
SHA256 e7ed57bae49155b6ba0f7054e655b63ad9aed14289b9960ca780f2fcbe7d3581
SHA512 f508fb984828e6dce18e45110cdea9bb914b5a3994845ad2f28b60fb33e213a132154152ebaffafd37bce050c142fed3a1b4664d79cf51ad1dac6f675b2c464c

/data/data/ir.iut.polo/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/1c4aba73-e73b-446d-b858-24982d434d92.jobs

MD5 bdf4bdfd7091aae0fede21de67ffc4fb
SHA1 1512f671a089d3f834f2635430257ac3bd5ad7a6
SHA256 4ff722965e17131ed98729412d917fc8a91526a8119962bd6552a49cfcf60faa
SHA512 4f163b62d8e8ef3cf9de5347da4ccee808971a221f9ccfdf1c054b400cc0ab5511699741ae7e99b6500a7136bb45ce52d4bfc2ffae551baed514bc8379511fcb

/data/data/ir.iut.polo/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/9af2efdd-dcdd-4228-81c4-41d6b12b7447.jobs

MD5 06e7e49d967ece8595c8c3e756fbec78
SHA1 e4ffe5b4f3bef4d510f3537740272b840c39d632
SHA256 2a4a575004eeb80ee0c4fb7897393b4b0fc929b20cedb0b18146d2d2077d6f11
SHA512 74d09cf05bd317ad6a804b80474cc1f62ed4d9fc4d5151f061e14a8201252d87b9a225848f60bdb8260709f1c664d084f8908ec7cf7edc81fb5ba9bf1e945ffa

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-23 12:57

Reported

2023-12-27 17:08

Platform

android-x64-arm64-20231215-en

Max time kernel

2889784s

Max time network

162s

Command Line

ir.iut.polo

Signatures

Requests cell location

Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

ir.iut.polo

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.10:443 udp
FR 216.58.201.110:443 udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 sdk.cheshmak.me udp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 1.1.1.1:53 srv.magnetadservices.com udp
IR 178.216.250.25:443 srv.magnetadservices.com tcp
IR 178.216.250.25:443 srv.magnetadservices.com tcp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 server.magnet.ir udp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
IR 178.216.250.25:443 server.magnet.ir tcp
BE 64.233.184.188:5228 tcp
US 1.1.1.1:53 www.google.com udp
FR 216.58.201.100:443 www.google.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
GB 142.250.200.4:443 tcp
GB 142.250.200.4:443 tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp

Files

/data/user/0/ir.iut.polo/databases/db_default_job_manager-journal

MD5 3e4614b3d95cbe7864052d864b581b32
SHA1 57f39e993dc22e0eba76b9ccd0deeaefac6b00c7
SHA256 f4c92ee22cf2ee3b9d1de8e694b6bcb8f422c00f38c5989b20871883958c2231
SHA512 89752238133d3a73d3eaaeee84657c218457270f5ee218fde39ae11310952f006b7806b37d570dceef71907d9c6fa8d07cb1ca0b745f1a6acfed41ffdd4d0801

/data/user/0/ir.iut.polo/databases/db_default_job_manager

MD5 4d86114d9822a04e44a23599678af232
SHA1 75c3f325a1ecc11afeabd98290384a6dfacd515a
SHA256 fca86d71de3d92c63e6f66379b3668b2fafd65906689a13ec9a412ab93989000
SHA512 f61589a7b5b80c0a9c49a7bbd5d77dbac2fffa1cf7d57497ff3e4ee7e2bd265836e1699dda3906ed3ccefd4ea1da31a3157620dac6386832561a39d114f805ca

/data/user/0/ir.iut.polo/databases/db_default_job_manager-journal

MD5 366b5110dd97d08cda61a6f0668cfa7a
SHA1 a3022a66f0d8ec1e44582791b15cc1cc632bbda8
SHA256 073ba0ed603afc889db1965aae7339fce4e9de06e928880ddc54a80eec3965ea
SHA512 0b309559007d633324d9a77b93951ca0ab8799c4f4da07a0b403ece4c4c09169a1b512bc8626fb4850223149a1f9ab79a6a7eaf411cc9a5b482d1eafe142e328

/data/user/0/ir.iut.polo/databases/db_default_job_manager-journal

MD5 665176ee9a9e6699905e0e3871ed26d2
SHA1 ba9a51a443f54319b9ffc4b847354d5b40c66eed
SHA256 021c35aa8385f4980d13610f107cafb267f4071b344eea688ea0af8ddcd1e35b
SHA512 b760a5761ee43ba7bc1d08c258a11eaf89738a27ac908f35f2310c9b33d3282f50aa7103a18dbecafc0b8975d6b3f4dc5a19352b978845dca25a3c7d2dc2d4ab

/data/user/0/ir.iut.polo/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/83c5b67b-a044-4f57-bdb6-9b0bd1594829.jobs

MD5 f56f328eea1d5c96a1b96dbbf59488df
SHA1 440c784cacff61932e2f61580b7cfdc3a4943c95
SHA256 90949c83a3d90fc0128f0d5df662aef3699971ce9e63ab067382f970cbab8918
SHA512 36e370cf16dac8b173fa182960789974d4087a7b607042000118ce518db8f1eaf93cf4f3be42c1c26ab53e87ff54da33b4c57a3a15e5cd47f2c2b66efe8b3edb

/data/user/0/ir.iut.polo/databases/db_default_job_manager-journal

MD5 bcfe8180a81a984ac90f67ba972d251c
SHA1 ec676236ecc9ccedda848b140035fef9dc988499
SHA256 67461852db7a093eec99862a07a86b5dc4ff21542e9e40d065e2bd77b6d5a488
SHA512 a5c963ab52503177e9512d76ceeddc9967dcffb1fb866580ed2f6ebe70ad1232583b3351d42a56f5ad716e9237d449adaef60794fbab848d1a5026d7fd5b66bc

/data/user/0/ir.iut.polo/databases/cheshdb-journal

MD5 989118e950e18a8d93fb538371a2b40f
SHA1 95c03e162977322eea1cd1a36f304ee00bcd0355
SHA256 1e6fa99fda2d9db3e1081edba502c0bf1df02fa97bfd6f0e35f21f9f15e215d6
SHA512 85e5efd94f601b06d9551a0521f99860ea84dc77437d05b11405171d482e2b0a3db8157cdd669a77689b117cb49add88d41f0a13a8d8b546a0fc56b4d16a7f9c

/data/user/0/ir.iut.polo/databases/cheshdb

MD5 cd74548a6606ec6aef8916c090a81e80
SHA1 7486fcc928b09f96d82152c533fbdd1175b6e45b
SHA256 e530562d42dd81a380c7252ca98089f8d9cfea31f54eb49267adb245c6bf7378
SHA512 817ed1f1aa3286f3c32ae162b93db8830affa47bb9f2ada3acc8455630a221bed648ce0d0635926819fd0f69420c65387c0148499e52f8e6fbeb144438669202

/data/user/0/ir.iut.polo/databases/cheshdb-journal

MD5 d6ad20e50ec885782838358258d3cda2
SHA1 6e64a8866bb5a8107a9adc8e37a5bde6e26c916e
SHA256 9297c13202257e39e84ceeb2d836d8cf42c34fe8d5833e087ef603bbf0fb1341
SHA512 3de8ca452d4b6f12d7ec3afef0ae03569cf5638dad2394ff41124e2bd30a56db4e9589cd80c8ef23f45765753754868c97df86e513e58b4cdb56531b8e379af6

/data/user/0/ir.iut.polo/databases/cheshdb

MD5 78acb62a592e75515a03ef615a66d58b
SHA1 559ef34796399c5ad013284406242b010dfe84ff
SHA256 d22c25bb0c24dcbc2f591e6c52820bed79f6a76b16a69ddee6259a1d623217a1
SHA512 90b19afd91844bb0c55f7bd9d0c829855dfc84504fff98c885c34903ad3d1aa391f28e26ad5ca88badb0811b8215957ffcb413681809617878d1f138ac795917

/data/user/0/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 331c8b9782a6ebf155d66e0e8607aa82
SHA1 3c21b00228ad086d8d23dcac6b1c490fc7e76d6b
SHA256 2abee43d9390fd8fa3a5c03c4de28c43acf7b607df4c7ad2ac9334f9ca631673
SHA512 26d5e93e6cbe413d195c8385213c52cf5f34b8db31c7da3e41b35c18f78b60bee8337cf936d2d6966f12562071c1e33944179197c81dbf06c7afadc838a814d5

/data/user/0/ir.iut.polo/databases/evernote_jobs.db

MD5 171aedf968e17a2744d2585715606cb9
SHA1 bbeddeb3b89fcf809619c35b4a318a80e7d5b029
SHA256 d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
SHA512 78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b

/data/user/0/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 27776a1b71b605a00386fad28f794396
SHA1 80ba825ee3d05d987692ed37e325174441d2bc98
SHA256 022f6f84eee82aafc15958e8ec8095497c24a440b805a8039dddc97e0bf498df
SHA512 9b5084ade94fe6170d293da488b356e6c458ba442ab5b8131abbecc2c26495c094eb648b633255f08d63dc616e4495548dcb65b451a9c0da03ef498cb52468e8

/data/user/0/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 7baa9b73fa5945ca8eb1197d97f71bbd
SHA1 8e2f993fb99275b7225162f080eeb0e9008688e4
SHA256 e8e5d76ffa3e5cfeed0bb187423cd384c7042abf2c212f720984f274d2204113
SHA512 c2370974bb771472dd48b830c102a063b50567edf7d4cd9775c80a2c23cf64698e23a5cc46a3746e0b6bc1b68425960a598c398568b4e4aba9480de5c1e15c78

/data/user/0/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 802c8d6956f44eb43d3bc6ce45c13ceb
SHA1 47645ead6f14459c6dff06492cc32e49902c01bc
SHA256 e4f82f11d4a36c0a5ce9f7d10293eee45773bf45d4135392c3444821ad1d8b1d
SHA512 64c0080a002b8a09ee1107da65953860d3ac27bfe1529e9cecb47136a093777715046d28b3bf2dcec35db213430dde1456065b989a8c3732228fd4edf4bb0378

/data/user/0/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 4eb2386e61f9f1c6e2e037cc0b4b1b88
SHA1 7e2f108ff0d49bb9ed52df96cdf2cf2fd8f120bd
SHA256 8b92c6b9c91b61f5c6410b68ac7f775358ea4a96b90a5f6d965e30c85b7cddea
SHA512 cf1b4bac878081749bc3e51ce8e77e397688579278a959dad9f72647c9dfeeef13266701b65da7c09b1f3504cfa362320858fbdbf237879ec56de07a9e49f73a

/data/user/0/ir.iut.polo/no_backup/com.google.InstanceId.properties

MD5 cca8a8b5679fc8328548442bd02ef7c9
SHA1 919cbd54c34254d555774210805e071265955a4c
SHA256 a5a75de6d0a5ec169e5e9e52bd6a2ae8d36beb61bad234c5d6f0ea125343c152
SHA512 918965bdd0bdaee1687e85b01400c535e7affbe055ca73ecc5e6351f3df046827f9a08a721078a23464ad556dbc4903cbcbdc2520834caf222fc06e36ca9ec97

/data/user/0/ir.iut.polo/databases/__pushe_base_lib_db-journal

MD5 f7d11f19e9b75881fd0b50d84cf0d7b4
SHA1 f43d63c35a829a408173503b84de0804748d12f9
SHA256 e66e300c335e011a465c26f3f3bf69f2c70e1a23e75b4a9e93ce089636dacc1a
SHA512 3badc9ec9a67d4bc7e1dad81b0ff562862b82e0191453c01614ced4b03b666482b69b914c0dd5834a5f2b8e9c0774d430d08abe8321f1b202323268aa8fedf43

/data/user/0/ir.iut.polo/databases/evernote_jobs.db-journal

MD5 228a09bdf87d1e129dd729cbc9286257
SHA1 cc73bbdcc2b4f1b32e1ff742f4bbc210948a31f0
SHA256 63a493bdad6c860cb2904b30bafb8eab6b9dd49d429f19c63309c25249372f20
SHA512 6b2e1fe164b8575b2ecc015216623b5a0839b5a63ed12681a1dfeef6e694c1337521299f2763b801332a26f1e84ce884ceca5a3d7be0ad5fd7c8bf4598e1cf2e

/data/user/0/ir.iut.polo/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/5da858b9-639f-45b4-a7d4-5bd1b5659feb.jobs

MD5 97f5e88143fe5f071350610c02c1deef
SHA1 495fafcc85419def99348edda3d6ca032be83235
SHA256 362a2534c84f216ba48a76d6370d518f6b3925bd6bd7cd6ce95ca72021554a1f
SHA512 a83495557d07518cb6cd3db0032e6ced37a8b08910c22940b7da0df504c73989c5858a89b65e16d55d93ece3118d92aec5d57ed60355ad9af3b8b7b1ddfc94e2

/data/user/0/ir.iut.polo/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/fb2bac2a-f919-4bbc-b339-af498be25d76.jobs

MD5 726e8f454aa10f6c90f778522f8735bc
SHA1 17d23a9d644b716572f3c56938e03eeb619541c5
SHA256 7836147fa40d9b16c0322c2801b6d6fb976061b05fd1c514240a0c3fdfbcda3f
SHA512 d33657bfcfd94090d84505804d4d9afc20f5344293aabbde9ad399045b49311448705b124d39de2bed0f85489705cd3d1749872b57bfe5c96c569e52f3f14c38