Malware Analysis Report

2025-01-19 05:52

Sample ID 231223-pv7hvahham
Target 1496937a42b57705edf4802c7fc1ac2b908f17c46537fffacf934ce0285ce3f7
SHA256 1496937a42b57705edf4802c7fc1ac2b908f17c46537fffacf934ce0285ce3f7
Tags
irata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1496937a42b57705edf4802c7fc1ac2b908f17c46537fffacf934ce0285ce3f7

Threat Level: Known bad

The file 1496937a42b57705edf4802c7fc1ac2b908f17c46537fffacf934ce0285ce3f7 was found to be: Known bad.

Malicious Activity Summary

irata

Irata family

Irata payload

Requests cell location

Loads dropped Dex/Jar

Requests dangerous framework permissions

Acquires the wake lock

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-12-23 12:40

Signatures

Irata family

irata

Irata payload

Description Indicator Process Target
N/A N/A N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Reported

0001-01-01 00:00

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-23 12:40

Reported

2023-12-27 14:21

Platform

android-x64-20231215-en

Max time kernel

2879745s

Max time network

163s

Command Line

ir.ziba.pishgaza

Signatures

Requests cell location

Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/ir.ziba.pishgaza/cache/1582435991586.jar N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

ir.ziba.pishgaza

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.212.200:443 ssl.google-analytics.com tcp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 sdk.cheshmak.me udp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 1.1.1.1:53 almabala.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
GB 142.250.179.238:443 android.apis.google.com tcp
GB 142.250.179.238:443 android.apis.google.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 1.1.1.1:53 admob.mehranarzani.ir udp
BE 142.250.110.188:5228 tcp
US 1.1.1.1:53 www.google.com udp
GB 216.58.213.4:443 www.google.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 1.1.1.1:53 ip.pushe.co udp
US 162.243.147.245:80 ip.pushe.co tcp
US 162.243.147.245:80 ip.pushe.co tcp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
US 162.243.147.245:80 ip.pushe.co tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 162.243.147.245:80 ip.pushe.co tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp

Files

/data/data/ir.ziba.pishgaza/databases/cheshdb-journal

MD5 d53498e8787e5cfb58ff0c8a7b460f2f
SHA1 a8e9187caf857c7b8247b8a4ac98cd72afc5a8c1
SHA256 4b7777d81be5ffda192192909f55425b6bc956df7d1cc472ec1b220c840691af
SHA512 dee8f6249a28f993c6e6e30c396ec5f39e9dad2bd6934556307b582766e32c9d6bafc2990139897b3e565823c5a2b5a9cadc3f8e5789d9be0e18ea03dff7d413

/data/data/ir.ziba.pishgaza/databases/cheshdb

MD5 fa50846a9ae68b114cfd63303b263d28
SHA1 74910ca3be62e152a8563be01f76cc8b33348991
SHA256 3b86f0382ea2b0666454af8e7ce32fabd441c1d3d47d4c7023f90a980c31e04d
SHA512 c617f48be9291e285ddcb63f23a45551959a689c7fc3f97f08837354cb6e70d70d54672721133bc6ca14e7193956a06adac52f3499b9e62451f8abca0dd4a748

/data/data/ir.ziba.pishgaza/databases/google_app_measurement_local.db-journal

MD5 2a78fb9ea6e182e18cec2854581b8850
SHA1 60502dfcff43a9079d8cfabf9e4d2a13ec6b24ec
SHA256 41678e896dea5c92675e19c2b3723aee3d7c7ab90d8be762b18caaae820105cb
SHA512 18cf3a9bc7eeb30cc428cd00869578a57a57f56dc8567b989b177853bf26f495bd574a0405141b036c90efa9847ecc77021b7fa3165a0a7bc641784ed24f72fb

/data/data/ir.ziba.pishgaza/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/42810d38-9c2e-4112-9bb6-46278d7b32bb.jobs

MD5 fb1b5eb5a862fc415fa9b03384d63278
SHA1 6cda2c673299997d4bc920d7d5da0d61535bf676
SHA256 30528cb69b2dc295804b07f9142c4af8bb9703203ab9071b44c81979fc5700c5
SHA512 abd1b6952a89a7dc621d995bda6a902cbc139ab163111cccb3edf0c4790182bcc444080e7d9d98416ff56fc37fce32fb0dcccc464fc6e13894f5dce56a5cdeee

/data/data/ir.ziba.pishgaza/databases/google_app_measurement_local.db

MD5 d7a22e3a1580cf60cac703a08d9bfd45
SHA1 39e9a9f6ab9e0cada5685f3bef170f9a4c9e3cfc
SHA256 41bf213841ca8346383e4a87731816f2731ce8bd5a46fe0654249d9b1b0c5793
SHA512 205c56655c1645657abdaa03774764bd7d134a70984e0168e059dd12fe173899740238eedf37daae6f29971c6e658fe48b260ab1b089505ab94d538b02582142

/data/data/ir.ziba.pishgaza/databases/google_app_measurement_local.db

MD5 f77404b7d7b90fef79f7dae53d3d8c60
SHA1 ccb2b77a5990c11a6ca9abfbc61643a8d0b9f827
SHA256 42dd9924c20114d467c44cd633d2fcbe3cfc50a8a8b305a2dacddec74694a166
SHA512 e2bdc9a9133e81528041cb9446403aa0d04ffe9d7eaf4407548fc96bd5ceab41928fc01408312d5f9d5b3c8b8e23d4b273a86493817c0d66d94352e5b2cfc3df

/data/data/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 9ca9c90d1068ab462a697b1596ead61a
SHA1 65e85b726dd4488a83c0fe05a7d1b75779f3edaf
SHA256 ba9f17a27b68a52f3d3a05619ee53c3d6e57bb9ef386c43119e9d361abf4d012
SHA512 3c233b87c33f0740898d39ab32a1e2609c2bb586631fbfb165288a6dc00264c330510dc6ef3a443fb668171de4123b223206851e4a7f7b5129c539b14ad841d9

/data/data/ir.ziba.pishgaza/databases/__pushe_base_lib_db

MD5 abe9fa56c177c65db8c072e6d81fc41c
SHA1 abe9e9bb6f7294324f549af4435f58578ae69f2f
SHA256 53f09b897033e2496e13f3c6e8d14ec1d1f7b273c2b4d47dacc569594fef0f8a
SHA512 bb1b70eb859448050dd71822652d1976456be07c098ab41f2f75fa277cde059aff0c45629564170ee07028b85d501cc941529ab06753e5be2e710692bfa3922a

/data/data/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 3c68db2e0de9fcab8991a59c21dd836d
SHA1 6aded9896c9011c2dab1b6859e821ef8a38e9340
SHA256 f56b9c323663ec1d559b5d87267d264a3c85ed50f902af3ca8a48b4ddfcf80ba
SHA512 9f88f2c19e25551012b51673524bb7ba5f04adfbfc88000f66348555787ecc4b79dcb8e3154924554552929b21ac8488d5188662dd59d186e6aeb4151def2389

/data/data/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 7da6c0ec0a4ce7c276f79deff46a4748
SHA1 6b6b5d194158799660b78e78f9674dfd7403b875
SHA256 61d0c90a9f5c61d41a72f3eaa77317d4e3a7240b7f009d5c2991919828f3d8c9
SHA512 418a22e0609f40e5714cd5a9095599997d6f1b5e1ed6a73c45a023a04bf63b278782f07282ba416f80242d15f2aee988083c3a3b011441430d067f127ab781b7

/data/data/ir.ziba.pishgaza/databases/google_app_measurement_local.db

MD5 08c1ff24ce03266360dab8c4b91834e0
SHA1 e7ab1b0a2c3ee06d5696fced51bee4385377b103
SHA256 22e4f86ff9f7e7da2beb5abdedd0d9663804e1624c0461ce2f1f04dfc6811740
SHA512 34ea1d2650a44a373547fae0ebb4473637894d809dc3b9fcd8bafe2bcd3c8a7c3aa4bed209cc008b000241261db1dbd10f678cf7c6493130079b9c8252f20604

/data/data/ir.ziba.pishgaza/files/info.db

MD5 bf690325ae14d5fb21e03d6d5ce6662c
SHA1 68b451c53297dc41a8d4223a5de4b99cf83a2336
SHA256 18644adf5aaa701a3d3cc11e9689fe53b035ae87df2b43bf8e1fa8b83543e615
SHA512 ddb11746fc514663ad993b6e03d50df9897b3b49c8780b989cfbff40257eaa836ba9e728bc2a2f6bd7f57604b04fb1cbb97c2edf540f9aac97af9246c0eec4b3

/data/data/ir.ziba.pishgaza/databases/google_app_measurement_local.db

MD5 125dd205e5934bdca5c8115ff3c70202
SHA1 8a04b0a2b40c70d821829da9ea178c4122a4d7c3
SHA256 4af3b8e0655fe26674c5746a6f6aa813847d4c0947717b2eddd486994c025a03
SHA512 de4cb87868e7565a5b4b99047d1099986cc63d404d627f592bcf948c1bfcc07820096abf2756e38d0d4ad96d22732ef1e25b52c660e24c594ec7e7328969977c

/data/data/ir.ziba.pishgaza/databases/google_app_measurement_local.db

MD5 16d25bafaad6d158417c16a475df3342
SHA1 19f5f3ca61d8e6187df7e380d2101d29617b6096
SHA256 fdf55fb5d0d0c487f44f35136c21584ba466445659653dccbf647d68b789d051
SHA512 f197c7ab1d5fbe0baa123a69dc07daa3b1f5e083993745fa190547601ef4109853f6476efc9ce00cb6d5ee60f1a204157be5081cd312b93caef3dc97574fbadd

/data/data/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 d92260d41e6d781930767c575ac42e45
SHA1 d94276ac01f0f77f03d5166ab1bcb3779b792a41
SHA256 2d78383255acd3141294cf3c9b49c50254aa7e0e42ae58b55723ed80a8df3bc4
SHA512 de0c626ce97dd6c0ce6ebe97a8335e6a4529154e70764d722c41e06fcdc1c8e602b31111dead8eb5b692b1202d0fe951ea62cb6e8f549bc76c3c53ae95459a74

/data/data/ir.ziba.pishgaza/databases/evernote_jobs.db-journal

MD5 7b1f27d26505985a8a23e6306c37b675
SHA1 b7d46add6dd3340a4bcfdace9b98006a30241a35
SHA256 d72a57519a338a11c8095d7db1dc560c6928eb0a08e8dede3570e19a819a64d9
SHA512 4449e9206c22959f520dd7a60bcfd0a481bc518a3a9a63e33173e8c19ea166ca6fac8f656aa2c4324e552ff38af018e9e36899b2f156f6c2a6b3abbb6c98ea2a

/data/data/ir.ziba.pishgaza/databases/evernote_jobs.db

MD5 5e737288d37e17d647589719b97ec406
SHA1 53eb24d1cccc99d817eaa971d716f241efccd02b
SHA256 be459893c46377972d0642ec4e6f40fd68ff06a146d878f695c1af3a6b3eb04d
SHA512 7bdd7ad193356a410da7879be38d9d43813a9cecc50d649b25a08aa765fd331307a8b8398a888ebf2d8361da82aa24e81d568da13ebd38aa4b684c98232d60fc

/data/data/ir.ziba.pishgaza/databases/cheshdb-journal

MD5 485bad089d112eb2490e5166ab1120a9
SHA1 ecf57d0bbf43f1817e882eeb35e491f3be171c44
SHA256 ba4e874d2dd5fd3768ea0b88c2b31faf3fc295d4cc8c31386e10c981f1d1e7e1
SHA512 4b1376457f5b45cb7fb430206d86c64aa8d215722a80e0c8e71da22e242dfda13e9da1a7d8d4e56341326d3b3faa212eec08bc3475ea371b1e73c6af2442023f

/data/data/ir.ziba.pishgaza/databases/cheshdb

MD5 6c483d28569b6f5a35a27912e8d07431
SHA1 7b8803ed1cfc9cb13a85c230b1ad06c547770a43
SHA256 1b59b5dbaea1ea64f3526f643cdbe39b055db2769c29fb2cf043daf0691ab5d4
SHA512 eb68df9f6f4899a2e4cfd0b7c1f7b49b825dd3ca9a3101d450bd0bb3b9f0f54251a04b62a4545df0efb7b406b8f37f9f262a07f436282159757354562aecb29d

/data/data/ir.ziba.pishgaza/databases/cheshdb

MD5 ce5319f5423715f7117123e80d202bbe
SHA1 37d2d9215f6a23c10f8e90d9cad3fab3ac996783
SHA256 09ef88db2fc81a04eee2defb61866d8e1649e4aec996eaf466b09a78af44d592
SHA512 4b0a2c2d2e7dbc9aafb10b7b41de8da29edd473958f3b091d9024faab3bcd9bb2aed578cbaf404dddbd15807d5c75cfc9387ca7ccfc51e7e5b4898b714f6938a

/data/data/ir.ziba.pishgaza/cache/1582435991586.jar

MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

/data/user/0/ir.ziba.pishgaza/cache/1582435991586.jar

MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

/data/data/ir.ziba.pishgaza/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

/data/data/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 0468a5fac6422948df7a6b3849b1819e
SHA1 d35ab28a627a3448c5e34b4a38ef27e382067b7d
SHA256 d580be4af9064c206334e2d4df6014aa77b3038a2da383dc548318f51fb93665
SHA512 45529a95a8b24eef37cf22e7b2ba4909d348e671190f53fef8434158e5454233a468f46c808757300651bfd5f8abcf85e7f9196592a87d30a49e67f8fa530789

/data/data/ir.ziba.pishgaza/databases/evernote_jobs.db-journal

MD5 5fddd6a4796f44b6e256e47738304a05
SHA1 c88534b4bed1d4a16af026c5077cad8f5b11c88a
SHA256 020f12e8c96bc07ea3e79a506aabf3e393842aebf9a372ccf48047ac74127d03
SHA512 981bb56970303cbd5933879b0aa18add8e7580cdbda131bcb467ab8e2bea6a38f3e60d58ca55b919882b59dc3be202ce8188dc55f8b8a59dd4bd5522807e5154

/data/data/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 5949ac7a086bb86b3fbe50f3b4e8a6ee
SHA1 cb5f3f6c11e9e2a8d565373f9aad9b82c9fc880d
SHA256 280cf484a74cb70dedc9bb80cb42a2a3c155f11405f0e19f3f44c48b5c56cbbe
SHA512 50471562726a53da4a1b1e2bcf51c79b098401aaf96d82a7f4095840082eaac5d4c27da355fdae9f8a8e315da57100cf8a0fd24e641780995ca6660342ceb8f3

Analysis: behavioral3

Detonation Overview

Submitted

2023-12-23 12:40

Reported

2023-12-27 14:21

Platform

android-x64-arm64-20231215-en

Max time kernel

2879762s

Max time network

132s

Command Line

ir.ziba.pishgaza

Signatures

Requests cell location

Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/ir.ziba.pishgaza/cache/1582435991586.jar N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

ir.ziba.pishgaza

Network

Country Destination Domain Proto
GB 216.58.213.14:443 tcp
GB 216.58.213.14:443 tcp
GB 216.58.213.14:443 tcp
GB 142.250.187.234:443 udp
N/A 224.0.0.251:5353 udp
GB 142.250.187.238:443 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.72:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 sdk.cheshmak.me udp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 1.1.1.1:53 almabala.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 1.1.1.1:53 admob.mehranarzani.ir udp
BE 64.233.184.188:5228 tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 1.1.1.1:53 ip.pushe.co udp
US 162.243.147.245:80 ip.pushe.co tcp
US 162.243.147.245:80 ip.pushe.co tcp
US 162.243.147.245:80 ip.pushe.co tcp
US 162.243.147.245:80 ip.pushe.co tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
FR 216.58.201.100:443 tcp
FR 216.58.201.100:443 tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp
US 199.59.243.225:443 sdk.cheshmak.me tcp

Files

/data/user/0/ir.ziba.pishgaza/databases/db_default_job_manager-journal

MD5 45ed4b3fecb52674b8d5cf025db33a66
SHA1 9320c2fec169c2ce9b7c7d6f63ca74d271c6d69a
SHA256 5693e0ff38f598ac059b75e9593cc82a33621e41651af44a70bc3b5d3d7e8f35
SHA512 3615a2be4f5d57636c10bfa8f1aac83cbcb93dab37b9ba17e6719dfaeaedf025984a257ed5ddfe616d1e5c08c01d2688bea78efe87c9f5ae17ecc012e9233f81

/data/user/0/ir.ziba.pishgaza/databases/db_default_job_manager

MD5 4a1f18b25648733896b29fdf2a1d89be
SHA1 b8883150a1eabcf6784dd19b959ad4ccfc020744
SHA256 18bc4e177a262bc1db79293c918c1e1fd9d22a43cd8af9f6f820e02250d6b9a1
SHA512 d241d2a4828c236d31c0cd712787bf83d946c91ee126dc696bc1d237798afea3d19fb94a59fc1255a8af3b29174180e72be5910561190475c35d21c31a17ba0e

/data/user/0/ir.ziba.pishgaza/databases/db_default_job_manager-journal

MD5 3110db02ebd7e62338e4cacbe0053209
SHA1 b9a3a77146524c22cdd95dcbddc85e1368c119d1
SHA256 65980c6b0c881e1f5793273fe2845e1882afcdddd7a4780d18a93985733c455d
SHA512 c7a284f211561912f8238745df1260391c790fcea63ffbdfd5be8d367e69c48f39735b944a2df8aadfd499f7c68c9d37478fceca68c811dda3a3ea85b7aa9d64

/data/user/0/ir.ziba.pishgaza/databases/db_default_job_manager-journal

MD5 dccf77f905a82db10b7fdbad54a35389
SHA1 9afa9b80ede85ae9a9cf1eb63e6a395816b743e8
SHA256 481338f39e6f21d9180faebd4b6a6eeb96706cd76f166c516621a926c86748de
SHA512 df6a1c11ce86b5c330d1d2d7006dcbbac6743ef2b48c075028b77488e4a40c2cf87fb112b0fd06525bd06463df5cedd2a91bbf2512f6402c97b8c4f7d0c0108f

/data/user/0/ir.ziba.pishgaza/no_backup/com.google.InstanceId.properties

MD5 e4b8c3872e0a5dd44f4cd03c556d2c0c
SHA1 6b8022399ee07282bd8130646f3bd84eb62a8ab1
SHA256 e84b21f7538bc3e3a4b13191c53ec4add28fc2f7265619dabd9d8d80706b831e
SHA512 0d7ae8f42cd2483fc40fafd835ef0e5181756157bd5bf331ad38b82087798c05cb0f47da61d964356dfc289abb0e69e53686e79cb5f322846883eb3f6cd39452

/data/user/0/ir.ziba.pishgaza/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/b173e842-3c16-45c5-99d1-b12aacc3e7b2.jobs

MD5 f56f328eea1d5c96a1b96dbbf59488df
SHA1 440c784cacff61932e2f61580b7cfdc3a4943c95
SHA256 90949c83a3d90fc0128f0d5df662aef3699971ce9e63ab067382f970cbab8918
SHA512 36e370cf16dac8b173fa182960789974d4087a7b607042000118ce518db8f1eaf93cf4f3be42c1c26ab53e87ff54da33b4c57a3a15e5cd47f2c2b66efe8b3edb

/data/user/0/ir.ziba.pishgaza/databases/db_default_job_manager-journal

MD5 29f98e6c86b3522146386035ae357d73
SHA1 ee66a4fbefd228d7b08abaeb662c0adb00c0b64c
SHA256 55201abcdb86dfd65a8659891731ff687355132d4dccec57a2ee884dcd58d1f6
SHA512 644eb5ddab6471658e7ea3540358d0c9739a03412b05b81e8cc7d004fd7602a39bc4d403c07d5879d449a073c7d585329c96aceb30f72b8660abce7775ce49c3

/data/user/0/ir.ziba.pishgaza/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/12a3a87d-47ae-43a8-b548-a23fd769fe90.jobs

MD5 ac58f99a1b179d71e8621412ad31c6a1
SHA1 b51fdad95876f5615735c2ab411031ff67d5e946
SHA256 9537553772c29c4303e606e458fd9598c14f1eee3cadfb446e241638bee3ccdb
SHA512 faf45d5eb4b890216e6ad33825ffc02cbc57914628e625164f9cbdacd5962ce8ca8f473ded2f56eb4d4006fc7cafa9cff8c9f76655f17f83f38d3e89b8d7e67b

/data/user/0/ir.ziba.pishgaza/databases/db_default_job_manager-journal

MD5 af0521a9dc7768d8b31d4883521b81c0
SHA1 923d020d596ce2cd41e25c3d73671824b7617e90
SHA256 53db2478908a89b74e98c6b5eeebfe8f59ae4db21afc530cbfd80551604d672b
SHA512 3ebb9e4fd3902ab7ddcec727152846b93014df761ee1e4c6b68fdbc999558d829492f5f5ddaf655bed6db3370d52c3313dde8208c3d3917dcc90f45d93badadc

/data/user/0/ir.ziba.pishgaza/databases/cheshdb-journal

MD5 0b828cf18b3bab7452241d876f01dd2a
SHA1 ec13669b44620aa6197a7f5e6627bfcf3280b372
SHA256 d683ea641213d19d0031e4f97dddcd76dc4d80bab58b3f1206634ceb2e732073
SHA512 6724878fa218225700096d920174a55399cabf396727a5f26bb7a4951bd8b49606a39cbef83aead5ec9ed39501ee60cfa9c08081cd476d665a6b728ce56e39ec

/data/user/0/ir.ziba.pishgaza/databases/cheshdb

MD5 1c7a5debfe81d48a98de2c1a2a6a5b48
SHA1 a865634959a6551d55077d4c756e1aee4578d2ec
SHA256 407c24bc3328ac9108c9c6bc8cba531dea18c28cbe1ed5d599b74417fd743e92
SHA512 cae09fe559fdc6bdf723507a90f96806caea0992b45b5b5063d191e83e2588eec2ffa55563e1c93f3c36a4c9c0f6848f20644b5c1a1b13ff500825ecd42fe0ac

/data/user/0/ir.ziba.pishgaza/databases/cheshdb-journal

MD5 f0ffd7f6b8a9474c63b2e47ea1cd0928
SHA1 14acc573f4df77d45a062790d40c89ffe7c38dff
SHA256 bdbe12a63590f0b477c66e86928660f63c45e62e44f2e390652ed1252b5b94ca
SHA512 909a535832a02762390bbd94de85d025ea88ea357222f5d9b79697af829f248001dd7bce0a071da9c66b5defdf3b896af56db9a92b5394fb394ddb139ac8e6f2

/data/user/0/ir.ziba.pishgaza/databases/cheshdb-journal

MD5 74a05c949c63098fbfc473693c027579
SHA1 9f135f31d9a7ca05aa370c54c04024925c896f93
SHA256 9120d26664fadf8184d5f0d8865ab05fb4d23dbbdc24bbddf3c6374c631df366
SHA512 9566c1bb26b7177749b94fc84a39ad21719e4ac7941c7eaf021f4b631d5cb636bbe88f8989ef15a68cb22961510bba5f106ed318392aae893c0cfb05a1f02229

/data/user/0/ir.ziba.pishgaza/databases/db_default_job_manager-journal

MD5 6187766d65d3b7b0a89b089c501a4ecd
SHA1 17de739f798706fa29171cda05c2f33674f141c6
SHA256 d6460fbe56ad4dee2e3d3b8ff9da367a122da26fb3783d604f0da53e48f09577
SHA512 6f9834a2d812ea829178e82f86ca00f2b564563cc6228fc4cb6fe3fd415062c127793e9b3a79fba9d734eda830a65a7e078a519c4583f3a5e756a867c30ae2d2

/data/user/0/ir.ziba.pishgaza/databases/cheshdb-journal

MD5 8dbaf79f511ce4c2241a20e4513508c1
SHA1 e81abed4d4ea59566544e35bc317051f27bddfb6
SHA256 a1b386ddaf829eddfcbe3a8db04b999b60743eb43ad161b476c3c92c85f6212d
SHA512 eb07c8cf362e636ce56f9fade02d69f3dba33460186e4c32c32c6e9cd702a6140e4750a37cb831fd191d0d81887f70a5840a5d2c93c1eb9945354b264be1f521

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db-journal

MD5 49333828eb3c1779042f18d5b6a126da
SHA1 e82e9e946efb2b8432639696712d8de8a23e8fc7
SHA256 53a1db8637f063b6a3519960932a9807fa5f8ad73ffd335a1935ade3f3bb443d
SHA512 b0b018af4072a373f5166f3f737c272a6c9c81bb2f9d716787740eb74fa7bf13225867b4ce33cba7b563f5af5a505fc2edf6d85b152874e97d19f25427f0fbd2

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db

MD5 e69f4f2d472f3a3ce382d160082a4e09
SHA1 5cba3a4a59cb8824c0acd41850accba0e66603df
SHA256 25936b28d1bbe4e60a47bfac592cf48f6c476e772b7ff7073b4a6c44ca091035
SHA512 bc40f46d5deeefd5d4c41d66dfffcccd3b72db79de276520266032d6845cda6711327f7af5921698167ae97286ed1765d9d2a32435e6733bf4afa7efa5b04484

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db-journal

MD5 3492fe3ac4fc41bcea0ef190b5995000
SHA1 088750bee7939f37158899cbc077628ecbf37867
SHA256 44cb6b136cc056e151ccae8b7459c229d46cb0b7e09103c5b389b636ba54b484
SHA512 d60bed09d9530396763604de544acd2e8db8e09d1e1bddd084c6a001bd9ed6fb198eae0cc96b81a755fa8f3c91b20c4191af2ac324ab86650796d21cfcfa7b4c

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db-journal

MD5 29e784663cbd3cddea45635e85b0f357
SHA1 544c754b6c176bc6efa9f1b37dbe5a5a2710b159
SHA256 5614b22a7ddb138ca7c568fd34dec1c2ca705546484f1d663d3cef27a0e51f0c
SHA512 090d749d3aa73925439be6489fc1d770ecccf9a24e348b82c81f837e41e8ba654d34358c86f2656679840a7c84f8ab5ffc87d9bf8b817c56d2239c757801f02e

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db-journal

MD5 4315fd7267ede41851b9579452c5ad8d
SHA1 fff36edbb9810da0a1e6d7e9987062e1ea0531e2
SHA256 f9e87d1de3b60750e8a623ed074cfc913d6859daed5b7e5101501a41c1ad68dd
SHA512 8b551ebfb9599b5d5ba5893757f701dfd9889b38f05bc7203df8f3f3d8fc5793db3cc6cc4947bfbe29336f0fba3bace2e553b93c9df6e7e7da6e625f5aa44151

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db-journal

MD5 bd608b4cc1e4b99ca4a2e12aa57a8b1e
SHA1 5012faeab0f25f0dd600d096f17b9f879fdc850e
SHA256 8c3d482b8817ce9e3d362c7bf4fec0e84ef4bed38eed8e2c091875c4a36cf543
SHA512 9d3b352086f4db877d673a8cf68e30bc0961a915e745b3395a8fce56c3fa665a20c637240ee0312e22862a680acc2b12bc1fc83a0514ea5e5754f70c1ed12b6c

/data/user/0/ir.ziba.pishgaza/databases/cheshdb-journal

MD5 82698da7696579e63ada2c87f64f8517
SHA1 35b009c795dc12c0c066e28a3420a3a1df00fe4a
SHA256 11da2a310d5fe577923a55fbb20410853a447392dac5ba1eac2d474d2f2f92e4
SHA512 868b076c0093cf71a0831cb725f0cb29b7899f1f7d24995a257b093d748fcf101df108003efb19e16504d21ebb2cb7258ed0015e7a9d3a07a4027767efe3b016

/data/user/0/ir.ziba.pishgaza/databases/cheshdb

MD5 941bc2bbd42de3d9f59cca162cfde69f
SHA1 e3219cc0529f4e732d16c8ee11d5d90488f1e989
SHA256 2e7c629f147f24fa69eab973a99d17e362f77b3193402150f98487705d41fb5b
SHA512 ec2dad9ef58b4ad2111ad152dc0c626c074856faba13d22687a4effda8cfecc87ffd424e5938b1997b9d9ba5c38cfca768b996d21b297ea9d3cf87d0c969fd38

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db-journal

MD5 0e1eda66759c94b2896d38084e1e3c38
SHA1 8ea04e84ae61f2ba3a48ebfacc63e7e7f2604cfe
SHA256 96036289ad4789f0f19faac2aa1ae3e93ae2fb41d25f007278976c6d19723586
SHA512 a10316c701e172b15caa4bc4377123a5897319a81e12fd4bb430b7ca470b2656c7cf49a17191a0bf2f9c6e295f0f5628129b60c04c6991ac237eb5a868043e79

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db

MD5 b0a1385fc534cfb0a6bef2acfb0cf1fc
SHA1 798ebd3440c563f61b030494776e01dea3cd1a61
SHA256 414041a70abcbec86f2c68f4c60d718dc9e18285d14166be5a5b8cfbe2cd3fd7
SHA512 9dbd246b3831fd02a801e5ffab3363c2f1ad35477d737b05236a661a42a80d16a21799a0feb92c863f6f1363353b9fbd00fe61b48fc41fd940fe1ecc870d2f21

/data/user/0/ir.ziba.pishgaza/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/9edb1cc3-57dd-420a-b205-535671a503fe.jobs

MD5 3ccab312ee4a444f33511d52d3db6513
SHA1 ef3ab9dd3349c0f4bc5f4706a4e76924f9064c5a
SHA256 2ee926678b45b8ca6a24ab469bba6b0f545ca2904c34a1252a5c369eeb2a2250
SHA512 56f632826924b4d2ddb2754f6f02320c4e91396c2c8ba58ebec0b965ed0e2051444f454ee85230aa679e8bc652c17ae9fea19cb16f289d31da8d028cb4245c0e

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db

MD5 269e355136adcb4dd9c7af5d9cd87d54
SHA1 671c7d0f86ab718114b9d81d09f4327bafec4aab
SHA256 669ef8b8593b9c1503cfb61cc85ff89a693020f1005c1ff4621b2e0dfa74a7ca
SHA512 0ead794df81f42866ee4d42f65e0a6e908522f7fcb0978a6a704190832c74a7434ad32e0b09ce7382095f628240abe99010cf89fbd5dbc8d4a237bf014adfb10

/data/user/0/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 f6140177a2ea942ae25be2a08395526c
SHA1 ea582d6e4a6f2fd6bcc458f5a811fd0822b2525a
SHA256 fe41e6e20a735d130573634714723341a4c4941bda753c5c111aab9eb8496ebc
SHA512 4b05bbf35c9720b1e267bb9e033304a56bf1597c92b32039290957729d49fc3d9a92887a21e91c2e8823ec5912b0b393b6ba3a6c318d04a5fb8a7a853625920d

/data/user/0/ir.ziba.pishgaza/databases/__pushe_base_lib_db

MD5 f41f531c07d4141546a531ff9caffdcd
SHA1 9dcac5aed06972d0ff6bd4cc1f1cdff85b36d3f5
SHA256 bb8dee5b5c3779f175abbd142722eb0022b98d374783aa80145b34614a4de646
SHA512 e0c8d1a820cb4c098e45776e8b50ea8c83944ef2e3f005cb0acbfc07688974d370f78100ae022f62564fc4c12acfdc43b710c18ca1c30f4f575bc08b9b12d2d4

/data/user/0/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 e5e33e3153bbfb17a7f8628f205759d2
SHA1 25bd128ea03a33b74499b333fe963bf94aedb8db
SHA256 acd9cc1141a0df6b9ff3a7d11cbc6b0b326d05245d060428cd9a1a01a2fb026c
SHA512 5636ed35f3b0ff3cc28a532c69145168a3fbe05b640b6c18e4cbe076a2d848d2dff39b3272ea6ce326ec5c0d0e105fc38363b62c79b8fd424c2b4db9269f57f4

/data/user/0/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 5afcb048489f14a6b8549fe3c2c8a3d9
SHA1 f83c7179851f081830e660193caddd209c67d112
SHA256 b074a17c73a5e4b81d3f1de789632c0374e42e1b594f29e7f64fe36cf8c6e737
SHA512 4d9b4c2f3afe67a31246037e17bdd10058a6ab584a605ced3711bb0ba455d85a700e90e300339fcf2cd530fb5aee6f3540eaf9f17463bef971dceb66de51f2a6

/data/user/0/ir.ziba.pishgaza/files/info.db

MD5 bf690325ae14d5fb21e03d6d5ce6662c
SHA1 68b451c53297dc41a8d4223a5de4b99cf83a2336
SHA256 18644adf5aaa701a3d3cc11e9689fe53b035ae87df2b43bf8e1fa8b83543e615
SHA512 ddb11746fc514663ad993b6e03d50df9897b3b49c8780b989cfbff40257eaa836ba9e728bc2a2f6bd7f57604b04fb1cbb97c2edf540f9aac97af9246c0eec4b3

/data/user/0/ir.ziba.pishgaza/databases/google_app_measurement_local.db

MD5 1d672f9216834427e996853b67b6f497
SHA1 c6771626dde36b4700a095156a139b5d83a4a76b
SHA256 d5173977aec665c44445d3a0e65cdc38ef5f79a06581e776e69e3c61c1de64d9
SHA512 0c2b4b12de0251e4f0b055e6b55f0e74121c8677c9faff3b57fe5ee185c848e711380685154c78858ac706a94cb5d25e62f409920fe3ca3b90bb65d168793441

/data/user/0/ir.ziba.pishgaza/databases/evernote_jobs.db-journal

MD5 dafa9ef6a75cecbda785ccfefd375f4b
SHA1 16150feda5474a74adab8e89887b42c8d4972257
SHA256 540d84bbd1f1cf96c54285dbbf7d5944a3072fc12e75089abcb9e247b8fa0c82
SHA512 b7a057535a7a91863457e562ce0ac7c1d283147b6fc75b61309b16e4a4cc781b7c66add5614dbda55a87d5f9775cad1d2b4686ca44ef2813ec7a6cec4b327a02

/data/user/0/ir.ziba.pishgaza/databases/evernote_jobs.db-journal

MD5 3d0e78deca1ac25fb7d7c8a5318d7d63
SHA1 71ed24252f4ae6a76842b97e5c1a4a6fbc2e8096
SHA256 8cf26c9f09a3f475a9f077b0d304d08a98a6368d08ea5a96d7a3ba3863aa0efd
SHA512 f4cca7f6f9e48aeb841d5bb968c5265b061b719b28a2ecff1799ef7f9c4a8f1a52247bec269c5dc06f80de05596326f2f94de69581992f696c408f6be1141f9a

/data/user/0/ir.ziba.pishgaza/databases/cheshdb-journal

MD5 75582f31e88bb1765d19f44b113d25a7
SHA1 54c0169e6958b9b3b8d5d96da73ff8b7e2f65250
SHA256 06d592ddf63b7751694aaa944e8e87f306eb17f123662a0d9ac94767f8e6ca58
SHA512 95598388097bed64edd9b87ba7ccb9dc73d14d7aa575d86da349f3c2af8fb41354e8d1f680627c21b49260d3756c33d6b134178b13e0af50f3f669bef73006f8

/data/user/0/ir.ziba.pishgaza/databases/cheshdb

MD5 f3dc7056263b5b1c347f61362065aa61
SHA1 304b8c9de951c950936f48d566df5c970fc97824
SHA256 e422fce55425065ef3c122ba69d49916f3616e36162b23a1374aef0fe9241836
SHA512 44226ef1b1c5b5d94b2d1a0ea6a96fcb0ed161f0862e34e526852dbd6a90f0183481ff5b0778aabe27e7a9e2f1f756da4a9b3d61450ec86c4e6719464cf3e5ee

/data/user/0/ir.ziba.pishgaza/cache/1582435991586.jar

MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

/data/user/0/ir.ziba.pishgaza/cache/1582435991586.jar

MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

/data/user/0/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 f3260e066190a7e15e4e9aaa5af081da
SHA1 4bae32c75ba9aec8045698a2721fd2f67208e31a
SHA256 1d05093a3af9f82cad83f8665687d8d87c7b42429bb30fa811293eb0a76bcea8
SHA512 7354b8c6d8e1540738cc451dbab4a547563d564a7b3fd138bbdaaf631797695c0d90ed455080fb6676af03d5e8098ddc3eb84d6b7561d581707307d83f6430f2

/data/user/0/ir.ziba.pishgaza/cache/~test.test

MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

/data/user/0/ir.ziba.pishgaza/databases/__pushe_base_lib_db-journal

MD5 be3c4bfc97ec4cb677cc1a303540e0dc
SHA1 dd16691d0f7f73a8ae7d2868441b1e223ef9a8db
SHA256 21d48d452b6852f86307015c0066faf2bc445feb3b650e5c12167cf1e07af5de
SHA512 0985d34114301a34e54931ad37219c7e13d3d649804054633db3023ef91a6949cc96d1fe3a90d7a6b3807b8d368d643cf7f7562eac3a7c0ba486777d8884f866