Malware Analysis Report

2024-12-06 02:38

Sample ID 240429-t4ld7aff4v
Target Clash royale.apk
SHA256 eeac062c8c9149a6739371238b857f18fb8a61c146443a972d1eb201d504216c
Tags
truthspy banker discovery evasion infostealer persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eeac062c8c9149a6739371238b857f18fb8a61c146443a972d1eb201d504216c

Threat Level: Known bad

The file Clash royale.apk was found to be: Known bad.

Malicious Activity Summary

truthspy banker discovery evasion infostealer persistence spyware trojan

Truthspy family

Truthspy

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests dangerous framework permissions

Acquires the wake lock

Declares broadcast receivers with permission to handle system events

Checks the presence of a debugger

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-29 16:36

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-29 16:36

Reported

2024-04-29 16:37

Platform

android-x86-arm-20240221-en

Max time kernel

28s

Max time network

34s

Command Line

com.ClashRoyale

Signatures

Truthspy

trojan infostealer spyware truthspy

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Checks the presence of a debugger

evasion

Processes

com.ClashRoyale

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 protocol-a748.thetruthspy.com udp
MD 176.123.5.22:80 protocol-a748.thetruthspy.com tcp
MD 176.123.5.22:80 protocol-a748.thetruthspy.com tcp

Files

/data/data/com.ClashRoyale/databases/core.db

MD5 c7b5801f4970b944a556dda8d75097f6
SHA1 ab62d5c3d60940ac286f019fecd21f822af864f2
SHA256 cc9e08d0728cef73f1f391fc1486845d285b6a14d778ef14c0ac2401e6b3fde0
SHA512 6ac93f5393ce957d0be7de34145f433285f6ee37f6037f174f4532502da62218dddfc0e32883bf94830b4c79f63aa16cf10b3fa7b6eb4187b72f7703b6e0f0c1

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAB02E1-0001-108E-E419F8ECEA81BeginSession.cls_temp

MD5 7d79839fb4e81810eba72f079d124ebb
SHA1 f00217b21e65e33156824275abeab5fda6af8652
SHA256 2cb884208ff92c05512baaa197128e6076ddac65cee6774572649a5f0081e7db
SHA512 cf8ebc3f5cea926f4f65f8bb28f959777dd3815fb15e55b5f550b63413b4534a93a6582ba8c80d2a0ee8538a1fc49a256f728858cf2ef4910f6786c260dd4f32

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAB02E1-0001-108E-E419F8ECEA81BeginSession.json

MD5 561130b5c844e09223596113a846ea9c
SHA1 99d0d153375ca32040a6186ad31306bf6f6ca829
SHA256 72e30540894853bf2258037b62cb0699eb6c4c4f9e03557ac2ce8e4ea096f20f
SHA512 f601bdb55577f876c699747cc97d7c65648eb2fc534820ac0abf75c32d88e81a2c7aab95ef241b76c455390cbb59e5c1c1881ea67b0080cf1808a6b4f1cb2dfe

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 b062ab1d704cdeb691d6e6acb3cedbb9
SHA1 abfd7fbc6b25d4cc8057d6293e9d30a8264d96ee
SHA256 8f952285dd9edb6e9cd6b3bf74f028440b8841a720b8181cb61210e90a74e9a4
SHA512 57c35c43636f90d1043453bad97f9a8cd90145bfb52c933f6119e308e4442084466c1c161c1a867d984f06852bd4a12a555d0e228bd12c42994cb3328fbf0f44

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_d516efb2-3d12-4121-a06a-c0aa0db91081_1714408620678.tap

MD5 73d870bccde6ca4166aff620bd46e5fa
SHA1 52c7f6eec79e74c9aa2b8ecd4dc22c9fa4d5824c
SHA256 aa92238eeeda8d5d8917d1abb49ab1723f3cd8db8bd289d320d1eb9e3a3226e8
SHA512 2b158d9c3e1f0ee4f8706b9dbf490c1c6c8cf18cf2262f1e0530483e1f0f38ef6cc231bdc54013fc192f736aec0cf534034d33df3c4494845ce1642764b1c3b9

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAB02E1-0001-108E-E419F8ECEA81SessionApp.cls_temp

MD5 d31d5210a7ad306027b0e2d935acca59
SHA1 747a01bb8ac6e4782de89c4341bfeb0675291b69
SHA256 dd8793c30c2cae30c0d88a7cb4d3d573e8595cbca34a8f03fb3e57d82dc1635b
SHA512 3e1cc5f7b2960aa304a1c54adafadc40e98105354a936e519851e4927ee489a141aa02ed26820c90b006a2c23c1103df950da5d9d44b03d32d73cbe213b949bb

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 50b7f8fc4348b9e7feb071233107dd10
SHA1 aa67bb48c4da0d7191efe90cdd9d3727eca03e55
SHA256 be6a1d0932124d82407a68cb3a5d00d53f69bb22c1533f60f16db7f6b699e095
SHA512 d838f1b16c7b85a10f985ec88a1c530c84f5143c856f944342f273433f259b180a7e903c56044de172269bb81a474678983db674eddd93ff396bb2b05fc02efd

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAB02E1-0001-108E-E419F8ECEA81SessionApp.json

MD5 ddd2a25c8759543cf5da792e441245b2
SHA1 421d7d9c85dd3a96802b9b2ee6cef0fd5c383f3a
SHA256 5bde13cc8c6d806e6f02bdd28e3e4fe32bd86a6674d3b9de79ab0760ed2b2598
SHA512 581f73fba732e00a50dab912aa2a5d0612eecb617211c408cd1cec743b24f093792dbd63aa183f1cf911f42d5923976e5cc7e71cbfc8e790123f54c73dde39d5

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAB02E1-0001-108E-E419F8ECEA81SessionOS.cls_temp

MD5 9b3d4522944ce6396563812bfdb92fa9
SHA1 6d2a6133c8f01938a48ccc77ef86ad8ca335c020
SHA256 d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9
SHA512 091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAB02E1-0001-108E-E419F8ECEA81SessionOS.json

MD5 93023624eb8dff5c20050da136aaae0a
SHA1 acfd1ffed752c28fb135ba83c0c6345ddf2f6995
SHA256 968bcd7c4f1abed89a09cc0e6dadd238a81e8655e64196b39a86be49ceecd39c
SHA512 bb25dfa144d3f0e17203936c503c5fedec5f9ca710e177f99e273010ba4a682199d4bda5684151d65f3cb1549f4611b3a645ce39646d3db9a1b2c17d6b160579

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db-journal

MD5 154afc0726c43b8a9dd0b0a9a4962261
SHA1 92ee1f78ba4d81d0be619a8a9f2556f616032aa6
SHA256 192d57df77920ab82eb92362fa5bd1f7fa3f2b9a9741802d2de1d8b225319848
SHA512 3960c816e06c898e95ed67774d3c8bd5f4cc835793fd4453facf5d9ad171bef3757fa1f7221076c7568186c888b14731619d0d8798f9317d6e599ec4c7d7bd2a

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 c2eb46510760465e83c3bd0995050874
SHA1 ae2778fe75189cdcac456a9904cea5804e94dc6c
SHA256 e89cc943f63e7dfc8e08dad6305410d10ed2a81cb8ab33d5dad36620573535d3
SHA512 7ac4a4763a5f24a4f089646e0dfa1a15e8390f5a1050e7b3e18c7a8d0118d40db47feea9d65bd0bd41dd2e59186fdaea9b2e9f81be043393d55aa64437c7f925

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db-wal

MD5 4cc7a466fee417e4f0501e7ec7c81c2a
SHA1 ca773a2c223543886583e791dbad522ebec2b3d9
SHA256 f245b7ece929e055a07aca098867ecf358b799cc2dfd45abc2fab18d5282c0ce
SHA512 a060bbbf811b0d5c81d08389a78712029571b9eb0ecba08a726e0f57c5f0321da9dd7c3089baf49114c2ba0ed805f93ce8b073cca45c03692bc2d0e87b2fb725

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAB02E1-0001-108E-E419F8ECEA81SessionDevice.cls_temp

MD5 630aaf4621d940e95530e8a8b0d39283
SHA1 d06c5d18de58b6abb5890a83b6fb3c3aa4a2139e
SHA256 2f752007f6c33aaba282800edfe3d52da2ea954e3eceddf08efb0bfdc989cb93
SHA512 98c301f0188ced6036a863ba790e03ba22f88ec55a884fdf808711147228e97ee0571abad094ad68d758b2482db6ee3f2950d43d56c875bfeda7f0a58cd1a86a

/data/data/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAB02E1-0001-108E-E419F8ECEA81SessionDevice.json

MD5 8c1412ceb8c8543650bed0f85dcf4c99
SHA1 e2ea16a5e4f49d8f4fc661f127bc8ce6f5d2e485
SHA256 b33eddddb3bd84b5d5975b074dd2fccb335c715b8506862cfaf451ec1f8398bc
SHA512 8d067a69ce521a0e004215bf6b746279e4c32e0bb8ba90de9e3e7e519e421997aafe1a3b8d636cdd4da578ee3c538cb1b84fa60c368c0dac9307d4064fd33687

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db-wal

MD5 8f6dc6d54cace4ab3ea3ef312b62e268
SHA1 f3249d1d5b3a7a82e3cce7fca4a19367c8a787a2
SHA256 5910e0f05efcb060502ce585e1c8d2105766ab8204c5b355c75c8695f546fed7
SHA512 bdf9680eb33c9fa4f1e946268287efc858a999172e4bdba9284a76b040ce4b54ce0b4cf4d15ae9d21d0b8d219f4b12d8ac7c15463a829b0592ba34cffe304ac9

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 41172d46ff8888be4cfc7da9dc7d75bd
SHA1 83758a810bc86c52f60c838acebb9bd0c541be19
SHA256 7c27b82cb8af372763b0699274222450a8311bcf96cd8e876b717d4ead2a4c9c
SHA512 6d2556fbd104bc18366276346a8fa3d36992b5a7e98b2dc43683912ab4322dfda0ddf76c43b20710f8b5a8018655e731e5a52b2e573fd62f0ba0767b868c3972

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db-wal

MD5 11cd9b4000804c9bf7d3fdffd9da67a4
SHA1 594e5f39d549f6ce57b1690f78b763a59bb36339
SHA256 addb67671f7ee4ebaaa0c891db70726c91bb13f762edaea09b833be1ee436329
SHA512 730caab1be338cb0940e11ff9c84ee29b6868bae7317809b4f047ac4d44decc4a59f7f09da42faeea7637660a6de6e2fd7343374faa396b3ca41e8f6c11f00ea

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 9154ad2f692d782aa208caee9da3751d
SHA1 f53dd96bbc6a44adc213b697cd063c01c9c9fcb3
SHA256 ff60ca9cb4ca1f6148b157e06682cace02b0667ec7f5c5d39c7ece99afc45e65
SHA512 a638498c9e12ded8471aab919e1ba1da4d4c091a20c55dbcf2618c1a54b964b7730eb8ac659f7f7c61804dff963f711f80a05ab59d7dff62a805402683fef427

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db-wal

MD5 6c990bc074934c45e50695a338ddeb36
SHA1 5bb60ec896b7fb76c7550deefc0a643b11f650d7
SHA256 ee3005e354249e047e9ae3a94a68b111f65d20ae39226404eb057de0bae70a99
SHA512 8dadc250af26cf2ec3d66d1540d14676afa5a1ef72aaaeca1851a3618554c96a4a1b6011d2b73e4fc3f3b75d581a4260ec93b44dfebef596173c44dc584ceeb1

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db-wal

MD5 182b001d86d90caf05c9785fb7229142
SHA1 bf0f8b3ca75298f9513e48d8eb7fa980749a9b84
SHA256 132338536f35c2a9dbc53fd77149f7c17c46cb01b1b737614aa7a845d6ef26cb
SHA512 bb27ad915e9b85d2a707357e1fd706340da432e4378c4f1e53f9c6382140093c06bd8095373761059c006468d19a09c6779e1744f5be9248da8c52bd68c47e24

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 26a76c2f833f767e77c888472638f2db
SHA1 635bed1ab4ba6afd35bfa3e47d4e29a8aa8b3845
SHA256 87cccf153b8f35cfac6f787c42102a957b1928578463453f20b262e1a2f2ee76
SHA512 5dc3ca2332378f9a232c41247e2d6480ad5c77888dcfbe2c56eb5bf2612ecbb69fb8f1401c687f44f5f411f0f0a29d98ef05c30ef47350409b174e6b8f17b4ce

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db-wal

MD5 8e357d975fb556d2fe89b4b6eae0a4ac
SHA1 b9ea1c33babb93e8987024a5a32c832060182f7d
SHA256 df4ff77cd0eb2d8832a7f920d4d8ad282593e75f6b860b5b31df80780f7fd071
SHA512 a33f6c7758f4eebcd67be007aeb1bb0d6d3a9f1995f506828736087ef227d07d2ce3166f22a78bbc91b04da895627fb1f0902e78c3c1cddc9229be93334960f7

/data/data/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 fe3b558c686931152484e7525843b468
SHA1 452c27e2732e5a11dcf0ea6ac31fa962bf25307a
SHA256 35052038399294c016c232890f221afaa288d95568821b74da31dffd20824cbd
SHA512 178161c0da96cc4adfefb8342cf0f3ecbcdb1af6056997fd5f832018ef51734feaee92ba2c4ed87ea871ec98bb172e8cb1ec81fb63e2f87c69b9b9a311ed2388

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-29 16:36

Reported

2024-04-29 16:37

Platform

android-x64-arm64-20240221-en

Max time kernel

29s

Max time network

40s

Command Line

com.ClashRoyale

Signatures

Truthspy

trojan infostealer spyware truthspy

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Checks the presence of a debugger

evasion

Processes

com.ClashRoyale

Network

Country Destination Domain Proto
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
N/A 224.0.0.251:5353 udp
GB 142.250.200.46:443 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 protocol-a748.thetruthspy.com udp
MD 176.123.5.22:80 protocol-a748.thetruthspy.com tcp

Files

/data/user/0/com.ClashRoyale/databases/core.db

MD5 c7b5801f4970b944a556dda8d75097f6
SHA1 ab62d5c3d60940ac286f019fecd21f822af864f2
SHA256 cc9e08d0728cef73f1f391fc1486845d285b6a14d778ef14c0ac2401e6b3fde0
SHA512 6ac93f5393ce957d0be7de34145f433285f6ee37f6037f174f4532502da62218dddfc0e32883bf94830b4c79f63aa16cf10b3fa7b6eb4187b72f7703b6e0f0c1

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAC034C-0001-116B-A9ECF78E6C6FBeginSession.cls_temp

MD5 c1e5d1cc0a2615ba58cfc2feba01f7e9
SHA1 83604eeb45ad7bf5f7a8398870aa507a94d5911c
SHA256 aea895daa62d965237a8ac023d873cb9ae64b61ff789bad4acd1fa4deac01bd5
SHA512 1ba57160cb83aa9e685d9e873f62b7c15a9b2f0695ab2fbbd2373b04fe688be890f165dbb028f2646c83e6a5bbd824875b8cbf61d74df4bbd243a4e5d5618b00

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAC034C-0001-116B-A9ECF78E6C6FBeginSession.json

MD5 9f4cd8bfafa54ad5c56dd993572dd4ad
SHA1 625bb7b3347eead6e2e4f08889a4192d8691a6b5
SHA256 deb8f1c0796f462b7ad76514bf2b612c986ddc22dab0ec8f6c70d1e67d7a2b46
SHA512 12808ea379de193bd767e94f645aaf27e60736faa0581a405bc47ad8eb4cbd625ed5e409c7bda75dd57086dda73b2026fe0fcded79edfa87942b2378ba7f1813

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db-journal

MD5 55c92d3aafac2b381599defaba13104d
SHA1 a1ed2e2059cc05fdd3160b21aa6a00d3767655a8
SHA256 9b735a15ce44623fad1d51da01f2bd05dcd81e228e70d5356f2a6865f9c778d4
SHA512 bf94dc2e0d3f0a1c1873c381dfc5cc76766d8ec3db966c2346605b7cc49a19a2b0989aaae355d2734fe5322bb29cace1e5abc456e415825d5d23d729ed301979

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 e2b6960b4291e810b77cfa713ad36d54
SHA1 bb00565cdffae29b0c4a03d5f44b6a42cbb9118b
SHA256 0e8a0f96ad0ddba59669ec7eb841907c97d4830e17bb3d82cfc1755772bbcfae
SHA512 6ee018b97bda3349e45a29957d0c3f2c2bf5f3c8eb39cb33e3ac713e5ebab4d330e6e4576fc417efaf367ba5032209dce6c5f6d3c1819b0c30546415bf572543

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db-journal

MD5 9c9d07ab1fc3d62ec4f149101a56ea95
SHA1 a66815ca671a4fa078faa312e6e086493a9ccf27
SHA256 f9430d1c5ff75b42933ccb30de1e0a88473121d3433c454f79a826fca6c76b8e
SHA512 2589bc4db95764ec37f8a721907385d8ac0d657da64db6eec617f0562f3527c3eaca41e0f8aa45d7188a8f218cf3230263c1ac0a190ccbbe150cf54bd941ef26

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 cba3ed7a2e0512e8eee94e28ca9843f6
SHA1 4c633415441e42a68400c7e247b06c3a1503f3b2
SHA256 c7ac6234e0d80e91a333a8673f335c1567db5abd68da6d8cd4bcd4ef3a067d0b
SHA512 16abcca203644ef739b37a6a289bd12220218832660a2827ec34a0f838942855e947269af71d595863349f88ed912d1c6832907a27d690c68657640bd0ea66d5

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db-journal

MD5 1c85128d35cc5bb923cca6fb0734c4d4
SHA1 c89022bc6147b4939a387a0c6b236b340ea5bc2d
SHA256 ec3793199d2f681392456581de15c23510a983acc07b09ffb7fb320a1ecdb385
SHA512 db1c23948e96b7c9219f9905dd5df7b05b6f6e469784bd508ff23bf790d8246101a542ef399411a12b44135bb218e7f4cde25a0a9b13984f8e63f5d98007f9f9

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAC034C-0001-116B-A9ECF78E6C6FSessionApp.cls_temp

MD5 e2f6bbe6e1a59c02a2244ff8c27b8ffa
SHA1 6b23c0cf4dbd843e9a9e424d7435557005bacd1e
SHA256 3eb8cfd8d1d68125a5eca74a46951f73728ca792f570617c6949c94ee3ed63d6
SHA512 3630d206742df58d1468238356942b9de7f9861cd338a96e637dbb0a897dcdb1602132f1f304349679f43f32ce619d8a458f26b0864551baa3c8086e26d0e527

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAC034C-0001-116B-A9ECF78E6C6FSessionApp.json

MD5 aeaef4acf48d49ae77be3f5e8b90bbea
SHA1 3fcb1a5d39f425983d627c46316468454ee0688e
SHA256 b40a5cdbc81bec0cca278142c7d518ecc23d2f88c974dc2cb470c5953c4b4c6b
SHA512 92f4c16a46b142e891f9fe4f60d27fa3c95828a24bf52689c704ec1f7e83e3512d633e5c5548815861af611a40554c6b9baabce193f6f985a7cf08281ff8d50d

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_96231bd8-3343-48f3-8aa2-c0498b77cbba_1714408621914.tap

MD5 b1d6c22f41cb1129f189cdba1a2fbf4b
SHA1 383ea3f9cd9aa1bfbb63fe16a7368f028375c507
SHA256 847292f26fa9c59b078909c4d6ffc775337e1036749db4fa666e3e4620d4b200
SHA512 40713e4021ddbeb0acd4c8fc47ea970ac2534a92e4a6d85d998f560b1c080ac30058219e66f2baf2aa3f925ec2df6fd983e547f7011b08195b3555f8b88ec3ae

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAC034C-0001-116B-A9ECF78E6C6FSessionOS.cls_temp

MD5 b3d9541cc92a9153d14e5160f8d8c008
SHA1 2e1ac80eb381dd82a03795b682f92020348c0113
SHA256 1ead5b213c87f182ffce484c34f7d9f140ad3425c0f303f460492efe8a26c56d
SHA512 78074409135a210ba4e1407ad9b3f784f5683e83aac4ce3482d4e8135425cf2b30db1ff5dd0041901c490a551a477237c6d255671c7b1fad74090980dcf3334f

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 f9f9519f8d78357f33989795bc4c4f66
SHA1 5cd11090f16659374edb14f4ade73b2e34dc9a47
SHA256 a525c5024bcfaf238587590bdea90c84ac5be9dfac50f2c5d3667f8be07e9c78
SHA512 12541beeb89a8b633533da5836bed99c5db8dfa4dfaddefd5b40dd02664f7729f1d47809dcb02dd1ce3251d96ef2c7ed87f41f32c30f2bb5a6acb1ede549a8de

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAC034C-0001-116B-A9ECF78E6C6FSessionOS.json

MD5 fc1dcee4e422d77e7fab7c08c8a41344
SHA1 d5340127e9d5f735b9d33b9dc61c772fb0e2dc15
SHA256 b843f05ed78cd137c272ba7f0ce8ede3aa853098a856863e51d5c223b58f21c7
SHA512 3ec07617e3e1008572f6f2528de9d4b827050cc5a7cf19a1604c961f9ec370ede6f5fd83bfcc252c0ee286fe244ee6734046ef1aa638dcfc689cd4407a6a8f61

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db-journal

MD5 34cea9b8e2d0602f994beaa2f11b3f5d
SHA1 9d395c81da5a5bf8e1ca5609c3f6ad1e75df4e74
SHA256 e0e3d5b3b5fd96cbe29f7942b29a8ee56296592ba272dc2b50dca6609057b44d
SHA512 14c1b27a1b37c9caac0724b2b9efd1eeb900afb28677e93405e5848884503c871b2c08535637a0ce2f1beae60b28be12b829716f5c64a07894c84447bcc3347c

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db-journal

MD5 7b3bd3c28fbbb8310627ec84141bd60d
SHA1 73cb388efe2878c81f6370c953bf6a266fce26e5
SHA256 a5506a696d3c1cb9834ca0da0949d15ff6ccf3d28c03715e9d676e1cb77576a3
SHA512 070ed87143887756a0f3c52f5748f494a0af1fe2845e38dd9275c3fe5cd5cffbdf95c781ac6a38d1f53651c0d4f76bdaaf6abbe237e66f473b47dc15a7cfad54

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAC034C-0001-116B-A9ECF78E6C6FSessionDevice.cls_temp

MD5 fd6372364a5c5c9cf8945ac3ea7a5d94
SHA1 3c798cab71f6ae7a81e71e58712368231230588a
SHA256 7400bf714ca32b64dd89440c9d5ace4e0115ddce44d169839e465df0e1638641
SHA512 a18b18d061dfd979bce1e0b769009668c322300e7174f51d2532e86dc6018769194507a106dd30b97317f8c1a7539d13a7baeab2900c1e00da7c74e899dab276

/data/user/0/com.ClashRoyale/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/662FCCAC034C-0001-116B-A9ECF78E6C6FSessionDevice.json

MD5 eeeb942571fa704cf8ae49731fbe9789
SHA1 b5989c4cb932ffc779ee25bb3f7bfb79cf720427
SHA256 78809f7ae96de01e3922b6d3a134c3f7e9a0cbdacef313f70e8d9345bf5fbd71
SHA512 71e55c16f9f8fc936f8607448916bbfa1ba233b7120b8676fe11552916ac4dd3e3a7b0f9c31e14048933c8bb9c9d6d630ab7d28389f31749640cc965b2636565

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db-journal

MD5 48dc9c40387c7fde3443d5af5633df25
SHA1 9aa89283fa347e37a8d7eb22d4bf2aa639731f27
SHA256 5a4c6fcdede7bea91ec3cbdb01b7e41a96c0ed71ea28dcbacf87396e7cd4f5c8
SHA512 35030953353416314884773157c3773e238f39fcc923f4b46a0b81d3bf7142d4f6f5d74cdec92eec315b62ea8d70485cb192c3985244fc6024bf490ccdec0283

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 d58a21dd780cee548cbdef81d20d793b
SHA1 fb37e340ad370858604de5cafb0d7885aa9d691f
SHA256 9ddd6448554e05f109bcab74eb63c20ebd9612a1b88f701563419c914cee2298
SHA512 8fcdbca20211f084c65214eea093bd8e5ffa24577193c030468f27064df1b035312fb79b36e344b3592ff845ab3f343b080e5fbec27e46f553fc368ba4091baa

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 e4a484aa3dd58b00e2b10ea489a732c9
SHA1 8109c7854c82e635668dce2e6e1e03f6217ddc8a
SHA256 447398f897afad0dd2398eb81daa008371036668fe7c87470400e980712ac798
SHA512 0d177df869a5ed3dccfbde766464d635900fa8262751453fa53dc96db05bbe6772bdd215f4eedfec38fb0551965ff1d40fe03be556059b61efc63c79f6c55a33

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 a1f281c1f565bc7a5d38999dca7fe303
SHA1 b20120de7e5beaddeb8a8f0f3033eda44baf972e
SHA256 2b20b7b0c554b7b3034fe8a36a0c9e4e7a0449a236c81202160ceac31e94933b
SHA512 34645923e7225f8f89c7d793bbe7eebdc6decadbc9489a32fda5af422af6f1d9d4b05ac0771c5fc4b157383a8d7a754ee5da6ae1bf0a6959f277e82ee46948fc

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 35415c30e2da053ad60d6fc059d1c428
SHA1 48d513568f45ce477fb5150f22cf665c3cbfbb04
SHA256 7217855fe02d58ac7285c8253b1b487c36c32dcf606e00908ffa96a4edab982b
SHA512 c729ae5f4e68dcd00384e79c70b152ee343af5031ed404caef6ecd5081eb46eeee77057bf1b6747460d735605759a3cd9508aef9adc3b4206e3aa3f8f9840328

/data/user/0/com.ClashRoyale/databases/google_app_measurement_local.db

MD5 169146b1416b4d79f642a689b1c432a7
SHA1 8d42a233c1be6486780e314270b9ac22c87f557e
SHA256 5a6a66f15b99c60f0944792b031b68cb0d394c4784bab1ff16c144c948330e09
SHA512 a9f7cf19b9cce2606cf517f61de54221103cb4aede50758ab6dc557fef7fc4e7f505da702e973e98a3e8b7a9b2bc8f80b3c049b8702b4324bcb8bcc237eab530