Malware Analysis Report

2025-08-10 23:55

Sample ID 240517-tl7vgafe81
Target Truecaller+14.5.6+Amoled_sign.apk
SHA256 f5eccd66ff4e8e80759a917e7f44f2713e4dfb71a49154f4bf9ad5ae032e1b05
Tags
collection discovery evasion execution impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

f5eccd66ff4e8e80759a917e7f44f2713e4dfb71a49154f4bf9ad5ae032e1b05

Threat Level: Likely malicious

The file Truecaller+14.5.6+Amoled_sign.apk was found to be: Likely malicious.

Malicious Activity Summary

collection discovery evasion execution impact persistence

Checks if the Android device is rooted.

Loads dropped Dex/Jar

Queries the mobile country code (MCC)

Reads the content of the call log.

Queries information about running processes on the device

Checks Android system properties for emulator presence.

Queries account information for other applications stored on the device

Queries the unique device ID (IMEI, MEID, IMSI)

Checks if the internet connection is available

Requests dangerous framework permissions

Acquires the wake lock

Declares services with permission to bind to the system

Reads information about phone network operator.

Schedules tasks to execute at a specified time

Checks the presence of a debugger

Listens for changes in the sensor environment (might be used to detect emulation)

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-17 16:10

Signatures

Declares services with permission to bind to the system

Description Indicator Process Target
Required by remote views services to bind with the system. Allows apps to share and display views across different processes. android.permission.BIND_REMOTEVIEWS N/A N/A
Required by call screening services to bind with the system. Allows apps to filter and manage incoming phone calls. android.permission.BIND_SCREENING_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions. android.permission.BIND_CHOOSER_TARGET_SERVICE N/A N/A
Required by in-call services to bind with the system. Allows apps to handle aspects of phone calls while they are in progress. android.permission.BIND_INCALL_SERVICE N/A N/A
Required by in-call services to bind with the system. Allows apps to handle aspects of phone calls while they are in progress. android.permission.BIND_INCALL_SERVICE N/A N/A
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications. android.permission.BIND_TELECOM_CONNECTION_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read audio files from external storage. android.permission.READ_MEDIA_AUDIO N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Required to be able to connect to paired Bluetooth devices. android.permission.BLUETOOTH_CONNECT N/A N/A
Required to be able to discover and pair nearby Bluetooth devices. android.permission.BLUETOOTH_SCAN N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 16:09

Reported

2024-05-17 16:16

Platform

android-33-x64-arm64-20240514-en

Max time kernel

302s

Max time network

353s

Command Line

com.truecaller

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A
N/A /data/local/su N/A N/A
N/A /data/local/bin/su N/A N/A
N/A /data/local/xbin/su N/A N/A
N/A /sbin/su N/A N/A
N/A /system/bin/su N/A N/A

Checks Android system properties for emulator presence.

evasion
Description Indicator Process Target
Accessed system property key: ro.hardware N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /system_ext/framework/androidx.window.extensions.jar N/A N/A
N/A /system_ext/framework/androidx.window.extensions.jar N/A N/A
N/A /system_ext/framework/androidx.window.sidecar.jar N/A N/A
N/A /system_ext/framework/androidx.window.sidecar.jar N/A N/A
N/A /data/user/0/com.truecaller/[email protected] N/A N/A
N/A /data/user/0/com.truecaller/[email protected] N/A N/A

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccountsAsUser N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads the content of the call log.

collection
Description Indicator Process Target
URI accessed for read content://call_log/calls N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks the presence of a debugger

evasion

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.truecaller

Network

Country Destination Domain Proto
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.204.67:443 tcp
US 1.1.1.1:53 digitalassetlinks.googleapis.com udp
US 1.1.1.1:53 firebase-settings.crashlytics.com udp
GB 216.58.212.195:443 firebase-settings.crashlytics.com tcp
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 tcp
US 1.1.1.1:53 account-noneu.truecaller.com udp
US 35.190.118.8:443 account-noneu.truecaller.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 216.58.204.67:443 tcp
US 172.64.41.3:443 udp
GB 216.58.204.67:443 udp
US 1.1.1.1:53 firebaseremoteconfig.googleapis.com udp
GB 216.58.201.106:443 firebaseremoteconfig.googleapis.com tcp
US 1.1.1.1:53 dlsdk.appsflyer.com udp
GB 99.86.114.57:443 dlsdk.appsflyer.com tcp
US 1.1.1.1:53 inapps.appsflyer.com udp
GB 18.244.155.59:443 inapps.appsflyer.com tcp
US 1.1.1.1:53 conversions.appsflyer.com udp
GB 216.137.44.128:443 conversions.appsflyer.com tcp
US 1.1.1.1:53 account-onboarding-noneu.truecaller.com udp
US 35.190.118.8:443 account-onboarding-noneu.truecaller.com tcp
US 1.1.1.1:53 launches.appsflyer.com udp
GB 216.137.44.128:443 launches.appsflyer.com tcp
US 1.1.1.1:53 firebaselogging-pa.googleapis.com udp
GB 216.58.201.106:443 firebaselogging-pa.googleapis.com tcp
US 1.1.1.1:53 digitalassetlinks.googleapis.com udp
GB 172.217.169.40:443 tcp
GB 142.250.200.38:80 tcp
GB 172.217.169.2:443 tcp
GB 172.217.169.2:443 tcp
GB 172.217.169.78:443 tcp
US 216.239.34.36:443 tcp
GB 142.250.200.10:443 digitalassetlinks.googleapis.com tcp
GB 216.58.204.67:443 tcp

Files

/system_ext/framework/androidx.window.extensions.jar

MD5 3056e1bdb7d4e19789d0319eff484bd0
SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658

/system_ext/framework/androidx.window.sidecar.jar

MD5 29469324e59dfcc052f24b5af4e7b2c4
SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2

/data/data/com.truecaller/files/ls.pb

MD5 9df22f196a33acd0b372fe502de51211
SHA1 0d612c12d2ac33625bf3e0351b6f5e4f73829fa8
SHA256 929260ad9b9ea9fe0f3553dd964f4ff3deb5792efd031a2b90f573fe91f012bb
SHA512 5fda97a131fa4746fa835caefeb6f6d64f2b12ff5a4e42e840639af3dd747cf3627fec8039733e5a77d9b99aba473dae4b08134bb4e39006dcd06cec90c76371

/data/data/com.truecaller/files/PersistedInstallation1332592552133199989tmp

MD5 8a58bed585abc8fbdb93baf5af65b416
SHA1 0e0b0c2cc7ec97c2a59fb5c0bc75ad000ed6c576
SHA256 e68756a9388bbc11166a429a72eb2c53ebb89475b129a6151b7df4f5aff4a455
SHA512 46c9764c1faf91fa4d5bfa3545a6f70802a47acac970a3eda260253c3f05799ba8702c950e96c16abfb62dd88f9d01b8395ed6478af1f17207ebd844b96203be

/data/data/com.truecaller/databases/com.google.android.datatransport.events-journal

MD5 83796be87a90a62be602fa040e591c0f
SHA1 a997112bbcbbc272a39fa22be1c0508aa1fcdfd0
SHA256 c455519674ec36483ea9204ece9ba33e43f4a010c981721da89f580ae39c7296
SHA512 f87b930824b7cc401f21b99c2f8a7bf403eb5a8b7c057d315fbbc169bf184e1e6d0e852b973d18814633af032ee7efc35f325ba7d484e04324aba7db9af0f49c

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/open-sessions/6647819401450001117AB627619D66E3/report

MD5 9991736a7f1693f2ae64263802ba49db
SHA1 111e39ab9a20ed6e8455bd416a32318a5a45592b
SHA256 97e2846db3e535f07dba78da5f7ed7f8f76d2b81837173ce8eca664cfb2f0c47
SHA512 118bc22ba004aa28db7d072eabcba847070a49c9326c2a1df676550e2ec25ccb2d978329a04b491a5cf8c63ef137dd152b06d02bc89fddd7b8c05e365b4062c7

/data/data/com.truecaller/databases/com.google.android.datatransport.events

MD5 9eb8d6200ecb3d7a9b7f20a06a778063
SHA1 59c9572267b991baca995b683075317b76a450f8
SHA256 babfaeaf3b209750294ea0d3a10c1ea96dffa04a3043222451cc9ded041a285f
SHA512 bd5f5e7c8eec463ba6e643596b77377515ef4a61451a87f440910f1ecf66eedf661d4692cc6d5524682a9217cd31999368f48e471469533efc0947bb1d18ab1e

/data/data/com.truecaller/databases/com.google.android.datatransport.events-journal

MD5 aeb3519d7ece3adff2ce539c41843271
SHA1 4df7a3cf26e2747a1dbbd5fa1f88b88d1c87ff4a
SHA256 9dcc564e8255f052a33382e4400ca7ca9eca7c7c6326b86b54c194bf3006783a
SHA512 018f40a48b179857936f7dd8a4940e00479a761d70d58ec8dbe6030e5d3c395daf2c62e394f5fca4862cd3777d373417ea58a050391e730a88e4c70873c2b0eb

/data/data/com.truecaller/databases/com.google.android.datatransport.events-journal

MD5 fefc7ba75dc72784c6b9053d6ba8fc88
SHA1 10a56a6ddbce7c8b0fd078691aeec2aadd6fbfb4
SHA256 2881dcb7eacc7fafbda4b341eb33ee26acef2aa63279535ee2f6ad73f2a8b3f0
SHA512 79a104b5893c8563bad09e18ce0cc91497ed2e54a9f5117502f4c1ccbd163d375a5a0e94bc2b5920b45dbc695ef31d2bdce413ce3091ad5c670b0c34ca980d33

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/com.crashlytics.settings.json

MD5 f530f71e47bad00d65f3985022b6bfb6
SHA1 203dba5a1a519cd8c58738c5ad885898bcb01f2a
SHA256 05428fe37967f0a31cd1bc9d1f3414c8f093318fb252ac9f52845645a2321b26
SHA512 4d2473dfcc7a68ca868039db87dedeb449becccaf60248c92e45bb66f9ceae70edafb3c684e0d367cf3e53be0504cf40733f4415ca0e4734e90371c3d36dd314

/data/data/com.truecaller/no_backup/androidx.work.workdb-journal

MD5 0575a7a575d8be2e9555b5feef029d66
SHA1 a7d4c6d10e0ffd1808ae9af82b4f96a92ea9e795
SHA256 c0f2ac72bec6ebfb0250a42003fe1b15a8f38216c0e0a3f6471608d1ca3b33e5
SHA512 7813ed7c9b5f20b8fe3b39ec6be2e4af0e0207aeb541c107b4a7c8a3ec2b89076df3a491b506f06c778be17ba8b202ae8322bfb8c8696d62eaf0952e1cd8f5a5

/data/data/com.truecaller/no_backup/androidx.work.workdb

MD5 2c4f1d02b006655b6585dfe1d0890a40
SHA1 9a548b58bc1f9b8e179629531c5e9ea36abc0a74
SHA256 42daef7f8238cb726cc94487f95486167dd46a9b84e01312aac54544a1139088
SHA512 6de0cc08f24071dbb240739f58d66de7f081c17921d343065916c3d4366296f7fce87aa7137c6681e650ceb0fc5a3753c1c81750c17d49eb993b0fb13efa6b0b

/data/data/com.truecaller/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.truecaller/no_backup/androidx.work.workdb-wal

MD5 de32700cea2168a5e1e07af39b17ac67
SHA1 b7c1116993a7f5ac4fe6bcbd2f6c83838328c5fa
SHA256 c5a03f6bbe8fe9c2302cb8dab1fb4fbc4ea5d1579dabd93d9b6428133b90b5f3
SHA512 cb2526e8d12400f6c1896588a24893cc6d354a0c561c3750ebd4c2e30abd773e8ccd7dedf5f310c990e037f689ada6c58f37eb9db7df7ca97b819db5fd99d19c

/data/data/com.truecaller/files/PersistedInstallation8739284890761447633tmp

MD5 a988fb8cd2d45ce53809f2d604c27985
SHA1 3c367c17666cbadf36f28837cd7c329d5a31cd17
SHA256 bf3322aabdd3b8faee1a680d91abc98215355985bb8ed57a0c9fb9faf7dd36d7
SHA512 4f8aeee998c4c5304f2774c5a92b6da3a83f2a60371575af441ef3ae62948c47490355596378bdd9fc974ca1d0f2b6dc029a070b789d1493e701a18caf90769f

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/open-sessions/6647819401450001117AB627619D66E3/internal-keys

MD5 6418ad5e8acda31fc8eb86b449c07f70
SHA1 b90524362ac76038544024cf15a32f209ed69412
SHA256 199885b54816d53e2c448e0450e901375d23b5edb71d58812bbc37c9fb3d4e2b
SHA512 67e14bcab343a8e7f5c760030af0343ee0f22009539d2658cc54d0da55e91b1d3fcab48b7b3a729dba4d0d5574ce12d26ab66409eca1702401c2b6c9d9a91d57

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/open-sessions/6647819401450001117AB627619D66E3/user-data

MD5 74ecaedb9bc2f72327b2715dbeb22d49
SHA1 56543632e1799735ea26607c4b9f0c26daadf870
SHA256 9feb6c12da3118b729a1f9193e69b189ce7862cb427c66a8b360c4d76133ab59
SHA512 bfe9f720b9aebb2ab43156221099ef40bd298e56c19b471acd86bc437d9aeb0366f15c5d58e94b7543e074e6b4ddf9f553170bc4e2642da1a767271a5554d3f3

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/open-sessions/6647819401450001117AB627619D66E3/keys

MD5 328e0e1fad82abfe205b19a36153dc2f
SHA1 e228898ef0eb8a2740d86d07920633d4d6b2fa19
SHA256 114a6e8f5c43bea09a4a73b24b44b030440a6f3be212bbe943becdb363f15e29
SHA512 6b38ad8681bead6a5a58db08ffdf916e0eb6cb51c3f94fb2451a272e433aaf90dcfb5db8f15a1ee6458690e29faa3a4de65b1a427b45d364afdd45bc3ef15d58

/data/data/com.truecaller/files/datastore/firebase_session_Y29tLnRydWVjYWxsZXI=_settings.preferences_pb.tmp

MD5 a65b9b3e4670dc3b48a9609f816ad531
SHA1 682a73f2c248815fba0cb50c45031a53d6f8dbcf
SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
SHA512 6c06e6791dd41c1c8d8e0246e9bf7fed81dbdb5e918e7dd78cc2af1f002f8a532ec28335b229a0ec5c1ee220861092cb1a7c7f4060663394e420d80ed391179e

/data/data/com.truecaller/files/datastore/firebase_session_Y29tLnRydWVjYWxsZXI=_settings.preferences_pb.tmp

MD5 06bd63584cc699cbc92ade3aeab0ac42
SHA1 e21167e5419847271e7f67b3b286916b8124165d
SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
SHA512 675f177e388425023df5e19cda634ab1e7673681feabfa7bb860089105353166491d15b8c86b5408833230dc5b0ac43e2b5a61e1d36ea0b40d6ce7166bfc385e

/data/data/com.truecaller/files/datastore/firebase_session_Y29tLnRydWVjYWxsZXI=_settings.preferences_pb.tmp

MD5 1fbccf7b936a9b713de5d42c6d8a075d
SHA1 7c8bbdf9151e7f53e2675329d471e552446e9ad3
SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
SHA512 b9177426b3facda6d86b5a83d05805a4dd2f5357d4979ca7282a13ce3f08ef7e7a0c5922675ada826bde264450b1b4ddcc54eea4de62249fd3eab1ec9acf32cf

/data/data/com.truecaller/files/datastore/firebase_session_Y29tLnRydWVjYWxsZXI=_settings.preferences_pb.tmp

MD5 14770edbc1290230aebe82f8dcc730a0
SHA1 f86874de3ff45c2dd7c982f9ada6b5fc979f082f
SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
SHA512 c6be6c93262e0c42527722af20fdd3be2c9936eb601280c36492e0bb2151bb63f88bfb150690ae361c75d01a33647c2440bb49e290af38c5c5af5a707320e3de

/data/data/com.truecaller/files/datastore/firebase_session_Y29tLnRydWVjYWxsZXI=_settings.preferences_pb.tmp

MD5 593fe7b37375108f3b08fa09acdde161
SHA1 59650ae6ca36d0f1850abd732f2e0f113ac8f226
SHA256 99e7873a3fc740aa7c0bc657cb1103d522ea00512df92f0fd6ff8bab02d7f797
SHA512 dac7bbf307edbd44e440f67260794791b8c96e9369e273d79a813659db1eb2cbaa8d688f46a26745fe466ffdbc1c0a0e45c35e60973bfca3ccc16c43087d3fd2

/data/data/com.truecaller/no_backup/androidx.work.workdb-wal

MD5 7fdafd1e3e76985a38da4500fd3a0794
SHA1 894bd48c54f75281a1177f27b7264e15687b03e4
SHA256 7f273aa15cc8faf51c10d56b37f269e81cdee185efb3ab0b6be34b02315ae0e4
SHA512 c0b258d36a6c25eee742aaddfe7f44598402e8285dd702f189826dbcf6712bcf1060abc9e9e7e87daf3ba63aa46173ef742b3fbb413a722179ed5ac8021b4ad6

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/open-sessions/6647819401450001117AB627619D66E3/keys

MD5 486ad34af72205ef84d45cfa8d9c070f
SHA1 db6a64fed03b31a63eabeb6f1630a0ad7c1f4ca3
SHA256 501f0562ae0e51785ada163df3e231c5695ea36d355dd752daaf1834d738bbbd
SHA512 5149892ef31bca7e9bfb44cef5e4bf8d4e26264d5e98352be9d40f82eb9b9a1c618f6153eaddb8bcbf4424b831958d1232120b8288044cfe9064dfad05112108

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/open-sessions/6647819401450001117AB627619D66E3/keys

MD5 36dde0e28465eb4c2ca319635b17b324
SHA1 17bc43b3bd4856d31a6bf8dfc17caa84880e579e
SHA256 945ca299d0079dde1cfde9f7057d9d9c9183030931a903699c3901e9fa1619f5
SHA512 42ac5269c2f76e812bbbbe04cfcfc80bc8f3ea322a301522ba8368194fb2d16b2d13a57e9769d456bc420aeedb982b3fb349f862b27513350ae2362025811ff5

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/open-sessions/6647819401450001117AB627619D66E3/keys

MD5 ec08e299122b8c6029ab0f17fb14d3f2
SHA1 3ca522217d4a8609aad90f2d1a4af71e6bc4cb01
SHA256 26d980879c4c4dbbec6e2e054d93ed74aac53b0c3e82968b75b39fac4f861263
SHA512 f9c466a11ecfc23e621276d88ed6572e65af85d0e3acefb4100fefd54ef576cc9e0e9ac36b70f959cd39e63a3262e821e73ba35a066a7001263832c911722bf8

/data/data/com.truecaller/files/frc_1:22378802832:android:d040f8b97ff358e8_firebase_defaults.json

MD5 239da7ae1a09d380c62a51503da5ab40
SHA1 4f7dc90ca8e68101982087a6dd5a08ffb4587165
SHA256 90289b9d8bf46c3dddbdf83749255df4e3ab9eb8f40995279c9d848fde5c2a95
SHA512 ffe65316cf9ddd6fb90950402b4b8f057d1b729e2832421ac2f4751c1382103151d9151fa57f1b98ebd82366458b3872e902605ac702fc9d14146af4ede5a6d8

/data/data/com.truecaller/no_backup/androidx.work.workdb-wal

MD5 dd8123c846712fc640adc309ab21230c
SHA1 6766dcebe5ae13a25f42aeb005747cd8c53f0afb
SHA256 fa9d7601445d25f9a4d4e039e93fa289fde87d26923c669097f03cf5d9e28843
SHA512 0c6e0dd9efc72e53a0ae1311fd7c4e0174b317fc565ce879a517244a1ec486c83b4805edc765e3745b947256b7ba55d5844c00b15f46e3de86bc0605384b5d45

/data/data/com.truecaller/files/countries_v2.bin

MD5 ffd6ead1123a97c9dcb94f47ecb9d19d
SHA1 a59dfcca34fb426476b9ec289c7e1e7a35d6b1a7
SHA256 cd0eed00dd19f4c830dd992df859d2d960832f845644e365ab9ce3928f41a3ed
SHA512 fe75ceb3700fa95b0c48d0fdb0e94b85a3c29b12af2c51920530430715d51d9b56602415325810a80b604e813a1536415cfbd689ea3e169b002af164f88fb78a

/data/data/com.truecaller/files/datastore/backgroundWork.preferences_pb.tmp

MD5 428955c70f5d1f15eecb85067a61a79a
SHA1 feaa09ecef773d361fc87f4f839aa8dd2ff49c2e
SHA256 e578fceeb978037133fa0de8c19cfd3921d738d128527dc8759f86f3c4f42cc0
SHA512 4a432a4b2bcc2b3dd6e9a2f4edf61234a10dfa47e354fb53031f1dde119690d28f364648c5e80c4ded96178dacce845ebd5c297f47dd124219a88cda28f6cdf4

/data/data/com.truecaller/files/app_starts.bin

MD5 df1f40dca8ab5567f77de745b249811c
SHA1 417e0339ee072a3ccca4c3a34b05f866b4518909
SHA256 9d19dfeea90de32019b88b78c8a8d19d903be0da286361ca7224c1c983c55119
SHA512 8cf7a55d39e85828f12fcc14216d303e466fafa0355e3d4ee13c9b13aa7ea213e6b033cecc2612a0736ddbf13edf3945324b5cffd7b96918cf103c6d4821f768

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/open-sessions/6647819401450001117AB627619D66E3/keys

MD5 2f14172c3b865d307e33aef60d5c1546
SHA1 cb3c608a788c44e948d1e116561f029d2a68d2f7
SHA256 32c384b44d0d8dfa4793066b99a73ece7dc18e5eb5e7f7b0ad1047bcde57c682
SHA512 b6d4ae8e37add98a71f083e18fb3a7a9b8e7d2943d7fb6ac68e0aa73abce956e3f1a1d7124ebd9688f7fc9a9fd02b85108c9a637197d93a272b08251ce7fb9ec

/data/data/com.truecaller/files/datastore/backgroundWork.preferences_pb.tmp

MD5 40bfda7b1055faa4f110d63b2608a80f
SHA1 82b4453b1d1a60eb0782b97d73647f64dcde2107
SHA256 f0b645818acc322382cc603816f69357682a586c369f52e9afad5b8d7621d486
SHA512 05c57b7339193966f77852fd6df684ca5d0732adcbaab4e520266b28e1d332a33ac0dbc59216a3281dfa96fcbe14714a11ea88ed1d60880ff7d7a0cd2f64ebbd

/data/data/com.truecaller/databases/analytics.db-journal

MD5 3b4524f06a4f271723eb0d4d17b55225
SHA1 2e46eab268726b16fd48102d5610395953eb8fc8
SHA256 3038f0d1170b6117f245404bdac76833e2fc7e3377ef6052cc578c92b4a130fb
SHA512 622c1d9b099f0dc9a62227f3a90e0e7c3df29793a45b3623a107f9fe181bb2da02d022341adbd6ced7db0e99815431026d0c05b6e2500cf17b2f7550718ae2d1

/data/data/com.truecaller/databases/analytics.db

MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8

/data/data/com.truecaller/databases/analytics.db-wal

MD5 1bcc049bca864dcb1675c8b5a9bfa1ed
SHA1 0a38997dd192b8de56fbe37ff94a40b8b9acf17d
SHA256 2ccd54d0f4c03b92a18c0a00b6a7a851cd3fec6a0909fbdca2ccb06298a27629
SHA512 3e7f6581768b531c7d593dd066cb2b0cc97f63013ad6c6639398cadcd5810e03ab85ce743dc4aa66b2eb3ae28056ad2c54f06463fab04a084d528ed687f1178b

/data/data/com.truecaller/files/datastore/firebase_session_Y29tLnRydWVjYWxsZXI=_data.preferences_pb.tmp

MD5 3f69fde66891e45930696320daa8992d
SHA1 57a8816b9ac2f314e5a2a0c07a36a4f622cb3064
SHA256 1785cbfb130b84b51622bf720ee69a8bdd1e413206b39ab27af24ad3cf7a7ba8
SHA512 37b9dd3b94ea9168fe862953ff471a829c73bf5441a2f5a8a87dac5742c2f6e12f4b5f1f0dc4195f918f5f61729e013e8ad50281a347ff69a6132cca8e11ba5b

/data/data/com.truecaller/files/countries_v2.bin

MD5 b7f63cfea9fc992d13afdc7fe535c953
SHA1 c1c2ab58d506256349d7a93597b666756dd3f0cc
SHA256 17dd658d72f253c9715243327eaeabf780254f2cb1803656a2230c705e4186cf
SHA512 12dd13a0320faf957704d9f398b998ff3f26c5956e3748ed34b8caf6c73c8216287a6cb13b1e330affc8e1730f0745e9878d54570b77f677c71b297d70147fab

/data/data/com.truecaller/databases/com.google.android.datatransport.events-journal

MD5 e693223e573748465ba8bd058ca2e62b
SHA1 ef3c7aa5af476380ee3a2d80c2c997cca32832a1
SHA256 a1b8e75ce6b1dab2c8d2559bc24e3ab1d26fa5621bac493ad60a06b657560136
SHA512 ca1157bf20b243b870ffbd2d648259de887f7260afd96ec3de6ce3de0f280b1c1ae5c52e7df8cab145587cf492c3c5233ced5d577f6d0e1fb52ef4a7f998a458

/data/data/com.truecaller/databases/analytics.db-wal

MD5 7a506f0be566c308aa8441232249ca95
SHA1 491cd77f760fdcb5b610057618e428a65abe665d
SHA256 06d3cb5da1ccd8172c133a87891bafdce75fcbe452d3111ad63ba0d63d1eff0b
SHA512 230212d5b46be6b82cb5df8e014acffa184696dde16d640b25c1b760a8f4029ecab2d11874a544a1b6816dd594bad68c476fbd14e71505d1396cd11c1ec48138

/data/data/com.truecaller/databases/analytics.db-wal

MD5 9fb4184338d8a7bf5e8eeb5794e108d7
SHA1 2a4d106becf02073bb34ccf25532636cecca44ad
SHA256 48e825774fdc60d158f97464e0b91b1965f57f481eab1de10c16bf76082dcda3
SHA512 60d2989f3df68c1c00c4cd120513c35644bffc9c80cdc2ff9087960d107ea693945ea19738566dce7037db99c022a1d5089928e21296796adbd3bbdaeff8ff53

/data/data/com.truecaller/files/frc_1:22378802832:android:d040f8b97ff358e8_firebase_fetch.json

MD5 b750853d8885e6f886da9c0c27bae34c
SHA1 ad3cbe4b251956ff515c9acaa76514430ca43b64
SHA256 627a128cf30df5e7321bc61408669648ec94c9fb186926a9d3549d66f8711750
SHA512 9f9fd8dd8f2bfe088ace330b892ad1ab7acf7060924a13121c97df6ba11a4f80564a235354d9e204d897846056d3584333b53c1c936bf2e284cc208a1fd9110a

/data/misc/profiles/cur/0/com.truecaller/primary.prof

MD5 cf40e869654ceb72a0febc295be09aca
SHA1 367c28ad08216f7aa870292e03f5eb95ceadf358
SHA256 4ed1e564f3e3a0a740810fea8cd847f7a01915c14ad0a5539152b75bf93eca14
SHA512 9a390211a77329f9ad80240c271d737b3b4ae3f474fec9b1dcc7f761a6bf7eb79de105ce8b35f7a2791dcbf2a85bd4e97e23150b1dc6cb43ce4eeb08d3e27224

/data/data/com.truecaller/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 da075e745508714b937925b8f22a6f4b
SHA1 683c347c35ebd2a3b1a6df7d756fe9ce613983d2
SHA256 776c6f8e883ad4e0810d97849109d05df49aa2ed81a0a20caf18e09ac1e94af6
SHA512 45762484c3f893e2f38bd5955a5174491896fff40b61ea1df5c947b9df40ecc29bada58f6c4a74505ee02221cda4620d342d29e6b20edcf30a656f6978664504

/data/data/com.truecaller/files/profileInstalled

MD5 c7bbfff9d4cb20769f148bac6036709d
SHA1 c9a5566c29b03974d9ed3e823cac4466e3395b39
SHA256 c8d60b038843e6a502e4328bf8a0690e84912c8f932ba23db1a1256646404b9c
SHA512 dd352cccc3af363c89ed2d4e5ea591ac70b69e0c964a20ad108f92b42e0c1e8756f55365b274712f3db48606c6ba2fb4465fe43a6f3ddb035ff364d7ec8ffadb

/data/user/0/com.truecaller/[email protected]

MD5 89586afce2181c4415592d5fa2a11986
SHA1 5c9675a1080c1004249d241b0e9199b6cfad8a6b
SHA256 1d42b43a4f2ca277b3dcc147c5f3d4f4f84b6b170b8912287b486fb7343fc1fb
SHA512 9aeb884ffeb4dfb3c04713bc31f7c6389a4a0d19ccb3dbacecac47ed08d85f8ffa522084a0c26d01ed4bb9d5eaac4773e6cad7e4da273b69382be8ba1a6f0c8c

/data/data/com.truecaller/oat/x86_64/[email protected]

MD5 75cbee75b96109a4214e11dfe9c631ea
SHA1 acecde06f6c4c385231b4472d6114a86ed5f226c
SHA256 d8c84fbec2346cb682330c8fde0982c4a1ab782ce2171f8778f311fb20f61a5d
SHA512 e09a541d50fbafb57514f42738563b15f3b52be33f08a577e3080703a3fff469b0a6da58975fb50415476eacb63324e26bda2fe925a807eba6b19ad94b3d925b

/data/user/0/com.truecaller/[email protected]

MD5 a2c570972e59d8a9b3bbeacfcfe3485d
SHA1 387746b2dfb1580b22af855fddd800ee9fcceaac
SHA256 328a8ac2b779f0af03eb1e17b0eecb78b1b4c8bedff561f58ad4d5894e71d35d
SHA512 d492487c9efd650e9f534d12c0705481e31c8bc58008f414e5360eee810feb0aa932da76ba08d8942c034cee47648455af87f9229080ce65df90908647d137ba

/data/data/com.truecaller/oat/x86_64/[email protected]

MD5 f674f3c2d2990958cb6bbd3ce436751f
SHA1 603eb819e3013fc30261868732edd44a0c467f97
SHA256 428146fcbec54ef1bca8be7397d9664cda9b2289ef3c1c609e70669444b12685
SHA512 e51583c7033c49d0ed299373e9f8bc7c2c53b30bf93af8bf533cc035afc7ede16d50e4ab5542a5d83aa5af0080cbd5975c2b6291fb8652c7bb3a7f01b33d00a9

/data/data/com.truecaller/databases/com.google.android.datatransport.events-journal

MD5 230a62bd300fb1515b925cf51e000cca
SHA1 4cbe90033dc74c74fa9d8f70b4ff912a56df82c1
SHA256 32634309ce9ec919974b376951e5d5238e6e171a5cf2533d23fea93ca65d3c66
SHA512 1c2e6e69fb3dd00db0cb690c576d37d1abd2db17432f3f67b403b0da5983af6c7912e740e50dd7148e1d6a04a0823491ba6691d2955dc1c6f4a1d5230ae347c5

/data/data/com.truecaller/files/frc_1:22378802832:android:d040f8b97ff358e8_fireperf_fetch.json

MD5 891292ba33553f7981f9ad5c50ce06e0
SHA1 f4174b01003d2be8eb540aeb7ab25917f67a3e23
SHA256 2a59d0f3298dcbfcd150b9c5349b78565320c7e73a700fbfcfd1838443578d43
SHA512 c0f4784b578b8a8c7221f106c9dfc1faf082e2e1f32d20d8117c4f2165271001ccd8a22babdd19ebaea952a2a93476fa4423e7b047ab11821ab4bd2d7d8e3263

/data/data/com.truecaller/files/.com.google.firebase.crashlytics.files.v2:com.truecaller/open-sessions/6647819401450001117AB627619D66E3/event0000000000

MD5 a427783578abd15fd46b9d44943e95ea
SHA1 e53f3ccbca13abe697e8fbed6d795f852077f43f
SHA256 8bf0e95b8acc76e1fd6ab92a95551c43595b361ccea5e8ea5dd8f2033c4aed7a
SHA512 097615218494a82337611a68a86ca891a0ec3915aeb1df01f0b7bd20d905e91ce2d8cc71e481a0845c063dfd9856f06e9acd2366ba61f46ce154adec718943b9

/data/misc/profiles/cur/0/com.truecaller/primary.prof

MD5 f99dfe0934726b9c742cbc105583b4cd
SHA1 ccabe9075a21b173b5f56796289f399830eb44b9
SHA256 b433904803be66d95f686467934dd60f65c6b61984b0cd7f28f9f520a0173eaa
SHA512 bfb4ea90030dd031568a2ab101e9f0fb75208559f5f6c5633e3a4990eb4548f7fb574d4b248d720485fc16d1d2eb568feded46eb6c121cc5328ec645bd5690a0

/data/data/com.truecaller/databases/com.google.android.datatransport.events-journal

MD5 40d8756e6b8f5746871b91e5ef93cd02
SHA1 62f76b0d8b0d13c671c19d695d7b3b1e7ea88387
SHA256 fdcf8de4c2a1175d8651c9eb0c01f64bf3c39d31ab74adbf72eb4952c0af8f4d
SHA512 507a659c15def82d9a7de57cf276d9640022c6e2ca76e29d7544bfbc337b71511e635e0c25528d4df25fdc3af2459227f2a3ea474c780487f4c36b7e59191dbb

/data/misc/profiles/cur/0/com.truecaller/primary.prof

MD5 37ba073df71f68a509353cc017349e48
SHA1 2235af383b5d98394632358489f92c64699a3749
SHA256 f0193cc39bcf879db4503b7a2276842fff4ea933688a1a23bb1c94e246d8526b
SHA512 3aa1aa83f9ceb6d573923f5e23c81998400b6a60bfe894250eb38fc7396b0748235613382bd0b5d056504d812d39eeadc4a832d734d51b45a7036b2c799a59d4