Malware Analysis Report

2024-09-09 16:29

Sample ID 240608-lgrnpabf35
Target QRunning_V1.1.12_APKPure.apk
SHA256 8667af0ff5318198dfe54d04658840b41449f3b2ca14312d31efb24528617dee
Tags
collection credential_access discovery evasion impact
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

8667af0ff5318198dfe54d04658840b41449f3b2ca14312d31efb24528617dee

Threat Level: Likely malicious

The file QRunning_V1.1.12_APKPure.apk was found to be: Likely malicious.

Malicious Activity Summary

collection credential_access discovery evasion impact

Checks if the Android device is rooted.

Obtains sensitive information copied to the device clipboard

Queries information about running processes on the device

Reads the content of the call log.

Requests dangerous framework permissions

Reads information about phone network operator.

Declares services with permission to bind to the system

Queries information about active data network

Checks the presence of a debugger

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-08 09:30

Signatures

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Required to be able to discover and pair nearby Bluetooth devices. android.permission.BLUETOOTH_SCAN N/A N/A
Required to be able to connect to paired Bluetooth devices. android.permission.BLUETOOTH_CONNECT N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES N/A N/A
Allows an application to read audio files from external storage. android.permission.READ_MEDIA_AUDIO N/A N/A
Allows an application to read video files from external storage. android.permission.READ_MEDIA_VIDEO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to recognize physical activity. android.permission.ACTIVITY_RECOGNITION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-08 09:30

Reported

2024-06-08 09:31

Platform

android-33-x64-arm64-20240603-en

Max time kernel

19s

Max time network

29s

Command Line

com.qix.running

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Reads the content of the call log.

collection
Description Indicator Process Target
URI accessed for read content://call_log/calls N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Checks the presence of a debugger

evasion

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.qix.running

Network

Country Destination Domain Proto
GB 216.58.204.74:443 udp
GB 216.58.204.74:443 tcp
GB 216.58.212.196:443 udp
N/A 224.0.0.251:5353 udp
GB 216.58.212.196:443 udp
GB 216.58.204.67:443 tcp
US 1.1.1.1:53 firebase-settings.crashlytics.com udp
GB 172.217.169.67:443 firebase-settings.crashlytics.com tcp
US 1.1.1.1:53 trends.search-hub.cn udp
US 34.120.59.17:443 trends.search-hub.cn tcp
US 1.1.1.1:53 ulogs.umeng.com udp
CN 223.109.148.130:443 ulogs.umeng.com tcp
US 1.1.1.1:53 voilatile-pa.googleapis.com udp
US 1.1.1.1:53 planx.weatergood.com udp
SG 8.222.209.112:443 planx.weatergood.com tcp
SG 8.222.209.112:443 planx.weatergood.com tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
US 1.1.1.1:53 sslapi.search-hub.xyz udp
GB 216.58.212.234:443 remoteprovisioning.googleapis.com tcp
US 67.229.51.113:443 sslapi.search-hub.xyz tcp
US 1.1.1.1:53 shellb.zhuifengzhe.top udp
SG 8.222.199.214:443 shellb.zhuifengzhe.top tcp
US 1.1.1.1:53 geomobileservices-pa.googleapis.com udp
GB 172.217.169.74:443 geomobileservices-pa.googleapis.com tcp
US 1.1.1.1:53 search.search-hub.xyz udp
US 34.160.99.170:443 search.search-hub.xyz tcp
US 1.1.1.1:53 trends.search-hub.co udp
US 104.21.3.187:443 trends.search-hub.co tcp
US 1.1.1.1:53 currentwinds.com udp
DE 157.230.125.44:443 currentwinds.com tcp
US 1.1.1.1:53 cdnjs.cloudflare.com udp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 1.1.1.1:53 srchingsama.com udp
GB 18.154.84.56:443 srchingsama.com tcp

Files

/data/data/com.qix.running/files/PersistedInstallation6150788641210568377tmp

MD5 ee18857f3b8784528aa5d3a5b2f1436a
SHA1 94ec7eb2a8b1fe3461bd3d28777db7f90dff7d1a
SHA256 3dd4c10546e87d75cd7062b1689d8451fcc000d08a07b7e72da87df0f77a4b50
SHA512 5797622662de28e9946e0d29c04e34635e3164e0407545e757988ffc1e79b113b1ef8ce7a39e1782a3ed78b58ff0c257f10757019d3a2fe978274003ea099e78

/data/data/com.qix.running/databases/com.google.android.datatransport.events-journal

MD5 1f82672f9e638229e7b192c3ed643fcc
SHA1 b7c20f7379e600bf7b29094ee984a76ae2c073b8
SHA256 975bf1ab787c648e633229ff28fa00d32fe057549aeb03644f20365f25062a13
SHA512 27ef164d47634af4697b215818ddad38abaf10cbf1fc262e1c92a21b997e710475e8d2aa40847160cb0180ffdc2a3f37e364cdf508da7510d757b61d0b101a23

/data/data/com.qix.running/files/.com.google.firebase.crashlytics.files.v2:com.qix.running/open-sessions/666424D802AB000110AD3834AA82C94A/report

MD5 2931b02c9b5029763eef64295dbb97f2
SHA1 1b4ab04f410f8a6bc1b7e8604190371c9c10a774
SHA256 fa004709399e6e87576b62b516bedbc1321d29cc17f0a4ac20d79d8a8a5aaf76
SHA512 16955eaa79dc20ee1d62f68326095a13bcedb30f7898f8f79f1f043468293976b416ae4c661bb052595c083a4e3a3ed07e49671c13af7ab664c933364f44ff6c

/data/data/com.qix.running/databases/com.google.android.datatransport.events

MD5 d1b7adef7a242db70a64c72aebd3015e
SHA1 aa066147739764257757409e57c39f6063a22f94
SHA256 9de424b7ace10689a8826f823b3e137acb4576f13ca328027f4b43a79859f74f
SHA512 195e71445113ab54e8a11c8091886730eedffecce53fec2f51de4bc4e3ce072df7f8150b31590600f831cb2ad49be8475512195da1f14d3cc9f26382f9eb67bb

/data/data/com.qix.running/databases/com.google.android.datatransport.events-journal

MD5 33b6ebf35b1a0a9cd93321b9c30a24e8
SHA1 03fe0ab3f4226cbfb323fe032a555e34459ab6a2
SHA256 9f91fd5bc1416853f7b9d46384f0648b68bca42613ab59382c586564167a3a87
SHA512 01c65fc8fe41f96667f2ab4cac71942bb04f83ffb3f6d3380d517474a44bd94ff38832624ce53fb18ab0d0d3492e0559440194c87a82b0f98df8644ed1b0e81b

/data/data/com.qix.running/databases/com.google.android.datatransport.events-journal

MD5 d66ff40f162ea23c8ef6448562d615c8
SHA1 a69ea16432deaa9e535afdb3e4ce985e90b711ff
SHA256 31ff935af3c94598b08c32073078b4cd81aea88a66ed44a58c5ebe66089e758a
SHA512 34650a556623407674c3e23fec362544e200eb90f2eba23301a938084bdfcc0e04770b779849c5e7a0b60207abc9d5e3b9f777be9b914f558fcdc60d91d882c3

/data/data/com.qix.running/files/.com.google.firebase.crashlytics.files.v2:com.qix.running/com.crashlytics.settings.json

MD5 1a2a88f4a85c881eee8ae2243e98bcf8
SHA1 352c1d8c441259603c8ce323ced9dac52513b2b9
SHA256 4857c8dc02a87e6783be4b7e4fab435e770f35380f9ded65c5d63537c4d9e515
SHA512 ac03c787dee07ec543d0729d3377fdbd1694d6504f00c197c6819266d0b471dbd70e283d981c5a963891a0d9e3b42da967ab2a825af256bb1ac9d780bb8e047a

/data/data/com.qix.running/files/PersistedInstallation5560154028375438254tmp

MD5 4f6f35e91c2bb731a9d4a2ba26f60f3e
SHA1 47b7c63eb394f1f0d9d5f83ff25d66979b0e64c7
SHA256 1535accd47d25501376d5e7440a79184ebc2120d8c30a8b2f6756b11747ef313
SHA512 20c89da2c31953c58d7a923115020d4f64d0f7af9fe6ce1cdf3a495733104a4c7446156e5d966968e88ac5bcd5308dec6f30f0af5b7445e7af0b087e6dcd5f95

/data/data/com.qix.running/databases/bt_data.db-journal

MD5 68c94c3b4556f1ebbb8ac033122b3da4
SHA1 bee849dc6a84eb51992d2035ad39c78b20acbbdd
SHA256 f5742af7574073c06e6438c3fbe664416170d6a182e8ee4dd4682462ae9cadf7
SHA512 a46ad0392f470bc96f16eac8c7736877bdeb2dc107fac4b1527eec4e4688af27fcdb154b10363147b469c4d7d90fe1f47f1a0ff0eae8347b5991534fa397542d

/data/data/com.qix.running/databases/bt_data.db

MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8

/data/data/com.qix.running/databases/bt_data.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.qix.running/databases/bt_data.db-wal

MD5 27df52d873337ee6c6d3aea6b2d0d522
SHA1 19bb15c2c47c5b826ee49dba692f197c385482cc
SHA256 61cca7f0bed53fcdb61ec1da64c22bacef126864d7fae15190943e858b9300a8
SHA512 a100d314d5abf81d4e202b557ab59f8a3864a2f10e00584f15a6ee2bba6893b9f41f9e7ae4b9c271b3325eeea26c9e70ccd53a0768a004797d4e860f325c15b2

/data/data/com.qix.running/databases/bt_data.db-wal

MD5 f30549640d8a12e05460399771bd1be4
SHA1 eda83d1994d48fbe66326a1d1b4a20df979821c7
SHA256 9692f9fc95799920e42683119f11d6a6f798c4efc917f5de9779877b62717c10
SHA512 27db08399766db8a70770e056332370991e0e4f96d32cf52ef142367ad4984eb8a146e7ae39d46348526b5d423abb312013d8bd315a25897b203378bb77d01bb

/data/data/com.qix.running/files/objectbox/objectbox/data.mdb

MD5 604f07069a986acad53da751dda659b1
SHA1 5003664dc5acba925b57a986020af631dd24d811
SHA256 caa9c0b4c34fac1b998932b6b151839fd6e4fa757df47d0f5ca6b704e2c68c0c
SHA512 78d448b3d5589298d7cf0810d9e1619966301e0c65c1aaf9b7a7de65d7ce4c8ef25bcefb128171c5f14abd1ad44c2dfa784c1220135f1d2df1ae8da1ddaebeb5

/data/data/com.qix.running/files/.umeng/exchangeIdentity.json

MD5 96b9026c1575de9fa0c22b05acbbef72
SHA1 35e8a2a2ee2bca05577b45c4b0a2580da2e8d51f
SHA256 e54ab0c2471eeede4c0c333b990eb38d8be1b9d845cb43afa89e4f727bf667d6
SHA512 711f37cdb268bd480f8eeaef7a8c206d727e56cee37eaa77e875e0c8dd6b1a5b10421ce813d68da968ae654029ed7993eabe11654972285e5701bf21e8ddefc8

/data/data/com.qix.running/files/exid.dat

MD5 ca292552b7c477034f959beab993129b
SHA1 9b3f478cf862aa94704bd3f9b7f93ed004e379d3
SHA256 1facdba3b24252be5990909fd325758c9fceed1fd32c9a426ca11e4ae0583367
SHA512 5a65e55268e4ee3a135a5bf0ed9dce857a201c0ef154acf32b991343cd674e64fd113fc1b0cf72de53f2f03c3ed256431ca1a328341fd4ac60787b40513d0415

/data/data/com.qix.running/files/.envelope/z==1.2.0&&V1.1.12_1717839068076_emNmZw== .log

MD5 d13dd66f5c92c499300e64b7b512ff67
SHA1 6033cde88cc78379daaedaddf20a3eaf2b0414fe
SHA256 2b1f8031f29423fb063f7231358ddc78e4ead2a9862596d1c7ec0119a64c0529
SHA512 0ecf60980db0cb6d680f3c027546689610c596978535ac2fb7def834c082628fef4138614d1d4e54631857932128ab1ba7361e99773084c0f926a6336c93c331

/data/data/com.qix.running/databases/google_app_measurement_local.db-journal

MD5 b0e5fcb70d383428de3c90e00c332250
SHA1 de1383a02d2e7fed4d4be993f96c994ad0888221
SHA256 57e838ad334b9dcff9ba4aae74a2a4fa9051c9084e86e6fb2387c7c4855d1946
SHA512 04e5dfd5202f6ced89d1ff7dc430d3f97699a550c935d5628a45d6f5b72dd5d45a0c8a83f9356c93c5a22df69758669abb47bd487e58fddada642195c2165f1f

/data/data/com.qix.running/databases/google_app_measurement_local.db

MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6

/data/data/com.qix.running/databases/google_app_measurement_local.db-journal

MD5 921c0786e754c2e0e227688f7d41652a
SHA1 97efd6ae597ce93d81202d3a5c141283804dde47
SHA256 739b28fd2e4b9e9c870a97385401755a486cc65b27ca716dd0878df9d4eabf55
SHA512 fc4ca71eb87e12a1c5fa290d854565f748951356029eca7eefaa766903f6315f13a5f167f336b36748257c74b08b684a639c6523b4e94d576dbb5b3dfecb0a20

/data/data/com.qix.running/databases/google_app_measurement_local.db-journal

MD5 32799b49078f5ba59f3c6edae4788328
SHA1 23e064341738793b73e7f415faae11e5c7c61c68
SHA256 716962c43dcd0aef102b4ccc583919a42c089ca6f1d4d6d0b6c9c132af54152f
SHA512 00473d07e6d49b774e1c97d976f787248785b4c8f2d8488887753585ce82d4881031b2c4a08ef03ffe8e286e3c4e12413cb45e2c034afa2f199fd0744348ac27

/data/data/com.qix.running/databases/google_app_measurement_local.db-journal

MD5 d3e40925667428c824948fd967f25728
SHA1 fc3b7eb35235f22d31a229281b010e2c6e806973
SHA256 5d58f7aad0cda463529738d5e1b31d576bbae66910659838389cff19fd9a46fd
SHA512 e58bd71d76773376b81ce7637a3503df07df04ed67e940cbb765e3414469a8e76367d184721cf58c5bf0294aafa47bde9c9ebe0a17ee07c5d87d6218a4aa24c1

/data/data/com.qix.running/databases/ua.db-journal

MD5 03ebfdeb41bc182657e4cbc15a5b3889
SHA1 70deb115ec69b53d017ffb36b7fb2fc6973d50de
SHA256 86ad9afa7393734a295e362250d20deee82d679c3f499af35f105219fe168da5
SHA512 469fa7cb404ba06eed37e04fb4dab3d3f241f8c19ec91016271b926023391aed249c2e3f9f43e62346201f3c665d9764f3a0cac6b44555dda7a86bfb1ed59d6a

/data/data/com.qix.running/databases/ua.db

MD5 bfea83a4b8abad5ff9bc0286709b22b5
SHA1 8751107db122f0e91aa4e6a37317d14cbf831335
SHA256 6baae7c380a518d9f0c29a25b493ede832d22d6b4c6ee4210af9fbfae3982b82
SHA512 cd59ee8399622545e2a653f1462b23dd63584a5165383dd9e221bea146f3494fbdbfc3477e7fad8bd8543444e8a2ccdabb08e672191023a3888cf4c0e89a37d9

/data/data/com.qix.running/databases/ua.db-journal

MD5 1a553088c9325b58f42928286638545c
SHA1 80ac304791923ec0163a542dd7acd4f7b447b2b8
SHA256 7c5d342633a99d23937bcb57e062c014501038dcc5d8c33b3b942b2a9b39c412
SHA512 fa0d9e016f79de79bc22f5c6a0540d22f653108e8557b7205696f47ee7ee35c103bbcac18b4704708f715ae034a5d722cade051a874a22a2868398485820206f

/data/data/com.qix.running/databases/ua.db-journal

MD5 0b8955a4ca9bcf99bde8a2a732dc0d2d
SHA1 005072634a45dbb91bd5decc9cac1b8eb7af30e9
SHA256 ac5ceaf25b655a4fb879e8ad0e2558b81316be60b7cd2767274241533bbe4a27
SHA512 6f09d8b616797f8280cc5c7d22a9f0eb6aa08d09a8c55c5e9ae9b7ccfaa2e19e33fdfb08d33863a8741a6018bc26357fd0150db33158dcb4d58840ca253e5125

/data/data/com.qix.running/databases/google_app_measurement_local.db-journal

MD5 b8ba844ef402cce9b1763f10cc67ed6d
SHA1 a3914c5248f8862ae6f2044b6078ea50998f1d71
SHA256 e4b31795883e2cdb1ca82f3678d9f9355ac7bc21ee2a312e06882446dbcf027d
SHA512 d457d1f95207020df01141c5b6329440077abd3621b8a9ca2670cb997b643187a357672e1a14098f55ea439227893506f6862dac5c9004517c73941a9f01086c

/data/data/com.qix.running/databases/ua.db-journal

MD5 bc2c2c691bff73160d8830f165a83788
SHA1 c2b2bd5b8179d824993c9174d8c384a8a77f170c
SHA256 aed140cd5526afd44c64038eaf348fe8f0af328440e1eead2f52da63eefc113a
SHA512 a2d37a4eb0b8fb54f291b1c4784f8d771ecfdadaf6896a5592da91e5b9268091ae40d81ad2613cdc3357a17550cb3888d7a6a9a4d5e9ab59c222078042dd9575

/data/data/com.qix.running/databases/ua.db-journal

MD5 35bdc9eb9a8d9a16e97512b2cadd8f4b
SHA1 1be341fe01676fa0904284af680daa8d3fa0c0f9
SHA256 bd7a42d2dce6c0da73175431fe13b2741c828523beab22bcb85998b1f286f8cf
SHA512 bb4d94a956c9413cd0a19c64c56b314d80c6e693273e9fc8c770e291f35f80e339894d700cbcbb70d650dea5fed022c28f7fa95eb2f2e30d96ff39d50080abf2

/data/data/com.qix.running/databases/google_app_measurement_local.db-journal

MD5 c0e63a9a4074339ee384b772a322d47f
SHA1 51957f55ff15a0f36b157b59df9cadb0a5387c60
SHA256 855a1b768c78383a4123ded8373213a472e675bc14659cb18cd529695dad8dae
SHA512 90c06e5fc79738f4dce3c666fc543f5e2aafe15a9ec025a97ba1d581904b2bcbe924e74359b212ab27c357bc7715c3d126dbb22f7b1cf378f6ae8ca09cdc30ba

/data/data/com.qix.running/databases/ua.db

MD5 7db90f397d1db615771ca188dfba1b36
SHA1 b983af4499a07c3a9a1a92a896a7627e023d7aee
SHA256 94f8f80f03bb2500ea8efb18093b509765cc7427ceeae806d1a0d3a336b7a538
SHA512 d1cf615d0abc5557f93543cf4294265f5fd96a8e5807165e21c5329b44b06de0fe591ebcf1377635a9e8ac6dc73ab25770b33a368075d9cc11b5cd39ed7dccdd

/data/data/com.qix.running/databases/google_app_measurement_local.db

MD5 a8302efcd4392ca3792f41ea79bf02a1
SHA1 1ef40c0a4e91da653e9098ac571b8272402cc7cc
SHA256 af3092c430a97893e8983b3578c11b3f8c9695de0da8a9cf81eabca50c5db886
SHA512 3405ea9b687d75a60dd39275867e726b38a208cd6d1826913265cd0c65680da3e54d97807f9b63173814c909ae92c2d46a039b0702ff544d5285d4b6821cd45f

/data/data/com.qix.running/databases/ua.db-journal

MD5 1af554a9ea04711b9de4da33f9c96bc2
SHA1 288bd9b18f2793baafaf9185342b1404b6f58a2d
SHA256 ce4a4670bd8ee63a0020906fea4b6ffe239dd8f2e6224156cf1b9a33a89f2731
SHA512 b352c9be0935839d229fe0c1d588445321a440cd25e6ced0ddf18b83b93cb561f455708373901f14e5606933385d25e3e813358f5f44024f446ecb0ea0a89484

/data/data/com.qix.running/databases/ua.db

MD5 d277f3683024ec685ae49726ae834f5a
SHA1 b804db8c614d4d64f2fdadc495304545e59cf32c
SHA256 590b8bc19f704e8a72da5325ddb64107b7f0ffd43ffeae6b0757d55eb20b4259
SHA512 525a9725b618800b2d61b6513df4fd4a702dccf20b290a7bb2737eefe9adda7eee023171564dc0e6cd8bc042a1f53a467cf0cf7286f583c11a9bc044b9dc22b5

/data/data/com.qix.running/databases/ua.db

MD5 5add056562361cfc372950dd1ff41895
SHA1 3c0c9b744751ccba47b80b8c8ed9f7c8b1a8897c
SHA256 5c3bd0af37a4706c174d8bf9b4f1f1df3d8783677e9ab42bcfb53818ba88e8bd
SHA512 3b4c0b27e97af240a6c1afe9c73d165a3ab3bd7b6f5253a9c0e6847e5c7fa6ce57bb8836cd2b053a8f96bf355b9c1f9c16224c6bc90170b77bd65370591a76d3

/data/data/com.qix.running/databases/google_app_measurement_local.db

MD5 a886f02d72bfed84880103f0ae0d2ecf
SHA1 3d359093ef2191f5a54350127da132f71f03e62f
SHA256 1412b679d87ad1ddc4ed91e58e75b378da1f822089f305f45e2da820701ab89f
SHA512 ea5382512308d1d211f5b8a4cea2daba10d0adcdc2a506e1d4bf6dfad4812327bb796a41e31fcf351861e5cb68ca5a8c9b178e8a851b8459d293c01265cf5adf

/data/data/com.qix.running/files/.com.google.firebase.crashlytics.files.v2:com.qix.running/open-sessions/666424D802AB000110AD3834AA82C94A/userlog.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/data/com.qix.running/files/.com.google.firebase.crashlytics.files.v2:com.qix.running/open-sessions/666424D802AB000110AD3834AA82C94A/userlog

MD5 760e236c5764a45406e05e18f09e68e5
SHA1 9aaa4a834e59db6c042e4ba15f4bb0c58cd0eae3
SHA256 8cb3291dccd2259cc288b7fb78d0b1af5f60114f4bfd2eae034dd9166bbe0726
SHA512 b9aa4e83bd1d370b6bcbe349d76644ccc953a159c419047b6c47ed16135467ecc10e5b1df70859e96ed343b9acbb1a8fc419149fb54d834adc71ca9f7043cd59

/data/data/com.qix.running/databases/google_app_measurement_local.db

MD5 32d01ea0de71183c0552ddaf628f29fc
SHA1 68184737849f29dd3d774fe9b9ee5e5e3fc6eb90
SHA256 e16c99a08d32a9e8a3635d28aea6e8f719a01c133cdb1180154bb990fe0bbe41
SHA512 f96ce711ea6a989187ef5432c287fd7518162c772400d500e632a907eb6a05762cb685589e75b4afc257f22f44ebec4b6aa4713f0ef3d699a7f142d9df98100b

/data/data/com.qix.running/databases/ua.db

MD5 7268549992bbf645f1de14ad45d2234b
SHA1 0a8ae73e580f254adcb0d80f93b867cdb78ee8ab
SHA256 8098e5b052fd6c3c80e5e8d857ffbb07d2bf89a99ee817b4462b23882cdc3afb
SHA512 afb4fe03a39cf59f6c985a01b7196ab70b9fbdc6c7429dbc68ec31217713d199d53f5cbd6f657d44e32d1de2163676c5955548526dae0e0e7f7f85e822a596a9

/data/data/com.qix.running/databases/google_app_measurement_local.db

MD5 50a9574bc88e9e6038527de2ceb62494
SHA1 3e45605889d2b5b11107a83254d9a3f41890c325
SHA256 837ee283f481740631dcf99a55b853f50be7b42ea22f3c34e1f23fb9073678cd
SHA512 3681cdc05ccb133b3405846149c3689b071832dba0862ba20efc4087d86bdf6ee758d186ed4b02146a39d47590be0f0576f41e78e568a98c90fe964aa432f8dc

/data/data/com.qix.running/databases/google_app_measurement_local.db

MD5 315f44fdb3ae753cabc5926caad0a48e
SHA1 0a0c90c35d81b0dbeb6dfec77e43743e1392beb6
SHA256 2dfa04fa678be896c8a9d6314d2d2809944a424206d98efa28805a24ca2de0eb
SHA512 ee00aac407e5d7541933de3864e459460f73a6d17903ba34a5464d4c5dbbf450e41c4ec201aad244cb33775774cac02c0338dc3bfe126e66494758e2d40ffb58

/data/data/com.qix.running/files/011134986548f3458aa3e7e2a7fceb8d

MD5 130c0e8f7217afbe1b987d8c51e34035
SHA1 54618d0c890bd50314908a26d041e556c31336ab
SHA256 ff5bd30ee20aee28442650fe9dd0214e477a359738d3b09518eb4574d3694134
SHA512 5bd0439ab624d8d44ec3b4e822dcd7279860f53d787aef7d3fc7425643ca3d28245c40de24b669343844396df905d6496ee8a03b63ba39aef8fb7a81acc065a3