Malware Analysis Report

2024-09-09 17:49

Sample ID 240613-lq5lxaxdmq
Target a4e9a8411f0e71e255b20db46374f3fd_JaffaCakes118
SHA256 561bdb30c49911d5c4829d800cdde1d01b472192cb3405e3224ae4d98491d534
Tags
discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

561bdb30c49911d5c4829d800cdde1d01b472192cb3405e3224ae4d98491d534

Threat Level: Likely malicious

The file a4e9a8411f0e71e255b20db46374f3fd_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion impact persistence

Checks if the Android device is rooted.

Requests dangerous framework permissions

Acquires the wake lock

Queries information about active data network

Reads information about phone network operator.

Checks the presence of a debugger

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 09:45

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 09:45

Reported

2024-06-13 09:48

Platform

android-x86-arm-20240611.1-en

Max time kernel

155s

Max time network

158s

Command Line

com.crosswordshop2

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Checks the presence of a debugger

evasion

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.crosswordshop2

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.206:443 android.apis.google.com tcp
US 1.1.1.1:53 graph.facebook.com udp
GB 163.70.151.23:443 graph.facebook.com tcp
GB 163.70.151.23:443 graph.facebook.com tcp
GB 163.70.151.23:443 graph.facebook.com tcp
US 1.1.1.1:53 api.brandstorm.media udp
US 1.1.1.1:53 firebaseremoteconfig.googleapis.com udp
GB 142.250.187.234:443 firebaseremoteconfig.googleapis.com tcp
GB 216.58.204.74:443 firebaseremoteconfig.googleapis.com tcp
GB 216.58.204.74:443 firebaseremoteconfig.googleapis.com tcp

Files

/data/data/com.crosswordshop2/no_backup/com.google.InstanceId.properties

MD5 c3d400546cd3def10bef581ff6bfb43c
SHA1 3706641bfa6d21aa6537c80e41056bb9cc81286c
SHA256 9755b323d436be0c9d7b2449f2fecf34875582a3deb7842ae6e4c01d4d7d132b
SHA512 1d930be5d6638d46bd23cdef2fd7029119adc81a24a0da3ad7deefdd1179d9af4c23002bacd63526dff2947344e80ec003594ace19d91ff41b489850fd3a3daf

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 00dde2a5b1777ccb5f47fdb3fd6854f6
SHA1 de5f3a391a2efbd75539fb201865cbfaa133cb0f
SHA256 660bc0fec999533611f8763b4d584d2dcaad3c629833c3488000f422693ce92a
SHA512 f27dac201625d2d4506fdec52af5c1336f0b3e4926a7deab3902f7339a2e08b334cd54ac24d50207db37e94f37b743d6b927dcbf1981ba65292e87419f073066

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-wal

MD5 67834acdcf6c90c928016d0f38ba5f01
SHA1 06210be90750c307e9de9204decc037851dcdc39
SHA256 b9a0d9625ac78c8802baa538dc8e6f5f6e45fd50832669516c5d872e7994f24e
SHA512 9fa3318586cde3c3148d758b85af08e3489d4df49ad3b3ee182ef518420a982a5b1e757811c84919a9f1e4f592e44b1d9cae0f410eb41118e6899540f7195480

/data/data/com.crosswordshop2/files/frc_1:781768038277:android:5878e7cd29c0502c_firebase_defaults.json

MD5 ec8d89faa6119c15b836e0bbefbb4274
SHA1 1919a456f2fb66374255e85c5402b02047e020f4
SHA256 5ccfc8115fb718beaf8552ef007f2b9953979230ac7dcfad8a925237507eb9cb
SHA512 6bba1aeff226e59c821c3e7b48a32ea23816926fc406b2f05b5581fc075dd1d5c4a8b26af62d9fd63700043022dc88eefcfc38b8c9faddfd5f663d152c07b005

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-wal

MD5 3ba0509f4f4a7b713f0caa9b56412a5c
SHA1 fca6af2f05c22e60187a7053d9a1514e558e0112
SHA256 f44246afafee651aa3cf691fa5827808b16a5ae162e165c91d8aca7dfd66378d
SHA512 a2d940e681f351c70bf0692ee36c498ce81d3d60eee406000c88cda99106bd1a7a7f520dfab87314317f2d5ca2b2d7b2b69c168be2dd9db6b087ea7a1b2826bc

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 ba1b279dd4623b6d67e38e564790c15a
SHA1 cfaffbcc9e9f906c5b83ed8d0b1c18b516f8f619
SHA256 65b0b0f68d98fa368b606d39078f4296a9373490eb271bc3027b76f72e9a459e
SHA512 9ace4b2eaa232bb1f536d8c71c39db0510a069431e86f1e47d73ca011cf49c7e044a8fe206e71c6bf58e843c82e90890f568d458d728552656357311690152d3

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-wal

MD5 4d3e5e3edfc080721fddf3a768fb3be8
SHA1 1cca01ced7ef70f5dfac68030b4e275b2a6e7ea5
SHA256 ef2081aba430367567b054e19be24cc82067da0040d38baa3f50d6cbacfe9ee3
SHA512 17e9f9e215b76ce111ccf08091435611e1c0e6182132d770daa878b1ade15ee96b96c85f1488cb83578410a98260efd388840ca0923acba8dc718b0d7614a876

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 7d88ff44d69f1a03bb7339906ad14fa7
SHA1 66a1aca734bcc4b618f0b906cf5a6cf8caeb6e6b
SHA256 b5c60dd86ac882ecf76b29d3b2da0d7b517b4d6429c404ac3f6eedd15808425a
SHA512 b87f0287811861e5e4b36f5f431c0a2c45f1b3b1ad994afe3a51c7b7341975c948ddec0f65ed55aa234d4b4d4949b474f4d1758acd3b50aebb267db68209e9aa

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-wal

MD5 b780bc10e076f907d683a84d4dc84ee1
SHA1 d370e28e14d0ad8c3942fd46ec16238cd6a9088a
SHA256 019dd52353d930ea3781f2743ddbd4e045c09c594b457a2b51ee619133d40b24
SHA512 d7ce672daa4e3f9ce11525fd423a141577c83ef8eac6c1e69e60df770584d820e751fb9f5c3c02fa545dca31417cb00ff32d45a8eaf2704bddbe982f379a52b1

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 e0fdddc2aa5eb4a9961e8964856bfe1d
SHA1 3eed82f9492112a4cecce6378343d97060c18486
SHA256 cfd9f74b9ceacce45eb3b46fc1e0ef0276d91c334bc3a623927b737f9193c32f
SHA512 0894204ac10ab601e7a00225ad2e3c39215eb44096c71455795eadbe60e38f0aa8e3e56d771edad2b4d4977748566a018cf035caccf64b09586c61c7e139d5a1

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-wal

MD5 829c414f28c108aa79a3461f7ee9a67b
SHA1 e234ac09f78e82ac364ebf8798023f32a33260a3
SHA256 d2bf332c8d92c0b1f987f8998e014e1ec1b68e6e94c57c633c21b788e4ad19c1
SHA512 272f14ec659d972f74ad3fd388c9d525b898af5c347f80d9fc0fd080ff8a3add7f5a458c431c7ce0dc5fae069d29a60470d1920303cd30274a07a0b6b4c5bbb3

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 552ca28fd9c4b4aa9abcda61ec586c8e
SHA1 4b7946eb2107b15bb171271f601c2ba0f4ca206c
SHA256 2c76480986612fc977724400389ccb5f12459cab427355d95c19b2c5a944d40a
SHA512 3da9c16ad11dbfe0cf6d2b0d9184039da263a8a24ea21304f982121b325d433497b58ca352b52a501fd7d28ed499c9e320ce3bc79c83248476b7c73133a8f321

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFC201D2-0001-1053-6070CC6FEF10BeginSession.cls_temp

MD5 dce4df6548583cfc55cf8fcfe79328d2
SHA1 c57c36c90158f4b559772cc2300267443d7e1a00
SHA256 c226f7ed3d7a9b8ca8f410c43587a7dc5640139d7b39b7d88a27d7a65f948108
SHA512 ee0073515193ded56b2e3fd629004a4d83799d6b039246dcfe80312097f49185cb4588404765761d3428b7b14fffd1f23328836c21f8301849fc2e2b9378258d

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFC201D2-0001-1053-6070CC6FEF10BeginSession.json

MD5 418b4133dd53d823f83ebea37d2024da
SHA1 a71c45441bd66ba8d90cb8e60894d76a94808733
SHA256 a8a6bf53bc5bc291b07af0cefd550f801938f9a14b7dff8ded00bd4e400619c1
SHA512 3611f41219c6f4496bc0f2864a28e47f18d0581caa5410161b3399eb2ccb5e322233637e7ad210b9da5ed97bdcc92c09bf8cec6e50ed01eb16f747d96826d729

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFC201D2-0001-1053-6070CC6FEF10SessionApp.cls_temp

MD5 913925a0ba88c87668302c352c10521e
SHA1 fe40eccabe14d45b7a5b0d527fb08d0d6f0627be
SHA256 cdb2572a4668c57c68cfc321110f100fa9db44226db9be5ee9cffcaac2242d79
SHA512 5a76e136589e353325ca237f6d3c5ac0126fc9d2b337b68d03a1da68e29a1c35f852da5c8d184b3016ed60f173c16aa708430ea871046a6b94d9d40a9d5683b4

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFC201D2-0001-1053-6070CC6FEF10SessionApp.json

MD5 59e71082947a66d7942e4abd40a4a003
SHA1 a926537aae1303dc9801421cdd78b8e01a38192a
SHA256 15dc2d9c33bf7a3ef308569c66f6b46ef9afefac5504ebaafa300babb9c71baa
SHA512 ac32de05f9c87165b55fae45bc1581544bb65a29765463978a2fc6f0a8af720b4f3c5bc1d57fa401bfdb3016541ef73fb239a1b6d6a2a2abbabe772589e9489f

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 c82134eee98244491e089ed9d613052e
SHA1 50c7b707e079b94076c1f7433fcd6e3fc5009afd
SHA256 5421644b3d4c4ff49e615385a1ba31043b1810bcc5322f44cf7cf54ab6510b2d
SHA512 856fc9b074e384cb9896df5a6bf141056b47185e6bdf35ee89a1862ddc5a88e0adf88a82bf5776aa2887a28f40da71a38820887e791683087061e17762af0392

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFC201D2-0001-1053-6070CC6FEF10SessionOS.cls_temp

MD5 9b3d4522944ce6396563812bfdb92fa9
SHA1 6d2a6133c8f01938a48ccc77ef86ad8ca335c020
SHA256 d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9
SHA512 091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFC201D2-0001-1053-6070CC6FEF10SessionOS.json

MD5 93023624eb8dff5c20050da136aaae0a
SHA1 acfd1ffed752c28fb135ba83c0c6345ddf2f6995
SHA256 968bcd7c4f1abed89a09cc0e6dadd238a81e8655e64196b39a86be49ceecd39c
SHA512 bb25dfa144d3f0e17203936c503c5fedec5f9ca710e177f99e273010ba4a682199d4bda5684151d65f3cb1549f4611b3a645ce39646d3db9a1b2c17d6b160579

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_48621acd-07e9-4847-ac59-66fa68d71ec0_1718271941919.tap

MD5 3800cb2ff00871782705e80170df3f76
SHA1 4f73c47cae66b5c3947c3c107e7704188c8d8d98
SHA256 fe4ff7a23564e7b35e4b4eb437a2df6396e67cc68f1cf40d256e841f209df1e0
SHA512 fa45e14fbf52652abf0f2606e5a2e2112745f7a93ec25f2c846539699fad869b5a529a9768bfbac613eb6412564d588fbd075a66b0cdd9cf305fd9960eaac01e

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-wal

MD5 366b988d2a4229d21a6bbc9d066de895
SHA1 3640ac962078bf8c6b34676636cd876e9bed413c
SHA256 5b9f99810bc0529039c91c6784cc44ef0617ca0f84688bbab13c879e0974a069
SHA512 4094b6fb2675107691aa0f35405d4222ca7b086f082c574ca3fd0f476eb33da34e6af0eedf0bdb0b61959b977d3ffbf409eb2f59935224c64db48a5af520aa6b

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFC201D2-0001-1053-6070CC6FEF10SessionDevice.cls_temp

MD5 cf9cb0612d588a1f71b63084cea67316
SHA1 3d035bb92fd3f8997160cf8025c40239af74d3ca
SHA256 0d37c5a64baf86735501f9044eeb926b3d46548cdcf67c2cd1f773df36624ac9
SHA512 70f000233e181e3b7c6fcf07aa04fdb570f970335837f8d1c4680a9f78af9f9e17c73a0a5646770f7a8787e338899edc4a5197b023865a4da894b1aca12bf600

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 ba1484241ad50b64a93dc1629801cb58
SHA1 1e5b8f70185afc2047e566fb0e2f7ca0f475d288
SHA256 b6843a349a2eacfe3760677370968f0a50c8a8cd5f1459ab9d882b324a32963e
SHA512 0020477746d6a83132b58a790447836cf9daffa4c05b0fef9e530ee132e796fa3474463c9aae5ee7acf76d9469cbc12f0cf436b5fd529b31ef493ce79499ec0c

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFC201D2-0001-1053-6070CC6FEF10SessionDevice.json

MD5 75db92d50c80a89e068550028c62acec
SHA1 d78ea55f5dc682e4da456d26383249f608fe894f
SHA256 1dfc488309883b61beb3462567a9befeaf36bb475a07a7ecef2be60bedb4b5a2
SHA512 dbb81daa5fab357f087dc295e7861444f945eb4c3883a09926b47312ce526bc069266a8a24b2a5b4921fb13e797696c5824195f0a79317e279ccf7855ca2ee13

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 78df811f363fba6805df0b2b5b5fd184
SHA1 5b0e7b1e1632a6618b6ce243983595dda6d6adef
SHA256 b9774dc0c0a3706829391386fe845f1c8b5e9040e118c02da1cee8e87d5fd844
SHA512 d23b1f935957c0f6292fc8152fd4db228a816ef6917e0f26850bd1012e33e61b97e545e69cd0e9734074f0742700d13a9939346034930537f6120b660974758a

/data/data/com.crosswordshop2/files/frc_1:781768038277:android:5878e7cd29c0502c_firebase_fetch.json

MD5 e4516983fb982e9c99a57f46114b3609
SHA1 a1136c6853396c854fcaba33fe631bdf29b9ffb3
SHA256 b96b3671e99843a5ab255769c455413618255bb6e342ffdeed4aee8d173e3cef
SHA512 553ad7e65266149aedb34651e339fdbf42af3b1970aa183efb0d2aee8b3849ae36cdb0a0f4175f706074a0fd4e5441937e00ff434b1028fb63ec96122a72b97a

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_37e9e15b-459a-45e1-8096-49363ed6a48f_1718271947464.tap

MD5 345b84607a0abee4b8fea652accd5d78
SHA1 82ecdc14f725509ab9ab9f318e71ab4bda53c8f7
SHA256 179c8b8875999af7778215b7c2cd88d54e02f3a44db3a07a9683e31a75016831
SHA512 86b10dc1c2af0675e487e20c70635b20dd6b27ecb7e03f6068db3cd9f01c95f71d2977901f02b239e6267e5ff078ee6dce122990197bd1ccd60a4955127ddcda

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 09:45

Reported

2024-06-13 09:48

Platform

android-x64-20240611.1-en

Max time kernel

166s

Max time network

148s

Command Line

com.crosswordshop2

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Checks the presence of a debugger

evasion

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.crosswordshop2

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
GB 172.217.169.42:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 graph.facebook.com udp
GB 163.70.151.23:443 graph.facebook.com tcp
GB 163.70.151.23:443 graph.facebook.com tcp
GB 163.70.151.23:443 graph.facebook.com tcp
US 1.1.1.1:53 api.brandstorm.media udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 firebaseremoteconfig.googleapis.com udp
GB 172.217.16.228:443 tcp
GB 172.217.16.228:443 tcp
GB 142.250.187.206:443 tcp
GB 142.250.187.194:443 tcp

Files

/data/data/com.crosswordshop2/no_backup/com.google.InstanceId.properties

MD5 f0cc95cb701c8e4d8135ef31c91fb81e
SHA1 19d36d43a16fa6a0aca40383a6d8a4da8f019a82
SHA256 f18ceb5181523410257d143d90f55a4a11400bdbdfe4613b0a306bc2570b18e6
SHA512 eaf1318050fa49e41a3b5a779520904082c995ee041a7b5d99763b5871ae7dba006c360eb1153af926080051f60508c72a234ff0570a5a02d7ceed663fb63a85

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 e2abbbdee0877b70c9ae6a4a57ae0f5b
SHA1 45202afbf483fc68f8d96ee3169b5f4376b5704b
SHA256 2c3b8dc410b1a2e24eea43d590765ab28c3bd68faaac733f520a4879e7bcf7b3
SHA512 168f68f8c0315ccde3b845a460a0b4867ebffaa92b5c2004a830a03e522b7b195af6dd19670a88e86c3fb59746be25e9ce22092bd8762ff4adc7e102322037a4

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 8d21dce241ac7420b451516cf136e154
SHA1 481e80de8f1da6ea978071430a8f1e6942891672
SHA256 d4d04f3c10ec70d74e6ea5596f787566abcf02a78416e891dd0e7e34cec7f43b
SHA512 856e76b9fc091c350149c31284f9358aa1ebb75257ab76c38240a211202378bed18edf28e691929942a060bb1049199f16cef67d15fc145279af90780dbeff9b

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 3dde65ba43d2595a4d7f99bbad4f7cc0
SHA1 53fd9c286f7b1717e57e0533880c19b0d55d2784
SHA256 0ff4a00db89283696ea74d0a0d7520558f8c15beb45c6b3d2544c930a262dd3f
SHA512 9228e08729953c48feaf1e7e1542cdbaff4b86faa2325b0af33ae5a998ba3bdfc9686325def61792e4a0959f07e5658eca85a45dbd6c42f195210b9969ae0aee

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 6db7d501ddb5154d19456746598566ba
SHA1 08e18c562217276cfa98daceda529b506021cb18
SHA256 9443a0b8cf0f5bbe2cc7f163806b3e3c7096ba831af2ab94b275f6ece22570a5
SHA512 871263f908d3b980a2c2b17b3645198199098cdb7e2ae0fae738af379102ab6927fb7499c4db2bc7857c8d4d90fda822b3ad807969d27eee9ec751771c7623da

/data/data/com.crosswordshop2/files/frc_1:781768038277:android:5878e7cd29c0502c_firebase_defaults.json

MD5 ec8d89faa6119c15b836e0bbefbb4274
SHA1 1919a456f2fb66374255e85c5402b02047e020f4
SHA256 5ccfc8115fb718beaf8552ef007f2b9953979230ac7dcfad8a925237507eb9cb
SHA512 6bba1aeff226e59c821c3e7b48a32ea23816926fc406b2f05b5581fc075dd1d5c4a8b26af62d9fd63700043022dc88eefcfc38b8c9faddfd5f663d152c07b005

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 377c7f851a10cd175df568f30b743a5c
SHA1 f67f8b91ab68057b05d4ce4358298aebe801aab0
SHA256 5025869f97ad804a3a91f03fddf48a1a813d3f3ce3b283608486b7b1b0c4fe5c
SHA512 70eee31cbf4c577c3331944793737b5f7353cfab560992cfd351b30f2d2495ed5388b3e654c60c5cd91ef9cca29bce2b9bf85b5ff09edaae947754f3283010b4

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 45cda510ae0cbedfb04ad795bf75db5e
SHA1 2a0070c55ef4b6ab05cb3e49d397374bdfd3d252
SHA256 54ac4dd8559667e183414fe4e860b145726de93b8136d875f0751578cbbd4a96
SHA512 4e138c615b16386913ef5ada6c74c7fc77ca8e915a7e3f59c32373b89b36f728a10d165269bb383d74b5c58f75163ff0995500ce157b2bb73d8dc9cb23318984

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 ec60df0289b9de003bf4e9c268b557d6
SHA1 ea1e15ca2aa97c982083555b26f04c967032e4ca
SHA256 f9ed15c9b43b8316711345b863f927e38ad3bb6cab769fb9323d79b6daa8c03d
SHA512 6298a9fecac4355888b14942be5efce984da54e6a98d779308bf42045b399715eb84d0d51d15968a94c03e98f6a4dcc02febf2ea096b307ca32db911566c54dd

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 b517542c4265e706818039ed693abc62
SHA1 07ac05cf1cfe66ec16556c157558f2918b74edea
SHA256 4be86fe66c4bed62d2cd75c9b89e69d38296a4ef4126c5be533bba68ff9e7e81
SHA512 83f171628273aa5d667cdb4ef8e01285d21c28564e2f08e61bf568c87be3e5b4f3e42ddff0fc14ee171e7eccec79bedfbd68fe662570e124c41967f03ae5701f

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 12541bf7a82787045bff00289e58dfa5
SHA1 2d4ff4c71718b6083a723cb2ebb89a2bf2a188b6
SHA256 d950efb5197e3d823d42858b7f6d952fcc5095b794956ad311ba6420583cf30d
SHA512 ef3f2e66a43d487215dce1c1bc02e6ad1daa3d02ba3337ec67737fdc9b68efe26bab8ff6e425dc9f8d62e3498b036cdc516bd6c60240870ec926f1d7839eb0cf

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 c5c5eb246cade577e182b7f4fb16a25c
SHA1 80324c6d580f3f873015c84fa4628b0d68fe7403
SHA256 984a3c1e302d262548dae56743c70492bc5d5aa4ab081f685a37522b1afa3fce
SHA512 62576fb2b41ad3eb8389487cd44bc9c2cce2f1e344e84c213e5527bee90a40e3932083952dfcd6bce87b83a538ee30e1110b5dee1a2fbc6e46a77552625d888a

/data/data/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 23f78d2b44ddec9c2064c2a7a10f79b5
SHA1 645887467479c557d35a32c77c7b6057bbd69c2a
SHA256 3133b2a0c0bcd2fb58fc83c6f28315bace120be58c150fe1915f4ae6210c238e
SHA512 f1d40531ad9eb70d72f1f5b5eca28575722f79f8c72ace411d8f43ef06e6631b20170e79ba41efe4d01424c6b3de02459d554a53db6f085030da188e1650edcb

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 03e66ff1778f8d3a2a702676b073386a
SHA1 562f29769eb3333b24886e8626b5bb13a5dde5ae
SHA256 c4639d218545d48214933fd5524590c4eeec4af2c71a75c2da604633df72d9d1
SHA512 622ba567d881cae1ee1ecad1c8efc9115d0d2d89496eb2e629edf731c0a66811983276707d21cfe8a1636638474237279d34538268fd05ff9a34e39dec45bca7

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBF01E7-0001-13CB-E755019E2DAFBeginSession.cls_temp

MD5 b0949a62d3ac2a4a772f8ec29c00ab22
SHA1 7ceaa3e0a30aa3a439d3e3d270ffae8fa468478e
SHA256 5d58b8521d4faf1af93fb75759238d2e7b18ca467010346c264081902fb1cc77
SHA512 ba85fd680e99ffc7194773bfabeeb09772fe59218279c652ff908ebac9920be53f1e5bb7594f295b4b77ebc54f6ea909d3fe046ee9b87df5bb3a82ac93e97348

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBF01E7-0001-13CB-E755019E2DAFBeginSession.json

MD5 4418ef1cb3090f1bb8b050a1779d8908
SHA1 e41565ab7337a8b643005adab3b67c7891c02791
SHA256 4664baef03a53ddb454ecc2d2c777baf72c240838e7444d3c99fdda60c369394
SHA512 407814282246d8fc30f858bcfd4aec37284149122616020cf55a6b0846a4d1a80a02d4f731befd8408e300f91fbd726e43b2257a382f42c58b1cd0f7fd590f35

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_cd583277-0f61-4234-a518-9bb8b9cdc5ba_1718271939043.tap

MD5 8fbd604f305ed9c504822bcca718d372
SHA1 c0004d289752cee1cdb20b555beb3ee90f9c7020
SHA256 fff6591ef4f4d38bdb9e35f044849b0bdd175669598020e5218e8cc55086e401
SHA512 8b851c7d514f5725cdacf43d92cf3c1724214360e118242f86495e658a0f158ba5a7b6dff9f950393c853440228f411ce1d6d2f4e4025faa4270bc3eac912486

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBF01E7-0001-13CB-E755019E2DAFSessionApp.cls_temp

MD5 557becda7ce2dd5ff9495b81a1de7be2
SHA1 45379aded964ef4e6ecc3b506a2d1ed00d37ad5e
SHA256 90f0d1dada87af82b6157ccaccbaf7a67eaa0eb91119aeaaae3dfca4aef22d17
SHA512 73d18a3a35bf423ab7f434d29908b6cda5f494ec62abad73138bdfa4196f4ca5207f04710d8d16da809430fa9591a195e2efc0e1a47541191e32bb0bceb40c54

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBF01E7-0001-13CB-E755019E2DAFSessionApp.json

MD5 ebc10ee14b5275c610d1271d973c655b
SHA1 55409d5a533718433d1950b67000f43100314a12
SHA256 06e02bd366871fe28f0fc1e54c94664aef9b8d10dbfd59184deb4f9f9c8b5f55
SHA512 168de66ac6908a528d44cbefdef940714fb88a97ba88a5bfe0d999f9831bda70b8ac38e9e47555041846b9d355f85947eda5f700cd96a204c5b099d9f34000d4

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 b146c4c999fc8de3502a58005f8d1388
SHA1 a8ccb4617e46727d7c02707c79db188b7da5d014
SHA256 89fce4037971b449734e46bf238d5488449a8351f0fa93b122ec9ead9e8c9d20
SHA512 2c718066a57b3bf339cc0d480c14455df0257fdd73211793c743778eb6c8a706dd0f75f0f3e900851dd3d6023a4332150da2774ef1041c1287631ee7e366fc88

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBF01E7-0001-13CB-E755019E2DAFSessionOS.cls_temp

MD5 2566d27ce8c28d8961f082c375d7535e
SHA1 92fe585b1a2c9c523d2fa1f65ab5c1b6a1a6edaf
SHA256 5acdb54ddba2e264f6822fbdbc4e9b5158f57d43785c2f01d981956b18f7a90a
SHA512 1c70679bbd25a57f9ac02083d5af0fe72b1417cf3070a195497f03d6f492e87b1ed3f570de7ea7c814c995a1530e32610d9570f31a480648f4062e8d3287be8f

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBF01E7-0001-13CB-E755019E2DAFSessionOS.json

MD5 5caea4b68c57072f7f52a5a41720566c
SHA1 4d9712f1702c7238949da43f7d8ae6efb233a666
SHA256 3223857b618b924c2b0fbc7bfb373a1aacf300a7b5ab585e18fffcf19039f363
SHA512 fe1455d21c521aeae3292bdcc386f6d2005dc253930c03e44dbcb972f96b849670d2aba039ea59e1a5ebc0350e6315151d17bcda55c161a62987d4bb01e91f9f

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBF01E7-0001-13CB-E755019E2DAFSessionDevice.cls_temp

MD5 2390c1f21db00b20c07107e3ec7275fe
SHA1 e663a646460acc071aebee942cc1776c23d77655
SHA256 d348072a01496839cfcde3a18866423aee74aefd613fa3bf1ff4a203ef46a699
SHA512 43ff60754eb60795ca1c318f44dcfe49194add26cc3d92c2eac7bef538fd65b6290f2e5953b8f1693b9425ebbcdd022ab16a18280146ee0b0c2eefe27bc0bd63

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBF01E7-0001-13CB-E755019E2DAFSessionDevice.json

MD5 afa07370d07ed0a8ac9554ee7001bb72
SHA1 d1e9de22fda1295087525ff3a377f7d7dd410ac7
SHA256 8d4b99fc4968c9cdff4626ff6c1467cdb427f7a597b153f03b4bfb62dde6c07d
SHA512 a7a974b1c4ca3d7ca92e1449dc9718d5ea2af7f8e4c605d25c731fb4bbe891fdf340835e2a4e3a363558744e5ee30aec22542f377eb5bffc0097c70d24f241d1

/data/data/com.crosswordshop2/files/frc_1:781768038277:android:5878e7cd29c0502c_firebase_fetch.json

MD5 763f6c1f6ac20ce150b0e74c5c8af550
SHA1 b60812b6259dd6d876f83da228e2580c85d7145f
SHA256 771352a7fa935ba06347fa0cd85ca781c74d58a344e6a7605a1ff64ec9abdf20
SHA512 d086c783c08e1d37f1992834e801feb5a0338e605c0f74b13fb2ca6b7ca1cdaaef37baa9c561bdb79df2908bcb2c24f3eb50811f43a8d7172cb593370b2f7e5d

/data/data/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_0bd0fdec-a8b0-4565-abf8-e2fdb5a0dc63_1718271944412.tap

MD5 c7535176e0c2162d0c5bf2a80a635486
SHA1 cd3a325cb0c9ebb647a1b77b29e611e1d7d69f4c
SHA256 5932a61753dc86c9d44fdf4c12dc010d86b8c8bd3eeaf850b7fe0caf38190605
SHA512 371e4c05b73683a1e44cd7ac2dab6ae2d4909d15dee95a16bc8468de2f3661389b1f0fe54d389050a84dc8ebeb984e1497e652d160675274a015c391b937feab

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-13 09:45

Reported

2024-06-13 09:48

Platform

android-x64-arm64-20240611.1-en

Max time kernel

82s

Max time network

132s

Command Line

com.crosswordshop2

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /system/xbin/su N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Checks the presence of a debugger

evasion

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.crosswordshop2

Network

Country Destination Domain Proto
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 graph.facebook.com udp
GB 157.240.214.1:443 graph.facebook.com tcp
GB 157.240.214.1:443 graph.facebook.com tcp
GB 157.240.214.1:443 graph.facebook.com tcp
US 1.1.1.1:53 api.brandstorm.media udp
US 1.1.1.1:53 firebaseremoteconfig.googleapis.com udp
GB 172.217.169.42:443 firebaseremoteconfig.googleapis.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

/data/user/0/com.crosswordshop2/no_backup/com.google.InstanceId.properties

MD5 a0440ff8471734103de4d89646c18f22
SHA1 b38bbf9156fc4c45f923683ac06984ccdf9e3ef7
SHA256 1172f40ee30a1f74844aecb6d284b338b245090e8770b1a1f7629b92f116c425
SHA512 c6dc1da63438d2e6914c3724a9446f2f9d8d519075d6c7ab3e933491dc3349ca5547120d62f8edfad1e8c322ea216a0dd07391b2f55665a0b5e272b1de851df8

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 ed62a04f384dbf069181727c0c88bfda
SHA1 927f6b989fe69fdfb8854c6d58a2a4f15d1e4b77
SHA256 482553dd15bee35a6aef34c770671ca4cdc3f9c3b52dc97c568bd04da4fc6c3d
SHA512 fbccc5882e735e9afede13bc30a060a42c3141a32a874fada6e09ca650859f65088febd34b4cf69dce792c773e90b5dfa5ad21a3365f8972c722ea26657a7959

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 1677f5675f639948045b978bd1f7e8b5
SHA1 b9488dd96cb252716b7ad526d2dd1017b580e989
SHA256 d95da5c8002f16ec2b303d6f70306c326d0ea0adc4a0e8977cce156e07f10541
SHA512 1a8e48463442153895d50d9b78ed5ed8b4b365d84fa18bea03ef984d818441ecc2e90f45ef4a0ca337bfc2fbeef8474614068a0ddc502d19d830ff296adb2b41

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 0019a6777f152bc37514233c03354f56
SHA1 19115e4a34d58a9e02fb077aae020475bf47ec5e
SHA256 9a5d1605eb6466f0bff9f99c2f5623d26614ea656433843a47c38c9029aa6081
SHA512 49f53321f0f042d73e5407883898f70bc2667d6fa8e3f3cb9953c8574d08f7df71ab68f05e08a41272eecdc03622f372ae3089dc10f7b03c5ce89a85f49bd3de

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 1d7e5b620be40ae43ded878bd57a91d7
SHA1 9e18e5b9812b403ebdc6ed23b6b3ebf1337b254d
SHA256 1dd245ceeedee59c937efaaf6e1b6c86dd6a7a757d4b5fbfac6f54705ce5b5e6
SHA512 5e3c0b529b63e4c32b2c44c1f4a6950edc5cb7e3ac7b34b4a1fb0c0003e6a86045ce16808e94ea75ed7b8f5c11e99ff2df01df0df02ff02816662589f46e0454

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 5e0f89aa0c61d59031fbcbda4e4234b5
SHA1 69dcaa4d98f30609aa43fd47c6d3b0f7addb0123
SHA256 8faeb8a203a51515a2967bc2273f7bda406015a0cf1113b5c197eb64b5512733
SHA512 e8d02971b645a6cd6677cb332a96624aa60bba4174314d9992dac52462ea3305dd5d11709ad4242870a201dd65e98e9912acde8075d7f13882684137d83612a0

/data/user/0/com.crosswordshop2/files/frc_1:781768038277:android:5878e7cd29c0502c_firebase_defaults.json

MD5 ec8d89faa6119c15b836e0bbefbb4274
SHA1 1919a456f2fb66374255e85c5402b02047e020f4
SHA256 5ccfc8115fb718beaf8552ef007f2b9953979230ac7dcfad8a925237507eb9cb
SHA512 6bba1aeff226e59c821c3e7b48a32ea23816926fc406b2f05b5581fc075dd1d5c4a8b26af62d9fd63700043022dc88eefcfc38b8c9faddfd5f663d152c07b005

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db-journal

MD5 ea99d3547609fd254f4db6bd7416d308
SHA1 07cc3ca307eac18bdbc1ae51ce1db8246550fde1
SHA256 a1c9fa54335490d457756102f857e5b8c1c2491af2900a90c61e8da3f38b4fe3
SHA512 eb442b7c77c0c3b6ffb2d324493d1822074bd07a4cd6cfa91f55668e76632693f0cd6a9d6937bd9717f31c4509d43016967bca18fae4eb86a74997321b10f058

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 7b1e1011e33569893ddde3dc4696fc94
SHA1 d050738db0f8050e66ac0b4fcdaaf40ed3f9ed23
SHA256 f2cc3afdc465babccc132bd3051c195829bfc7a8c4627ace2570ab3cdfd0f0d8
SHA512 5ab017e6a240b1509be1edd61a089128b83b22d69ac2f045cf5c2e9a2c45ec18eb3fc0a31d573d55718ea7d3c2eacc3a675dfd81d1aceb93b932df67b541cb66

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 2b7c7393049f4d922263e6a8a525856f
SHA1 e1c444882a9a9f2a34b4bf5c8b023f0139559858
SHA256 6ff03c8dfac7d0f289fa57e9bbb327c7c9d8d01f6b65448da3cb34ecdc48b32c
SHA512 7227b8df7184ecf7e6836d45143032eaec5ff0f5bb62aed30591bfba4a6c0644d5690d37fdee9548382b782680c0ad983085abb95dd4cbced6fff43c86977e67

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 374c2a21d2a0d6c11f8d3487fb517092
SHA1 9a2caf2d6814cfb2968774dc1a209f112b58ca2a
SHA256 6d483d713a0223eca0e94c67f0fbe615292043d9fa9168b8809bed65958c655a
SHA512 229abd7c0f797f61758c0a77833299da2f5b1049fb6aa20a4ad6e571c8d22ae5d60106aa6876297dfd83c673e9fd62f5295fcfd63de056c569127bccd390d355

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 32a1731870ddcba89954a0271107bc35
SHA1 49ca67e280af09db3d150fe156a839248976952d
SHA256 4b70e4b4044d383691b50b9be7407ae967982668c4a83f6a3a59ebd81c97cf0c
SHA512 63d39014f90524a29a0cbcc13c56bc75522f5f4de4159d007661095d4ec82e0d597d22c987b87d5edcfa17dc85e2e169f96cd3823064ca73ebb4440865d84a0c

/data/user/0/com.crosswordshop2/databases/google_app_measurement_local.db

MD5 0bb74a58cce87818fd1e7031e2fc1f0d
SHA1 70db1191c3fc35536a9b91ac8cda7c87ade79ab1
SHA256 78e22560a303bfd3e8c674f7fe19e783fbb43d1039f4ca96e05ea24a39f39ddb
SHA512 04a4b58585d2f3c1f07ff254ee4c197998708fc038dc21570a93ab07e109d6c50b488e7752200c2ac7e51e422a83ec28bd68f8e8060cbaeede1f9a15c82a277e

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBC01B9-0001-1141-2229ADBE4B9ABeginSession.cls_temp

MD5 0c69e0c74e69922e171f45a0e6b53913
SHA1 bd4c12420e7835bbf5a5d7255cde8eadf5fd6a30
SHA256 b25c79481b1fc0f215b4478e41e74c50af86f47224ffa3536b58be23239b1104
SHA512 2d4574d1eebaf6346f1578f96911611d7bd5a5ed0cbccef190aa8bea82e5b780a0869693185bfbfa945a4c471aad5616bfdc57ab5f8237b600b16ee3532dd878

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 a1572973b621ee1f19b14b11b60f274b
SHA1 3a1f14913f32c0b6090a37bdd29b2af1c9141383
SHA256 cfa39b4cc2625a1507084e8be08d8638e6686079a7ff725e501519c041fedfc3
SHA512 d9e5c2959a188f77b57eaba8c7931c50c3499b291cdc77625a777b7b62f17cdc75de6965ea01e39927d80955e4ea8b48bffff8b6fad42e5956ecbca169d46227

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBC01B9-0001-1141-2229ADBE4B9ABeginSession.json

MD5 152c55d2f0fe687dea61e71e05c80e89
SHA1 cef6995e066c310dd93d3fc8c501de74ba77da0a
SHA256 b0328cda416737f000084e823058ce5d9a63aae286bec1b389cbb4204964e2cf
SHA512 42950cee8dddae095f2288c59fa54efc84920318d3c44116ecbb6c8f623abab84aef57dbe110f0c369b3049c695efd8767f0ab5c8f27776b85e999a3636f458e

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_32ddb98d-c174-443b-ae51-d575b47ecc86_1718271936059.tap

MD5 1c0139cb577a9e40d638031624eb5b10
SHA1 c9bd7f01bb691bf20186e1ceb1c995783f0122a6
SHA256 636b52c0ff80714d3b972c9f385e9756299022768764ea066560e932d346917a
SHA512 b8e8a1d6a84547f89ecfafedc1c11eb225f7faaffc2275f479a81d89b07092bc5fd148b5ca6865ca9efeda2b72fadafb14b09bd5f11b48026803d2a58f1c48d2

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBC01B9-0001-1141-2229ADBE4B9ASessionApp.cls_temp

MD5 31931a1b00b3410992c0ec62282f8fd7
SHA1 18be3130f7f0f3e614c60d7d2d30308aeb825294
SHA256 edfb4819a5de1f5c15a400d134c29971884f822aba6473593d29fc3d897d6be8
SHA512 2c3c9caebf13cfe6c298695aa808a00f3d254c2626b5792e954cb1429e14393ca8eed3f557330535b2999ef413c8ddd2ec5226bef7730c930dd239a44dccf0af

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

MD5 49cd759cd3afb9ef26b1e3987d49cb65
SHA1 557d054933ef38a512199268d3970e1c2e263da2
SHA256 6460cfbe413a9116ca14571cc30a150a91c4fea68a65f3cb269b43ea318dfc9b
SHA512 3b62b8aa9b13f7280a45027330e8deb21ffdbc2f1abaa0ed1c328f09a5b4b6a5836402bef48f5f82c9dfd7011c8b30c45c30eb3b0e446be724d59bd564869f16

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBC01B9-0001-1141-2229ADBE4B9ASessionApp.json

MD5 40f05ee47be7469605b30e1da0242b95
SHA1 46defe3fb10d487565617c88b590dc027c458f28
SHA256 41fb2bb6c1fc08cbf61e23f6e28789f92e8d5b6ea61b5f188e62d061f48569cd
SHA512 64682d559952edfd2ac5607b38182db1de9ed3ccc7ad6c178dfea917ed42605942a465f3108e70210c899d6b7e2be29b5d55bdbe76ce868899bbd3c43a66e27c

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBC01B9-0001-1141-2229ADBE4B9ASessionOS.cls_temp

MD5 b3d9541cc92a9153d14e5160f8d8c008
SHA1 2e1ac80eb381dd82a03795b682f92020348c0113
SHA256 1ead5b213c87f182ffce484c34f7d9f140ad3425c0f303f460492efe8a26c56d
SHA512 78074409135a210ba4e1407ad9b3f784f5683e83aac4ce3482d4e8135425cf2b30db1ff5dd0041901c490a551a477237c6d255671c7b1fad74090980dcf3334f

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBC01B9-0001-1141-2229ADBE4B9ASessionOS.json

MD5 fc1dcee4e422d77e7fab7c08c8a41344
SHA1 d5340127e9d5f735b9d33b9dc61c772fb0e2dc15
SHA256 b843f05ed78cd137c272ba7f0ce8ede3aa853098a856863e51d5c223b58f21c7
SHA512 3ec07617e3e1008572f6f2528de9d4b827050cc5a7cf19a1604c961f9ec370ede6f5fd83bfcc252c0ee286fe244ee6734046ef1aa638dcfc689cd4407a6a8f61

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBC01B9-0001-1141-2229ADBE4B9ASessionDevice.cls_temp

MD5 fd6372364a5c5c9cf8945ac3ea7a5d94
SHA1 3c798cab71f6ae7a81e71e58712368231230588a
SHA256 7400bf714ca32b64dd89440c9d5ace4e0115ddce44d169839e465df0e1638641
SHA512 a18b18d061dfd979bce1e0b769009668c322300e7174f51d2532e86dc6018769194507a106dd30b97317f8c1a7539d13a7baeab2900c1e00da7c74e899dab276

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666ABFBC01B9-0001-1141-2229ADBE4B9ASessionDevice.json

MD5 eeeb942571fa704cf8ae49731fbe9789
SHA1 b5989c4cb932ffc779ee25bb3f7bfb79cf720427
SHA256 78809f7ae96de01e3922b6d3a134c3f7e9a0cbdacef313f70e8d9345bf5fbd71
SHA512 71e55c16f9f8fc936f8607448916bbfa1ba233b7120b8676fe11552916ac4dd3e3a7b0f9c31e14048933c8bb9c9d6d630ab7d28389f31749640cc965b2636565

/data/user/0/com.crosswordshop2/files/frc_1:781768038277:android:5878e7cd29c0502c_firebase_fetch.json

MD5 4d947a64b69d84604776d6f650120009
SHA1 0e2c0649487dba4ce654011438cacb44323c6b20
SHA256 8046bf07114b0d5ca986c7fcc95f8629152113caf9e7b1f399b2d4f7dc27b915
SHA512 b00d28b2c1ec3271b6b24963222a63500a57446d00b68682a3c2e00b88e79c13b0c8bcffe1ec5df58803dc713482daea2b93248010b32bfd497d18f73569ff5f

/data/user/0/com.crosswordshop2/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_df88cd0c-bb15-42bd-870e-b052e5898716_1718271942266.tap

MD5 d19ffda5ffdbbee96a58a64c4acbd084
SHA1 384a4fdf52e6d5177e90113c1c040cedcf6f9bef
SHA256 8080c548818790236830e044a03fd4d651d0ba943e5945f06b1da566ae6d8002
SHA512 86de39cdf45b32a79d862d2525e6f3a42f2655ca7dfffb028be8982df41f3e4768d7e6abd07518f3080bb156a4d7dc1da9b9c2de008998b4593d43bd01dcc9ef