Malware Analysis Report

2024-09-09 16:07

Sample ID 240708-a4tk1swgng
Target base.apk
SHA256 b89ecafde09182f1b0eaef752d5a146c465e49d51840a9b571a63d359fd5efdd
Tags
discovery persistence collection credential_access impact irata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b89ecafde09182f1b0eaef752d5a146c465e49d51840a9b571a63d359fd5efdd

Threat Level: Known bad

The file base.apk was found to be: Known bad.

Malicious Activity Summary

discovery persistence collection credential_access impact irata

Irata payload

Irata family

Obtains sensitive information copied to the device clipboard

Queries the mobile country code (MCC)

Reads information about phone network operator.

Requests dangerous framework permissions

Acquires the wake lock

Queries information about active data network

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-07-08 00:46

Signatures

Irata family

irata

Irata payload

Description Indicator Process Target
N/A N/A N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-08 00:46

Reported

2024-07-08 00:49

Platform

android-x86-arm-20240624-en

Max time kernel

19s

Max time network

131s

Command Line

X.God.X

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

X.God.X

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp

Files

/data/data/X.God.X/files/PersistedInstallation2414160169941785562tmp

MD5 581ea04a3a05d6fa35b6c06f15e87583
SHA1 fe0b5639b668adba60e0bcd075ac02d58d5f9410
SHA256 e30b849e077b4b9ee1d9f5379d562b0eae8f56fdf7c478a52e8e0ca41b176ae3
SHA512 b5abc543938a9c2ff56f1bbce088df1038d94e38da53fc430aebaa94ab49fe4773a7c0064d5f509229627ba25bf877179965d99952f6777f2acbfac43ebc836e

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 c38a16118ace7476a4c389b66e248d3a
SHA1 9866be04231c2ef433c7efbdc501840e9067250d
SHA256 79fbc12c4e565d430ad6fce2c1235ee6f44d7e0e4374b012cb14959373a2024e
SHA512 0fdca415de97a981aec6a1e3535659c9864a911229ad4828ad5f142459b13bbb998d3d57d5e22b9a481ac95be88d70083418081cced5f15f21d26b6de214ecf5

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/X.God.X/databases/google_app_measurement_local.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 4c98fe474306f5af88c13aa591d64f05
SHA1 83ca8323735a2604ff724c4eca106e31f742e00a
SHA256 90dfa34e528e2fc95f26252fe6afc44927378b55d4d41243e3e9f80d04129043
SHA512 3fd381342457fab0fbfdf8a1c7dc9333a8962985ed59934aa98ee519e1141f9a7f22cdbafc820a814fdda131e8603bb57083da3f43ad3f6034f977a2201adcb3

/data/data/X.God.X/files/PersistedInstallation4019345683410782546tmp

MD5 e22e825311648a5b096fd2e94e6dea6b
SHA1 328e06749c0c8a50c1b306b6d1710b773688ac41
SHA256 14124d70655f7fbbd582253805376c375f4780d05dc1445cfd3cd8d6757cc7e3
SHA512 d37d34e54e98f54f40c70671474a9f2920460d4bb282b8f8fa3df48eb8b7cd8078c2d5a57c7662b33ab1116fc7a8ed170a8457a0183b2b79bdf42b1348ea9a96

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 f4db96d2992fcae1a006faed63287c87
SHA1 10519521dad99d6da5c9773c7835a94405b6db66
SHA256 b4a9aee72741aaeb87c4346b65fa416e75d1bf8cd93885fe2913c21e3a284c7a
SHA512 02ad876e4d954229ac27296ea4f7da61fe4f0ddec788a0b344b22c419a7fe609bcef670097511cb40b0597b192ff09a3c2e06b259af1c79002ff38298c2c8768

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 5a5c2eb676a2ca174db4fb3028285b71
SHA1 3f5e3886f3bc4a1cbaf1dbf62bcf2ac421a4a357
SHA256 f9a4de4ca0fafe1243abea3e7c3031a26c52f0c05797103e44cdb94e46521684
SHA512 01c8e97e5339f8dd8d6b9fe8c9698a48ac974e148bdac64da2c2e5485abf921630a5f5138fb67d02bf0dc94d978f4eb3a79d526a28913ecbac512bcedbc715c8

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 ef416ed47822f70287d3f8bc2c00198d
SHA1 b3213bc1a0a47ff0f9fa305e5e8546fc501779af
SHA256 ba430f8453db385f3a99c7cd3bfc020006d22e819e04bfbfe744fb20b74a6919
SHA512 bcceacee35934e259640b054878800ba419589502f82e6396d65e26668c9075c318ce1964fbf088854b4d49e3723e86873a3a4b259a7d6e2d4c0ab51be0deb78

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 db15998ac9023754dc447951b791f1c0
SHA1 dd768d724f92677712d3969a416c25aeb60bd256
SHA256 846f7c179baea839aa31257e212b5a2c5a5dec0582aa2a22ce732df18f9b2114
SHA512 9d6c23537d99a97ea9149d2ee52498dc090d25a13ca574d9f8adf126bd64fceda83c0d21e6f4c967ef793b7d3b4f08bd480f792a176f3af548676b8ac9f6c41d

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 e1274b9de1ef2a16f5d5a1c69ad9ef52
SHA1 ee5d745f1cd91ef9d5cea9cd89b10ec06ea4ab43
SHA256 86e9b98c02ddfebd3420b6ab49233ee6375441e721d40f554124e6b8014b636f
SHA512 34b35326815704bbbb04706a45cda11f7cd976a90af3187e61a6eec6e5e17a133c7ffff61f5ea08bc9f20bcf9e85051e70688260f9fd329b528f7f5595899550

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 058ee7571a0a0bc900230aa502676e82
SHA1 12eb5914493bfdaf143c2c8375c92ebfcbceafc0
SHA256 f450b4b12b95e7d288dce19585ed75cce4d74056f6bc1528d2c5015c2bf196cd
SHA512 0119fcdd5de602270a65edc890b56512e9c82d7a794ca9d280d042ae94f7fa908d9f4cd075cb84e4aa93f70507c70ca989979953bef84dec800bc2bce1f2475f

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 1dd3de56131ed1808c2045c261d35601
SHA1 184af79e3cb8bc22f7d1744469eb31b45cefc6a2
SHA256 7cd59a9055a009ba1e96aefcf8036a83f5e3ed58c2a6158880de831ed7a46467
SHA512 4c389199439c3227869d68ed0f2dce05ecc5810c77670321c896595898628154bb4fb39aed3c356d87aa6b6a843a1fa86d066ffe813d3c2b29181f3e2ae02908

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 4577411ec133f75f91f33af6ca368f9b
SHA1 2edc56c8d1d44d8da526a93691fce1db978d0efc
SHA256 45567c1df776cddf7dc6dc51cc20ae22aa0891d6b41a2ce1198c507fe64a4567
SHA512 10248ef93ab03f3ea5f4ce67bc71d3a8ccffc8d4c89af907f2f57231436cb98d74f6f8bd290dd40374c8f225dee269dd3637b2e9e3b1b8a167a59a5b40ca130a

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 e43f942439b4845a990c1d756ea42c16
SHA1 b5dd73b5594e1792a20ce6e5cbafa6494bde2a9a
SHA256 fe1bd205f3091870c4817ef34c9392e561aecec6fba319f9e13528153005150d
SHA512 0649efb787b09b0cb1f0fd290107dfd8ee8a74e642cad66246ca915acc0b2420e5b0bc29fc6d91d8a6f1a3153bd2284455a963158b4ff324b8a6732e50e911c1

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 3e881d9a01ca707bed38018ac69f4518
SHA1 5820f9351d7cc8082de6e5686eb9f8fedf6fb830
SHA256 4a5bf9bfe9b032546f886dd5fe6717de78716734aaadab620c0444ed6df5151c
SHA512 8f0395c94b3a449f3c61e7117f400c7b8a12c23d3655be6772bce2c8aa0ec8d8be8000c5cd2c6e10b334ef54a4add5583717393c3239da80c334c45b8b392db8

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-08 00:46

Reported

2024-07-08 00:49

Platform

android-x64-20240624-en

Max time kernel

19s

Max time network

185s

Command Line

X.God.X

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

X.God.X

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.201.110:443 android.apis.google.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 172.217.16.238:443 tcp
GB 216.58.201.98:443 tcp

Files

/data/data/X.God.X/files/PersistedInstallation1657322525987973127tmp

MD5 d457e5f61d046fc6e752e8e6e914772b
SHA1 087a061b1ea60505327eef4362151cd70ef74926
SHA256 656dfd828656434205e6224dbf82f320a488aa1b65408e3e79f4747f4d8f7a0e
SHA512 b814f1452e5f0f6423c76ea8e721df3a6ab5f2c6e7b9ad78e582c2d4eac120a29fc01fb234878dbb91bfe8f93b582d8a747b01e2d1a8d44caa46e41ff2831a56

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 c4514729970ec7b5dcc26968c4f5326d
SHA1 31b7f0e921883129c9bc2a9bd73ee355463a70df
SHA256 707172e0a46f6aac11fd43875dc921aef5d1ca4476676c92f731eba3c701c89f
SHA512 0fb5093a4f845f2fabf480416f163376604c445258a422d6648e79bc447b9202dc561fd344bd6ece121513a5dd8ad6cb1dac9ef032d45e1da1dff021dd03d8a4

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 9382b5434970819770cb01c6fdd4956a
SHA1 4511fbd86706dd75be677b9d49f279d4b36c6c21
SHA256 56927422db57adcfcf7a795ec3cd06e15904f71d351640b14bbd7594ee8ecf4d
SHA512 99255675ff2971bd2c553e48a22aeb78929a7ea166897506fe54459f8ce50aef54983d9096272c7c5483b146fff061a0623b80447df77d5f7f279eebd3babbab

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 908628c7f1d81795b0f74503c5461f62
SHA1 6f8f9de976506be915eea9ede3740a4fc1e7e779
SHA256 46b6ca1cd35a3eced9abe3732c2eaffe3baa173377b89095a9a9d20092702c48
SHA512 5039916d845fb3ead2ed33f8a590402e5203607caaa867125b362cc9d2c3a3f7fff7b8acce56fcaa51c7d7b35942364f306e487fc4b268fb7959550885915960

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 1908022d994d8f4936315b57ac3147f9
SHA1 3b8070ca08db04be832d4b6917a496930707b83b
SHA256 f4b5989fe109f65ccffb601750d3533a762fe6fe7deee75c016c2e4390c06ea0
SHA512 f5c383caf96386b472921a491aaeb6a54f4890de8583e223818cc818270f9e01167535557f1d6eba4255198ba52606c862bf6e570e55670a1ffcb58602e1a211

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 1e1dcb8f9bbf8659222a59af1308c5bb
SHA1 91975bbd20bde771149a6be6ba3548827d383f6a
SHA256 34dc10524f5554ac431bfb5efbe8c444c98fa1d61757be8ebd12cadc4586a225
SHA512 0401bfb68927a1cbd7e0323022cef689e7c93734f7128f518e9cd1ef297a5fe39d01afe22a87bf975f959b437489772058dfddc94d5d3810d7d84ba0d4b0e64f

/data/data/X.God.X/files/PersistedInstallation2412416096730622992tmp

MD5 7c0a2c10c8da7a4dc4ae49a94a631659
SHA1 8c2b350e53cb2212b78190b97dfba42d2e16de90
SHA256 15b2608d0da734f37397c1bcb72bb7ed37c1f8024d70fd210257e30e8385d388
SHA512 fb9d84083a65004eb78ecdb69c06711875f1ddf7adb1677dfd949ceb81e0756c101d23c270f5fd26ecfbf8dda909ec7e17046ce35fd2cf5875a3f4da246f07c9

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 a6fb74f1f493e4656d4c3a964fcff581
SHA1 260d05d0bbd8a5b97ef46b6d5b63104c9679ac64
SHA256 c579d94a4503d71d9e980a4f170eda53c6e8b9e786838c9e05efddedab5082eb
SHA512 7f430de5e859197234e34fc1e473dab14c16b6b9e8857f62234bd61ce4092fcb42e53b50369d2d139e62034de5486801960952014db801bb22c6fd52a54d5b76

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 73200aac388aaeab13ce24060e9b81d0
SHA1 6787f9839baec9f7a49883779ba2155d64fd000c
SHA256 2491518cc1a56291a8f541ebf1a3606fd447cf803821c0ae9b853b82afac0ec9
SHA512 8ddc1081909a232ddaea349717896455255457319db655d41d60550e1e6b91316b8ea99f041c60bda6b23a43bedfb47dd6d53a8ed95b6d359a59ccaa67c91d6b

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 43ec8aa818e3ac2e1593f585c20c67ee
SHA1 4e42f623e492378fea6e6027254ea5a23b70a653
SHA256 3b50959f6f911d3e1c310901e86147ffbb6e0d237285b0662c5290f848cc95b8
SHA512 821e2fa4d373823f85e27cc8d95f713af6ad6cacae91a4a086829396bc5ca79695d099491a4053d4a2761d50414c9e19011fa3c3fe2f6208c22ddd8dba2c462f

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 64f14dd968226fc688a9596bc76e5a01
SHA1 450f3ae9ffcc751c595a5af812393e7c1d70160d
SHA256 d4bc34bc7eb4bd91b238b05d1cec40a69cc944f4cb8213af5a3881ba2b435be6
SHA512 500a1f80d2ad7ab17f5a1da306ef6d19ef4cde75adf9325e78e188204c78acfd08251ddc7e1f95e13e91b24dff574b7e3e9d4f6211de2eea5c05a7a99bef56c5

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 ad42e239722a8f4cb5d34750c668c7bd
SHA1 0f20ddf346243bf34f2aa18bdbd3bcffe24a78c4
SHA256 36cc4c1668335a64e5966d0374efb540116df01c6cd12946d27e665e6fbdafa5
SHA512 c938b6fd3bc2781bd73a522f965e76ef1f6efa248df68fb6fb37ae5c012a767ef1bd2de627384adc1e08800059a596a13bfaa3479d2fe6e835ffa93f35c5901d

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 adf6082723784327d7d1b34adf974e7d
SHA1 b1502f70eb881a1dfe41139cb719fefb877ee37c
SHA256 252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9
SHA512 762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-08 00:46

Reported

2024-07-08 00:49

Platform

android-x64-arm64-20240624-en

Max time kernel

134s

Max time network

133s

Command Line

X.God.X

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

X.God.X

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp

Files

/data/data/X.God.X/files/PersistedInstallation6178452778439230044tmp

MD5 b835fc2a4ae513e2fdf7811171a356ab
SHA1 a87ae77d4c9dea869699d533b8bd8fd2608f5884
SHA256 dd14b5378b2099c37a63b09bc1ec4d915c287b8f23eb0b6d29c9a85fe314b036
SHA512 26ae5162969aaba5efe913d1664d21b8af463e1e2086c7b5bd7efa7c4ac270524af02c7f5befa74a48c9a78b5e60c13fb7ee4065dbedab707e990cab4c1b4f6b

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 e49d644c530a1079e4933e61496b0c99
SHA1 1433b8dbcb91540ea3daef2fd341cc1937673654
SHA256 98068c0d8cc7f54dfc0107d0d635ac69edfb950e6a9b53447c889c135c9d0a86
SHA512 5d9ddf42aac99f4ce34e94ceabc758cd79553c62b17b6e785a501953f5b678e0297b8b076eff03493563e35377eaf8ed687de334fa3f9ec80d516b5d43ea9dc1

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 94021849d16bf9214d4d706aa6a47419
SHA1 d4c538123a963ebe7fbd42ffd270a3e8417671ca
SHA256 25d0a151a514c71b3e69b629224e35cf4f0998ad1677aae722ed08b58827f027
SHA512 795c3d36dbe5bb85f507590ec7d1d68e4f41be9754739f16bb33b8a2ce412743b33a2f0355526e4ea4a050fab20d076bd47a4d51bf755f9656fe6557b933be8b

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 255ddc9405e802552f48924de9857519
SHA1 b7ccbf83868dae14183e9fd58a7d943b3ddf480e
SHA256 fd5b7e906a86fe88276f368483fe90e74f5523fa93081249580551a17fc0cf4c
SHA512 0dc7ee1033a222d468031bf8b25fc744f305b09743f16ccaea9a9648bc4303208fad0c4abf224549384ddebb79b2d5ce08d2e1e9fdf31ed5cf16d32dd2c2f6ad

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 b80f3d885b9f74b190671660022195f8
SHA1 79ade8a41c836bcd2ed6caef6600c7fff7e4912a
SHA256 005dc988384a088ef29cbcb5c6547cb820d2684f04a867b6cb30ec8b533c76e2
SHA512 21e70d7056daa8739dfede2d242115113383e7d11d42235c6ebaf464cafb69cdf33a8481c7d0439a15adb93325d7def825933b5e82b0bbfde5b1ea7e7ca39f8a

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 6dd983d99b9ca629ed2994ce5c103c7a
SHA1 dc70ae8ca78f8ec701d82640cf60e07fa6cfef33
SHA256 d0da5ffdc45f140b394411fc61a0afe386d71b61e0dcc84a5b014dadfefab8b6
SHA512 e618c2cf343b0497249859e1acf8b1f138dd5b449ca7da0a13ac9fedb8b06e8f75da36981a28f9d8ddf09507645dc6339de143900406f9bd117c6d2178478940

/data/data/X.God.X/files/PersistedInstallation6855894786756254205tmp

MD5 2098d791280fe9377889fddc6b9e73ce
SHA1 b06ac4f33907de3745385e213dec963bbe5612ca
SHA256 6e545dcb913ee619337d457d6adb1bed77e92792ee8a3c9cd7d6b3b37cd7b3f1
SHA512 1b6518da69762a124560f57e02736481033adcb52835afa6c0ed3d1fe296799466be2fd10fbc3a5ed36470c2477f2c4071f56225358c987af033dee427c519a5

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 9de79b84c66d104d4933f32b6ffb98ed
SHA1 0c5c53c3fb3aba021f71a24905bed29b8e09fdfe
SHA256 ca2b8a2c26d8d6b73ece8505fbafdc927942f608c2cf9b0f26602f45243dfbff
SHA512 14fd2d95aec4614f0feb2755229c80203d8abe1593ea59cdde8adf826632e8d39da9800f89fdde37873a0ceb1f4a065ba897fc71630cc27822e577bdef2af764

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 ac13b943e00f07fd0344446f889eae65
SHA1 ab8917b073036c73736e4b755d1be4d0dc4fc964
SHA256 59f5e887d2dd513214ba68ae89ebb5f538d40fd16ba9ac26fcc53a3afb5e1686
SHA512 fe868fcb80a18ded461fcf5977dd40f05e8565f0aeab302bd7379b4c71dbb0a84600e3fa40d5fea2951acae68956f8ec4e68f49ce59901cf3550cbc8d65cd2f5

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 a72cd1a1ffba708d652969da44518e8e
SHA1 5443cfdca9d2ff5004e795369f4a22a0175f599d
SHA256 c7831eb16f9e920432d1cabab04e34ab3f4a74be0bda2cbd51a1f55307161438
SHA512 07d3e05024c220e7354d0b5b678e71066f0916eecc11a5f3361af5eea165d07ef48cb01ec4435e7798d4e0e4b23fe49ed9a64a9deaf50149c51ed57bcff084ce

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 406d7cd80cbf19bb491a5de84cb02ac6
SHA1 8bf6f08cc591bd85d38f91ad7df1dde765ba38bc
SHA256 4a1099cb7228e20465bf7d9cf6e1bf51ff6c27204b443844e916a5036c0ddab7
SHA512 0f519193cd577ce7e664a985c817e6dcf04d9fc01075f71670890bbd20a72b16ef9d50ae06d0c43e99506b23f325c00152e0f8c3293c5546ce520ee031835e77

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 3b0fe11fd70608ac8e1dc09ec60bb246
SHA1 c09931adf5183af144ebd7b031a620cf2c66dfd9
SHA256 1b834813c5bbdf9a955df521b5609a93158227fdb14f0f6e95d3964af2ebffb5
SHA512 6a5f1ef493a3f7a49a24083b7147b95850d85dca4c8ad88187a2732d17cb3315963b73ffb2a46a1238b829f747cda22e3773e030f04130ff56d2787bf6368ecf

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 de82e2c94d2718988804b035a46d17b1
SHA1 705f5ff19093ad209f2a666085d6ccaed3bf58a4
SHA256 29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39
SHA512 68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e