Malware Analysis Report

2024-09-09 16:07

Sample ID 240708-allsfstarm
Target base.apk
SHA256 42557a21a58510a23268509e4457921f81b507b9d407e42f3365a6514de1baa6
Tags
irata discovery persistence collection credential_access impact
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

42557a21a58510a23268509e4457921f81b507b9d407e42f3365a6514de1baa6

Threat Level: Known bad

The file base.apk was found to be: Known bad.

Malicious Activity Summary

irata discovery persistence collection credential_access impact

Irata payload

Irata family

Obtains sensitive information copied to the device clipboard

Reads information about phone network operator.

Acquires the wake lock

Queries information about active data network

Queries the mobile country code (MCC)

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-07-08 00:18

Signatures

Irata family

irata

Irata payload

Description Indicator Process Target
N/A N/A N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-08 00:18

Reported

2024-07-08 00:21

Platform

android-x86-arm-20240624-en

Max time kernel

19s

Max time network

131s

Command Line

X.God.X

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

X.God.X

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp

Files

/data/data/X.God.X/files/PersistedInstallation2324307682570653436tmp

MD5 d5c3e26ecfefb37ba0a1b436f82482ef
SHA1 5edc4a8804b17d5fee8f55c2512760742d13ee56
SHA256 c8f7f5f1ae9cc3749db4ea95d954bc52d9318b09deb184f7a831692d9ece5b40
SHA512 92defbdda1e6dcdd2f5267fc1f58615023ec3b140c2ef8a2b1dbaadce0eed8ae3bf24eb9ca9a92a30190ccafa62d75caf550e92e42ddd1f037f3219a7c406607

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 7feebac3eec9ca78fb488e56852933fb
SHA1 8f6ea612156df2a9e693ff0f25f89a309af91205
SHA256 0133fee22e6ceb995d71bfcf7f1e9c2360aab4c51b1c2929d2ee49f7e12e9bef
SHA512 54f988996f060e103c659f02eaf114d8bc508f17e671a0242b15ab737a47bb8bbe351163a20c4be4c46cfe23ea4831970cf12572051635e0b559f22a8e64a286

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/X.God.X/databases/google_app_measurement_local.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 2cae91abe01211cf52f54668ed04f377
SHA1 13a4dc462e749af65737a0e57d061226833ee1e2
SHA256 f9867d89de5f3003dbde8a99caada35a6c6d318f570d5a908a0733d136a84dfa
SHA512 9918858516a01106370967d1aafd52020cbb0443c38cc7909c1d27ada1cc38db8fbfeab6e9735c78545a85d0be5c7e7e1cffa68076aab9b5fe8b1cee6e3ded66

/data/data/X.God.X/files/PersistedInstallation7668000789562974577tmp

MD5 d8683b833ce2ffb7dcdf24ebda4bca58
SHA1 6ac0dd7d1747410fc8499821cfcb7d2ddc819d15
SHA256 8391c02bd555a8a0e4eb45eb4cd16038688d472e428834aac4f4ab548ee9e504
SHA512 8caa9d1916c1cb4f9c91025cc0957d39e869fa0c402000b43e960f232e73872acfb5fc5a14f560ee32f4179b1de8f6c13bd02fd891a55d1f8e0d9ada80f57cf6

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 e2b7850131e532eb92827f5d23d6b51e
SHA1 3c2a35a9cc2b03947fb3ec83db4f7212d94383c3
SHA256 ec985b32f2d7eda0b927ba29dc12a7dffb74f83ed69eeff81525fc630e67114b
SHA512 0589625b590e158fda7c5934ed7d65194d0251bbbcfea5e1a6f4d6927e4f0fec470fd5ca24ab2e7f98a471ea06481ddc92cd52c8dc6cc269bfdcc19643c29942

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 36ff0b125acdd96a2d045a50ee6c1021
SHA1 89a4d260550e2c73df29fc387cee8db89921c259
SHA256 ccab2150e659ae8317e71d7d21759fa13d893a92449b6a5c083505f0b4a33f46
SHA512 a6a8b1b01596c78f1abf952c6cf679d1138fd60f95f3667f288fc27123657374321f0508c6ca60a6eae38fd9fbb1c7acf3385f7f4824f3db0c782de40bccffa1

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 ab76f1e53cf25df85e423a7e4fed85a2
SHA1 547b86e32daf54f6271dc14c66d1e7a7fb38517c
SHA256 0aa5f6275a6e5684e8539be829ad4d396bcd7071ffd8b2d193d6c4737d457fcb
SHA512 8e12154b52dfab7b5752379286a12685dd556055046d0d0eb72ad02695b8e949192d5fdb8216fe4634e80ff49f867585cf6b79ed5109a69a6133f32e44630595

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 d62c7c53be72a40d3e489d0f72544d3f
SHA1 9db477e7ea4ceb871d84bda2169faf2fa94076b0
SHA256 a484e92dde784b4c674a896a5e8a3f16e677508a45df2cd7dc998772b1b0e85f
SHA512 dc579119341fa2d1c3c6754230f1de8448e2b96c2354004e022ba45a1a5892efb88130a9679da0bd6e8a1bf5e896b5c8f384039503f3bc33fa8a6424b1fc07b8

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 3199edcb7210465a0ca876f0b6180fed
SHA1 4898fe3e3c423e43db09732ec45cba2df53a9111
SHA256 8ea1b8cb3aae70093e6316bae32d870faa0e680f94e4de097237e5bae5cc304d
SHA512 9387bcf4b66326e3549c132362314ea030000e06366b54899497dd1d2465b85466c2f9eeb58b4ce0fdd14e09f33fb5ce8ecf5bec9085b425d5b8f49ff2a3f8d6

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 845e2323c0e42d1ce44bcc0ca7f47c58
SHA1 91cb662c9a17a407ddbe425b589838840401b08f
SHA256 58edba9fd9579a334125c32977701d2c4a1ab29710389a6e139bbd9f9d7a7675
SHA512 6d37ef218fb4b6a6943065b95b22a276d7b589ef9fd924e1da15d3130066f4723736c964797c196ae21808c6e418940d76fe7937022a6d885f9a1d5017491cdc

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 ed1c38d03ed7ad76e166da19cb4d02f6
SHA1 a9ef93b4c944626c5e6d1284dfb77bb49e6e0841
SHA256 3c9c93c56f0028eb45f3f69e41e8caf244484269657daeb2fcaece81bed9dd12
SHA512 12e5669f9a6a0e89ecbcfff9ffe841857f1caab3fb8e99b7657e0e5915dc165add030907e13650314a43eb30b4bea93c5bd304a574a35312a6465ffa249a0c95

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 beab4bb6b25d0b5d34344ecfbc639aa1
SHA1 7cbb2e2a5dd0f7905f78d9bb2c1dd19762cdad98
SHA256 87f7bda95f334f45ebdd5bc355c8ddb76731aea00e228cffb0052e59150d3343
SHA512 d82a5029216c5583a54dd92a94553c6b4821cdebbe26096ca9b400970f7519d08efe69b0e8e7dab6199d0db3187e9ae93820ad3d30ba7572ae6af2ab651acd81

/data/data/X.God.X/databases/google_app_measurement_local.db-wal

MD5 13f4b8b03b4a217f08fe0e5eecc1d618
SHA1 f64620d6823219693cb5ba5fe760e5eded4a09b1
SHA256 f4376e9033fdd72129c6fd38b479419710828fe2fd4407b056f2ef3264051793
SHA512 06192a86eb358ae3640e66ed9bf2a9e8445614da21bf2c127b38f7def74b11cdb17cf226dba057e33214f9676bb1f61b55b31beea540e66f81bb9ada5c3cb37c

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 3e881d9a01ca707bed38018ac69f4518
SHA1 5820f9351d7cc8082de6e5686eb9f8fedf6fb830
SHA256 4a5bf9bfe9b032546f886dd5fe6717de78716734aaadab620c0444ed6df5151c
SHA512 8f0395c94b3a449f3c61e7117f400c7b8a12c23d3655be6772bce2c8aa0ec8d8be8000c5cd2c6e10b334ef54a4add5583717393c3239da80c334c45b8b392db8

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-08 00:18

Reported

2024-07-08 00:21

Platform

android-x64-20240624-en

Max time kernel

20s

Max time network

185s

Command Line

X.God.X

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

X.God.X

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 172.217.16.238:443 tcp
GB 216.58.201.98:443 tcp

Files

/data/data/X.God.X/files/PersistedInstallation2388754558086105502tmp

MD5 aa26e4c908ccb5b1d8958af2b0d84458
SHA1 9353ea7a15ae775ee80b3888b1d874e124131735
SHA256 1cb09ff31fd58aa636c10f44a40006e178eaadc659a99225d1d4d256a0a544e0
SHA512 28e4e9540e466772d776599357193c946099c42b10645eb81854fe26f1e44c1b71d34faef5f6dc990a1093bb2efbca03d54e759131ba0ae89709c2e0ec565e9f

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 c158000c37e87c40aabfe1812d90e3b2
SHA1 16a793395c9daa5d8ca54bfbaf172e66b514611e
SHA256 a52901c40e66d1a4eaad01bdfc3aa2c91927be6d56b6894ac0b3bc6cd4a20e4b
SHA512 5aa254fc814d067a1b9326514cd8f27e2046a39ed7f501b64e87c659ca35020fc164d9f7e0a0a9213a702daca5f3e423eaeb16c679fc76abcfb5663449cfc447

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 f3f89f622bb0e51872bdc7f0439468a6
SHA1 29c1abb2df57023a50d959180647b4bc88212c07
SHA256 383c63719f2ccb26e32137b296c68d5f1289642a0a47442abcc3e0ffa3534df9
SHA512 b74e1c651c6908a8cc5be504cf11d5a767e9e8d0247760a812d50c4be55762206b4397d38004489fb16c515873d97bfa47031b4a3b4c7619e0dab5da81b9ccbb

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 5eb2b70a0dd3bfd60c747f5316bb169b
SHA1 f1f95a2b8691e3814f49280500f80d534f4c934f
SHA256 61f0050fae5fc493ded25953323709e6a397eb340f170673bbf5f8be7a890996
SHA512 57bf794c826d558f3e37e4546a95126da4e7bfe8ed48145c537fa095d25a3233218a9fe25d16ec24f6929d352cdedb0f5c450fb4ce11775689f9cc2f3840198a

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 9b8527f04a34cc826829a064951e0785
SHA1 5a9a560574e1cd8508b1ed25a4739428ca854a77
SHA256 8e7404723fc4414691a3c8504d4c25fc49fc3444900543d2b90ae6001826084e
SHA512 cf80882cac6827ded61416935043c18865d03b16306976163249ad0ad2ea5347eacf6105a002b961630f4f3dc3ef8099987d81af007c331af8e931943cb0b134

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 4d4c502c8ac36905614e687279f1e724
SHA1 ccf6ee4f0318517e113c758dd207345c30384d31
SHA256 081d798ee49a3d12419ab09d7a224c6c0b85fd5f3fb9737b2d407e985aae4f9e
SHA512 27cf2cf8706362aaa35087103be78768f9466c92cc4c7b17e7a12282b175d85d6f035b455f1002638b255204f0223445692507f3457771bba964d73597400742

/data/data/X.God.X/files/PersistedInstallation3625676172271023821tmp

MD5 dc881d6483055332e6692147ec8d683e
SHA1 fcdb2251d59691dfeea37e4d1cd84235c940acd3
SHA256 33d174f537f8fe06b7fc68d510ac5815655f7be8c98fd832ad4283ffc7204053
SHA512 e74bb62587e842c167431eec3a5c83ce0989ff07b68ec76eee73c9580afa284ecfcc5196c1b457250103b21dcf09d75f282f1fc11b70c4b53a1a0b87173a685f

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 a78002e88faef956feea76be8ab1c091
SHA1 0e2112eced8de256f3b0ac2a8bf66b71618652b7
SHA256 5d0f65ed99e38196bd412a1d7bf03565355e817a56bd8cac62fa9ed2d7e0c6b7
SHA512 1832b4f3ff051ced0025348b96da8f6efd4c46ad0c3ea633281ad9742e3b13ad010aa2f2d6bf78741b0ec1c76066448a15782d6a8576031fed1fb4bfb2d6f6fc

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 c10c518a06501c416489487fd35eceda
SHA1 7d401dcd9ae141a17cf5d397e193f345d23ba99b
SHA256 08a722069953974112da73ddab6329ef82940f1d4ee4db57dc5c54824761bbbe
SHA512 0f03deae5e42c6723c1932cf8de1af218a7d475e6fb72d8cf2c3bcdba735e3ec721af5f51af3807b60663024ef47125d29e1bd36d986b81e14459188d31a0109

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 6d8ab2e6cb80a96d8a36e2c7e0cff6e5
SHA1 d65219be144737bd43b895ff96df6e6c145892e4
SHA256 beab3bb73c276cc9b4c4e212355bf6da99e749ec3077268edacd1cae2abb1558
SHA512 1c3e711e7f34d076e582ad348855a8ba512d7fec67f53e87ba9b0514f581e27865c32d319cedd447d169754825d587f73872710c07e07710b5ed81f3cfdfc282

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 317bb28343a095925e8f2d6380a086b7
SHA1 5c301f94607a2f94057334288449153d35181647
SHA256 00cb025c1f62d61710c9268eb6a24243b64879d2d54346355d6aaed5b145c360
SHA512 ba66c7873f7e1f8669701a8f79218876eaa56ee90bbf20205e11a35a8e04824d7707b59941a1a62e33565abf6345a8db124f4d8dbd7fdc48ed5eae414ff27f07

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 2062bb625fd88bf1f28b4d0a76c108f0
SHA1 fa0f86bbbc69d516b575d7029ccec98fabf2bea5
SHA256 2a22665e3328c4725fd8700000f5aef8a1d2d5de8f12c1dd29e7252ce66740a4
SHA512 ecb1b822dad060365d6ed9c242b3e5327408467a06b1ee2816e168108173b1bbacc82aa47a326dc4b9902a5499b0bbc63c9590dda4cb08081d4a57465fe42695

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 adf6082723784327d7d1b34adf974e7d
SHA1 b1502f70eb881a1dfe41139cb719fefb877ee37c
SHA256 252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9
SHA512 762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-08 00:18

Reported

2024-07-08 00:21

Platform

android-x64-arm64-20240624-en

Max time kernel

20s

Max time network

132s

Command Line

X.God.X

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

X.God.X

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.206:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

/data/data/X.God.X/files/PersistedInstallation3092712713336222063tmp

MD5 50ec48a1bfa6cbcc425d6f8ae3a129dc
SHA1 fcb76b084ac1dbad66de18b51e417802797c0000
SHA256 73580eef62928c39e63107328b65b316d5c553ca5a0623d00eb4aa6a8eb51287
SHA512 407108c08e73559aada313d3cb64240ea4c0c8174f75bdcc31ef5a0223f74f73357b18362b186eb4fb2c5f35492142a5e72ad2e805cb647db05b190b0b60e599

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 4d46f3d379e56500759755bd7aaf70a5
SHA1 fa6dfc795f2513b84cd36645bd2f2665577dda10
SHA256 f52aa16309ca69c002eebc86c6713f873ae64599ace2a033e5b1da287f1d91e4
SHA512 eecfc79ded6700f742d4b4de032764ca74bec9d042b6d596ed147dd434f1833a6d19cda87076bb863c60325a05d1d72d3ce6bb2fc37515957b29d1a3d283fdc0

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 72a4c9c68eed91d75daea68058ef0a11
SHA1 b91e7d4a94fc4ecc1838e328c91b5e82352139a0
SHA256 51489c6bb690ed349db647534755680b2ed20d5e3d7f0fdbc42b16e96c9d9295
SHA512 1a3802f3629ac2abe1db76f0e06225de13bcaa84fed140ea2c04274f1638f1b999c9df56de113c340eb4da6b56d326c7686742b22fd594465c92645360ca4e47

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 81b0a7a18386a1d3023fab4390686456
SHA1 84aa0e98c179a0599bf1f5883094189f4db7e5a6
SHA256 f92132ad932f26ca7b2a4a5569aa985bc640d9c84ab7213c4c4af1ec9610a026
SHA512 c75b2746da0b29ccac6b66706411e30b4c9e034ba8a30ea4449964dbcad4ccb3ae312846f7d344d6a786a08123bf3f2151bf777578f26da33cc0f114ce41a037

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 00e604e58f1e2a39f487dc3cfccb5508
SHA1 60017356841992fa298196e3f3d6ec271e9fa21b
SHA256 9fe2664fd8bf6c2751d564e7e11aeb4686a04c5ba22af8f2977ce5b971be43a0
SHA512 0994542fcf50c59e933a9900a261949db5616876f74c74cdd751a520f0561fda333c37a05d1f03cb3a00ba01eece0e576cae62cf0810c2e1a550ec100c012f84

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 eb256e14c2b6500eb1235cec9fdbe7bb
SHA1 a14e3f1d8c210850e7ad4b387c63cb18cc0cf586
SHA256 b379eb4e314e4e157d9584d8854b9e4ed8a831e2b0ab001c79b9b4020cf2c936
SHA512 8e7bd76d0c63b9fb016d7f5d8ee1734002b06bfe3f6bf5a2b116a5ae1a030e8996e913fe50d0612c20b26b55933d883009e1dcb033e1d753db1626aa84932087

/data/data/X.God.X/files/PersistedInstallation7793032041066112759tmp

MD5 04ac296c19c1a635e34c7adf7e99fff3
SHA1 d94754a037c82a625217e0ebc972ca62960404e8
SHA256 f35eb0e421241b7196aa1f817573133e99e2e77a0de197b91df52c98d03b94e7
SHA512 f3973ed9b2ca121c5ea36c9a9986571eda7a85b9fa8e0994b1c41dad8a0265dbc4a74fd548cc0e5ff2812f140a74c09232214b512eb39f8e9e410baccb8e1b7d

/data/data/X.God.X/databases/google_app_measurement_local.db-journal

MD5 a458a960a6ab14f15bef18b819f4fc89
SHA1 c3cc7942ad7c36822623c6cd9c97205996506f9d
SHA256 558c0e4efef41588f2a1aa30154da92ab943648289716de25de5bcaf3597a049
SHA512 f45a660a2c7cb228681ebeb5260dd85675184d02919a78c5fa0e9f0a78089fcaffe9f95bf32aa39df3f454d883145f79fece0af633ebbca4c4c53049844cc2dc

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 6d68b465e2b30eddabd96850c06cb99e
SHA1 042b49a250599bcb7a748a2332cebd4099cd5f96
SHA256 61a2ba4d15f30355ed1d9531a772ae2b8f1042a52e1ef6d3f117061fcb96157b
SHA512 e4f7f144cf2f7f4e31dd07eaf242954654b01d0c4b59fcf0801017c7664349c46939fddd77923662673ed6e66af25316343bc0fcdf2503af63557ca7cd46adbb

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 1f32ec80d65a6d6fefa3e6c8800540ba
SHA1 b89017bd62c1afadfc2283f54931697266b68f01
SHA256 88f4130915f3a1c871a5464e508941d85b9a639d4cd811277738acee5c7d6b9a
SHA512 2a29a5f4efd8aab0fb5da128ba6a03ee174f1b51984089d6c9c94491300936df19b18b325bdd0bf2f38eb889848b87ab3fadb64e1afe7df3e52e9790f5cff710

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 825537eb90d8cfad9d248c689f729d3d
SHA1 63404b516d251e38082b1057dcfafd122ed04830
SHA256 346a74a9aadddc72ed48b76ff8f8c0dee35934c0ac2f610ca5d9c69db13f643c
SHA512 6aa96b3adb63dd8de73cf5c55f639f687fe6e8fa5770a6cc5a4c2907b38d4a1a60ad3f0a4617066c1b6df0eeb1d7b7103f969aa3ca0baf370f7f9907b0fac3f8

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 b8ac3db287f0c770566ce507dea82c63
SHA1 043a541efea7aa34fcf27fcf04e1e055c918f90f
SHA256 aa6810ca2254483a54750014a907fe62ee5864ff143bd550233f368f5fd0bc30
SHA512 53fcc4b31b7626becb3162f745dcf4308770c260dde898b3d1cb41592549cbaabb094d422074ee75990447ab47dc65a24852772f97ce9162ba639c838d38f1bd

/data/data/X.God.X/databases/google_app_measurement_local.db

MD5 de82e2c94d2718988804b035a46d17b1
SHA1 705f5ff19093ad209f2a666085d6ccaed3bf58a4
SHA256 29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39
SHA512 68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e