Malware Analysis Report

2024-12-06 02:38

Sample ID 240920-cw2yjatfrg
Target 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
SHA256 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
Tags
truthspy banker collection credential_access discovery evasion infostealer persistence spyware trojan impact
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc

Threat Level: Known bad

The file 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery evasion infostealer persistence spyware trojan impact

Truthspy family

Truthspy

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Obtains sensitive information copied to the device clipboard

Queries information about active data network

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Queries information about the current Wi-Fi connection

Requests dangerous framework permissions

Acquires the wake lock

Queries the unique device ID (IMEI, MEID, IMSI)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-20 02:26

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-20 02:26

Reported

2024-09-20 02:29

Platform

android-x64-20240910-en

Max time kernel

13s

Max time network

149s

Command Line

com.systemservice

Signatures

Truthspy

trojan infostealer spyware truthspy

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.212.234:443 tcp
GB 216.58.212.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.46:443 android.apis.google.com tcp
GB 142.250.178.10:443 tcp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.212.200:443 ssl.google-analytics.com tcp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
GB 142.250.200.2:443 tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 2dcb11f8fed409bb8db801385ffc7b52
SHA1 9607a394fc8977cbf5f612ca2f9ffaeec53bee9d
SHA256 d9d013c9c78e0a0c0d2e28c7804a6a0a3aa18a422dd55a13660c24ca9cb2c7d9
SHA512 18827f1b9bc4a24fb9e892ff10b686c022584bfe13a1e40485bf6102568dbc3c3d9bd3777322b1511f553b0066e8534af800303646ee11ec7a9555b7ca68a8a6

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 01e6b0f091cf98c92eb8f000f259e8dd
SHA1 70ec97f414baacf7cc83ee24fd3ce5b15a57740b
SHA256 7cef721d63c9397a413633ba1c81110e6cfe06bdb3527e65d8aa167b7999d32c
SHA512 88dc78de22336a1b50296fa10f42782d905d2172a919b2edd82d2e2ad0fb35c22aeae16659310b34ebf85f645471212dba8e3cdb76d7bf9e9debb1a7a130bb17

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 089cae53a28638cfcb1f7278c744a06c
SHA1 0d51fa993106036b6a95c6937c0c32ee7992856d
SHA256 9cb6b249ec7eeee75b0debcef0249cc46c985c722141a02610e1c8a8cefc8fe4
SHA512 04666435201c272bfd329c3698b33a226be42a615644b7e65328c340b1003908d070c4d9ad088e9963f8e4e831e3bc256399f78158eac093b6cc2a5b1a5d08cf

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/files/PersistedInstallation468223345222067595tmp

MD5 a01bb20a451035d3614fcf8cc5ed0343
SHA1 8bd83f3a2106056d0c40b7b8e7cfe2ea37c0934d
SHA256 8abe26d407be70ea30450b42c5b8b611d9e644615d15729dbde9deb65fa2f889
SHA512 a2420ebb06af60e56c83734acbf8fb8a59dea9070e5e284554ae2e7d7a544bf48b553b5207c40f2b16e07f58ae030b361ce3f96abef6a9a8d87c1fcae5c7d790

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 2fd94d47755705b4e40bf6d9274a79fc
SHA1 376d47330dacbe0cc034875b662f7d478486b059
SHA256 3d52a6587dfe9d05cf07cfc5e88e05f521181b8ca298095c0f7d07edf56ace17
SHA512 9f72fe4c78bc49f635ca821b7b5e67637900e12dd25022994c002691dc1df7daf9bf8feaea8f6f78008e6d0d30c448a1aeaacb78d9c4ae1ee9cb6007f4a047b4

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 e0156a303e3d82e502e2a56c45e4b8eb
SHA1 f7d6b31a108e6278e2cf6dc04fed6ca5bb719c07
SHA256 d7c9f9169db179228b9977c755cff54f1a39ab8227990aabd120d8c3479dc930
SHA512 3a775f5e6ee685dccbb3c07e1a6bd6ce06dbee4a3e7622cec19c43bfc825d10cb629b7c5d79e1dcd270eb3c77756c380ac091a27c1047acd6c21a67569e44ea6

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 ed1eab298ce0f5b54e0f00cd7ee8bd1a
SHA1 88afb6ddabd6287c1ae48fb9359ddda7bcb2c297
SHA256 94b64fffc3d1bb054c8b49f043a54fa144f286196362a991a5d1dc767a31da94
SHA512 4a534be6741d3635f9e5895fcb2026e605f5c85ba5389865e4a5e0ced2505296f55a931269bf14dfcd907660bcac8b9d3cfe8bfeea4cc1af42820ba7c4bd4d99

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 6ce0559da8bb341d10b3e85d218086cb
SHA1 17ee6eb7db0d833822d92b7005065bdb5e9deefb
SHA256 ed15fcddfe75739cbc90eb31bda27b35f156e7294229f72b39d6bdf30bf60040
SHA512 fc2420f3442fd881f277723f535185494b7e4918fa54f747a800b772c348cb3aeedba338b516e6ba4b6ce8e565daa533d28d93e436b2dffd1e1c42bdcac505b7

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 4528cc5d591c9f7098b4a728ab777783
SHA1 cb2bc2fc2cacd243bb5e86cd3490b164fad57c25
SHA256 3e21ec35875afedf40255dba9f0119b02ead5ffb4013c8cee6bd4aa529dd8781
SHA512 58aece8eedcce6640e40f5e35f4bf85dc021b9871ef795bb16def1383a00a19a89b737a10740661586ff76f3beb3262ac69aa1ec5dc598cc7beeaa1479f542b3

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 72c90d20bdf5f53aeae78c51cae85beb
SHA1 12715d4a55c80feb728a2213736e4e7e87a5dc0b
SHA256 c4ad8330039a3ac02e1ed65844873ebb572a620a4b7c36bc2b37d89d249dae74
SHA512 97585cb9b13ec964f62defef47fdad083ad19cc012070fab0845d7cabf9db01d76350d16e71d5659b4dfc0a070629add53f210bb25fb29ee11749a01323b65d9

/data/data/com.systemservice/log/log4j.txt

MD5 3171ac0ebe8d087a88623cdb4f512ffb
SHA1 a1636eb09d25771b1911ed49d39715eb39c228cf
SHA256 5c28253daa837a8f0652a09b0f41b1ec3842a4c2dd94b367398f775b6588e1b4
SHA512 7757c086553b6058cf9fa8db54dd1a764e9f186e248ad9446fa01d641a5755bfab9f0ee1953fda6dd75120145e41c80f50f09234fd2ceeb025d4b764e0e6169f

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 877fa9dc5a788acc91dbc5d0b9f9a84b
SHA1 1d17c9c4d10a06766d7380dec7d651f0859e3a9b
SHA256 9a54350e4b4719762dd13cbc4682002b832c6cfbef133db75b40203706d7d2ff
SHA512 1a36038fe89ff09f65ab1d09b55dc048db0850051ed509e33d3125e584c6122d61a824fb4bbef58dfa0a0d7c4bb275e301490d62e2e4d0f3c8a28beca600ab70

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 493da7a550b7b61d01bc7c1b1d116b52
SHA1 74c6cd0dd2304ad57e47e6027d362ae7d29d2dca
SHA256 6e531f40fed767c5a0506425b1e3376a379ccdfeffe13b9d3cda44bd7925ba7a
SHA512 29d6674b9a45cc255b7c0af87c2f96ea3d27106264689666aa48e211b06c2300d2da10eafdd424404756fa63f273a8f9b06dbb1a4ac4df028cad8cbd0da59b3a

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 fe3c59353600b42f25cdacf3299eb4c8
SHA1 1299bb380dcca03d21b30e51e1efd9091914a6b6
SHA256 9e3d66cb4fbc23eeafbc777248f832048abc6896ab728fa189b2e999ff77c7e9
SHA512 7ae9d80ef689382d3c02b02ed858b211cc91495290b22939601a9565ec150a50c6d62662f13b1d3ad649ffee18ce903dd7522c9f57d9eb0b6ce1df479ff730fc

/data/data/com.systemservice/files/PersistedInstallation6771672096377460263tmp

MD5 f2685ff722ca4ab589eaf9580cf56088
SHA1 63a9166936d33d8be54533a4af181351ff67ecaf
SHA256 0e43450da8441a0847d7be44ac838099205066e1da759b32420f2fcb18c3a1d9
SHA512 f7068615773f45ff11b8aba92cbc0f5554e57ef7524194f6334888a6a3d77de91973f533758cb2106c89ef3b9d2ddbb4b9b2357c7742e0397868dc37afde9a30

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 97286328c2b2688417dc2dd3175cb783
SHA1 9b765033704f8fef3b98da9b48bae153dac8a27a
SHA256 1bf7bf8895a6d156b1cf52fc67f02777ac3aba6f54619e8207c288dccee8b2c3
SHA512 9f3698877f4dbf182f8b3cfda252f3f76dcc8ee5121c4b9120d9e91f4eecbb936e9c1e4b3747ab3d8e6d39a92b9af5c403c97263535f5ef6c47a67df48e82796

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 1a3d389f446bb26c3679845fa12c1d22
SHA1 12c3e8e366a9b52e5c008f86969249a018806607
SHA256 408c6260309e08ae529baf16c5ac62347034d40501b86adbbfe0e3b753931844
SHA512 5a9fef31ee1a2e0c64da0f443291a51106c4c715bfb13eacc2db057a95cf0fa6101150c0a04d6dad18f1ed4d6a70a28e886b34555c638ff6ba3d488d4f179498

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 f871ff700510a56a54fdd56bc41b7541
SHA1 481548c8bc3254a00f497140278597b915460c48
SHA256 ab18f3bb605f3cbedaffc75b2d5a03fe21ab82179d268331ea907bdcd32c23fa
SHA512 12e3d348199566e137f02b63e4c8b4c722aa086128c0f1cea883d512075b8573d40d889d2b4452d9e3d9c02f523716da9775d93750c242a1a2d9e62f50f60fc5

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-20 02:26

Reported

2024-09-20 02:29

Platform

android-x86-arm-20240910-en

Max time kernel

13s

Max time network

151s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
GB 216.58.212.238:443 tcp
GB 216.58.212.238:443 tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.228:80 tcp
GB 172.217.16.228:443 tcp
GB 142.250.200.35:80 tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 5f9f74923374ac5d02c61ead237712ef
SHA1 f0f332efe2a3a9c51d7981a18e0ded4ca2790e27
SHA256 41962baf24333e6da5ccade386698e5a19a642c19ddfb62dc98a09412668a459
SHA512 2ee5e8d65eb0a0a1943c3bb1c067b687758bb85e4476adcbf56aae7aa67da0989df34c24d6d7572da5da40bc0a23cf3d2ad01e3dd2f2f67daa56f6467e466dd3

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 15042a5a7c6a243e5738f607849229ef
SHA1 8c660c9056319b1fc467a0651fd9a614a5ea75a0
SHA256 7b0bd1ce86f230e7ac34fbf3a8ae2cd88f57a497e732e233de42110f77b20c54
SHA512 08e03269f429c6be19d3f915560a8917c89c25e14c292c1c8170ca8a4a4e3eccfd2e2ca73db28719c86e2ce7355d992629ea69bc094a46ec24f69f4c043903c1

/data/data/com.systemservice/files/PersistedInstallation696777837936318193tmp

MD5 971f3704172d2ff0c0406c5d5432369e
SHA1 b69552928e5ecae7a8f800a61b2818c2cf9868c5
SHA256 50a55b0c629e0525fff01adc493295b59add98597138bb0d8c797cc935e679c5
SHA512 dac4c6acc88728a6f9b67bf8d3e3d46aa864ad7168211b108494ec82dec88c7e6e7e1151be3539c6e0af3c381b8d91553bdf866e6f6a6edc8d3b600dd9bea1fc

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 c88414c27d50a093a9a4e128d718d2ae
SHA1 9e40fde54a4fd9c69518811819d1a6dfcd34d236
SHA256 a9be1e2512f0834dbe5778e4848a22057dc67e09553d5d6cffd7b6f2ce10b10c
SHA512 e79692ffb6eaf335aaff190291c0b84112cf62e88ed51df636b13c3b7da85a4e04059785b60d32ed6d2673330e4606b73407bf7fd0faf3fab532a7d8e0c4475a

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 8568e0f63511db98651d543965e243e2
SHA1 7e3776115db5d5fa812ba5a3d4bfb76fcb833f34
SHA256 1b40996b46e3470d4e63add9b6e1fb1be7cb7f15a5d6e180afd496889c9c18a3
SHA512 c2ab71d12a7491bee4810d225003f305356a262bd4a12fad1c26a2a87a5ecc7cced3bf0303dab0818aa03b61777a03e130b7d35b7ef987de616b144b86a7a1c2

/data/data/com.systemservice/log/log4j.txt

MD5 7f7ff6a1c48f0f7cc3c1ccc9d047bc38
SHA1 634845086b0a564de11afe6f3b86b657c57ab0a8
SHA256 de5059a6ec5ed67a2dd32ece356356c96106e1f92484407a8a51504050317b8c
SHA512 57c6c71427f99af14358fb9055248ae1ba2bbe353d45e14599f0823ca63a8bbcecfff51a85e5e9da28ad5d8cc64308a7d65618eb0bb3b21ac8d1e69b989117f5

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 502e7904ceb7ec18e6cd41d57868c25f
SHA1 551e512ed1ea424b2211eda4f2809464054059a0
SHA256 34623b1acbf6349ee4d893d0463ec351c69c22fb90697f86d8ab3ab497d096c6
SHA512 6ece42d21c36b570f3d03b44105538e91f56c1a36fd39731c6daddb96a7e1344b0e90a8ef0da7287ba1e7ec86e3ede81d855b2fdb84b2b6e0775044fc9a6711a

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 271679146179f3bb8e279ddfc31c3de8
SHA1 5122a06eb62f147042b082a5c208cf5714a038a9
SHA256 316d5690b52170211190e4eda7eed089d4391f309c1ca9679bba65f8bfbf4147
SHA512 618e2ab84ea10af0bf59758c01c84fee44b3f6a3ee73f89b63d5181e4486f9956f548abb01f20229c3cba4c06e68bc743ed3fa52680f466191f2d99a16757add

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 bfaf493f61983fb1a5faf29a6fab9c97
SHA1 7204b9d43eb2634a9789a68a992728ab72fb91c9
SHA256 7bea7c96b5d818eebca62f9d68a0e394a4f38821d93632733e3290007b91d6ed
SHA512 1ad64173fcd420562c8900c770341e033286cd57b19a5fd94131448e022af87db92b4a21121bec3e30a954f864f0fa501d4440fe29d6f801b51870bca5f5fa4e

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 6422abe358c4e77a5ec38b84358c9765
SHA1 f477067af62bf41589bd963180618042322effb1
SHA256 51056c2dfa7c75ecb864cf78392803de912f060eb0b4fb9b0f87bed8a42ad596
SHA512 ebc10de93470e79d3dee652ca256d3e79461aec5147ba133639cec2ecb502e6293a6461173ece5cb6f603f646fdd2ab1b2cdb422a69f75ffc9d1d4e2ee7c1822

/data/data/com.systemservice/files/PersistedInstallation2982954649181223080tmp

MD5 0d025f24f937877a176047cc90d9c700
SHA1 fdff7c94b060bb5a317d8ddc16e284868ee92d43
SHA256 27cdbe4f6904beccf64246307344e0bb9ec972d6d610ad7c0c65066c92be7778
SHA512 1524e8aedaea2c83ea02f655c4648b9a56799a165990f615852535a02860f3722f3b0c501d1fc6b46bd376aa1105aa40ac9a319ca65cb93b65cbcf8cbadc0b84

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 96abb829e6447880172dc84281422c14
SHA1 2406b4e34682636149051f46928cd3230cc1de68
SHA256 37625773f24e77e53ed638ab5fab6a58576ea5ecead8870d82a7759d4ac82fd3
SHA512 26c897f416c40c28b2a8ae731f2fe93118a5265d6062e42429a4653faaeaa8e7ad24d8a106b921bfafa99e6844c44d5f0738ded818a1b90e349b213079809d13

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 bcc12bdccc4ea8594dbbca98db173439
SHA1 0097de0af7cc6fb186a58604b0afd914c308ddea
SHA256 daaf7b535cd42bd16c2cdec8d76c39cb284880cb1577003c03b6ecdf3d808f89
SHA512 a64e87ece6fb7983d8ff197c49c1be58060d4f73a067a20d80a319f0b9ebc042fc910bdee4a7458a4b9cb9a94417c37c421e57f752bdb13d92e0d1d4903405f7

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 4eb96bf5ecdfbf5e8467b7302ba3b3ed
SHA1 239184bf891861325c1b372d3a4111a5785defa9
SHA256 373562ce98d2a804772513a5145357a49512cc7b81f95245539e80ed81be3c18
SHA512 6075d35696b5c01571bd22e49e5543ef50f8fdade66a5a22425ecb0acddf46b18c7cef49c1e6230bcb5a44c1a0a58e8e040221e12439d9c5bf82509b8233e034

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 ff4915f56c1b4a5fd3a755930219cf60
SHA1 4796c28e6ea46565a49f7bbebe8c78c702d7b8c1
SHA256 fa918629b8841b9923aae8f43a6459817c73dd15d17131c931cddc5a9df0e4d8
SHA512 62c0bb0e59668d6d09950a41b6bab4c28627655de73a50e80097b9e734d6e6cdb0cdddf5f5c707e01cd385b2a677fd2b1c73a4eda2cc304fe05544813de32abf

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 ab84c7de16629f23f28bbd082575160f
SHA1 4c3f657110db835fe15bb3338e256b573e24da82
SHA256 ab43550d65b6a7ae65809034fd52eb2e737e699143171cab6a00d0ce80a42337
SHA512 254c3cbc3cf4a7d4bc615b416392dd822fef02dd344237a5acd6af75864e777f3357749cdd5d4ab441750ed736f9f13f3f6ac6f52562aadaa0097afa64514817

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d