Malware Analysis Report

2024-12-06 02:39

Sample ID 240927-cr16fashqg
Target 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
SHA256 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
Tags
truthspy banker collection credential_access discovery impact persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc

Threat Level: Known bad

The file 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery impact persistence

Truthspy family

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Declares services with permission to bind to the system

Queries information about the current Wi-Fi connection

Queries the unique device ID (IMEI, MEID, IMSI)

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Acquires the wake lock

Queries information about active data network

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-27 02:19

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-27 02:19

Reported

2024-09-27 02:22

Platform

android-x86-arm-20240624-en

Max time kernel

18s

Max time network

131s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 a8d35d7223a1283568ee2c208ac2c34a
SHA1 2a5887bfae216099a9d8e8eeef981d425458c4e7
SHA256 a6effe9b7081d762b3fb7038c5b493456d653119fd9418c4a8065ce1bceb76f0
SHA512 59645ea4e834a08cd85cf9d3378a9ece69bad4f40c5137ae845ed2f85f6ece41278837ef3f2ff3cef6e452c62990c973bd8f0771316dbe611ec94ee5d60c0e78

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 275793eee3857eed50c41e06a9b681f8
SHA1 d075f34324b45fdb7a7a177155117c9521d99e41
SHA256 a6cca82abf5907b076a3ef0d65119998f64e3066c8d44537ed95edeac630b6fd
SHA512 733d7a4a5efba99f3ddfed212d740d9811a9f5791f194846548c096b80a79e0bc98ce60f4d49e0e7812888c555f2f1aa14ef0682d3cc64e205081be428aede54

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/files/PersistedInstallation7203321821232067117tmp

MD5 270d861f353fab3bc2e47eb94631ca34
SHA1 ee923b21f6eadca221bb685e267830b3a769134d
SHA256 17608b54fac1db415c141739cb7364c245afca372df6fce547d739f21a210675
SHA512 a7541a4123b751b100c581f370de99f18db55fac0fb15a30283b10c2e2675e10deabf5d2bdd95b4c15394c7fc9f85dd1cbedad51d15c640195aa224c3c14ea8d

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 c49d313fcaddb822078e556bd1ad248d
SHA1 2df675fae9e3cadd6697664e9302a5021b196a67
SHA256 df4d40ebc82c0a1785b4533fd543c43b6fbb2ecbcb2afb591bb48dec2c1b022c
SHA512 82dcc9ce1f0791ff98543bde0c04e2ddf9c536acad6dd94fea2991eaa25c2b12a278437a94ee6f67c25a5b82e4e45da786458480d7852ade7869f62d3af568d7

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 6f413e5c4f8abcd875379dfbd342ad76
SHA1 e94c04e5cebbb1bdde10564b446caca95467212e
SHA256 69af27d5c564d5710eca61c27bc8d2c2a22655faf804f1cdc0bbf066cba406da
SHA512 086681c0d1234b1efadf5021db74b3cc8de9fbe1a27d2c3a4a7d6f354973765b6bcecd26268a5e3d03a68cccb26f171ab38efad5ffd878d83cd2ae83f4465ab1

/data/data/com.systemservice/log/log4j.txt

MD5 74b3577334694c1521cc9775b1c0352c
SHA1 b26169b6a0ce92063ffc24ac612b72e798744937
SHA256 4da610a4eb79e0bbc3bddbc10bd8f974b5716e069ee3b483e31a70fbf3b0da26
SHA512 82b85bf92bad0ffa32073d64ebe8832266eae1c9e598c167039aaa66bf7b21680765003c7faff243ef462fcf1e1a242a4eef0cc2a1c9e44da9487d525f4ff8a4

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 e129f66ed63d498c7975da243fefc344
SHA1 a52860a0e6a4f9310ac140758549f007013276a3
SHA256 948c3c45f86d05aeb4693f4286330a5f3ab21954eeb098c183975dcfae2d6625
SHA512 a0f2c715fdcac8fd51bf1b0064c8f7d735075be917eaf69b9dbd1b7b370c06cb00cc60d810035cc40d41644961a4ebf70e67ce2d7c8d78dac60f4622da7a1a2c

/data/data/com.systemservice/files/PersistedInstallation1953719659072681261tmp

MD5 c8639f8a68d4b9a62af071c492c5335b
SHA1 12e9a623f5610f91f99884e70b9a97051b75c08f
SHA256 cc73468c39a2c02bfd188528560bba2ca4ca6099a1e3688f457be9894acf5833
SHA512 cd882dc5b500c89ca5b2908fddc27604e129ccd72dc221424ba5aacabb539a4f73d0ea0b992dabd558d13bf97c2aca3c8bcead3a777b0c530ea9a5bc617ec21c

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 21aece0c05023514960b8c1d3755467e
SHA1 9e7f5a1fff4c0abd44810e063d9c3d1cd59e26cb
SHA256 44df27a6554b4c097bbecc19572b64d01eeaf5264b84db90f2243550a9a41c26
SHA512 07661931b3202a07c2d89a2ed006059356e9986bf5e8834794ff447c35eb0faaae9732256fcade0798e673d80b45303f35869d659a31ced5275c897429419263

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 fb5b45fdc29b57e66317481eb6699f15
SHA1 a3e1aa330cfc1ec94d770ae31acc1fbf864a3bf0
SHA256 5671570ccb3562f0701882048829fc1ca40022b8ee94e19995dc1fd153a798cd
SHA512 ea7a1b6cd6d38801c7de10d3e581de28e30dc9dfd2d1d5cc660894935213f6e6b2bbf88812b94657e36a441ad0f7b1b25e510a299525e77a3a9152f636639641

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 fdd83e201f17a51383761f1e9622c4a9
SHA1 0242004ad01a65c1cf3eaab9d0961984f82fecbf
SHA256 ec389f40ab569e41f1eb6c49d6f8ccc30e9f2acee0b79191be02c26ce63600e9
SHA512 d547fb6043e76aa2292c7dacf8587b7f09185c94b6069d3d2cb6ca98dac88d8db7666f486fa1e86962329e0332b12528cd08f922e6355c1b6c034cacd233406a

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 b4b6aab5d5b78786f1d19e3ad64c7057
SHA1 7f7db6e353ea877733a55db8c70ee1bb5eed9c19
SHA256 1b6d8d019f08f7397e27d0e0a7666d9ee78fc777418a9e86d07b2b99071b5a2a
SHA512 3270702d1dc72fca8e5b9b5d88e8b118e1bb2cfecb4570234de9278e46c4c97a1d495b7e89fd334b03d4060f7e99c02e667c33d66846fb7584999bbb69971231

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 8a2076c5b271f07d8c0f038a8e04ff1e
SHA1 1d1a9def10fccd807fe56be87b5ea6d52c95d4f1
SHA256 904f26952daad5ba521acf4514d16a1faffb7f934ff1cf1e3f3aca4321cbfd20
SHA512 7c6e99f277de57c824dd4c6c97492d3abd9d0342fecde601056849e35653f500e31f2e9c6949b6e8b0410c3a2767b350c42f37c4bc0f6e07f1fe81a33729fc39

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 9081e2b658f59867409f64c3a0d1fc03
SHA1 560defe3df21c141363dd4151b4ffb5070c3268d
SHA256 b43bbaa4c895503c2d2e9b0c80efb7ac88a73a1c4cf749b5c6171ad94ea6c16d
SHA512 61dec07f8cd1d065659f8b983845941ac45a848e48df14c69373dcfd1caf28d57deb7c4319f7345f6c3fbf8a8235fc93826b3f14924e6e2da17ac05b9f512671

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 24e6a69f4a3941f9fc4e59707fa27f20
SHA1 3c7c4057bd6cf94f83cfded9bfb95d2517760f15
SHA256 4696ca8395ef37c95112bb1b92e4b38d21abe04a85c0e3e133486548b3feea13
SHA512 0c788ad861e1ab0c2f40ef522a7b0682905e9bf8c8b109816c42b5f5aea04caf962598e19ffc08c7f8c288c51345c8f81381141130772afe43af7672ee48b842

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 503269cfc95b5b58729eea5a99735a6b
SHA1 bdc7e44868675653f285de0e0fa7426090ecc627
SHA256 a0cca0b6d90a2a9ffe96531c29de737042de0e86792fc84206f06b1a58868daa
SHA512 0374b163fc9fbf205cb7935430659c4c2bfea575db667875c3411135bff0962f05fb7849886af47c9d8134363a6735f3be2cd4bae5b0598bbc0192fd4c5b03fc

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-27 02:19

Reported

2024-09-27 02:22

Platform

android-33-x64-arm64-20240624-en

Max time kernel

20s

Max time network

133s

Command Line

com.systemservice

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.36:443 udp
GB 142.250.200.36:443 tcp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 142.250.180.10:443 remoteprovisioning.googleapis.com tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 172.217.169.67:443 tcp
US 172.64.41.3:443 udp
GB 172.217.169.67:443 udp
GB 142.250.200.36:443 tcp
GB 216.58.204.68:443 tcp
GB 216.58.204.68:443 tcp
US 1.1.1.1:53 rcs-acs-tmo-us.jibe.google.com udp
US 216.239.36.155:443 rcs-acs-tmo-us.jibe.google.com tcp
GB 142.250.200.36:443 udp
GB 216.58.201.99:443 tcp

Files

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 676475a0601da2cf6dfce2c1afe6eacc
SHA1 499a539c68eace1d50be33deb57f7180fff02084
SHA256 69d83a1d5f389e9c58a19cecccbe904957e3b923ce97a6e81f5e41ec3bc941cd
SHA512 89f58cf6a7ebb6b4ea1c6d23e4b4f665c0fd0182ac7ea0de5b280ec5fbb51b1e9b0c5e050de6c7a3d169c44c9f4135903d713b890de2b2aaa524ff655d768adf

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 3c5a1a525688ad39af1ca81c92397197
SHA1 d3440eb5e3195697e030b0a320266bb10d9faa67
SHA256 350a22be02c5688ac63fd071eda8fb76a82bd55f18d5c918545755897a70b7d4
SHA512 0b31fce68e3d9c04387a04e97fed9f42953940bd3d7bfe387176661611b61559e136bff79fdf1d74aaebb433f32e574f222473f61c955fb195a17b699790a44b

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 8319658c10aac40799899d57e97e5f2d
SHA1 40a0b9b86ac14c7c9356ba87b9f9565b143f7565
SHA256 bd8c3f3042e2bd8f5af1f43adc70284d5d3339f6701cf19e7bea790698256fbc
SHA512 025774a9ae929f2962ffdc12fdca3a22002e7187e8d705d8025f2ff11b74e0a67da609e52213ba0bcbf9576e45a08defe9fcf383f05f594a61470e2b8c858bb1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 5adaf41bf5ae08dd43833c3a08c5ca1d
SHA1 5ae2fc1a41a39933a36041533dcd8716f974978a
SHA256 887a42b81c19e27ca69edb3f4b782e1f89340c1423d6c49b056ec284ee7802b2
SHA512 c26fde53b3f8c1f4aec89eb894515e8eb2c01ee800f86550440a8b4664d19106cf191a9344c0b8680828ed4691399c9758d77d15f35e3c84a0ed66f21d5ade36

/data/data/com.systemservice/files/PersistedInstallation6907304384932853097tmp

MD5 fc1a92e4a32966ade3b7ba9d9d52a055
SHA1 96b995da02c49fce828f86495c8ec791cbd45fd9
SHA256 c26c1742a767c27147f52dd09631ce150214ee89ee85745748844cc740ecc941
SHA512 2b564e963cee412960988f093ee5a0cbade4e515284a436ec999af934bfdd74d0ad8e7029f91d8e3098e8900e17ca4f9120317589de47cacbadbbf571d026a0f

/data/data/com.systemservice/log/log4j.txt

MD5 7537e3ea442dbca95cc9bc73fc87e741
SHA1 e111e5c78759eeb6ada1d7cc1f1141a3c019e8e9
SHA256 a982577d10fd794b0a57017b3fbe9ef2e9c01f94c7f63955d5535d62043cf305
SHA512 c38867ca20ab6a1322a1d03c0aa2b2bb4a54e519da07e517423ef8af40eef0da3fea18e4f5c2be3fe97855e9a84e82eda1f987b3a82057e088f0f9d0db16f714

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 6c7a085b8ae7fb0abdef7c283445b0e2
SHA1 6c563bbf806897962ee9f11fb52ec4898c8ca7be
SHA256 40effd37a2333b15f2d2d633cbf1cb4944998d3cad9f748e05c933382d08c71e
SHA512 cb677465385f82f18318d5853620e151b04fad910859cca7650759e0c7152a1264a80c9f21fa5d928ef25429e5ade39f9936d24c3f3a57f0bc982d5a5a5d5694

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 1be7389f07b55d16368be520b71746d6
SHA1 612fe65daa168abe06cc0c4dd3f6db564652f9fe
SHA256 e48a126b0e6d06512ecc526174da05c75e9b04f1a30baef85cb0cd1387683b0a
SHA512 3707180fcf4be9f556f2a49bef20fd5adce6db9a64063ed4a1a03150475cc2933306f9e8cc8ec90583ca4c78b24e5272e2eae943069f5e24b8f6245de7dab003

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 dfef211b7385179d74f206ce70158acc
SHA1 63ae9f6fde67d4f73ce9f1d666e9238d43e09f91
SHA256 ea104671ddd4540d74f8eb62cfb8f1b1fff9c8444d6fd02fd8fd1c002654a865
SHA512 da7253a10963e482b1bc167eb190e201b9f2e04cd2db31de5c719533e44f74d12c984a5341891540794fbac2e7f97fef53b6e5fe39eae3b6f02fc7c5b257fbb7

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 51c79032f303d9e8fb4e4d383d4b2364
SHA1 346f60751ae50faa40c0e451de21670b41e92d68
SHA256 9d089bd904268f8a00b3f46dee5a5324511f85796fd6ad29502fb5f91699690e
SHA512 760dad08021e7665b2f5757905ce77d6a6224b767d2dd6b2575371d514b326e26d67f4f593e6c68bbdb509e0e6b3ab77b034e87c027005ecc141a17e0580bf35

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 95963b648989c889c46708bc2aab5032
SHA1 d64551744d7a6b4078fa20d80fcd4a25f0029016
SHA256 480afd241546ddfa5c27ace823c90ace7b6abdbe23a66949490e996f2996fbd6
SHA512 225db53ee4732125733d9a403a380bf4aea6a61f2f4d68778484e2a5788d88fa3ff959a282d30d5c77e063ec4dd3dacc6cbeaf667fd6577fa87832193f2aa760

/data/data/com.systemservice/files/PersistedInstallation4084395489120680956tmp

MD5 da280e3f62143a46264189c7df13b728
SHA1 7ca2e7b46a73b342566ffd34d9b7fd29fcd6afe8
SHA256 6cb7f4c3f4cf4198198eedb1b4fac43879e33ba183652e28244dc19585879d0a
SHA512 dc897cc7b34ec958e1b47786e24ff95067db521b411f133bc6379653ba485609dcb5cf4fd820202a4a74dd7860ccfc882a5b3d2bd72613a60889923b1ae98125

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 06b805755663008739d6ce03a124e202
SHA1 3b720943dba8f7786351f80361bc70011f15135d
SHA256 6183aea48ad54cce8fc1a83a7b62621aad4f4b068cdfc2d1c1d11cf54914f275
SHA512 dfe9a3f26d91567059b52de6f270eb5ccb8c5286cdae89914ac6bf8a39d267eca4304b52ef0c42d95d5bbff297749dddb26869c1f8daac5598917f2202c06667

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 92bee05b44b55436b9d43282af9a7310
SHA1 3b58f899dbf741e89a8a17557c240bb361da7807
SHA256 bc02acfacbaa01f8bbdb70f40d3dcb902f785161b38059ff5be980dd7ea13535
SHA512 7d6146f7c275cf4a2e7b39e92b1cb621f5fd03c969b4879d3419664986c22f6448dc7089d63d31d421cb80b064e4d083bf6bb1252f8cce3427f97d44e47243f2

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 2e539c3deb0bdac88e2c083f83764602
SHA1 8aae98e38aab0b7dd2e317e91d607ba4f5032759
SHA256 4be3f03dcef7dbcf1905ef22aaf677867514fb44b1d7cdb94a092a64fac9cc10
SHA512 094610b5f16931680f906c7148a79637c2863fd6032bfeef629c94bd8e7c0e83dd9b4604f53af0743b527fc532231d7770195b008d717198dd2aec76ca27b5a0

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 5ac51e5d619125c275570dcda8ba1982
SHA1 389fe4043706cf86024d77280f0cf3e6411d591a
SHA256 73651bf32b46f26bbcc86e559647b332aef3fd78b4e315c842e033775b95e2e3
SHA512 66a4cb95954cdabe09709417ef0330d02d30158921abc6a2249fc14f2ab787ef53d2ec4d3cf4f764357c6103514236771cf214e9f3264baa9014ffe9af1157dc

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 992488318da200392c829ba9c3730b0e
SHA1 5e039f2b02318201f1b8e1f389e0d3aa9593582b
SHA256 9844080031a24904400b1cefc146a9d5305613b261f1b751af22849869de57f6
SHA512 1540d71e02ea8e6f5659a22a59ba51d6e29d61c4e5b707685d83763423c3da8a216bd6ddded22a5c02ba0f87a4d2da2d75a83067d16dbb193e1367805ddf7a91

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e3f13c7d7678604e5b293f6672bc0ed1
SHA1 b16c998ac7ca1db79cd4983b207a292ac1d96e21
SHA256 486eb5bec4ec277ea7b334a0d0e431e5e62881d3462903e8294640edbe96b2e3
SHA512 b63bab85a373912587e78dfc9daf8b4168a223c7af08fb87de8140d66b9f35042052d2d25694e4ea7c9f2064107e5471318b6dcec39c4e3dc0aa352627fa09f4