Malware Analysis Report

2024-12-06 02:39

Sample ID 240928-ctaq9svame
Target 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
SHA256 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
Tags
truthspy banker collection credential_access discovery evasion impact infostealer persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc

Threat Level: Known bad

The file 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery evasion impact infostealer persistence spyware trojan

Truthspy

Truthspy family

Obtains sensitive information copied to the device clipboard

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about active data network

Queries information about the current Wi-Fi connection

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Queries the unique device ID (IMEI, MEID, IMSI)

Requests dangerous framework permissions

Acquires the wake lock

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-28 02:21

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-28 02:21

Reported

2024-09-28 02:24

Platform

android-x86-arm-20240624-en

Max time kernel

17s

Max time network

131s

Command Line

com.systemservice

Signatures

Truthspy

trojan infostealer spyware truthspy

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.78:443 android.apis.google.com tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 32a93c673b4f00e91c71289708414b70
SHA1 532827d89bf8969e79b5131a8d4efe6654a1052f
SHA256 bc81d9cae6c3b808ef6b8edd107f3fc6f350dac7e54c110d0328cb64cf2be725
SHA512 a3394f9c08dc685825463d66983ff94bcb8a93da3ec08c18e243e7aa4f03d6cd82460530dc57b602318c2af802bf71caa8c602f3ff41c9a6e86686dcb637ca9a

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 bd1f6e8a3841f9f4b3735c2350c465e7
SHA1 31f84a1e4a2745ec96ab2954e632036c54c2cc2a
SHA256 e988d27cb832123aac3cf0c1a64698923597182efe988d104c8fb017d2a97619
SHA512 88ca170544f6386815d607d3250a365fb006b3bac6ea0ad1a3cea784e659e9db3f0540fbf0956bb592784ea62bf3aa8cffdae01393d31128de80e33eb056c9fa

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/files/PersistedInstallation2278692290423120189tmp

MD5 10043259459a133204fc2aa0478ab0c8
SHA1 5c27a33d0fd45421d2eada50063dcd2622d2f6cc
SHA256 a3f974f892f1a8837f219f8864460970bdfa74e2112f9863080b0f6790cf4028
SHA512 a360c4acd8aea8f68fa21d3b0a3418ed08dc44f904adab885fa6058d350cc45d4e795a3c8e70477d406a15e771bd64b371327750667c87777288a9ba84d6918e

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 df347bfc3c37edd975e4efaceae5d49d
SHA1 ad9d58f95a1e26974c7c9e5d09327194dd4292fc
SHA256 7204427d00746f6771ffa528bc6ac94ba0fb0c7049110501da80853726a5cf1a
SHA512 b330bc0087a8149bc583ca6807b7f244a300f32d0cb149225f39c7c704019c7d7d7ccfb3f468c04a2174d58b5c2b721fb06ea23d2594775ec051dfb0fd538c37

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 669f7e0f565f8b8da5fe02578d9fd228
SHA1 e438b9acbccecb54c48f60c96ad038e976062494
SHA256 71a3aa71297eaf51eda420a8e36c394847e6819bbdf22ab9e8f631b0a388173d
SHA512 7150b7723af1c3a4047ae8bf1dfd9f28ffa56321643d6304f11c2061986da46291ab9cca5350f335c25d53df4cc033cf1a6c48f3bb3d70deed02e161ce7acb43

/data/data/com.systemservice/files/PersistedInstallation7828123823438777817tmp

MD5 cafc68b925503cdde556b7a2c28ecb1e
SHA1 5fa6ff271943f96ac8b4f5ebbd397fa635592873
SHA256 e5c3da5f9a2e1d427ff7a2eb0bb8ebca8c28aa12be4b63e992200dcfc16f49f8
SHA512 65a44f65016874af7833820491c2f6daaa2e141845437ecec3f3b69ec800edc667c9e5fe6c212d6059694da68dc7f744a9bacb2741d014c1d18532632ea6fdd3

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 ed452df5fde9051e1cb8cf9516b14d6f
SHA1 afb7297dc03fc3481b9796780e5b77c95475fbbd
SHA256 4e166cda45e3497dfb38b79209d02aad905ce06c6060b612cdc838192b4e2e91
SHA512 c3722da132fe3711eac5908016341f7de6b8b95262b959c77ba4b937a717bbdb1eddd35035c8c24aaf2e05b05985fde06a25d61267da6889fba4454103699bb9

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 8660b16cac3518a957f02ec23d14e686
SHA1 174c9694d28daedac87ceacde475248b87fb13b7
SHA256 2c67fdee75a400d8cfd096fe490455c857af4da9893e7d1d32fb3700501d8889
SHA512 6072f3ff806d6296c2a5712ae27f036466a3c73f7a8d0d9d7572c6e0cff6ef91aec9775128df506f3a3341a437391c77b56e94d1804ba8295a3b2e08cafa92bc

/data/data/com.systemservice/log/log4j.txt

MD5 1d6c0b710a2de3ca8963af46a5352dbe
SHA1 5258a056b479e41058f02946b7e0680ca9420211
SHA256 89bbf63ca21a59b48c1d213091fdbbe0601aeda8521c0582057465f70d4d028f
SHA512 1adee4cf865d26067ded0d9efd8147167e24cdf6616c80cd288e6a511951096a5dbfece43d9c2760a396695e701e80ac880602d3badc4b20dd4212f926b92160

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 ff63ed56afd03cdde1625ad0a873d8c6
SHA1 49097ec9145cc84ce6a6e2be650ccd4afe0d038f
SHA256 e0914ca0f6246bbf1d58022858067747fd737f19273f00a9d2ae4e590602f16d
SHA512 4c5e476e277c976d0162fbc362faae5fa7c6591fc1f4d620e25de0c0908b5433cd2c6c2a18c112cf35ed8b36acfae2c3987340504171cb47af31613b2ac14b71

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 3027590fead1231e874e039994848787
SHA1 18a591197cc17d10378915d4dcaa14a2763d9a4c
SHA256 f75bdbb77a720c6bee1bb5c68e0db630eb876b49fed6cc2f0250bf550c478423
SHA512 a168e39240bc51a86a35d1b8334fa131fffac4f823df0d70eb04d959ddc36c8418b6a0182ee0931720b0d0bd2a916bfdf546ed793e888d867f91bec6f99ef6d8

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 835e585d91b278aa35a9afd505809a59
SHA1 15cc88a8b92952c7395f998b173de99efc19f4c0
SHA256 31d8f01c8ceddc5031d6606838ef64ebb9178a9134e60f3152d4d363308ebcc0
SHA512 40b7b402555507bf0828bc668f4df25d5fdd74e7a42cb4baff957f177af35528a32cb21802f888021afb240def759cea6f72a2c4eef97df37c6f214c46818e1c

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 a4ee8578a8d38981d3506ad1029bc669
SHA1 f128d18f1e7fd5155d71651c962320b4620f8cf3
SHA256 974e86b0b921bd1a5345c208c98c120cccf1cd36660d0752a8684c2fe225b94a
SHA512 cb9a321b0be65101260e71921d405059db33db336915db2b3519317b53a15daa1ce76546305a64360232617e7bd293c254e9fba5be83e2cf6e8f619b39a42fcf

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 b96ef08c34fc934dcba171fc4cddd0cd
SHA1 6ea75b54647ce9d312cb072448ebe6fb5ad8b308
SHA256 a4b135c061e8b542aecf76ecb20cab27ffebed2496858dbaf6dcee6a54b52584
SHA512 a58af35da9f7f0054a29ca86573057f2965bf85a60e27a5778ccc3b2047296ff32469f7c4e85171a167fe80049bd7eebaf6f13f22985fd2c70a7cea601d8a49d

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 25c72ce3df9c2e4836e95466cb917adb
SHA1 0eb67e63de5e0c654156136ad286060fa86e7608
SHA256 4ab63176aa6bc91ab00d7075f5cc6eb94ff91298f8045d413974afd9b3dc662c
SHA512 881cb52e44e44dc81f43c232cc09e818dd121f0f2184c04c4e4f7366b458b80f36cbd85b3d3d53ccc33146d4941df968543ffede52d2dd384d075b8f9598d42a

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 a0e1c75f34a87350e15129595d167d02
SHA1 0c2581c25bfc2a93e7896a103cf133b45f9203fb
SHA256 33cac952da004dc6bec3eb1d090ff97e9003783b186554ba19b6e9d483ec4079
SHA512 26de12fd277e7bfa19f7670f2a5488a02d98c430e95b555eb29d411b9a49d9f860a23f20dc6991987f0e86a1d9a1ae1becdb99185a5b3264a3a795e9fb4f9502

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-28 02:21

Reported

2024-09-28 02:24

Platform

android-x64-20240624-en

Max time kernel

16s

Max time network

156s

Command Line

com.systemservice

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.14:443 android.apis.google.com tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
GB 216.58.201.98:443 tcp
GB 172.217.169.46:443 tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 81f29826373f189f51e8e03431ed5c37
SHA1 2ea388c93e8c474992b00823fc1b8216ad48f473
SHA256 aabc5bbca0de641e1af4d6883b72e5df73396c8914ca3e718ebee18b71df7456
SHA512 08805654b2b1c5f69be64b793f9999c0d3c5be6db671e644ea97ee2060aab4e72f4e65256aaccc3184542f732c9e0a6b0b93ef85235ce5142a8862aa025e1438

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 306b6df4fa9a571e4fe3df00e91a2533
SHA1 00cc783d056003da21f8d1293790e2c8bc4bf718
SHA256 32e4602d9fea6062df5655f7f608e59c7d772ffbdddd833bda862c0c602c6807
SHA512 0a9b15a7edf9144ba37d46c348d72f2cb82bfa2ceb9677acb3bf0c5d21dbceecfce9fa0ec2e7e555b6c2ded5242e3d70b5bc1bbbdbed5b8ea956ea91ef90cbf7

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 b4ed860bb10a14ea1b22f642eef126ac
SHA1 a6e0c29d1161f19b46a61aa84deddc5669756ddc
SHA256 f2e0598bd2e3a1eace0d24e295a011de915ec8e985f8bbe2dbec1360a3ad5f52
SHA512 da8fbc39ac2e37b0d9ddff2a7126c96b0323c8f98161c9759acccd75a740a1933745ed9ba5ddede343eb4e2aaadbd90d7e4813324d98b4ac96029e05033b4eb5

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 aa0d54a8d68fa5a64ae193dec18183c8
SHA1 0a9811d8e166d8a291f25b15ee5f070d5637ba0c
SHA256 92d023fed94736d6fedd6980e4f86325c8aa0557f3e614ecacd52910d46d30d6
SHA512 9974f90efe9747d189f98fd28efbe5c2f5d50c1671f6912a98b4e265774ca829cd0d2a1d3fa1777abdb79f155c52fec426e3e15a7c53ea63d098e68b3fefe853

/data/data/com.systemservice/files/PersistedInstallation3514750281963694555tmp

MD5 a8386d645100be71dc5d5a858878faf3
SHA1 a78bfd98a3df7a11a44ee0e91a1a6b78fe49fb35
SHA256 d02e85c61554bd3f3c19a27df955eb9df7b8a31b13e7c52ad078babd8e253a66
SHA512 cb7fb607f79e6698c06171554d0b55789360886eb6511f6053c72d31f5ab1f5ec4e28d5f034d13b3a682cd7c64d1b18026a1346154f61db2f2253d1912f175e5

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 78ab1b2ffb1190a8789c7909199f31f4
SHA1 ee6ec98c0e85a58d6939376f067605782533186d
SHA256 05f03ae99e8601f55a1f82bcbffa2fbb957240a24547e554079863b8385a5d5c
SHA512 e00a273ec1d2cb843f26783e0f89ca4769046d848bd69d226bef9532849717c55c3ec261d4ce4d785bfa65d259ac1d57fd48a24fd56063627ac10d4191ab7a1c

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 74219131d4ed050b4dc5f1c661f912c6
SHA1 04d882e09cda5071f4e272732f43b3c7ba5c86ae
SHA256 2be567a535dc09ecfc6a31786a7465d499160e55a1b3b07df590096afbf1d485
SHA512 68fb47e79dc368f667c7c408e61b78da36577ee6d46a74011691dd83afe3772ed7642973821477388c8201394000c4ce30d633edf1cde2c90e55ea47b5be77ed

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 ec63080943d4128198c7e6bf009ad455
SHA1 47d46220a7c29f6f1ead20ad10e2c8497f6198d7
SHA256 1651a2a564bad94014c595521255df3bf7a630ab0408f019dda018c4a2f88bbf
SHA512 67893b4bca71f28e776e8e540390cc23f0fe57e805fa7ef6cf2f3b097d4485ec29bd1bf11293f1fa8cb73e2fb4e27a9dfd1c5d7d5e4633745685ec9afb017a91

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 bc018b74944b678359f9bb20463dc577
SHA1 3db88b408d8485682af89ebf566258c1edb5d22c
SHA256 fd7bb2b38d7d9f591a02b82d6358aa46b7e36dbb9b82148eec66cc4477976a66
SHA512 71e5b60649fbca9cc71634528bbc02cff5ab085070603560f443e48c334e12ceb371ea409f5366829c30bd13cf3d6c9cfd35dae61ee539b3ba830c31a16ce652

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 d6c144425354ce822dea567ecd1f1f38
SHA1 2b0dd703feda07900bfe8d3ceaf44d03a96ed215
SHA256 95b7dec8ef442a5b90589dd3184e59b31b3d6c5ded6e4ab81a8a0a4ffb9745b6
SHA512 c6c89364e4db696126c9b5b844a8cc61843a70948f9e4db3eafdbdac899ce9a68fb7778b26327fefa95dbcf4d9a35b0893fd8a4d5f4169b1f1735fffee26dd53

/data/data/com.systemservice/files/PersistedInstallation4493107733651200051tmp

MD5 c76dcdb275ec7a95ad4313571f85f9de
SHA1 2257251417ceb7ea90e695fda897b59096b7e0bc
SHA256 3e88923b94a4d036f8cc23abc71004feb9e23d70052e263f89d5fa98ce625419
SHA512 3b49eb45741f5b10fac65d60a1b7f73cd798c1046e779121b1a619e72e66541a804cded581f99f24c2a2a36641757e6cbd6f9c28bad4a9aaaac11201cdb264d2

/data/data/com.systemservice/log/log4j.txt

MD5 b73e6c12c349a15508b80d47ddd7f7fc
SHA1 8ae2af18097be64ec3dc39f0e0ce20c8f2a17b77
SHA256 97ab5111761ac46fd09eaf2bd3fef233ee00ab2aa20fca2f6a35ed98b406302e
SHA512 7d1ba8b3f60f42c4ac83ed6801be9e759e87a9df5a8f6bb36ea7b9218b7e0db9348fda261f43599bb8b4c873af67beaa3e7c6377f76bc8b796c985fe8c56099a

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 2279f4fa4a94cf7bb1e91599c9caf9ee
SHA1 5b1cdf32120d9d5d7f3a0b1ce60301183a5b2141
SHA256 7866bb528fb494f6220dbc924d3a9c80c29d64412060f382fa7baf164b80fb3c
SHA512 998092aec08a53d3f92fe37963df91577fccc04c38dd8cfa5bb70da5440b699c77e16b3a39e78ecd5eeb3f5955080692f6402066de7177af41fdd7c577311ea7

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 59379e253321ff383bd09a297bbc0348
SHA1 e20d94cba94568a0c4bc7e3fe07d3fc4b2770f34
SHA256 23a2145a44c204e01b4c69e5bdce1043d1fd82239e26def69df10e6c82548f1a
SHA512 bc0b7658794797fe9a7556291f487a7cf8a92abba470282387d3e9da42bfd202a3b4d02587f556d8069e57a9975945d79655852ce3318c9e061413e531a8edb3

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7a4de70c80cabff843c209d0aeb13f2f
SHA1 bd89077b16eb8dc1b01fa1d33893fc65647720a9
SHA256 e8fbd79fa0e15bb8ae83639b787fffd688358d51fd0e00d365446838a3c5b3e9
SHA512 5f28859e21872f2ea0d9962919fb728eabe5717f2aee3bc5d8d8b905ed897f3f8dd3c8b4889cabe2a7985f4aeed0f61659ef1d85c702e4a6c0a29d3c7d4a61e1

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 ce52a05323c7f74513c8788fa5a91de6
SHA1 0ef47537ac5c523178d6c9c648fe1372f0394434
SHA256 03763b6c6df570f39f11780f4a7e6f540d2abb5ffb25ff94e5d1653fea414a44
SHA512 9d3f7e46b521a32600de258218a84ab214e66a616687de6924cc73aeee2290339a6f344869d35ed5d256f27f650172b3fd91ac201e69f4cfe255062ff142cf88

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e5d8a7f23288e78e3d6a6d8f445892a7
SHA1 b1487bac5ce8051ce4af6a27da0ddf0914d85575
SHA256 598875c3b3d63dfb0ecdf7287dfd80f3e4395f128f3563e8d33ddb3f197108c4
SHA512 e33090cbd55c9b7e5720590ef48b46b33a646ad1c783c85b5e01561c94cd5adedbe787c4dfea724b1daf7ee3fe9b843204510a16ffe90314c2e83681ff78d0f7

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 f871ff700510a56a54fdd56bc41b7541
SHA1 481548c8bc3254a00f497140278597b915460c48
SHA256 ab18f3bb605f3cbedaffc75b2d5a03fe21ab82179d268331ea907bdcd32c23fa
SHA512 12e3d348199566e137f02b63e4c8b4c722aa086128c0f1cea883d512075b8573d40d889d2b4452d9e3d9c02f523716da9775d93750c242a1a2d9e62f50f60fc5