Malware Analysis Report

2024-12-06 02:39

Sample ID 240930-cymavsxenc
Target 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
SHA256 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
Tags
truthspy banker collection credential_access discovery evasion impact infostealer persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc

Threat Level: Known bad

The file 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery evasion impact infostealer persistence spyware trojan

Truthspy

Truthspy family

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Obtains sensitive information copied to the device clipboard

Makes use of the framework's Accessibility service

Declares broadcast receivers with permission to handle system events

Acquires the wake lock

Queries information about active data network

Queries the unique device ID (IMEI, MEID, IMSI)

Queries information about the current Wi-Fi connection

Declares services with permission to bind to the system

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-30 02:29

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-30 02:29

Reported

2024-09-30 02:31

Platform

android-x86-arm-20240624-en

Max time kernel

17s

Max time network

130s

Command Line

com.systemservice

Signatures

Truthspy

trojan infostealer spyware truthspy

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 12ddde802dd0c9aba4ba9cef1db5ec5c
SHA1 32dbdd70b20650dcb6e0466eec4c87c65cdc6fc9
SHA256 2642c05d1f5ea7df439d1d6dc0dd6602c37f3a2bff579eeca8ce0d87bfa36894
SHA512 2167191a9b543df802d9769d162fc10e1c9ed240393319305055d362538e34275a8e3ddba8c06e3a28bdce9a615bb41d44c791a471af936368cdc1e179767ccb

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 f15fd059fa7b65c9ac3363a386e3bfad
SHA1 ededb4ef452aca4b7f6d69f789c6c94e4ebc6445
SHA256 c627d6062de3656f50008da6fb5541f432452f316cceaf8d2d5ca2312fb702d7
SHA512 e51560fc52090d4cd1c604fda7a5aeebc22ea541a9073302dd2710c62d3a23f56ea8e7c8edd63c221ce295b135358f3f96c65b6cb58a62d0526c62b4c0fcd06a

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/files/PersistedInstallation8557866359329733263tmp

MD5 db1cd5747a944319f6a2bcf9bf47b8e6
SHA1 07ac2266a41f1536ceccfe93247e2ad50fbb3c0f
SHA256 571607bf4a25cee2c3ccf3c265c8a76db05a70ccb5aafbf1d18d3a8b0ab02352
SHA512 e4f3ec6d7d90ae146d57738990812be218ea908e3e057203fe5682a5d048d1d115b7bcc0758c3f7edcfc983e0432131f3e6f7c2f14e73ab0e90f573607a1c5b2

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 775841285945fba26b551f3bf8d4c463
SHA1 420470fcf5da73f81661967999fb9a5feb8cd1cf
SHA256 6805139cfa65d15e656d9af088229c742b59c43c823e8928d9d4f62b16da2583
SHA512 958a564cec4d2e02e201cf66581f0bd872e8d4b014eb75bb83ab3c8b21f63b09d83ec427a28b2a5c63a183ac5932eda00157459172a1c4164da57c9420bcdbb9

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 f8c47b279b1649c6ac67608474d85a75
SHA1 df7fa6aa5c653a972a0a238e415eb5978780677b
SHA256 2fae9641b69c5be4d8fb553d477dffc279972c2be2adbbd2bc5d48a1fc6579d3
SHA512 037ff48be95cf063b02d36852a9b01ac17e03dfd729bd0e68a9557ecce8b5185649cd751911b80a74c2866f5e331bf260e577874c60f3c0c5d6542bd492b58bb

/data/data/com.systemservice/files/PersistedInstallation7114504393088812120tmp

MD5 295777367b33b174540e0beba444a3e9
SHA1 41131381e7943629b46e7e7d0e7c621663cd0295
SHA256 d4b5b51368504f646a620c828732ca154d0c6e1b35fe58e2e076d78033aa8b5d
SHA512 30cfa605e83fa6121951d5b4b405403456c7369261d9753e493758b1eb749a3b689a62cdcb9b07971faeaafbf1bfb458943f3ceb12a30c2c005ba0520d48207c

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 0a2e615ccefced666d010bc8393d6bff
SHA1 035e2850aa067ee50540b7a8fd37dd337512082b
SHA256 6f64401032c781172b4472581a58e1dacdbb4efcaa92441f324ca5c5679d6872
SHA512 f4c634c0b5a17e443c35172434741d2f3e60c1586cad0b065c16b7bc2bd79d29808b7397208c0b50565c64717e8d434ab841be43384dbffdac0c27333a515c17

/data/data/com.systemservice/log/log4j.txt

MD5 20a45ae23c3afe2aa0b8e4c6f3c87a6f
SHA1 c0c99b4b19aaa03273c82ba4d2b4408007cf6e3e
SHA256 1267cd7ce27ad466eea322163185800a8b19cbf8c93a0e80250989da2adc8dc5
SHA512 e58cb4e69bef1d542a7889a11b3bae58ef6b391bead7c78d2d7a1fc90e7f2f174e65d2c82102e80331f3532c7a6a119bcbc1230dba24b226341c7745d6900d01

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 dc72ed57ad6f6526bd1083d92979a705
SHA1 594fe14264e8922c7bb84d8900894d398b2e1459
SHA256 77ea8025e8efff611eb8c34d556b8997c0072cd82fa7f484938cb3d233df3921
SHA512 cbe83219f8ed1c993f233d3a9c55692fd4838e9310c7e1cc55842566b0df89de1ef622149a29da032247ebd1985a85c08b00ce76f321b23b699bea0f05171ab5

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 e8b302abd6a14ce77f47b689100275d2
SHA1 44391815154f0274a791c19949a08bbd44d2c304
SHA256 2670ff841eadda9e1a50d1c126745ad2eebc759e9614818bdcc6d9ce8db42197
SHA512 c8d4e4d76a76f94ceb0475033bf2b3c30c3aee98f69c2c0f2929884ed11552f5879a192e3aa06c50f5052f60e141ae008bd11e2c15760b927c927b2030289170

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 d726ee7abd2e6f76c5bb88d83b8fdbf6
SHA1 9d0d416ed24a12e12f220cc587cba9b883f61224
SHA256 a51a9eb0d2e5ab0706c0daeb0baf91ab863ce8eaa6a4189c340c8d5d9b99aa2c
SHA512 ed67f872ac7205deb162ac096b0b7981993d07ddd5339a5d81265740f8a51ae9fc6670216dac11817504dafe70b1c9c31978c3a1c35969c1f1f1aa44a04497f7

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 57dd45554b315f39448bb2aeef4a3ca0
SHA1 7a8b2813b0ce72ec45b8d80d575ab0cdc4fbcb01
SHA256 839405ee527222c35ef458c64eb9a55ef2a05cb7bb3f87d3f0ba74e462c9edd4
SHA512 3c6d2462eec2221c109e7b4cea62b702db48d5143e96dd12cceb131644a5d8bcb4630220080000476d0395b658a20a36bcf4163beb4b9d10deefc9d0e3032f9a

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 8a003e231889ea951fd9f393e110ad13
SHA1 1d22662d0b8657582df3adb4971dcdbcae921c4e
SHA256 ac9a0df5726df11f8ea261e89455b403ec59e7f647e33444a37a2329620af1c3
SHA512 5eb02d56df2c814c4344f6a552069a36a2c724724cb4e343985e4e8c48ab5d253d24b02e85de63a6233401fda487f2781c72afa0ec21808752e7bdd26bb86d40

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 4db964a005a8f07cefb876cf345c13fd
SHA1 7b7a991de010d9b20e2d6ef3faed2f58489b8a22
SHA256 ee2054078dee8bdf9d88b69a69ab528cfa15e27239ce6a84cb5f394aa9cd7126
SHA512 a80f7363bad69fbd5fcf4f2a1ee913635256ccd2a5cbc8e0f00e22405b095dcce095b0545ebdcff30a6b2a06a2b367d8695ec823e697ad0e4ad8b9da40c6212a

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e52a0907289e7f5e122c040ddafda8b8
SHA1 e4f33c97afc1d36dae5bb0eeb997dd60f648b630
SHA256 15b2dfd5e9259714345e9c167bb74683079d672c49ec2e158c858c89278bbe5a
SHA512 0ef0c7445538553dbf263aa97b7dca5961814577fe8ba5c6076fc3392f760d6d0cfb5bdffb7f92d575edcbc78bd0799706c65c4ba42f53640e064e85ede57c7f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 94771d884033ddfbfc48a6603db1e4cb
SHA1 dbf99e5d9ebc010c019a43ef2ff3327e4a2f3fa8
SHA256 7a51c528c784e3fc0006ba637f73e1fa32793152fcca0772accbc44b369b2475
SHA512 bde3e759ef4dc8f022126e8802c26ef8b52bcbb32a2a12f6e8782ada82053c7d137d4648eb42635189f23a51917a3924a4cc62ee2772b3b631d570e26b142248

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-30 02:29

Reported

2024-09-30 02:31

Platform

android-33-x64-arm64-20240624-en

Max time kernel

18s

Max time network

132s

Command Line

com.systemservice

Signatures

Truthspy

trojan infostealer spyware truthspy

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.196:443 udp
GB 142.250.187.196:443 tcp
GB 142.250.187.196:443 tcp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
GB 216.58.212.238:443 tcp
GB 216.58.212.238:443 tcp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
GB 216.58.201.110:443 tcp
GB 216.58.212.238:443 udp
US 1.1.1.1:53 rcs-acs-tmo-us.jibe.google.com udp
US 216.239.36.155:443 rcs-acs-tmo-us.jibe.google.com tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 216.58.204.74:443 remoteprovisioning.googleapis.com tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 172.217.169.67:443 tcp
US 172.64.41.3:443 udp
GB 172.217.169.67:443 udp
GB 142.250.187.196:443 tcp
GB 172.217.169.68:443 tcp
GB 172.217.169.68:443 tcp
GB 142.250.187.196:443 udp
GB 142.250.187.227:443 tcp

Files

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 de63b1b724d7aef36565e7585bab4fae
SHA1 801ca8ff30a8f899e40ae8ce4e1e4fa8451da308
SHA256 c0e4ecb163143358a0f3b7bd622807df381f028551eb62866c6b4f2f714a40c6
SHA512 4b1a0d44ce7fcb4f76f4bb29347c2cf83157463233ff3a80ff50dcd755815b8dd1636d65979a288e329f3e55ddef3875576d651966a76cd184786ba37c20601d

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 405771b49ab0508d423aa8d9f7183e3b
SHA1 066c4e99ad655c7681fc7541619c798ac989d1c4
SHA256 904f47c140b795f2c05bc3f307b3dc9ee75a4dede61a0c11742a279e4ade3f98
SHA512 83f3ee57df745ef2bd33630c979d87b738c3e503c3f0c765aefd68a26ce755352ef78fcc4e28b3b64c1e7ec950ede50088a0bda76da59b74a602f356d3495824

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 7879e352eca3d9e1d508d6c05a85e827
SHA1 5663e364a68cdf2c614d9a55b9cd732cb68dffdb
SHA256 a3d95fc1724a6b8112bf22452552879fa5a20091dd972a356b1fddeaeee9127e
SHA512 45e61e9d73f887781294ebce956b75a44830ac909274bb547a0545cfc43d07105b043c078b11ba93ab685b6b0be185ab87c344b9cfaf9d125d486765bf820fad

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 12eea975f7146e6292b2c8c6b031f879
SHA1 6a1caa5ed21413cf48c8e86ee86277a2a7a33ff2
SHA256 7b8e15ac367652eb1046b72cf64a22d522e17271017ba15aad94d29eb5711fbe
SHA512 e94dcd07677b7bbb612518adb715076d24c181c482b7dd14c5368e25d5994185db253ffc30240837a506ad72303ffcf176668a1c001f88b1777fd84d20a5a630

/data/data/com.systemservice/files/PersistedInstallation5676696143921071401tmp

MD5 885b918fb25c79ff87b5784e6e968aa6
SHA1 64339a483c31f14c7d1bf9c02b871b3dfa7c1c3d
SHA256 907f2ac86a2cd93fa2c453f9fcc5ec591f3361e631e9d861f8e93c68c242599f
SHA512 82f47b757df0fc002e7701cd6104d7e5fc7ccc3dbec98f030f9dadbe66d5ca2b9da935cee733074ce883d74f1e493ccc69ac5eb899bf1a3c226645958fc42dd7

/data/data/com.systemservice/log/log4j.txt

MD5 ac126866644af97ec87c69a427f1cad0
SHA1 d06f0ddc22012c51450a3535c10d224f6b63e153
SHA256 01df9c022d17cfab82b93417c37ff28a836a4370a21a5de740f70e3dfdef2b29
SHA512 81ea56006d50f1190f1f33a72902b194c44f88f72f076f084b7059c1c5c83f17c058d2f453bb35cadd21d445c8fa47cf6c8a1a71c42573da1a48a447ebb53c01

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 98c9214da17425a869a0cb35dea5a764
SHA1 8d593153b10651f94b29e70699698ce4a41c0a0c
SHA256 28b0f22b37fed1ddf357bc680fe97c38ff3ae1134dfa72ec1b273cea53d700b7
SHA512 da6d4da4c758ebc737931b87ae889e60bc61e4b3207efc0ad52f727a2a516471d52e44b4c873e9852e937f9bc129a85d0e3f96611a470362dad80acc6d4196ac

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 48f0d7b3105dbc69430aadc534d4b4c7
SHA1 c1cac21b47e358d9e83e9bea16b5d45367f063c9
SHA256 59979d4dbfd13c6a497521dafea169f8c75737251bf4d6d44a35c1f57909e712
SHA512 aabda82cd1b05c1390eb76b30fa0349e2fd31eda7448c8b186fd29e4c8977717eb7cda0824de20bb8ee84817dbef8e5f582f1fbebc9b245a644e047cec0fea1d

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 e4131096b3401534c9e163fb7f5476d0
SHA1 9ece1a5d39ddb8d0fc27517665b8b5977d2ca091
SHA256 f0ef6f1c570dc1dbf227adefcc987f0e5ef9e43e7166811bc2f03f23fe51162a
SHA512 c77608402384fbc7deded0b89acf774968532a5df0eabc8ad7e57149df4c79826451632fa9e7bad15f20fadb0b0c679804578aace52a77ae9512f55f60c65a2e

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 f1288f5974686afc0633ea04e50ced7e
SHA1 d71376699eb376f224690da5642ea94f939ea0cc
SHA256 0fb217f12863b97daba294a14023c95f00fec1dae0e428efa89d1741ebb0ed4a
SHA512 af6e8e1373bc7224355ceede4dfd8ce6296e2edbc010cf4ea548b7557694ae63b0dcf01ca61d715d8517ed3cca2d4a62238c2bb55603e5c4a461b2e965f8c900

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 1f85394496f6f70eec253b8d7b419ec3
SHA1 c1425a7839fb9cf29bf56fd8eea083b74b9fde8f
SHA256 ac7657cd824c1247a5bfe0ffaa433a35a1e21dcbc0b37336cb14649f1b8f24c0
SHA512 f5c9d7420c2cc620d30c158a65e6a8024c0ebcee331f8a8b74f8c96331001f74ad3b978708d70d0d7e6cb955e71d53ec1d059f44216ca0e7f3a1ebc68f23f90b

/data/data/com.systemservice/files/PersistedInstallation8220899095800567926tmp

MD5 c917c6cb306874a475fcddb531d5117a
SHA1 163d22f3171ac2c424979292b953039e2fb7d9a7
SHA256 b2686dae9d53a6b3abd9433ec69e477149056ffe739a0fd09376a7d143e7df34
SHA512 982e6f8e2817f9d586ffafd8424734939f496b1ad2526c841ba1dfa217adbbda0d710817cca0e2320145e9cfa2d1154a203c5e47d71be84f6a12486d1f002b28

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 41eb8a5d2ebca0cdd060123c5e211267
SHA1 55cf920c9c7ce955f4dc8c94ec07ae46aa806fb5
SHA256 360ab3939d6e7e85a1a4a6d0088f2c86c0a3ab9721dc5bbdc4e83193faa13fd0
SHA512 fd7f01a65b0ecec27334ad7ea6b2c8859e9c5664a83c5b0eaa1fbd72e161d8a97c2523162b865b780c628e74f77d629f1e8f394632b84b39870f4352cdaa079c

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 99512055ef01d657050f2736247fc1cf
SHA1 adfdf1bed2e64e979dcc8c043820d427c95fb42b
SHA256 13a09a445e9f13a1dc5c285691ea9a07c69e2f8a1f2639a7d44b20bb5c311379
SHA512 609f4183f628b492789732cf401852e19f66a164e5c28c6b19868fc6d7ad7e7d560cc5423a1ffab49b5751fd44648245ae1d705366a63e0e7814cc049010dc0c

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 75c9fbbb55b969cfe4d8523dbcfcf4f0
SHA1 02caca2178b19ef4de976da2e06fb0da37866403
SHA256 a413903dfebb7b927a46de13edc1a7bbe21491136a75b9bf14edaa2e60a90d4e
SHA512 1243b402d9d71dbc9580ae172d343fd396c4ecd60daf9efd2396a3866b862205bc5e555451c039fac8a51775495f77d9004e1f0aae8ce3e931e5dc0951e4201d

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 10d9124731c0ce705d30ff0054bfd928
SHA1 20193d5910182b62310ba3df5b4f5db2d10f223e
SHA256 1079fff4c38e6559310db4ee836c810bbbd84c9f980f74020e04473b4cba776e
SHA512 e9a065beaf7589d200bac2b1eef9a568123943ea49631ab919d958e22eb5f0f014ade1135675133295824be53484aa12348dd9c1bda6ab74e07fbb3d386fb780

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 5d8636cf49ecd3f25025117c9288020b
SHA1 e7a3233984fb9a5fb7b4f23f7255c60b5550b5fb
SHA256 515556d95ec82db8e4ac42436ea79e8bff76e6b80cf67d60347483acc7f22069
SHA512 d761ff7a86d950ef503f90fc691e3ef3fe50e50dce593631267990194525eba057d0d138751ed5fcba21bf7db68d6bab4c622d889542636b4ed5865c2970ca94

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e3f13c7d7678604e5b293f6672bc0ed1
SHA1 b16c998ac7ca1db79cd4983b207a292ac1d96e21
SHA256 486eb5bec4ec277ea7b334a0d0e431e5e62881d3462903e8294640edbe96b2e3
SHA512 b63bab85a373912587e78dfc9daf8b4168a223c7af08fb87de8140d66b9f35042052d2d25694e4ea7c9f2064107e5471318b6dcec39c4e3dc0aa352627fa09f4