Malware Analysis Report

2024-12-06 02:38

Sample ID 240930-cyrwcaxepc
Target 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
SHA256 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
Tags
banker collection credential_access discovery impact persistence truthspy
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb

Threat Level: Known bad

The file 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb was found to be: Known bad.

Malicious Activity Summary

banker collection credential_access discovery impact persistence truthspy

Truthspy family

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Obtains sensitive information copied to the device clipboard

Queries information about the current Wi-Fi connection

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Acquires the wake lock

Queries information about active data network

Queries the unique device ID (IMEI, MEID, IMSI)

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-30 02:29

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-30 02:29

Reported

2024-09-30 02:32

Platform

android-x86-arm-20240624-en

Max time kernel

16s

Max time network

131s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 4bb031a52af069bf325fc31419b1f605
SHA1 05eee14616bec5c7b99d60b0d216c9eddb05aac4
SHA256 927e2375c1250b6736f1eaa833ce6c311304114b992df52fdf44cf4d2f52cbe6
SHA512 0d0907ec990bf42b80d42f6fa23a70dd05b2342b11e31db9bb9dd74630490808f359222ff9523910642f4629d6db5863c20dc524bc88f166e27345bc5f9bf115

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 9f9ef197b094b4cd500db5d893dd8532
SHA1 108a6c779ecab82fb56dc5f439c49cc70e0b436e
SHA256 b2a71db612c6c39319aad308d6be35595abbf3c9344763750887c2711fb7a4df
SHA512 c2190446537a14ced8a141ea1cad40fd135f196a51e4a1ce71ce04887ce5b7cf5e87550eca20d0eb318bcea50441a39e0cf28c4452b38e94e513ff3492165e97

/data/data/com.systemservice/files/PersistedInstallation5102289896480711584tmp

MD5 ca8ce2b5e7c8dc5624b32a2438597a4f
SHA1 9f892b024741bf3f7b746d2f7dd7b48a7d5ba9ea
SHA256 52a94a4c2c66fa8e9c87e001439cf7cb7e189b92dbefdb2e6ac380e7faa951ee
SHA512 7ffbbee1a8711aaf01493408da58e6d114232b83582f06b5a3fca5f6a2096f8a82a339b8322470cce2833394e1e655a2395bf6581338c32b11825e9fa4c00978

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 437fa1228048df67c9ed2d484ad07b6e
SHA1 8278aea58119472b30c5f1ceda05541ff5a7c9bc
SHA256 d10f73a2f0c40482dba88c429d2572115c62bb48917c96bef3ca180b32ca38d4
SHA512 23431c137b7eeeb988a787d420b6d7425a612592d8c92c136030e8f8d94e7d5747861c20a9f671f479953908b21217627c91a51fe3f626b7a2b72ad654b64caf

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/log/log4j.txt

MD5 04456e89b64f9b53faa6d0d4ca230735
SHA1 9f4bf8b849176dec4c0f3166f1181538e35bbd7c
SHA256 b6507fd058c40ab86b02c1a186423a85b33ea27d5898b54f8b0b5d860c4b919f
SHA512 f7245d617af128da2b4cb111b524b3c6ad2d011957c2ddceb6ec34c2af4c89240c5d7ac1e619100ab1754bb0cf28416f7bb0eeb127a01407f52d2abcd2478ab6

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 f78c13fe1204c1ac5edffeefa8398489
SHA1 f4d6dc675d96c575e0cb71bf12257ecc76be30d2
SHA256 3f4c5c80631ae9bbb4c9c43cddde4b1a55691496ccbc51daef895d7c7ef6a3d5
SHA512 a112546f99ab602373942f6f514fb55443fe61479ce6d8c5eed7ac58134e369d4c2d3546236bb102538f7bd281bb47d8537928b139b3a6866c3792dc3aaeeaf4

/data/data/com.systemservice/files/PersistedInstallation3749291125172858653tmp

MD5 85e2dc4ec125773f65faa4dde6e8c797
SHA1 f06d649b676022d4539c2782c4ccbe81889b89c3
SHA256 1caa8eeb4c8e993abcc6ff4703324f12c7df2ea0d949b1342bb40d2e011ca58c
SHA512 468569facbe665b43f2e8eb8826f1100b1cf324f6924a858cdfb231861bb46e01e9b2a9911d2812f00174183a394b1caaa768e349c7841baac135e49fd60d65e

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 23441bb1992d8674acf04bc4dc1da439
SHA1 aff906e2a9d384a03d31d3b3ca3b1f4814355f59
SHA256 41fe912a4c7c87cdd79f12cf371e859759c6a761eb32588279083c4198196f58
SHA512 34f4ab7ba17b88d5c67ba88edabdb1011631904c630000785df42f5e641bfbcd5f390b5ad25f7753d178ad62a9c577ed6b01935a064cf44600a1afd724b71b08

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 62bba10fd6e59311662a2e70b9e504f2
SHA1 d94cceddf1f3c37cd4badae735a399e5d9a71c13
SHA256 2c56dcd750d630a48677b2ffc871cb6500ae45284afd40c554aa82610ba25df8
SHA512 aea342a6926c08ccce0fc8b8cb5023e9c3410d60d7636b30653f5541a6ec35b779df4aa6e8b2addbb72a8616737c99b22f162b513bfc3daadfe4d7b38a11b3a7

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 31ac0836a5ebec339f3cb5032c6276b4
SHA1 be5003d56a70b928b3b51209b0820cdde2633895
SHA256 95cc26a8f119890fedd488311d829954cd1ca54b1055f73a476ad9499f3b849e
SHA512 2a343512b22b670c3ec60337d193512d70c63692f143c4fdbf8ea2ae6e0d2a0c9c9b827b302a60eb8d8c52680dad029df201e9cd1bfa2268f8e4f6c7b2336736

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 f6ca2fb41dbcc73c18b83b4afe5731d1
SHA1 3ebc342465a75418f8f14f9240442a7a1fc13d1a
SHA256 d913c8b41c86ed5fb072afe594881d71c02d75d4af3c8ff66c9c62bcad2c0970
SHA512 0c17ed7af5bc82fad5860984391d2c40e4e0a912420b1594d2786ed53d9f3245dfab0716b0643929318c9dace96f211992701c38e566cfcc56b0aa7b6a5e674f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 bbf0675a718d7ad6fcca12b49fbe7a60
SHA1 e26b278d16dc73703e675e719d5199c80066e5ea
SHA256 f58bb729c95ba83c5f63ebd48d180c429e00081d9a13a8694afdeae72a437a5a
SHA512 dec9d0accb7354361e0dc392c5e8fca0376e524aed16cdd5baa0b3716deb013f448c053261fc6f8f2968285bbe6fd77871c020af95fb675f358d72b1c582df4b

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 f802c8ddbdd35ceb143b51ba7e1d98de
SHA1 eebaa78f5a77e3ab135958371b70b4d385465aaf
SHA256 f283031d926a49b1d158bf8f812e953e204e5f00ef93431c6e938d2ffc6c3fe6
SHA512 9d0864757410cecfe9f1084dc1a73f3b1b17c89210e8005716381f955ab426b42a6580250f3dd18ff9cc5143189ed9825df8a55816bef9636146dda761dd392b

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 039772e24566e194d6d0d2a35c444f7b
SHA1 a1aeb101cc02d2b1407b109071145250372e7509
SHA256 608ce51806bf278788e96c8b1fbf5f031e18992f48496bba9ee935cfe5735958
SHA512 7c752ffee03b2429399085dc153b5c870823db108f7bf7cc6e977572afe4e5b13a606d6066866d6fbf70d39a5737ae34c929b41468bb7e2b1d4d36ef8aae9ef4

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 12502e96d2a8b99be0b5d3e8b17360b3
SHA1 5b5cba665645acdcad08c886c84096cb81243f43
SHA256 48958e0bb9fd0e6799d7aa5cb0fd86dc13c0ecbcfd7560057ec8e8bc81f3f4c9
SHA512 4ea0a81ea8bfa309a1fa97b96bdd95f98b1a366a60b7f5f08475c31239428bcedc28eaa8c98ed734394dddba07aff0e05679b577d60482394900694b3c31db1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 e963af66549bfc5e3298a313d5cfd202
SHA1 c63ab6d6c86815c02b21301468c0b54d685eda1e
SHA256 24895de3b31a8d37885831d76ed70e09422c74960be35dd90ebb833cfdd6790b
SHA512 bc5c7dc913306c3f81791ef6e62465dfb6715af06f5d44bee1b97505ab2b5f4f8c2b7584eba2209c819e1e0fe1591eeb9a7c77dd1dcb70db8d27624d3e688b11

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-30 02:29

Reported

2024-09-30 02:32

Platform

android-33-x64-arm64-20240624-en

Max time kernel

18s

Max time network

132s

Command Line

com.systemservice

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
GB 216.58.201.100:443 udp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
GB 172.217.169.46:443 tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 142.250.178.10:443 remoteprovisioning.googleapis.com tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 172.217.16.227:443 tcp
US 172.64.41.3:443 udp
GB 172.217.16.227:443 udp
GB 216.58.201.100:443 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
US 1.1.1.1:53 rcs-acs-tmo-us.jibe.google.com udp
US 216.239.36.155:443 rcs-acs-tmo-us.jibe.google.com tcp
GB 216.58.201.100:443 udp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 7f7ecbd617e0f19b5c9b775fa3cedf66
SHA1 7f620728fd5c5c540790942976b86ed63c8e6396
SHA256 ebab138eeff5d521f65f629e04ed6cdd582079aff80528890382ab85c0818a34
SHA512 bf97c74c645015611b3bd99fdbf3214a9dcb1cd4bf55ec8b0d1d744d3f56c8de2bed46a9e3d353721a57ee92f2bbbf2b88793cea63a58d41a36496a5ef5f1642

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 2e9d94e9df0be6ad1044e972ace179c8
SHA1 dd1da4c8a7eb6678f79c0c70324ebf5fcd8376ff
SHA256 c9b477593d77a3dbbd19f937dc10cca352c93be4547ddda4a8e1e6a896f3fe63
SHA512 98e3a20f4d43d89bdfe22f6c4b809a9b73155cf41022c99e890f96d6700ac449bad18be8bbcb9fb2283695d67856eb7c75f5c9f88b4ed72240e7d0347cfcaaac

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 303f00cda72f15fcef0329974c136acb
SHA1 7eaa3d56e81c750a9172290fc081edff8149e975
SHA256 0b8e668047b02bdcf2b1b244afa2ad7ce299831b0f85e075ae86fceed29386a0
SHA512 6c3089deb9d8cfe099a68cddbc73575891b929b09fdb6e19ced6b8da4fd0add15bccfe9d1a90576b0ecbd0fcc87086302d0aa01cfcec5bcff77e75279bb97582

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 ca5784410a5d2a1edc270e378d319b03
SHA1 ae77e1490f561c6adc2634ea673673baf10d3c9d
SHA256 0db1a5fe8830c71400eb5995543162c25bf5ab395e5a224a1ae2659441917467
SHA512 def039f3652dc8aeb50fa2c3676b9476e8bc23141127c5ce445a96683b9ed91160642940d2b29b519f4b256ae0624cbfdaeef7b007c7ee30e86076040e442e14

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/files/PersistedInstallation5338595103840724293tmp

MD5 567eb8a7a3f58dcf0d20a48c30deff53
SHA1 87b8bc714814b462f83da8c87a9e5c4d72541d9d
SHA256 876f8d0616319968dfa421fdd60e3ce165f4234d5484885294e6d7002656c7a2
SHA512 437677553cd2edce2828a2f6a83a8d33840679e8329e400a0dd1574cb3d2b5f23bd96ca9159f722b6a1699106fd23edf9c2821b6e7c59ffd3bc7a67d8b21dd40

/data/data/com.systemservice/log/log4j.txt

MD5 2f76916e521a420627b4c8140fcdd8b1
SHA1 41af0a4260be0618bb5027535af5fab2f67f3ba1
SHA256 068bbcfe7c5a9b992c8eccf2e835931c807788d8deb8231ae6d5cb83339d759e
SHA512 50f0a896c48a8accf3644067eacc6dcb0a5d3ae105c0ab6b25453fc16b0323a5326230262e612c96cb6ed643bf1934a0f7a51025ade9d08daa284353c990c434

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 8a2960921bd99cc2ba59e9d31aef2d32
SHA1 7b01d232bd88ac1f00a8d3a4378242cefd78fd40
SHA256 bf5e5405c9dd2bcf1d1bdc8b465130a6ec2f94ce9a03f360c243c223a3e2e5f1
SHA512 72945f645d05ac15f90a5fff540054372f6d7499e8706141d704cbc9d67129a55cb735ce802294aaf66ccdcf61a97fd37293776612c9ee57ac6496fd9dbb6dfa

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 87ec860f21e5090026e3685ef8a4e0c3
SHA1 810b3db78a440c209ee35be187d853d867511d26
SHA256 4a567d1f2a958389d536138ec483372e26508a5b5d05559ae243f3f3dbd8a312
SHA512 945eb16601198a0d44080ae42679a275a59e0bf1fdb1b84fd245a29f254a74415a5183033cd5a2fc285098ab3aee69bfa1b01e49664455aec8969c318f441228

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 f450374cc405a00308668f16a3766a22
SHA1 2aa5e973f9ded75c0ea7d3cf20d6af3c62d3a4ca
SHA256 91396d95255e18b1dc5185685666ff1682f0636519062ffe3aa0f2f2ed814908
SHA512 17b0be7ae9464bde7900f3bfc20bbbf01013bc5be58e3f157ef459ed90e934713fbc25ff735681399412ae8aea09b0ea2637d03006188cfc1396d120264cdeff

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 7a9399d83e5ec596a02c2bd9add7ec30
SHA1 fe9c7e9a9507b6fdf86fdfe9adf7158a5a7f99c0
SHA256 93ed1d72a90a23d7548db3e577a2c56536d3a8663aa644e209441e3433c488c3
SHA512 0f24c588134e60d7f17f0484f04c397f2cb2d4519fcdbedd7797219018ad1628610b8aa6bc7155f772475ae793741a342e5f1a113d8e6b0b173ff12aaf947c26

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 144e240cd89b7322fce40538ae262ffc
SHA1 4c8561772570a1c18eb1638f648345e944910f9f
SHA256 08a5fe431d2e4a37a42b3c7481fa086d89488883b159474d1f767d53a0e3cf62
SHA512 b7c9a1dccaf9255a2ab836dac622004fa21eef0a635f74180980c9984ef90969cbdb9aaaa59d957ea8b1c522ac9731982f61b07ebddfdbce1481213f50817260

/data/data/com.systemservice/files/PersistedInstallation8265951836380093780tmp

MD5 64241d92591928897848ddce666ce35e
SHA1 56980b387919d784ea4018b3489d2ce2c9deaec3
SHA256 ab1ce58b64b53706ca501995df8a7986d04eba2c22dd0fa24f233abfa17be581
SHA512 ec73a72d7375e2433c9fbd50b36257972c1b7e906bf26134f40c4087baa4cf8c77413e52b988c6ae2d7511a72652768ebf21555dbd62d6f26620623347596967

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 796f17a8642118c415103b64d5cfeef9
SHA1 25fac27c8f90a0cba014176f2102415c62bed3ae
SHA256 4dd2a680e8893ad59fbf2e089ad6e1b4201e7aba09ff531ef40dbed435ff1741
SHA512 0882ee71a78dab6c5630aa7a628fd03d6afeba51bdca36ef33d458389eccf43d3b249d605848a6bae9877d3e6a228ba17bf5c9cd4428114df896dc092e89b2ee

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 afd3c0d8082c068371e279fdf4b42011
SHA1 f5882dcb738f80b5580402e82c3333aae290cb0a
SHA256 53bcb48ec2ac4a9c35aaff93df92aa7239c3e0fdbbfcd0ba60841cc710355645
SHA512 c18e26acc75c5380af879c822edac003b9e724bff61fb99b2564ab5a588b24d8194780fde1aa6233bdab28e9e5a58687ee0ed1497e311b98b7c3d822881e6136

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 b386f22bb12f51702c395b133d630033
SHA1 410be990fb199eb12e82a03e7692e44fde939f90
SHA256 2524bf295e9b0fa7a2296528de90deaf2f42c9a3835567e17429310c775fd9cf
SHA512 073d7efd734af8ea2551523c620c752c780172aad61d9c155ed9b7f3bbbb21c11cb4c8a259e681df4128a0b5e5015c2d9003f60d0b259e6b304297fd51ca542d

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 cb81c26fea976ce771d77cbda5d528e0
SHA1 e08255572fc4b6e8b728f45b8d84745d206d0f1e
SHA256 3e838a8506ace5dc5730009a85b35d298de873cd0b71936477a6b6c8adfade97
SHA512 310b98470b9e8b4747ea54c3140fde180033661d3a3be4f5c961ea786abdb3753866cfc9537560b1200ecd7f5fba98ca171c22e2f326c53e79ac9f27cc96b53d

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e2f571c4bc1df8d4677037bbfec44fde
SHA1 4d203f6de04a04d4f9b6f3fafbb76aa5e3520b39
SHA256 a5680ec67a8a135855b91c73f16f34cc1893382e3fc832a4c929560990ec75ee
SHA512 52e4ae594a710f2decd174cbf7ec508709960a69f9935c4674e0dc4135463da23d317c282a6fa87a8c56bbe9c5a5368dd67e728e419edb928e5bd9284783ccb2

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e3f13c7d7678604e5b293f6672bc0ed1
SHA1 b16c998ac7ca1db79cd4983b207a292ac1d96e21
SHA256 486eb5bec4ec277ea7b334a0d0e431e5e62881d3462903e8294640edbe96b2e3
SHA512 b63bab85a373912587e78dfc9daf8b4168a223c7af08fb87de8140d66b9f35042052d2d25694e4ea7c9f2064107e5471318b6dcec39c4e3dc0aa352627fa09f4