Malware Analysis Report

2024-12-06 02:39

Sample ID 241006-c5f3eszgql
Target 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
SHA256 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
Tags
truthspy banker collection credential_access discovery impact persistence evasion infostealer spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb

Threat Level: Known bad

The file 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery impact persistence evasion infostealer spyware trojan

Truthspy

Truthspy family

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Obtains sensitive information copied to the device clipboard

Makes use of the framework's Accessibility service

Acquires the wake lock

Queries information about the current Wi-Fi connection

Queries information about active data network

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Requests dangerous framework permissions

Queries the unique device ID (IMEI, MEID, IMSI)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 02:39

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 02:39

Reported

2024-10-06 02:42

Platform

android-x86-arm-20240624-en

Max time kernel

17s

Max time network

130s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.213.14:443 android.apis.google.com tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 2c357740881b4c963c6e1e65f71b1a0e
SHA1 cf079be38085ce408e7ea12e16405a21fe58d892
SHA256 7ce55be09d6379a9dbc1865e36611459f99a42a9c808e0e49c4c3e4df4345206
SHA512 56a7cbaf74ea29293cbd378c6f01f1e19bab752aaaca936b953cb1054730622b9144928b657e26363b6d18c64b258c50f7214121087a116fff8a7f51f65a5498

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 d678ebc4e07169a9cff1519ed2f78a44
SHA1 220f0442df3566516fd0c170c38e85a60401163d
SHA256 34919ea112bfbbd2e41951c35f1376994ce4b274fd2379d3d474a4824277db45
SHA512 ac57065f6e2829ad9c764d92b9a78fdd722d431f2d7cd2bb7f49a338d6292bf03b94b3b0a516e9e17d4697158d6536447460e74fb176e51cbb65d60478505369

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/files/PersistedInstallation6255290332241537194tmp

MD5 0b690a03726a744ef2494cd184d53dc8
SHA1 70ab004f058a2a30d6efe7ab57da1b06ad70aa47
SHA256 7d680d0f9c74e1f615f63fcea3525a88edeb0b121f27fe96b8b76417812777b4
SHA512 d5b87857d59200b369d0c458259feb5d12373709161ad3f3765986668563c14e6cbeef2f1e511eb2b8a3f286615f81b994ec5eb3885a78b8160dd9d553d283dd

/data/data/com.systemservice/log/log4j.txt

MD5 624da656fafaa05bfe4b1208c9b952b8
SHA1 c59e6cfda8e9395f151f3f2a00b3679d27ba2225
SHA256 f4d673444efc8dbfc1f0a268d7e290232f4f7481c9a50e810f07d8bddd598178
SHA512 d9d4ecb6b271a447acd39cd925d545d9d8e5609e8700cd3dc72537a82718e7ae0fb960e77c7ee44c88d8fe03aa97089d681b3f741e876a339dd639a7c3375066

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 668e23a9e6debdb6fce8e6dad4ca47d9
SHA1 9772f1aed592b28d45f9eb50841519fb45929e5a
SHA256 0df057c609dbfbe8fac17aaafed22d190ef9c3d15415f0443b3472de64b18852
SHA512 7b00ef476380384da6bfe9de701dc979327edfc97a72803c6d0a27273523cb194bf62514c73da1f4b7676c1eb2aabf2ef8bea818c45131d685a3e9234039e9cd

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 94d0237f60e5bbb22503b7ae1b65f5c9
SHA1 46e1f4aa57c891735945c4b9f4d58a9e14469665
SHA256 b8faf2c3e1c5d96c6603b2b8c16fd9d1293d965b02a1965293df540c80a643b0
SHA512 034b2d7f49ed2a76f5d02d9cfde7c53296277cdc494810e43caa571cf78b983b85dd9569dbae7d047406358102f0b367d2a1233eee982114e660d0039f94071d

/data/data/com.systemservice/files/PersistedInstallation7467712851324637173tmp

MD5 cdf776e3d23d131f98b86eac5cf130c5
SHA1 5e933dfcdcf4c38773b15c37781ee20775a622ff
SHA256 1b2c8ef8aa287dc103790c4b6e8145d403cefabdbee3a9e7a210a178175b48c5
SHA512 dbe0b110468412285c0fb3d509b3903ae83d1f22de4f6a7990da92ee2652847cf6064a29ea62a38adfb8c644c8e82c5dbb8e5927d02b3fefc73ec1d07b1bd195

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 fa89d1c46d65724e82c2ec15c641339d
SHA1 d770dd71f21dbc6e49155db396f19605ad349f48
SHA256 8a3c55b441d6bf35cdb1814bfc2329b91d392d8bb1923883fec6a793ac3e26d4
SHA512 afcb241b8cf581e3f26451085717d7acc9cb40b0cc3bec94725380bf08c7167243ccb6355e0dc6c701ef3f646cca47b195064efa6c89ee5341f50a797b1f4ba3

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 82b03d943bd72dfb4aa55680108f3b74
SHA1 e2a2c3a1424336dcc58c346244fe779778519fe4
SHA256 2ca01169462c0e98562e21ee5f5fe08899aeb294d1d328ffe51983db733e88dc
SHA512 d5c786375f6bec96dba1f58b736f3a02e15cb474d9290318eddd7cd596b933cdcbcd7c5e2600ac504ca7ecfa46a8731de74cac0dfd2b24a78810f9d471312795

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 2329645338271ace7b4492dbad751a31
SHA1 979ec62124454746a69e7aeb4f45ead3409ce07f
SHA256 d609d7f312247dcf9ed7312a76a29673b53c56e0ebf0fe2a16fd51078c606ab3
SHA512 2fa712de75460bb136274868e967df5d7a265edf2b4cc567f981cbc7de544360d7b052e4656306549eae36a34df0b242a21ea2240896d182b2c83597f7af6e68

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 67a830a3d3d0b73c960acaf2a7b0c4e4
SHA1 7eb51a28e9c4c8580cb544a819e68fc2c07b12a6
SHA256 74ef92a587fccbf14e4d1849a422aeb39de10365b9959063ef9983bd07ff0d16
SHA512 f72fd01994d141dc938edef590fe90f149ff22f845d9d5ccf7bea08754829c04b22f1608e9a7207c81b3d66d4ddd3ffbb59e175d22713c40294d19be07670bb2

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 76dfae1ed6c246fc99a26556a36183e8
SHA1 b5e4fcd4e2cd72277355c3d76cbbce043a721ea7
SHA256 29a083708bd1c955b64d3c5766d82040bbf32b9219a7c097ac1147113d7c3bb8
SHA512 4bdfb3844d260dfb3acec42bde943ca5af19aa1d0196daf205eeea4a92df8f78087462e49050655760989abef8d32c9edea68cb4d51daf3937ae854727b282b5

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 24b48fd86413e944ee067f115004f204
SHA1 acff1a91da2e4d85e64fe3a8a803e88ec0e024c4
SHA256 8765e5a6e3b4f29676fc473e66fd71eade5d634ba3889811104cfc3c7a788ca1
SHA512 ddbb53ef9f7b07d3081d24ad4a06db71d8201fa1e28ff8384d8285df224bf33c77708d47ddb4de7825a13ed7701506ab1cd5c145dbc7b8491c97a7f903e353b6

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 af205a35d9066454a9e12bbd86c35854
SHA1 06f2f0bf3b830bbdc5509747d54ddba79e3ab0d0
SHA256 fd82e1fb10c03df45dcdb2b6d7bf2f6476aa08f81ad4c2006f224408c9cd0f2b
SHA512 aece4986864f4a5d82773c1c794ebf83194ccbf7bd1f20c77d817863955166050676f9ed1c12f1ada21954273ae5c59be03a2eba88d6ce6084133d4f34c3d107

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 c642937addeb389b69c86db44c200283
SHA1 8fe590534e2acc480c707aa4c9dfb2419fe7bd80
SHA256 70af1ef9e990341ad8b91b03dd28995b28657e70c4fd014b44c1f418063b9787
SHA512 d6923239dd6d47ad96b1101865d8707f9a85e62e2586527791f3f3cb17d6679d56e5a493749840647ac7e42ca79e322d5032bed4b1c969c7b5fa465f3feaea47

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 e9161283fde797183ba1ad34d97e73e4
SHA1 647b75f5e658a43a031ef97103987b1f4dd0a722
SHA256 501669fa67a8fa1f9fd513eb3a34b75eb8684ead09cf8d74ab7152823022c580
SHA512 5b107bd4d26d839484c3cbe4168b1eb250ef4fea15cb66f6a1c7dffa1aa30634b11a66da225f2f054046b49c4f99eff8f925f0e8b0755753439d0e87f10e8ed2

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-06 02:39

Reported

2024-10-06 02:42

Platform

android-33-x64-arm64-20240624-en

Max time kernel

18s

Max time network

132s

Command Line

com.systemservice

Signatures

Truthspy

trojan infostealer spyware truthspy

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 tcp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
GB 216.58.212.206:443 tcp
US 1.1.1.1:53 rcs-acs-tmo-us.jibe.google.com udp
US 216.239.36.155:443 rcs-acs-tmo-us.jibe.google.com tcp
GB 216.58.204.67:443 tcp
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 216.58.213.10:443 remoteprovisioning.googleapis.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
US 162.159.61.3:443 tcp
US 162.159.61.3:443 tcp
US 162.159.61.3:443 udp
GB 142.250.187.195:443 tcp
GB 142.250.187.195:443 udp
GB 142.250.187.228:443 udp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 544cc6a71597c3e01df73812bde63cef
SHA1 eeb8b09bae3ec28b539743fd639cff9d33c6d9cf
SHA256 9ffbfdce0c236f453570045afce15d023532ca669635a5a91bcc879203163f78
SHA512 d3a101d6614bca82427c92045fbab562b79b110bca72669f8554928b1b0f35fde35b70c8dff0afa37b3e8f46b57403ca8c2ab767c6088f0c40c800af40b94f44

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 8de21c37f6c09e4752390afb7ecab093
SHA1 4d46d2c653f9e5446d68d050da50d6a92a8f0783
SHA256 6cdfb765b8ba3337a385125116ec4b008f180f5cd08806f56b074e4d756a0757
SHA512 164691e20a60aef664a34ba78885b6ad833b6d4bb37f3041e9b78ba33561d9be89e7b59497a3a04c8065be28d01b5ac6b7f272ec43ff626071eb845a77bc9c27

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 2000b2c76b904cc426d2dc67adf7c349
SHA1 470aa66de381c2e36192eed7462bc0f346a0541b
SHA256 450671ba1f6bba0cee030add74f49fd34445252444c245b79ba8c705adee1a9f
SHA512 5ad42ce3db91294f6aef127526a433f09acbd0b3f419caa68da6ed2f3899a5666ad9c278680243da3fe97a553092da80333be36edb5697ecd9237ce81828f6fb

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 cb7cc7d962b29707285e756bfceaba7a
SHA1 8da1b5f4efe3430f41ee6da6c4edc5a13450db12
SHA256 2a4936264e97cb594958d50b0bf055beaff9c05370f8e0a86c334bcfc345daad
SHA512 33ada75c3ea916b43f655ed9d7c6a2ec572ba0c2f19dadbdf66edd4ea566d8d5b0800664a7b929a2501ee6833da55e0131f79ccc86791e5e2b50a663f84bb708

/data/data/com.systemservice/files/PersistedInstallation5058891959376218380tmp

MD5 77e55c36477fe0ebb66d68e8b21b2d0c
SHA1 70a45e0e6d8dd6488769996566a81c42affcd02c
SHA256 2dd325660834a3c68e360cf1dc03c5eb15037ed6bef8368c87211a8caa4521d0
SHA512 271c1e5664cc753857cad3e0a85c10337b443b6602c340fce1e6137800a003c2eb5e74d4d6ff5abda7c50e7bcd87b8be07350f8aecf53390e603704be1471cc9

/data/data/com.systemservice/log/log4j.txt

MD5 caf4331a7db33614a57d764c5b3a77bb
SHA1 9e0008c475e7754b273fb52d5b2928f4692f1c7c
SHA256 6861934d7c141eefeed601b9e9dabc29ca1c0639d541cab20cc74071f43f9bc2
SHA512 305188652d8ea2cb2d14b9daa56e745ba5e30ac85adb1ea0009c8f9e442dcad70d78338717154508146a3cdc5e1d06b5b7897100aef343be03ffa55dcf153701

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 5592f9dd0dd636579e11b1da40596b14
SHA1 8383dfc5a28dfac2a69b6d2b5d42db16edd7851f
SHA256 f6af6ed25ddd8c679e866460ab0af7dccd6007d7af7c5524857dace06366c73b
SHA512 2475b844d51b7325638e1e72bd8ddb913b97267ccef9ad31075e8214f7200e8670a1389a734e84dd35f75b70232d9d77bc6bbf4f32f19e92545f57b036456a38

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 bf74c6174ad9313a22c31ac50a61efef
SHA1 ea50b6a9b5b899b0e500bc578dda1ecce355b776
SHA256 ef66e07f43f80a2059a735977001ca103ed5c54d0f684a1eda04a91518cfcac3
SHA512 bf7939c1ec53fe9e536c92b91f2ee1a7d5d3885d4b2f5e6f5252812d607a36ae47b7f9024625fba460bde195fc33418b8b527ce7932aaa66728141c0713ea170

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 7aba2cd941c04d3dd6217554f3f07dfd
SHA1 22e49380f619d8196bf233d734f6c10576df7eb7
SHA256 29b4e885ccb2e2f55e9d7ccedb6dc5cc21c79ce44eb6c188bee5369975b96b02
SHA512 3ed82c06d2703e285b110136d582bd410b8dde57e1e2ba41c9e44ecfed77ff7164c80d7dc2523604ac2b695b963f149a161a48857ac2780798e6d1951bcd284e

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 461475052355a49b061e2b0c29b8ce13
SHA1 a76ca2619c37c2b5e3fb156d5f628053c00e8b37
SHA256 b8f0f28f7c5cffee85accca885d71cec86494945e24937f9207230ac25cc8d9c
SHA512 72dc11cb55357500027a7a2bb58ac35a18a7a8a95b10c892f199a99fad1e8abed0c8b00f199ddad488ae40b2ed88d53b8752844cbc1c27141f394ac120230309

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 c7398a19f52ba29984ad7f6a8a6c0dca
SHA1 3ee105567f7d4a3a710cfd732750e9469ef7a6a4
SHA256 856e816673f97dff3f6f4b5a30cdc3ecb8fae349757526fa7b2114e279f4fb06
SHA512 5e496215fbb9a9da201765966594b17ee18a784474a8c80f913580f32f93963a6fa0e62a5eae5ae405bf8a64b3cde6dda910bb8065ae7e3641c7a38feb3b858e

/data/data/com.systemservice/files/PersistedInstallation6369981330297448078tmp

MD5 cd8d4a7f9f638f1ae5a9cda4448e40c4
SHA1 592160917925a56f9ed953cdc21d82ed409a53d4
SHA256 2afae864fbfeb0715b311bed276e922f299aedb021743da4828fb2323eea71f4
SHA512 b15e9c359bba38072af54865ded32be0454e7fc36b8109b6ed44909af2b43bfe0b8c25627d40a69ae92488ceb12dfb2363a549af12c60d5d55439082d151dc25

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 5fbc0a5cef9e8c9f39541bafceedf1e5
SHA1 31fc7efd86d696c304210d306e96a2b4fa0ae508
SHA256 75add6e6cffa65eb77b7b761b5ae28c93276a565f550421c2c0b1d0e80ebf24f
SHA512 37b4eb5e0f291081368d84db6416f921c349a8363a19601635c395b8ac703d0f9b5b903a85dc402132a9990ed37874db8d97894f774f0147ed9db59588232710

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e013ab1e7871a2a1a319706fa40c7151
SHA1 55ae3c4169721d6d0cbed3b6505cf3ccf59cd7e1
SHA256 84bd7ec92fa27ad3a8c2afb0b315232771d27f006a17cb4b379bd4f20ac8242f
SHA512 b16317d5529d3003e9ca6dd006f5739342246c221b345e486567224da427b4cc774532c4b796b846fc2b60be1aefe93408b29b5d8e4ca1e080279c5797ef1550

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 0f23aefe64a12f7c90ed5483532eca99
SHA1 aaeee6f3585e7ec1fa7e016a2aae65ae3e42dc64
SHA256 07022ea87ece465dbdca6ca48aaab401d8c1befad3ce0031aac6a1f80cb94419
SHA512 2a5aeba231deb4cb0b98b6e0616d6a29702e2c27b0d10139ff08589e6cccf81280eb4a7aaeb74a853fb15e80cae5b905d5d95081b04ea81df14763bbfba37ca3

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 ffa3c78bf96efce1b20e104ba93a6540
SHA1 1eff72d89afaefb7cb0ecc79a187a5c917d19a9d
SHA256 5a3f262c029266078038d3ac86272f39ecdae77e8e3285822f2e85b5bdfd4c4c
SHA512 fd950435a7d8b8363400e04cd3e70f941adef3fed2617f347fb3a9ef5141e8fc648292bc5dd54a19b06532c57ce1ad07b2c6c8c7163769bc4cf7c726879707ef

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 f38468bdcfd28e0c21a0dda04494f497
SHA1 600240d12cca3ae05b8caf4ac2640d0e5e59a9b2
SHA256 5920605fd789d89170aa0566f8d65cff0088c1eb91bd1647793fc8948c5a62cd
SHA512 664ccef2356246d18a00843f282d3cc3ae6a78c1a08ae245bfda3105e4c81afb81a407bff8aa4fd162c53f6306fcc8ba84cf354401a9960e01ec8bf8381b24bf

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e3f13c7d7678604e5b293f6672bc0ed1
SHA1 b16c998ac7ca1db79cd4983b207a292ac1d96e21
SHA256 486eb5bec4ec277ea7b334a0d0e431e5e62881d3462903e8294640edbe96b2e3
SHA512 b63bab85a373912587e78dfc9daf8b4168a223c7af08fb87de8140d66b9f35042052d2d25694e4ea7c9f2064107e5471318b6dcec39c4e3dc0aa352627fa09f4