Malware Analysis Report

2024-12-06 02:37

Sample ID 241116-ct5awaxkbx
Target 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
Tags
truthspy banker collection credential_access discovery impact persistence evasion infostealer spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Threat Level: Known bad

The file 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery impact persistence evasion infostealer spyware trojan

Truthspy family

Truthspy

Obtains sensitive information copied to the device clipboard

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about active data network

Declares services with permission to bind to the system

Queries the unique device ID (IMEI, MEID, IMSI)

Acquires the wake lock

Queries information about the current Wi-Fi connection

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-16 02:23

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-16 02:23

Reported

2024-11-16 02:25

Platform

android-x86-arm-20240624-en

Max time kernel

17s

Max time network

131s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 406538111cb91fae5139839dd738065b
SHA1 19ef4f030214e6ae3c07d9f6b8216d47da4fb4f0
SHA256 c00748141c88b422879f6a726dd83cc0efa31f099ef1d0116e13c8c4b42fc6e1
SHA512 66aae06030caf63c90696b4eb73e0bc1a13ccfd62910dfec6b048d44efc49c9d5f0c7e7cb67773d13b58a99e89f6c9bd463fb043d7114aad75388dd049b0cd72

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 9ac3d7b4becc166c911741c704fb000c
SHA1 391a4c4305f924373e265fefa11d31d7e8f8589a
SHA256 296ff29c7c9a950c984e169eae680277f314032b0ec4845eeb15156e59cf4431
SHA512 0b4804c4d3efb3fff2347aff64dc61c454707dffe0e1c562bb407e48425cd4e7f64d3813545c7bf18dda140b4a1870f513174cf22d0ae4cca9282acfaf80068f

/data/data/com.systemservice/files/PersistedInstallation4078326225790681570tmp

MD5 14b73d6ca0b493d41e5bb88bddede7c4
SHA1 03e063df62c3b3420d48ce9a13ba8785a4cf2478
SHA256 cb0aaf5693f1e6ed4507ce5477cab231fa02e7abfdc82111d0aaa5ee6acfa9fe
SHA512 39f538f39f449f812a6ec7ed4784592a0086d727e7252e0ca6260bf3b1b0f3d9934af7c15e3893de6734f08c86546ba6eba10c54845b288f8dae0fa9f0c04cc3

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 b5b0882ea615f05b985e61c09a2a9d47
SHA1 291ebc49f2a6c41855ad8070a7e96472f8cd5f26
SHA256 d8000748f612b5f67a56038b06e062d104abeb76bad6fd6935d6ce182e773e31
SHA512 21cf8ad17d66b4543d57bc63a61e53a4ec57e3aea719f9c1beda09307d6c9303884ef810d5a07d2d468b017a1d283f442ec5c1ab7a148831519ce17adf92c9f5

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 fdbc1910f9dc14c5b72078204e5b3d3a
SHA1 6be1c2d7b77e2627cc36e80d311a6477aedbb052
SHA256 880cee9ef359ad30b2d9b6b5742607fc62b4e1f54c0144701e84a9d5a29a8332
SHA512 2b8bfe65b81ff94878ee07c263344894adf5e984b26a5d2b67364a7624763b328755413dea3919ff8acf6259474bce0059471cacc9df60e04ab4661ebceceb86

/data/data/com.systemservice/files/PersistedInstallation5108924944372839118tmp

MD5 3617a934b27ce3711e4ca8c5bb16ab4f
SHA1 1c313491d59bee04dc62cc3fbc4cb0f314d4a752
SHA256 a0edf05f32c1f335f7ae8f2030294bf4b44577f1793d64d14dc198974da6811d
SHA512 bb0199c2d9750055a50cb185d4b68397d6707a97fba6b8fa3af349d279e85c69d33e1c46351c0fbaf8c5b0edb0f84dff80f022162f9a275cdb2f4a77d74fdaec

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 498ae537ebd160705ee28641a86ec276
SHA1 fc8dc7047b7be2ed183f01c7dc93e2f7ab3512e2
SHA256 344444ceb150d2e0184e76e0585759d685c6c7870721f776f1e0843f56aed022
SHA512 67e1b87cc332e715ce6503bc1bccd41b927b4a4ace19ce868175b8a6b121ed51365491e5fb6a39445390f3e1102094ca4470f788afbbdef25519cc877b3043ba

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7b65add18294fd79c1dc8b714b2ba7cf
SHA1 ee09d8289d38b815a07b06fa96153f77b4323879
SHA256 2d4b63dfdbd44523b72616e80be080e5dbdf8f35f8b37cf2d67e798014d4da23
SHA512 53946ce0168d9f3c40eb3490163c8b5901e377bbfdf1822cb9324aa4e11581112e93d0a192ccf65f6c04abb2351e37daebdded36c39aa212c9c29c169ea128fb

/data/data/com.systemservice/log/log4j.txt

MD5 dde03a104c6189569bdd0b8cd9b5d369
SHA1 4365ca918875e66e1bad8e0e667c51847fda3026
SHA256 33e1f6fd828dbc8186151d7c1e934829462240701849dfa6557fcff6c26c1c62
SHA512 e6ed33eb92f57fd16b5335ab893a60101d5046076e976f06b91743e5e98c7057a22534936cb0def24cf4d70dc0c9c5b2ee21700f000cefd25d213e94e3fa2615

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 15b3e736e3e9050a99d1878ecd6bedf3
SHA1 dded3068ca4a14aec16f54f850a52c9eb720d85f
SHA256 0e8abab2df13344c5d63845edc4690a798f6475289226720a0570972bcf871e0
SHA512 9f7c4db228726bf1742c8b5fc8dcc68e4daabba32cfdf51a417fdf7a0c86c9edc5c2cdcb58485e3b4b320d5692e0f2e95dcd898af2ef48a2855795d06dc66af1

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 5392cc5116d8cb418c999987088bd946
SHA1 b2cba5397a11ef5a37d8a6b151c022662a3b162e
SHA256 06824d10a6e645f851c15f02b235cdf8ce218eb43b132c8fd6d9cbc70e4d4fe9
SHA512 7ff3d71c306ac3b6b28393aad443c58a12c616ba732915ff50f4de97674ccb8cfb36f03efb12179ad2dc33fa5f20be5a317f1aa8667e7faa486d33093bf40432

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 02a4d1481f3af7c5551177aed0595cef
SHA1 df9f7bb4f82e69772c5dfb1defcfb93c0d1dbf45
SHA256 7bce8521c7353191d9ee6b8adc5408b260a007253b6e600b7b90e50764da27d4
SHA512 a9613b320c3028eea723f8bdc67a1791e9f77833411d6a556327c56100526d9f7b0bd94c7decc595fd8585975257f3c4f76bf43eecc77da74f2767312864b726

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 fde7c235eb8c97798d5cf43b69d5d351
SHA1 1df7333389b2be1661dd056eeb2720aa1d753a82
SHA256 99cc559266dbc2670af291bef749bb3f1093841db680c929610f84b36fcf24db
SHA512 abf009706e17f732d0f3fdc14bb211c402697f3206ec010f9d2958984eb40e13bebf14348d3a6e441c6d6f5ee72a91d003f0580e3c5c65dc705fe70165d3da90

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 0dbeeef0841cbb358effdd49b5930046
SHA1 a6353a5c1cd069c4674c848b67f8eac1021590ad
SHA256 3ecc4239c7bf2a3bafbff8375573491d65ad25dbf6901a30dba5667897c59515
SHA512 daf5a2d62957ea8bf96bc303e286da081a12eebec86c954e2cfb80dc74bee6e4dbd9e28e25a5123f8b216127d93349aa10813a72b1cb74372d3b64f51342198e

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 dd8dde3aa4c6e52138730f148db567c0
SHA1 259c4fe3aa3e8c546e9a4d9850fd644b92176b18
SHA256 7f1dfcf88040666f8399d47f0145b4121c2b9577fbd27e6178d93988075b83ff
SHA512 3a2f231b4acd51f97bada78ba22abb95ef7d0f7ab991904be5c96b7912607a3895e84df7f9e2b331b485d8f6f1f866a542a6296328c6c0b2fb22668537491afd

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 da2c658d248179b47c99b813b32419d2
SHA1 561a679d72dc9fcca58d79243eef9445d107563a
SHA256 278b889f81b4f2c68422dac1c2b092810a0f427975297d6372c3b3e2ed34955e
SHA512 55b942c6b4f5d80286bd009eb21a154fd0ba395c374049b9aaf3b22904a59c0800749dd7a262afd2aa876a5fde9276fda757a415a53a7f7c5cb54ef86514cb25

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-16 02:23

Reported

2024-11-16 02:25

Platform

android-x64-arm64-20240624-en

Max time kernel

17s

Max time network

134s

Command Line

com.systemservice

Signatures

Truthspy

trojan infostealer spyware truthspy

Truthspy family

truthspy

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 2b3766631017896845ac3bd714ba2877
SHA1 d0308653a74736b05559a29e39313e773b3af0e4
SHA256 87eb0636c87c60210bbdbd9f90b59c28123b5169ed2927bff727d55011e0386b
SHA512 0bd808ec1fdab48f769eddb2db3a9fb9338f60cfc0fc523572e88e0b5a193ca2455d15cdba5315a726cfec4eea11b92f7cd6cf9789eaa461d3a264545e7b3ce9

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f65ec0a9324c7c42e9d76c22021ba15f
SHA1 704ddba6c9014550dc343a300254795b57f12b61
SHA256 ed9fb84b4bbb87c62e8e90c745127dbc8d6e3a8befb2d8e32e797935c8c525ec
SHA512 8a66f542362df74a8dc2b323add1a867dab483859bd8ea64c5e425fa31912f67cc437428fc78e337221969615fcf2d9552ff883a9aa7cc6b34dfcd0c646902c2

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 e307f9feb922c0bd3300f55a5708d9b9
SHA1 fbdd32b230eb9f4954d77b4a67ca2172bbd373cf
SHA256 162743eaa24610df63a9a3dfee26fd35175dd1a7907d3eba87b43e07df118e83
SHA512 e6a2f5c87915879ef18c1882872d73778c381256fddbab91fa34664ed37ca2e69eec39ce298a1cbf4ea9290bf17b8faf733de454c396c2edfe23d522d2f22aef

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 ae459eaa98947efb026a4bf377ccd79b
SHA1 7792d96103285ab13fdd055371f499521eb25be3
SHA256 1079de6ea595a935b294dffca2ab0bfb761953f3f0459bdb2920d34412cc8107
SHA512 448f9d955188d30989729e7fc06c3574db4b8dd5722bf8d479a1a04c27bb35253862ab07fc1d2883532dde835810e61a5d5543f3cf649b068a34a9aef985c29c

/data/data/com.systemservice/files/PersistedInstallation4240269649745202854tmp

MD5 77f396c89fc09ca8339be75720c24e31
SHA1 10b92c97c2d04caf1031ced8b8c37e1a5c49a7a9
SHA256 8b6478b6cab5d4ef559d8f15d13587a5c48e3de43ef9bb2e03d7bc0f65eabef4
SHA512 ffa377238664874179b62f1664cd21d9fa428d00da9a6f6e9c6431c3bf219804d4564f45ba5dc229016c7c7aaf6f2beb7fc2564ddff01f3298c2bef97d0b966b

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 98baab660389386d4bf8cbb5d9cf38ff
SHA1 2d38d57af18e5f03d962d2b2ac5259073c5aa2c1
SHA256 ee5ea185f50bd777d63805846ff98ed5970fdfdbd7f84ed95af612c1083fe6ea
SHA512 080b72009b2c3f6647ed8c1557c1cf2f89ad4ea736a80bc41cd29c857f48d270ce387d2d60bdeac9ebd9fc9011af1faaa586e518e3bcca3d964b465cb9d93f83

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 73c0a21cd791a413fbd47aeaa5df6862
SHA1 772cbc0bf429eab26a2de6fff20e698e9be2d067
SHA256 717ddbaa45e7193640a45ce4865db0242b57495e946e19e5270885cbd8260626
SHA512 1b90fdb60a7644f823a6cf0b508246a9e53aec70e176fc1d8e1321a4158d19d00492a9ca2ecac6eb27dd62790d793997479cf97b69ffc557f6e8d7c6287d6c0c

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 4edf9f9e4a40faadc2f4f8df30aee1f2
SHA1 c3030b748f039f7caccb7612c891e13264cac7f7
SHA256 6c32a3103e3efd67e37117316ec6b53f18ff4c2274748a8036bc2450bac761f5
SHA512 edf5d5fff52ceb1287cd578fb4c55a83006569974f052821eec3f1b3fe8d3909c3db8dfbf6b9c98bc99787440c0cec8922707db291cf7ca61b509c5b2d5d9d9b

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 045b39fccf819a53eb862383cfdd1cf5
SHA1 b39685ad1e2da2c3bf7188d1c5fd5f92abeb95f3
SHA256 62e91981011e1f69697dd346f79a2645fd14952aca7ee9b21506256bec15c58d
SHA512 390c6818742d102e60d973b26092aa21696d0a5fe7a25959bf89525ad4371a79c114cd76d5bfe90456984acbf549f8f1271fe5cfc08c2280eb3d9d7743ef1568

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 e53697ffc08508cb5cf469ab1cd2ccf9
SHA1 a61284e92c602c356dde1f85afcdc8daa3adb2ec
SHA256 99d7caa5c7bd42ba2afa34d0d44299f3715c04194e72fd02d7049b585f3446bc
SHA512 987655f76b8f0aab6017293b17e876f70676f54454839ff0aa688832888ddace4f3448c38e33896e4e09cea476ca1401e35dc51429ed9cfc2dcb8800f7bd2f52

/data/data/com.systemservice/files/PersistedInstallation6242294431356202549tmp

MD5 c6bed7916e0735221b3f2850a97571fa
SHA1 e0b4f833a2aaebff631f2303851ee2986be9bd27
SHA256 2ad56deb877ddc28218b5515ded4b757c2fb07d235dd4ee24a13e074d6c97f94
SHA512 0a5b40a4d64226b888c679cd2a111a061e43af9c59177ac09378a63c1becfa6190735d8c77017766d5c08d34ec6f8ec4e48766abe33d661416352dcff5f4d7c0

/data/data/com.systemservice/log/log4j.txt

MD5 dc085c1d045363e85cbed77c5d9e3751
SHA1 48428f5b8c820e73d4e2798ab136274d370749ae
SHA256 7e65ba576b5d9b091bb23b267e968bc7a13544212ee1f9d1e2594c7750878c64
SHA512 59815102910a528639acae42cc07ac511c012b294dc0a97aa9699a39414354123f7b975748c5ef84750331830bc28cee93837281ecd3fc55101fc1d48f191404

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 e9e0043a292fc075ba49d4459284e3af
SHA1 e7a66a5daa9cdcfa27b50e8f4c41f6bae07b0569
SHA256 986e9a29ff861c102bf45329da85d0620826f1ba63e5a74278d4cf71a948b824
SHA512 b5cb1c152a5a7d07fc85d882ed71304a6009028f6fb6331f2fbed52e67bda7a226bd6c6bcddb066e8013840d7edfe4ed0c65e727be75d616ac82a7040a41e6e2

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 c61807f4c52122c4884ad137440ae5d2
SHA1 0bebe12f0157adce1e7dd879957bf6064b66d2c3
SHA256 f72f22df021dda9cb51b18bf7da93cb20af96e43cac9201cda87ce4ef5e78b39
SHA512 3134b11013ea0bfb682d7759bd4f0cfad9cda3af340aa69401199430d094673b2ce4127ea0f4f2bafc22df71543b65b88cc9db8debb27d87d7d09cb890ad847e

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 edac57cfa5bb7b0e6db8915c35ceae66
SHA1 c29913f2d414ee386c828d96c1a4bddb466af587
SHA256 d45ea8b034c52cefe80d775371e9c30fd72e99e08dc4f4d526c7ce8202d73d86
SHA512 e294dd65180e8754cdbf24df7803d8c15ee235ff494431d44d762e99d8071ce6afc40703e9e6e874210c79c37cd872a0a65953c926b14bfbd6aa0a997c2cdc2d

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 684507008f2da37e4983f3cd8032cd8b
SHA1 e3c362d9da0aadfca94f5348a3091ec53b274b6b
SHA256 d3006e1d8c84858bfdecfcdd100a828ce071bd5755c72c5c3452ffdd22513631
SHA512 31676e0bc6693fc23938e92bd148dd4828482afa7117fc2fd609578c2c55e20aa355f2a58beb1939ed5e411557f601f2035b369fe298a097dfe32620e72cebe4

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 aad78bc385c0ccae9736db436fed6011
SHA1 7fd519974dfebf869210492c0248df27affb13ca
SHA256 2260335941058636a724873576b95ed4f55ddd620cf191e8b65e9ab8d71d1799
SHA512 466be71b763e48a220dd795b79aa1d875a301cb8586f950320912c18842ed7f14c34d201dfea70885ddfcf7a2e9b5c3afc5efa21ff714f9dc28032ed14c78df2

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 2238195eab25764b61f2d26ef6a720af
SHA1 d366efd0cc079f0f87d23c630ec8d99f90541731
SHA256 599d63ed390f7e8e81d82b379c9a733ffbf454bfa5843bd0c909737c8d40dfef
SHA512 478111185428119bc92f0ffa3b6d88a7c644108c4b1d9b14a53bea1d74278bc78e67752e41d464dd81e3d600de8b7a723d0c7fa0ce920250ffd26977f9fa3470