Malware Analysis Report

2024-12-06 02:37

Sample ID 241122-cxgzrasnbz
Target 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
Tags
truthspy banker collection credential_access discovery impact persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Threat Level: Known bad

The file 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery impact persistence

Truthspy family

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries the unique device ID (IMEI, MEID, IMSI)

Acquires the wake lock

Queries information about active data network

Queries information about the current Wi-Fi connection

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-22 02:27

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-22 02:27

Reported

2024-11-22 02:29

Platform

android-x86-arm-20240624-en

Max time kernel

17s

Max time network

131s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.238:443 android.apis.google.com tcp

Files

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 6b938818b09996ad43c9e29d853545f2
SHA1 3e75e24337eb1b61cb2e63968df7ae0b6a6c6f54
SHA256 e87f0d03693be14e714bc916b68839b48ea43dd5303d34faaf448d55176795a6
SHA512 305a938f1007fe166a4c57560c172f431e75323e4d77a270fc7dad0095c1dbdbbed7da77f6c939f4ef60a5d4907e2632e73c2d85d959876542e2074116a7d510

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 328a7c6ff5010dfef7f468335d3c581d
SHA1 6fd1294927158def6e7a6ac296045ecfd0c788c1
SHA256 d3f08877aa6cdff4228dd678a771122bc3b021f51497413da33c0fcf7d8f6b8c
SHA512 09be42dfaaac4a5e11f38d704c148092ef6185a8c01f6a284507596fda4e4d57a7852ff41c85474fc46fcdbdaa87a98ac11d7a86df27e50e33437c89b391e465

/data/data/com.systemservice/files/PersistedInstallation7508692130334274586tmp

MD5 f8795d5208f2afe927142aba61c0861f
SHA1 9507cc2f6f322bca05acd3c6c2d997d4d0093374
SHA256 c37aee375e0fdd32239fbac58c67a08f3bc781b924aefa7115a620b9e5c07b02
SHA512 fb9f72504b32cde5f8b7e5237a868010bb1b51cc66abfff5edd45649bb3e4118b558953a6ea3148a939079f927d80b8f7a0c598a2394e74ec8eb232026f9f81b

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 9aad80d9134aab77d29e201fb1f819d2
SHA1 d7aba1bc0fb1015d1aff99e24e115ba6845e1da7
SHA256 e01e6583fe363e94e51d2a83ed1ed7f5a1cb706797da401db99423848420ea14
SHA512 1908806d04e5dd2077fe1c7de0adcb96257fe8281e733e225fca25f9be7e7628d39c87db08546820b32a02fa8cd87600b49f5d6d0c6da9e7a87f4c2bb940d8a4

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 953bb841aaa1a1d4dd1a27b998639621
SHA1 594ba1999c6eecc83a2277593c9126b65a0c721f
SHA256 c653aa90b8ca9197088e4198440015610ae7cd0bd00ffeea7aed784ed35197ff
SHA512 3b7bd85b07069f8dfa366d8ae05581859c1f8f444746c3655d708a8c42ba7f7e2f651732afbe8633885ee29e8f794958362e3b74269fceb3ce3d9fe194745f76

/data/data/com.systemservice/files/PersistedInstallation5466307345553395662tmp

MD5 f9aecf7fc65d6e2bcecc0f6fbf2b073d
SHA1 0679f29b006b045d4433a7e7aed7c3fcd39e6c58
SHA256 ca9e7e65dd7cb640309a19ed4818ab6cbdd4ff578fd1e547ca130e888b40fb4e
SHA512 5e750c5be04138eee270215c00aafb9ed533b1647ba4716d2574323ed32bace5feca0131b01ed1f195918e7ef025ce4c5912d6c70550b07fd4f483f9d23d07eb

/data/data/com.systemservice/log/log4j.txt

MD5 37841166725ac9083c629b5001c6b732
SHA1 7133a6118ea356775e2700af63c6f3fba2400ff0
SHA256 bdb903c72ca99385721646b26800c71180af2a2be48e67cf4a0be8e0a8828740
SHA512 6dc25118d3c2c9b898e060fab593e8b1cc6dfe6b51b8502cea94f1f1068cf1d7b8a7948b64b99dd85c0e86a41ed09daaeec24c2eeaba3f9a7fc33b2d4398b7f6

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 a056fd669f5049bc9f7ce089debefa9f
SHA1 4e4e5838a01861f46fa71b4c6c41f8b8bde45c4f
SHA256 5cce719a351dc2c5028cce44d1af3d45d4abfcd4fb87456f7554ec3a76ea675d
SHA512 8e702f4b369f51ed9f9844bf476bab6fb039bd6ed18690c750ee7f063f822a26b3f1b2ebf3729137a0b5aff0a7ea960de336fde04a10c4c9e9279481bfb2d943

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 a9447f3b0a8e48a60cf8bde4acdba183
SHA1 cb52b95fd9e55d87738192544d2365d67868a4c7
SHA256 cd8b92b2783271118bf667d4b62547fb0541c0deb0cacb500d2030cd4b34e55a
SHA512 e820a0ae0625973ee68b2336dd19f40654815a93d047d8148f7ba412590b047b0567db87ab15ea43dcb202d7373a2f58da193f2c60a2a6fe37570100314850e8

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 00521423a8f805277f6e5f58ec93cf7f
SHA1 f013559cd1ef76f358505d8d00e15c9343ac4659
SHA256 21c0585cef270eafef9bc4cfb90e2aab63bf2486735f753edc1d5c923f51cba7
SHA512 83ef7129d0e3bda86cea2edaa32177ecc2df08d01ae706f0af444a08d316efc2d28f24b6cacf78e83a83f8676785519e158221f968cb4ba1b2a321bfdc5f9993

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 39c22f4c769036b6cda0eabd73c9c388
SHA1 90ea191c34f67c2f3833c809f1c76f2884f2e4e8
SHA256 3bd7fc798e838e62656b6ddde2dc4aa87c0a44712a412ba32e517a0f2839a2ff
SHA512 24349e91f199ef091ccfaf363a152b5611894fd0aa1dc1aa9e1d0922e0ab1e8041306340519126632c3ca9e5c14c40ac652f61a8258a11e7e92d10876326bca8

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 6e774bf65ba8a4939dc7b576bb2c188a
SHA1 fa34bd44ee6b5a9d5d4946f2b0ce06f823721cc2
SHA256 6706fe7fcc235269817ae0a1d1f240600abd2af919b11df769daffff24b3bedb
SHA512 df1e54c9d6bae74333d6a138e965ccc9f567128cb04393d8f6a85fe1922532b78efb46c28c11bb62a45157852363c874efee87be29a452a6c9f7df94972f7be1

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e3d3904698bf51a62cc8f85ed74ca3dd
SHA1 60356d214e17c1d6c5f821200f0d862e4828136b
SHA256 92712203b28bd184279c150f7979e5de599f2393a78e8a0ab2f9f497e2e2de03
SHA512 18672cd94e8c23aa9663778164cdcb071c4077663a992f6d1cd99b443688ad1d0291d9c30f0c5e417848b4acac64199fdb89b4394b3da92d94907df082359bde

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 ada0661f9b97e347b0e3cd1556177395
SHA1 1ae633b040233adde9bdf3085f706937da34edc9
SHA256 584d91d5822dbc8f33596a9320b2cd61bb57d3e54c484bd1b85c8576775d17cf
SHA512 00864d9a757ae98393dd08b14d2df7a24e3d03f490c86f28009b4d6cd88bd318d34a29b193ecc4e93cb2170b01732c04a9c8cc5e8d49da7703d80689264a733c

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 2d03c5ca66a8eefecbd56375914036ba
SHA1 7371dafd73b093a451680bd8f6e0d71091a6aa64
SHA256 dc89fc44b59b69175555eb63cfb9232e288e2bfe05e03012b3ec4ecf5fad8d3e
SHA512 dc6e93ad9119bfebc4de215056741ca78c9d456e14fdc0fdd42e1cd507b6c23f032671ba54db0df39c606f8d11a8e808c0930ba4fbfcdb145b0b2eda922b25a1

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 9a4a3c7c7bcfec1fccfd5c82d6cd1d9c
SHA1 eb106cff049cc6b528506afc14a87b357048f7fa
SHA256 27c38aaaaf762f5919a9d3c42aeb1c2d37caa229fa9eaa21a4aa1991b9654ff0
SHA512 6f3db1b6ed49b2a3c1e61196f761f50406a08bb96dbc46d3440f5b3f7d14a85eb756c458c334e8593b70fee1c8d593d09212011998cb79a101794aee1162d034

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-22 02:27

Reported

2024-11-22 02:29

Platform

android-33-x64-arm64-20240624-en

Max time kernel

18s

Max time network

132s

Command Line

com.systemservice

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.36:443 udp
GB 142.250.200.36:443 tcp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.46:443 android.apis.google.com tcp
GB 216.58.204.78:443 tcp
GB 172.217.169.46:443 android.apis.google.com tcp
US 1.1.1.1:53 rcs-acs-tmo-us.jibe.google.com udp
US 216.239.36.155:443 rcs-acs-tmo-us.jibe.google.com tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 142.250.179.234:443 remoteprovisioning.googleapis.com tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 172.217.16.227:443 tcp
US 172.64.41.3:443 udp
GB 172.217.16.227:443 udp
GB 142.250.200.36:443 tcp
GB 216.58.204.68:443 tcp
GB 216.58.204.68:443 tcp
GB 142.250.200.36:443 udp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 8ba0c82b8a92b439bba3997ebc0024af
SHA1 558d5354501365e6a901b980894e5110bd3e5b5f
SHA256 b58e2ec3a6e61c340519248682257856bfeacf041a33f8eb89182c3a79ab0bd9
SHA512 4e77680946293cd62dc952f01787b4fc8dbae3740a4815d155924ff3c487d365f5816dbab5ce69dba9560c8e2f9f3f93c0a5332ee5a165216ac681ad8e0c8d0d

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 18615d36bdc861bef736526dc5d58dae
SHA1 f329be674ef5fb540d0a1cbded34a8461f9db7ea
SHA256 359a6867c5fb15ccf743c95847d8e96247527d7b163894df8b36d3944d44ffa9
SHA512 d9a9cecfc77718119ae6f2552abba9198b71dadd26d99310a326aab64046378099323e992b17ac74d67d873de6a36416447278461eb8df6d7ab53f8a68182081

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 4ae37e70c7b169ab7cbd092a9f2d2f67
SHA1 684ce6df883ceece5016234c56108e1444ca9ca6
SHA256 f5cb39042fe557d06848783e233855cca009e2cec6c199f3652d4aeb9dc956bf
SHA512 d46ed112ee97eb20ba5880bf59310caa78cf0a64dabafc9b0333ae6d9799fb65ec60a338465702c01ede3f9e003eb7e12c6e90b108bf1761a21e0d3e0f85e123

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 22d8c6ab94705230363c288333a393b0
SHA1 6f08c23428c0789fb53ee3e5425a653b826d17cb
SHA256 638110ae047e4b58ea0efd6f141f8c3fb78bcf163964e1542385c660726569d7
SHA512 32ca64d761e2354533965254a5e165d271a49c43cbc3674e3d027ae8c1ff2dabb442addb517c059b4016d23fc4c026346400d5e01a991ac83a6603e8084c109b

/data/data/com.systemservice/files/PersistedInstallation6338733501820803709tmp

MD5 d4366798b75041f48abc9c25be15ff8d
SHA1 592712f5af6ac44f522de3ecf31d056953c02021
SHA256 229da911cb94c673e03b61ffe5da23a677085d3752b36134d571b61c6f4df23b
SHA512 8f64c97bbb0010e36332b3d11e78f43758eabe19d8773d46accdd747b203c0a554be33f655a8acf515ea264f2e7ed28ef87ea92e75832e9ad0b385c2486ccf74

/data/data/com.systemservice/log/log4j.txt

MD5 1b8d0dd19385547a10934741e6436f53
SHA1 f31a17cfdc8615f84fd099317f0f3ca3a45cd8c4
SHA256 9191d603793ccd4b485877bb9ac9f156652001167d1641a145aa902b93310d07
SHA512 d6fad9ad3537241814b46408b0737a7c7b79532ec0b0f96e560eb10a9f97effaed8aa7d63adf6f79e2c20115573ec686b3721baadadba091748953754148f923

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 d1b1acdeccc13609555b042410784078
SHA1 581821ab4d06f4d5fabe4f93974a1742c9cf1dac
SHA256 dfd97480cf6c6d6983ae3c13d4053f177091666d0e8e5b2cf5255c547bb5bafd
SHA512 142239293b0392373b0e8609c69b3f6a8a4798c794496bdb4ca0bd4cd365aeb55eec2afbd67d836330eb92b5fae13e88fed1c93a4985182ffbbefd4c2f42ac90

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 79f92b7a4c0ff9e519254687a4462bfc
SHA1 ba4f533af3a471196e36c63a5c9b298ae9501868
SHA256 dac6a310b399af1d4045353231051e64c14f0a449470a2dc237bf75284fd8431
SHA512 9b9afb4317c6fb9b1b7800acb01618cb4e20b5b3dd95f5852cbc1bc0ad03c2401eaa4a220ce6238313df5380fd2f5bfda29db3b99db0b3afc2fd07f7cdea9c3a

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 e8c61eb544a89c97ade2a4f11f0c7388
SHA1 37a7bf4f03dd27188cacd4d3784cb0fe914917f0
SHA256 4ff195336d18133dc09f13da9c94c311639c2855b95cbd676dde70d03fac0c86
SHA512 06b6163a5a3cafa4770d76b341666210ad8cca5ef374dbf5b73922fc3de3c80a16969ad64b5369c58d22e2db9c28f9cd174dc50d501e0cb489feb000dc179aec

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 fc9d65913ae5e8c581325aaf370ead88
SHA1 3febfe08997441d6b2c8602a9ae48ccdaecc96ed
SHA256 fb41235eab5f203f04fa569a886f57860417dc8f7ac24c55d67862d90babbaf0
SHA512 451aa450c3f547f6768c7d97c046e73b9c4820c03253c3695fe9fbc109f2d842af5f26a0f058489ee23640cd0a519fe53172fe985d85dc8629b2394f3397fc60

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 6b4e491c01d202e3df7f570df7d1a9c6
SHA1 c669974d2e1010cb7156768fedb125e7556b6133
SHA256 7c586a8a313e9aae6b0e88daebcaf45f78027b9e49827beb8e462c897f7c57cc
SHA512 86afa475f20a9ac57ab08a015d30a6f73f12b6344b4d4043a160c4c863aeb1ff61000bf812f5400a94c676f0a36f8c3b96552771aa746b789926520aee6a0d94

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 e7eef13cf94e0675464a57d69b03be12
SHA1 bc2fdd23d1a06562d609c8ddb0c9668e376d0a82
SHA256 21db59c21f136acdaa44811bcb228abf4a01cd1bcf5eaae68bec39e2285378bb
SHA512 ab1b54e8d281d3e20dc4dbdc2921e90f2b10833f1a07fd60ab4931e3ea0f041225b58600ceaca437bb1d77993ff73c4db504fbab7c4ee0a8d9616d9ad4fe3818

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 d40a71ffaeee42a351b34eafeea110c6
SHA1 654c994e31cd8664f5007c7ce75ec2a98376fd6d
SHA256 7f291f1d812b6d178819560da04c44839ac614e604f70e4a9636827c86bdd688
SHA512 926419af3d5bcd40ef9f57840c849d5c77fb0afdc6afa04e549be50e16bbde5612b44c02d2f98e7d0bcdac759d04d6c78a645ce0329b7852e5f6be13ccaa452a

/data/data/com.systemservice/files/PersistedInstallation6156816282229143832tmp

MD5 4d1c1410b22fd883fc244dd48fe7ab26
SHA1 3ac87b562a23b50ce664276fddd17d1dad07a4a6
SHA256 da4a54ae7c75b1b554692a305c100416dc9064d847a70eb317ccd9ade3be8ae5
SHA512 a0f8faf0e7ba14e0070c78c5ce70b03dbc9176790acb083a55831b185c3e6855507b1351dc942ba068209ea8c825272d441bd3644bb4a120eeb088c0a81b367d

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 c0fff72bf13db42fe0a6270060fdc408
SHA1 5f84a2fde3dafc0efd52c774dee575e9a4c3b139
SHA256 3c9c98ea80a7cd997246d6c75bcf73d4b50002c19b8e7104ba9ef0b6213108fc
SHA512 94f4f3fb5f314369f6dbfd7dd726bcb4a2cb88646c65e13cc9f045efe403139875e280366bf4ca561166fbec0c5c6e3abed8a7996f2ec87fb8e6f3a400809fd5

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 9d4726831a37a45d20565902f221fdee
SHA1 81b5cbad3cc05a3005e2207a2d9c77ee18e05e18
SHA256 333992c2bdf282d361d99ceac8a6ab3eb0494214ffc9806958f78ac53016daab
SHA512 2479dea9ca51a84ac35a353412a5b2fb25c4e3c4e4f75224313f23f9c045f4a53c079e9fb3e5a0851b6f383a4fef6576075d20dda2539a9c2d036588a1c52642

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 66bf12b3bbe6a12c424c7fc7e4b45cab
SHA1 48a96135e03432a6784de8aca6c24b2709323c9b
SHA256 a7c9079c1b998b2def68b98bab3725ad90700461cabdfe775dfead3bcbc0e0cd
SHA512 849325e41e77b370df50995fb768bb3f5c8140528afaf19a7b7063d2f3cda8171b9963e9e9eec09869bdc16ef8889276ef9b7a9351deeeeae22078e732acbb92

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e3f13c7d7678604e5b293f6672bc0ed1
SHA1 b16c998ac7ca1db79cd4983b207a292ac1d96e21
SHA256 486eb5bec4ec277ea7b334a0d0e431e5e62881d3462903e8294640edbe96b2e3
SHA512 b63bab85a373912587e78dfc9daf8b4168a223c7af08fb87de8140d66b9f35042052d2d25694e4ea7c9f2064107e5471318b6dcec39c4e3dc0aa352627fa09f4