Malware Analysis Report

2025-04-03 14:16

Sample ID 250224-cvjqkayjdy
Target 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
Tags
truthspy banker collection credential_access discovery impact persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Threat Level: Known bad

The file 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery impact persistence

Truthspy family

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests dangerous framework permissions

Acquires the wake lock

Queries information about active data network

Queries information about the current Wi-Fi connection

Queries the unique device ID (IMEI, MEID, IMSI)

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-24 02:23

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-24 02:23

Reported

2025-02-24 02:26

Platform

android-x86-arm-20240624-en

Max time kernel

17s

Max time network

131s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.74:443 tcp
AU 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
AU 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.96.1:80 protocol-a100.phoneparental.com tcp
GB 142.250.187.206:443 tcp
AU 1.1.1.1:53 android.apis.google.com udp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 6feef572c11042328f2ea7a5c9067f08
SHA1 a2454120a4c05e03243bba2f3e74c7002d8f7bd1
SHA256 6d2ad953114b1d5e3f4d853ae12af9e42981fa759e7db33d95b66d598481e0b2
SHA512 f07e44afcf3c8a783ed95e916308e90ff45303d31bd185fc31e14fce2197db790269429449f811d191e0ebd905ee47a7ab0d292ae98be5695cf10bd673c264d4

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 a7bcdc359c3485f0f4133f5d5763d7c3
SHA1 45e9883be7cbfaf31d71bded00c4e47552060b2b
SHA256 b6e99dbd748c405574327c86cbb4f5272d048d31024090c1575c4d0c503b13f2
SHA512 b5f5a45d87da01e0990085e3de2df6ec4d227457e5a70b770723344bd5a564db06389e38579a3d0e2c7c52203c3dfcbd43ac7b74698fd7f328fd99c08a739a6f

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/files/PersistedInstallation2433864914849684981tmp

MD5 cedeedfaccb6b1a9c92ba8cac9e6542e
SHA1 eabb1bc0c717275dc1e7e7e93a335e3b6b1a60fe
SHA256 b18a6ffc275f7859d0689e2f700cf84e357b5e65cc7d3be98e3f7dd61c0efd6e
SHA512 610efde120574c036b6548ab035c7bc639ab978c66497a46e035293908eb408b9c678ad2a44543835aef8fda167ae7e9f8af401ad00cca1aaa7f322639b59b0d

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 d23e951e14e1c08961a765c30dba2716
SHA1 122eb5c4e3c860aea3cc4c3a9b45b936e58c1f0c
SHA256 9dc394b1b9c13affa4bcdbc247cb2115feab0c611d87f985f9e7e99cacddb810
SHA512 4585fd2609d1bd922aa776e9f5592875c72b0a71f0cea337c933b649b2c4f2bfe9ae3cfe6dcfdd8d57d5bda6a7811ef674c1fcc782a4871774de20b80ef2fb5a

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 fc7a301dad97d90edf364652e2763817
SHA1 996df116c43f42905a3d9ad96a623ae9cfd4a758
SHA256 f108e7987bddf571c76cb8bbb660d603d29ae5a1cde1c38b867440c4e9c507f9
SHA512 7c88e059de2989f84be05bc63c9ee1f33e060114a83d6e4ecbd33d71aa033a303e796c793188df92a8fcc4c520cbe12c38d21fec2003f41c0fbf3d55a25faa38

/data/data/com.systemservice/files/PersistedInstallation6909515179547065702tmp

MD5 4e53d55682b874f6cf1fbe3bfcbfb69a
SHA1 b362590c58e42f7d84119ad15742fdb3f75be6fc
SHA256 fa4128032c00d3a0841ec25794aa7c983f65e18772044106db76753878063572
SHA512 26945e23827b2e54663f923c7f9f58dd6b6e185c078488781bdb9bb621352de192db7db515dca156617e96bbd6444753c3f6001ccb658a79bef6bc83f3b0891b

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 3cf1dfa470cd591b509e91d151fd2a4a
SHA1 c9cfa642a417b8ee30b0cedb18f4a8d429f66733
SHA256 7177f1dde19792e4d089039a222adf16cf4cae7924a2c9c38d01a83290bcb3e8
SHA512 28c8f7635f7676c2886d55d7f918742fea0c9a7fc9c021bd87691f222209525909116e84bc2074738bcd632526d8c1eada25b88364875bd84d1ddfa0096ede00

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 caa6a48ccba6cdcdf338e4da32963001
SHA1 deb27574c4c762a366ccf0686f8a0f3fda277792
SHA256 befce48dd7cb7c8499926d39c7af270f2e233eb60d56eb101ea3703bf5ba56d3
SHA512 4074a6851d1da9e15c255ae4c83d71cfd16a7ca87d3a54382348cf3808677ad638f137e5d42a624326d074e5a0cf46eeb85d43e6afec37e3c739d57927fa229c

/data/data/com.systemservice/log/log4j.txt

MD5 f3b42a92d12d92298101caaf12c1b0e8
SHA1 cb690f1193176e3d484c101b22ee210f77c39e2d
SHA256 599e4d10d658f236f411f5cb5333b2a001ef97c2483e2994cad829b8937f0c9b
SHA512 2aaf2f7be38a4bfc3856e706ee4e7901351b19efb42675e06933427cd54cff000e2aa916de9cf4c979aacb3ce1bb65f026773e6610805072a7a774ccef236ef3

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 91575e4f00733219e6e6bbb828635e34
SHA1 60c63666a755b2de33b40eed1a42f6194a05ad92
SHA256 9c1f428017b63622bc1b4d032c793a12dd897312e15144449dbd7d25671d2be4
SHA512 62b493a00047faf158cfe26225c2d8a237d19f08a279b627ccb2232c8dd389c886a3d4d0d296a3fa9dd6db8500baae38319ed544c3698543ce4f3710f824f965

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 fa584421d436067fa519b3fe45432fd7
SHA1 2fcfe9c325f636be1c1269f7e06e6dc5cbeccb21
SHA256 796a6a47a79082f7c00b0db0ef90cbc245dbe73b6a0f5d291c06aff5651d7a31
SHA512 af0379507d4b3ba71efa03a29122dfbd8c96542cc1b82afbfd784a215d71c7a502d0d47b9715f68236a60c0d8d4a97bf3147fc863e029e4355b53e9071a0680f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 5ebbf7ded283eb94e9fee8d9b2224f2c
SHA1 ce185e6dcd1de141e03be66dec1fc9668e103a0e
SHA256 396d93a26ad430c9d65e805a9022181d4390c7f4d120b909ee58d0dd489de748
SHA512 4062397e78d6e7fb4a58b366946dcd4edd11ff91c4b832e8b939d4f66ed5fb5b03e8bc1c171f9b575f1b43dfc6f487bd963ba2876851ca63c2facf2c53a9d7ed

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 632501b9459c752d03967fa98028e5ef
SHA1 a510a8fce315799e574bd10fd74e0f4f02bcabec
SHA256 9df536f9d647228a15e400de3c1c0da565d53cd416a087ce6745ea24c7efdc06
SHA512 379e81266be971684d4beea8a463f30c13bea9afd0d4907b0664944f3f9132212e81c7ea8b1e5c9762ce3a7e2687bb4200f46b420ddea847802fdf416bd304ab

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 a7ba40747b0f251847d06cc2f4715af7
SHA1 cd4950120d122887aa4bc32bf5d752c31958d49a
SHA256 2a7b26d079d135df93a4456eaa420846a6aaa994cff7734b33ca51b0a5d1058c
SHA512 0135054b40c3e068dad15748658e04e21dffc711ced67798b695ea3366f0be48dfba9ddbc942e782f2b7a4b9a08f402156814416c54a7360fdcd665917975429

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 c76a25c38733b24624c17f22ea5f4dc3
SHA1 1255c35ae29d7bfa0fcc4c5cd2bb1d2c7027d959
SHA256 d1d1fc4f9de2fda5cfd52244db728f57f4282cc817e0dfaae2ffc2c81b99087a
SHA512 bd146a73791f5d36f607a55c86c698aed36997790563f2136061bb76846a0b0d43082db9b7b845127da6a23a53fd1e8a69cee939b0009a6f5c2f5f7cda308987

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 73c349d6f2bd147826134ca1c57a57a9
SHA1 56d5fa1d5e5c7364e7e77041778030a2f8615e77
SHA256 27651c9feb1db80663be58acfda3429cc5f99a0e4aa9fc389685b844bb502918
SHA512 45ccd2aac312e0013e81a2b0bae4a20cb82f6f74155b1ddadaacb761c4c8a6420659b943775cf58a454cbf64bcccb9c4413938d2360523090ed3a1c4f627b685

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-24 02:23

Reported

2025-02-24 02:26

Platform

android-33-x64-arm64-20240624-en

Max time kernel

18s

Max time network

132s

Command Line

com.systemservice

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
GB 216.58.201.100:443 udp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
N/A 224.0.0.251:5353 udp
AU 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.48.1:80 protocol-a100.phoneparental.com tcp
GB 216.58.204.78:443 tcp
GB 216.58.204.78:443 tcp
GB 172.217.169.46:443 tcp
GB 216.58.204.78:443 udp
AU 1.1.1.1:53 rcs-acs-tmo-us.jibe.google.com udp
US 216.239.36.155:443 rcs-acs-tmo-us.jibe.google.com tcp
AU 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 216.58.213.10:443 remoteprovisioning.googleapis.com tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 142.250.179.227:443 tcp
US 172.64.41.3:443 udp
GB 142.250.179.227:443 udp
GB 216.58.201.100:443 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
GB 216.58.201.100:443 udp

Files

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 3e3181c3c920be183a5d98c18918697d
SHA1 0f3d53b27a3068f8a00a867527ecdeb0fda0dde6
SHA256 1e0244dc50c7c35f47834ba91498eb3ae8ee64deb2c03ec18e8b2d4263d5ea97
SHA512 6d2b3365d775e08bd26fd5237b12d7b01fb44e15a401f0c39ebcd55097740a44df923546b1e76b083aea77f0ffe0471e4209ea5fe1ae98872a56a82462c74848

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f25a70679ff85211d31ef7b0429f7efc
SHA1 66f12d81aeb81ce1b2229a326db12e05996d6fab
SHA256 86fef98399820c27a3746f54fa38c41b5ac224c9c6dba4bdf16c24a2653500c5
SHA512 4d5aba3f1c0431466b06ccdaaa8d2ace77b4610be36f007f4b1f9b5f823ea914c790d4b281ef0900606e191ff3d3ca88304c5f7695e4711560e120e00ba4ae86

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 f1b7b170e3ebde24e9f1b2691679aade
SHA1 9f0094d07a1b0f6680a5aabca653b39e53de2530
SHA256 9f984e9f6b7206ed8dfaa2d08aad518c3b42b1d1286935e33e9e16e547814968
SHA512 2e9c65b398eb6e209224ee3ddc29226d1acbcd4b9dd68fb5b1ab20fef6ab7eba3b2b92d188ef0a9305a83ce3e8b6d6d753656a00f9f9cd82f1134af158658330

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 71c1e40c8ba100ae706445b928f775f9
SHA1 826f3c12065f34c43844dd20d745ffbbdef63a6c
SHA256 eef5735736e3413f935c1685f708d03596b6bb24a5a98af013b1f065c36dd594
SHA512 50da340f0e15d4b058f4d610ea77760fd782d27b2ee2a08f842667909a033e5b23cde122d3a0618d8bc20638c388107357b525eb0120327b0cb2ff633fc4332e

/data/data/com.systemservice/files/PersistedInstallation3012234294092200259tmp

MD5 1d9349096603f958d273c52d91dbb83c
SHA1 a13ad19732f24c9f9105bc83cc570a92307bac41
SHA256 a060bb4a1096bf32ba5f83a9f0a144d3ac9c18ff2398a63bfa229fe768a83b1f
SHA512 acadd0e2531010d32ef17c7893c81d305afb4ce8ea484265aba572a5eeb08a3a41acfd567acbc57b4d24a6c6db21f29aeddc630ceb6e0570867312df224a21b7

/data/data/com.systemservice/log/log4j.txt

MD5 322464c42e2506dd1feefb277138282e
SHA1 111a958336b39bd45776a86f1f590c7d5b54004f
SHA256 2e2c7a35cd5a3342a19740163b87daedaa9da69b2699d09c9cbdff7d8511bd8c
SHA512 3f7bc47531f3c9683cf72abc76b009e51246521f7c3391d239c8706a156054418bf2b4611bd906a863a66323c4d5b0e15d01e5b5e2b59cd77f35df132392c653

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 a94a33d949012a7513c16c5052e9176b
SHA1 221083169fa24c645fd556c24e21f274801df96b
SHA256 4218f7470e9ffd000dc516356d122aeb3f52c7f3073e8fff341459ad42a0c8f0
SHA512 ae68b5db4a29dae7254fc6605407e72029387db3709218773c5b8fa9c4f0845214b2cac7c8ae856abdd5e7b445b77c71e228f67bac87ed6d5c5444f5a92ee711

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 cbf11869e44d2b7cbc3ab1800447a418
SHA1 e24edfb418365407e97b73adb7fa952e834346b9
SHA256 88eeceb1f75a53e147ca21a5b13fe7ba45abb0b41b8e5738ad4120bb65544fd0
SHA512 ff75bf79dd7902a7c2080b0420d5c41723c7de8a6fa30f54a1936f91fed68440571091e1171ee5c1e7fa99f2eed3091cbacddf5221bfd5c22165ef8d838ffab1

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 77f7d2e1f06ecaff56857fc0c1e96392
SHA1 c8f8bfedb2256a2ca0d7dd6626aca760e746541b
SHA256 76486e7468e8cefae58658252b5547ad3d0c90a59d631be8efdd3c06d2617555
SHA512 5dc0b89c9802282eae793fb62e63ce23032ff0b55166f1d4c9c0d5f1a8ed4b5d601f3a138f71956dba34e878f399f8a5aca41f14b072172b4d50c5d95a04644b

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 146de24946c2c5c2a5197544dd369dcd
SHA1 3179b0c1be33122b1f04e52fc8aab4466797fe4d
SHA256 9f0f6e99c5c246c8a60a7ea617c2a0a873750b50f3d71796a237a90a17b52f5d
SHA512 56e1c28ff02919c68cbc92ea99619ec5cf05e9ed4994b2137fb555707a9df315218b2725faca548001ea6f76ed27ce5c14967af001677253cd976017dbd6b657

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 b60420f61dcc8617643c6b881bfbeac7
SHA1 92b8c8c28d963c027f527cda944754588ee46631
SHA256 e015fe5d16f260bbbeb2f49ccea59451fef48a87660e1ca9d3bb87336c30fcf9
SHA512 878b3b0d5a7c361e3449923ae46f8adeaeddf30937dc2931a22fd9562b84111f966823bdb0ba714f2baf2d45c18adf6abfad3539593f0322d0ce9479128bdf45

/data/data/com.systemservice/files/PersistedInstallation5255398700206420292tmp

MD5 64391e3c10e171a8d975733463f13f45
SHA1 92e428511170b47b9d43aaa98f58b1357e99010b
SHA256 efcb162747a67966a6bdb35d139f0b47aa08fd4ce0a1ec1a4ff09a1d257a18c9
SHA512 2ed5166aaadbba18046c3ec0d5ab14a6de6e260c63dd9cd8bf5645ee164902f211a750e52eac776bec725fc6e7c28ed99901e7a4da5c87a9191d2cb1ab9b5b54

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 acff58a7a69818af3364d36490a560a0
SHA1 76e237058220c1b0347a604377a297bec1aa66e9
SHA256 acfa3821731b6ca36d46224654a06aa00a667e2a847dc4bfb89c16bda13cddf1
SHA512 b6ff4f09b2b09ccadacd8b3dfca4acb5f7cdee61b68297aae2874f7043a04231e05d8bcf33f3ecbbe1cd6d3742eeba63ec674ef71e02092506b804718a302ed2

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 dce1886d5601956ea92f589d3fde3f51
SHA1 c67cedbc15224989d0071500d8febfcebe2ee28f
SHA256 c83d6c0263c7e5cd3cabdf7355302c2136eb443298ff172683b53291106f4544
SHA512 f2f835798da357b872c1dff6090633d4e56b4c644a15a3d55565fd29e7241eadf138b2ba80ac274a981bd9e3ed721484f23fd5dfd0126bd238434ef0aee4f93f

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 f0b2a143576d678eb2e0780940021bc7
SHA1 8be9b2b40b097dd538a0ec94de6a470e801d516c
SHA256 36cc47aae8e764ef3d5b371993e17e7d04702c74a4851edf5ef3733f68117f45
SHA512 2f518d7660b81416af063bd416ce1502ec7e038f411e101c7dafacd1bad9a298654fb44161f6d9a84d10026edb5df8becf25ec4495499c751959ff58b1d899c5

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 ba2b3ee6b529f00ecd67578131dd0340
SHA1 8233d63168e73457569bdc93114e98d699b02e65
SHA256 e4810d0d07c84d9dee001fb9873222f042fbaa1f967c6f9a21be73dbaf4d8795
SHA512 b37a571883370f836d5bdc70f75e6a6df11dddb1c105057b0470464e179fb7d636a8e196bd32fa0fcefb36649a9eea483aba05cdf605f6d25caf4baed3c93def

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 756c0c585cad780bbca8e2d81216a67c
SHA1 ef056e10223423e579e3a5512bc55a8786a3528c
SHA256 a3a4445afac23aa1e52f9e91522659203ee2aee0f8158f6bc96be258cdced6c8
SHA512 6c65db8d6f022d75e7f9815964de9ffe8f2ef002886c11a45829ece93c3e05640b6cbf63b6df2365f3f55f0a6ede578b97a172c83da8b8b212c04cc87ffd3744

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 e3f13c7d7678604e5b293f6672bc0ed1
SHA1 b16c998ac7ca1db79cd4983b207a292ac1d96e21
SHA256 486eb5bec4ec277ea7b334a0d0e431e5e62881d3462903e8294640edbe96b2e3
SHA512 b63bab85a373912587e78dfc9daf8b4168a223c7af08fb87de8140d66b9f35042052d2d25694e4ea7c9f2064107e5471318b6dcec39c4e3dc0aa352627fa09f4