ID: Sample Name: L3sEK5fFCj Cookbook: defaultandroidfilecookbook.jbs Time: 02:53:37 Date: 29/04/2018 Version:

Transcription

1 ID: Sample Name: L3sEK5fFCj Cookbook: defaultandroidfilecookbook.jbs Time: 02:53:37 Date: 29/04/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Classification Signature Overview Chae of System Appearance: AV Detection: Location Traci: Operati System Destruction: Spam, unwanted Advertisements and Ransom Demands: Networki: Boot Survival: Remote Access Functionality: Steali of Sensitive Information: Data Obfuscation: Spreadi: System Summary: HIPS / PFW / Operati System Protection Evasion: Anti Debuggi: Malware Analysis System Evasion: Hooki and other Techniques for Hidi and Protection: Lauage, Device and Operati System Detection: Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Screenshots Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static APK Info General Activities Receivers Services Permission Requested Certificate Resources Network Behavior Network Port Distribution TCP Packets UDP Packets Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets APK Behavior Installation Miscellaneous Simulated Events By Permission (executed) By Permission (non-executed) By Class (executed) By Class (non-executed) By API Disassembly 0 Executed Methods 0 Non-Executed Methods Copyright Joe Security LLC 2018 Page 3 of 32

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 02:53:37 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 5m 14s false light L3sEK5fFCj Analysis system description: Android 6.0 Detection: Classification: Warnis: defaultandroidfilecookbook.jbs MAL Show All No interacted views Not all executed log events are in report (maximum 10 identical API calls) Not all resource files were parsed Report size exceeded maximum capacity and may have missi behavior information. Report size exceeded maximum capacity and may have missi disassembly code. Report size exceeded maximum capacity and may have missi dynamic data code. Detection Strategy Score Rae Reporti Detection Threshold Report FP / FN Classification Copyright Joe Security LLC 2018 Page 4 of 32

5 Ransomware Miner Spreadi malicious malicious malicious Evader Phishi suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview of System Appearance Chae Detection AV Traci Location System Destruction Operati unwanted Advertisements and Ransom Demands Spam, Networki Survival Boot Access Functionality Remote of Sensitive Information Steali Obfuscation Data Spreadi Summary System / PFW / Operati System Protection Evasion HIPS Debuggi Anti Analysis System Evasion Malware and other Techniques for Hidi and Protection Hooki Lauage, Device and Operati System Detection Click to jump to signature section Copyright Joe Security LLC 2018 Page 5 of 32

6 Chae of System Appearance: May access the Android keyguard (lock screen) Acquires a wake lock AV Detection: Multi AV Scanner detection for submitted file Location Traci: Queries the phones location (GPS) Operati System Destruction: Lists and deletes files in the same context Spam, unwanted Advertisements and Ransom Demands: Dials phone numbers Has permission to perform phone calls in the background Has permission to send SMS in the background May dial phone number Loads advertisement Networki: Checks an internet connection is available Opens an internet connection Performs DNS lookups (Java API) Downloads files from webservers via HTTP Found stris which match to known social media urls Monitors network connection state Performs DNS lookups Tries to download non-existi http data (HTTP/ Not Found) Urls found in memory or binary data Uses HTTP for connecti to the internet Uses HTTPS Boot Survival: Installs a new wake lock (to get activate on phone screen on) Remote Access Functionality: Uses DownloadManager to fetch additional components Steali of Sensitive Information: Has permissions to create, read or chae account settis (inlcudi account password settis) Queries camera information Queries stored mail and application accounts (e.g. Gmail or Whatsup) Reads logcat Data Obfuscation: Copyright Joe Security LLC 2018 Page 6 of 32

7 Found very lo method stris Obfuscates method names Uses reflection Spreadi: Accesses external storage location System Summary: Executes native commands Kills/terminates processes Requests potentially daerous permissions Classification label Creates SQLiteDatabase table Reads shares settis HIPS / PFW / Operati System Protection Evasion: Uses the DexClassLoader (often used for code injection) Anti Debuggi: Creates a new dex file (likely to load a new code) Potentially drops DEX files Malware Analysis System Evasion: Accesses android OS build fields Executes logcat command Queries several sensitive phone informations Queries the unique operati system id (ANDROID_ID) Hooki and other Techniques for Hidi and Protection: Queries list of runni processes/tasks Uses Crypto APIs Lauage, Device and Operati System Detection: Queries the SIM provider name (SPN - Service Provider Name) Queries the network operator numeric MCC+MNC (mobile country code + mobile network code) Antivirus Detection Initial Sample Source Detection Scanner Label Link L3sEK5fFCj 8% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Copyright Joe Security LLC 2018 Page 7 of 32

8 Domains Source Detection Scanner Label Link googleads.g.doubleclick.net 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Screenshots Copyright Joe Security LLC 2018 Page 8 of 32

9 Created / dropped Files /data/user/0/ntc.ncellavi/cache/ads jar File Type: Size (bytes): 4786 Java Jar file data (zip) Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false 728E13F581DD979E44B9612B352069F0 179F5E5889A29A0C3A87629CECC9F0C21E05C9F DE0BA4286FD2C3699B92D571BD759B18B F06DFB055E C872B519E25C370A88E7C794E41E46583CE36E2678C8CDE5B571BFA6D94DBAEE683AACB9B4ECB165EF16600A1 C52D6057FEE84AEAEEEB953B ABB6135 false low Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation jhapatech.000webhostapp.com true false high googleads.g.doubleclick.net true false 0%, virustotal, Browse high Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious Reserved unknown unknown false United States GOOGLE-GoogleIncUS false United States GOOGLE-GoogleIncUS false Netherlands HOSTINGER-ASLT false United States GOOGLE-GoogleIncUS false United States GOOGLE-GoogleIncUS false Copyright Joe Security LLC 2018 Page 9 of 32

10 Static File Info General File type: Zip archive data Entropy (8bit): TrID: Android Package (19004/1) 46.91% Java Archive (13504/1) 33.33% ZIP compressed archive (4004/1) 9.88% Java Script embedded in Visual Basic Script (2000/0) 4.94% Java Script (2000/0) 4.94% File name: L3sEK5fFCj File size: MD5: SHA1: SHA256: SHA512: File Content Preview: 51366ed225b5cd82070e177e34388dda ec647a9cdd4eb75878d4d4f78666a8cbd45f ee23a4b0f78c03d8699fade486533e d0 636f848515fbbd1a4 9e1d57adb72cf54eab7b4e8147bf213b0b12de62217e459 df853fd066484db627a7598e3684aeeed969ea91550ea9c b1c37ada6b2f4afc3205c16fc9cd54926a PK...WB]8R4Zn.I..a...META-INF/MANIFEST.MF ?f..N.=...Bp.n..D!Q..:a. JQ...*.Z.v.,23p...Y.9...i.....i...M.va./j../...#...4..:...D...]/..U.u...].....} M...?.\.D...n.Xx...s...<X File Icon Static APK Info General Label: Ncell Ntc ShortCuts Minimum SDK required: 14 Target SDK required: 21 Version Code: 1 Version Name: 1 Package Name: ntc.ncellavi Is Activity: true Is Receiver: true Is Service: true Requests System Level Permissions: false Play Store Compatible: true Activities Name ntc.ncellavintc.ncellavi.gtc ntc.ncellavintc.ncellavi.transfer ntc.ncellavintc.ncellavi.recharge ntc.ncellavintc.ncellavi.update ntc.ncellavintc.ncellavi.ntc ntc.ncellavintc.ncellavi.ncell ntc.ncellavintc.ncellavi.choose ntc.ncellavicom.google.android.gms.ads.adactivity ntc.ncellavicom.google.android.gms.ads.purchase.inapppurchaseactivity ntc.ncellavicom.google.android.gms.auth.api.signin.internal.signinhubactivity Is Entrypoint true Receivers com.google.android.gms.measurement.appmeasurementreceiver Intent: com.google.android.gms.measurement.upload Services com.google.android.gms.measurement.appmeasurementservice Copyright Joe Security LLC 2018 Page 10 of 32

11 Permission Requested android.permission.access_network_state android.permission.call_phone android.permission.get_accounts android.permission.internet android.permission.send_sms android.permission.use_credentials android.permission.wake_lock com.google.android.c2dm.permission.receive Certificate Name: Issuer: Subject: classes.dex =# e64726f e647 26f69642e636f6d,CN=Android,OU=Android,O=Android, L=Mountain View,ST=California,C=US =# e64726f e647 26f69642e636f6d,CN=Android,OU=Android,O=Android, L=Mountain View,ST=California,C=US Resources Name Type Size abc_ic_commit_search_api_mtrl_alp ha. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 280 abc_screen_simple.xml data 892 abc_list_focused_holo.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 222 ic_cast_on_2_light. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1076 abc_btn_check_to_on_mtrl_015. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 429 gtm_analytics data 2358 abc_list_pressed_holo_light.9. PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced 221 abc_menu_hardkey_panel_mtrl_mult.9. PNG image data, 64 x 24, 8-bit/color RGBA, non-interlaced 604 ic_media_route_on_0_mono_dark.pn PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1206 g abc_ic_ab_back_mtrl_am_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 240 common_google_signin_btn_icon_da PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 2531 rk_focused.9. abc_switch_track_mtrl_alpha.9. PNG image data, 29 x 25, 8-bit/color RGBA, non-interlaced 534 _disabled.9. PNG image data, 62 x 62, 8-bit/color RGBA, non-interlaced 1212 common_google_signin_btn_icon_da PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1295 rk_focused.9. abc_ic_menu_cut_mtrl_alpha. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 381 abc_switch_thumb_material.xml data 560 _normal.9. PNG image data, 146 x 62, 8-bit/color RGBA, non-interlaced 1647 powered_by_google_light. PNG image data, 240 x 28, 8-bit/color RGBA, non-interlaced 4766 abc_ic_clear_mtrl_alpha. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 395 abc_btn_radio_to_on_mtrl_015. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 996 abc_ic_ab_back_mtrl_am_alpha. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 325 _disabled.9. PNG image data, 165 x 70, 8-bit/color RGBA, non-interlaced 987 powered_by_google_dark. PNG image data, 240 x 28, 8-bit colormap, non-interlaced 3099 _pressed.9. abc_textfield_search_activated_mtrl _alpha.9. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 1817 PNG image data, 36 x 10, 8-bit/color RGBA, non-interlaced 193 cast_ic_notification_on. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1039 image_2. PNG image data, 185 x 139, 8-bit colormap, non-interlaced 3334 _pressed.9. PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1618 ic_media_pause. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 355 _disabled.9. PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced 795 abc_screen_toolbar.xml data 1660 abc_list_selector_disabled_holo_ligh t.9. PNG image data, 13 x 41, 8-bit/color RGBA, non-interlaced 227 Copyright Joe Security LLC 2018 Page 11 of 32

12 Name Type Size ic_media_route_on_1_mono_dark.pn PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1662 g mr_media_route_chooser_dialog.xml data 1140 _disabled.9. PNG image data, 146 x 62, 8-bit/color RGBA, non-interlaced 1252 mr_ic_audio_vol. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 1746 _disabled.9. PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced 1152 ic_setti_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 604 _focused.9. PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 3080 recharge.xml data 1664 abc_ic_menu_copy_mtrl_am_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 418 ic_plusone_standard_off_client. PNG image data, 76 x 48, 8-bit colormap, non-interlaced 702 abc_ic_ab_back_mtrl_am_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 246 common_google_signin_btn_icon_da PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced 884 rk_disabled.9. abc_menu_hardkey_panel_mtrl_mult.9. PNG image data, 192 x 72, 8-bit/color RGBA, non-interlaced 1822 abc_list_divider_mtrl_alpha.9. PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced 170 abc_text_cursor_mtrl_alpha.9. PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced 242 clicka.xml data 512 common_full_open_on_phone. PNG image data, 128 x 128, 8-bit colormap, non-interlaced 494 abc_spinner_mtrl_am_alpha.9. PNG image data, 18 x 24, 8-bit/color RGBA, non-interlaced 353 common_google_signin_btn_icon_da PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1772 rk_normal.9. _pressed.9. PNG image data, 222 x 96, 8-bit/color RGBA, non-interlaced 1901 mr_ic_media_route_mono_dark.xml data 880 abc_btn_radio_to_on_mtrl_015. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 753 main.xml data 612 ht_normal.9. ht_disabled.9. PNG image data, 218 x 92, 8-bit/color RGBA, non-interlaced 2331 PNG image data, 327 x 138, 8-bit/color RGBA, non-interlaced 1865 abc_btn_radio_to_on_mtrl_000. PNG image data, 128 x 128, 8-bit colormap, non-interlaced 1014 abc_btn_default_mtrl_shape.xml data 1092 _disabled.9. ht_normal.9. abc_background_cache_hint_select or_material_dark.xml PNG image data, 109 x 46, 8-bit/color RGBA, non-interlaced 787 PNG image data, 109 x 46, 8-bit/color RGBA, non-interlaced 1190 data 344 switch_thumb_material_dark.xml data 468 ht_normal.9. PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1705 ic_media_route_on_mono_dark. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 794 abc_list_focused_holo.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 244 cast_ic_notification_1. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 661 abc_list_selector_background_transi tion_holo_light.xml data 508 common_google_signin_btn_icon_da PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 2332 rk_pressed.9. rk_normal.9. PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1824 common_google_signin_btn_icon_da PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1221 rk_pressed.9. mr_ic_settis_dark.xml data 424 abc_cab_background_top_mtrl_alph a.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 234 rk_disabled.9. PNG image data, 109 x 46, 8-bit/color RGBA, non-interlaced 888 abc_fade_out.xml data 396 abc_list_pressed_holo_light.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 212 common_google_signin_btn_icon_da PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1860 rk_normal.9. ic_plusone_small_off_client. PNG image data, 36 x 21, 8-bit colormap, non-interlaced 574 ic_setti_dark. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 850 button_pressed.xml data 1132 Copyright Joe Security LLC 2018 Page 12 of 32

13 Name Type Size PNG image data, 146 x 62, 8-bit/color RGBA, non-interlaced 1282 rk_disabled.9. button1.xml data 928 abc_ic_menu_paste_mtrl_am_alpha. rk_normal.9. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 373 PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 1273 abc_spinner_mtrl_am_alpha.9. PNG image data, 72 x 96, 8-bit/color RGBA, non-interlaced 617 _normal.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1026 ic_plusone_medium_off_client. PNG image data, 42 x 26, 8-bit colormap, non-interlaced 408 abc_list_selector_disabled_holo_dar k.9. PNG image data, 42 x 126, 8-bit/color RGBA, non-interlaced 307 rk_normal.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1975 ic_cast_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 774 _focused.9. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 2251 abc_btn_check_to_on_mtrl_000. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 288 _disabled.9. _focused.9. PNG image data, 327 x 138, 8-bit/color RGBA, non-interlaced 1704 PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1704 abc_list_pressed_holo_dark.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 211 ic_cast_disabled_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 785 _pressed.9. _normal.9. PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 3080 PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 1035 abc_list_selector_holo_dark.xml data 1208 abc_cab_background_internal_bg.x ml abc_ic_menu_copy_mtrl_am_alpha. data 436 PNG image data, 72 x 72, 8-bit colormap, non-interlaced 363 abc_ic_voice_search_api_mtrl_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 1291 abc_ic_ab_back_mtrl_am_alpha. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 416 abc_secondary_text_material_dark.x ml data 468 ic_cast_on_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 771 abc_list_lopressed_holo.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 212 powered_by_google_light. PNG image data, 180 x 21, 8-bit/color RGBA, non-interlaced 3352 _normal.9. _focused.9..xml PNG image data, 218 x 92, 8-bit/color RGBA, non-interlaced 1869 PNG image data, 222 x 96, 8-bit/color RGBA, non-interlaced 2338 data 836 abc_btn_radio_to_on_mtrl_000. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 831 ic_media_route_disabled_mono_dar k. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 798 abc_spinner_mtrl_am_alpha.9. PNG image data, 54 x 72, 8-bit/color RGBA, non-interlaced 630 _pressed.9. abc_ic_commit_search_api_mtrl_alp ha. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 1879 PNG image data, 96 x 96, 8-bit colormap, non-interlaced 306 abc_ic_menu_cut_mtrl_alpha. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 988 abc_ic_menu_selectall_mtrl_alpha.p PNG image data, 96 x 96, 8-bit colormap, non-interlaced 390 button_disabled.xml data 1132 cast_ic_notification_2. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 898 abc_spinner_mtrl_am_alpha.9. PNG image data, 27 x 36, 8-bit/color RGBA, non-interlaced 391 mr_ic_audio_vol. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1313 abc_list_selector_disabled_holo_ligh t.9. PNG image data, 21 x 63, 8-bit/color RGBA, non-interlaced 240 abc_spinner_mtrl_am_alpha.9. PNG image data, 72 x 96, 8-bit/color RGBA, non-interlaced 611 ic_pause_dark. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 204 abc_fade_in.xml data 396 ht.xml data 716 ic_setti_dark. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 587 Copyright Joe Security LLC 2018 Page 13 of 32

14 Name Type Size select_dialog_multichoice_material.x data 692 ml ic_cast_on_1_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1263 abc_ab_share_pack_mtrl_alpha.9.pn g PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 305 _normal.9. abc_action_bar_view_list_nav_layou t.xml _disabled.9. ht_disabled.9. PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 2792 data 396 PNG image data, 138 x 138, 8-bit/color RGBA, non-interlaced 1922 PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 973 mr_ic_media_route_mono_light.xml data 880 abc_grow_fade_in_from_bottom.xml data 860 abc_btn_radio_to_on_mtrl_000. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 622 abc_btn_switch_to_on_mtrl_ PNG image data, 81 x 81, 8-bit gray+alpha, non-interlaced 2804 abc_list_selector_disabled_holo_ligh t.9. PNG image data, 28 x 84, 8-bit/color RGBA, non-interlaced 253 ic_plusone_standard_off_client. PNG image data, 38 x 24, 8-bit colormap, non-interlaced 377 abc_ic_menu_share_mtrl_alpha. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 545 abc_cab_background_top_mtrl_alph a.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 225 ic_media_route_off_mono_dark. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1527 _pressed.9. _normal.9. PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1708 PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 3035 ht_focused.9. PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 4128 ic_cast_light. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1847 common_full_open_on_phone. PNG image data, 128 x 128, 8-bit colormap, non-interlaced 494 cast_ic_notification_2. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 535 _disabled.9. _focused.9. PNG image data, 327 x 138, 8-bit/color RGBA, non-interlaced 2137 PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 3340 common_google_signin_btn_icon_da PNG image data, 62 x 62, 8-bit/color RGBA, non-interlaced 1233 rk_disabled.9. ic_play_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 325 notification_media_action.xml data 616 ic_plusone_tall_off_client. PNG image data, 50 x 20, 8-bit colormap, non-interlaced 349 notification_template_media.xml data 1428 abc_ic_search_api_mtrl_alpha. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1908 common_google_signin_btn_icon_da PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1242 rk_normal.9. abc_ic_menu_cut_mtrl_alpha. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 610 ht_focused.9. ht_disabled.9. PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 4414 PNG image data, 218 x 92, 8-bit/color RGBA, non-interlaced 1270 mr_media_route_list_item.xml data 1204 _disabled.9. _disabled.9. abc_list_selector_disabled_holo_dar k.9. PNG image data, 92 x 92, 8-bit/color RGBA, non-interlaced 1057 PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced 682 PNG image data, 28 x 84, 8-bit/color RGBA, non-interlaced 254 ic_media_play. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 758 ic_cast_on_0_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 731 rk_pressed.9. PNG image data, 222 x 96, 8-bit/color RGBA, non-interlaced 2442 _normal.9. PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1542 ht_pressed.9. rk_pressed.9. rk_normal.9. PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1765 PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 1254 PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 3694 Copyright Joe Security LLC 2018 Page 14 of 32

15 Name Type Size abc_btn_rati_star_on_mtrl_alpha.p PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1078 _focused.9.. xml PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 2029 data 836 mr_ic_play_dark.xml data 424 abc_ic_ab_back_mtrl_am_alpha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 485 mr_ic_audio_vol. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 928 _pressed.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1595 abc_action_menu_layout.xml data 584 ic_pause_dark. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 206 ntc.xml data 5044 ht_pressed.9. PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 3214 ic_cast_off_light. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1547 ht_pressed.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1879 common_full_open_on_phone. PNG image data, 128 x 128, 8-bit colormap, non-interlaced 494 abc_ic_menu_cut_mtrl_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 1253 ic_media_route_disabled_mono_dar k. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 500 ic_media_route_on_2_mono_dark.pn PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1296 g ht_normal.9. PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1833 update.xml data 1848 abc_textfield_search_default_mtrl_al pha.9. PNG image data, 12 x 3, 8-bit/color RGBA, non-interlaced 180 ic_media_route_on_1_mono_dark.pn PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1028 g ic_plusone_medium_off_client. PNG image data, 48 x 30, 8-bit colormap, non-interlaced 433 _focused.9. select_dialog_silechoice_material. xml _focused.9. PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1813 data 692 PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1779 powered_by_google_dark. PNG image data, 120 x 14, 8-bit colormap, non-interlaced 1765 abc_popup_enter.xml data 512 notification_template_part_time.xml data 660 ht_pressed.9. PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 3500 abc_btn_switch_to_on_mtrl_ PNG image data, 41 x 41, 8-bit/color RGBA, non-interlaced 1548 ic_pause_light. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 209 abc_tab_indicator_mtrl_alpha.9. PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced 199 abc_textfield_activated_mtrl_alpha.9. abc_list_selector_disabled_holo_dar k.9. PNG image data, 12 x 11, 8-bit/color RGBA, non-interlaced 186 PNG image data, 21 x 63, 8-bit/color RGBA, non-interlaced 239 abc_btn_check_to_on_mtrl_015. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 549 ic_play_light. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 720 abc_dialog_title_material.xml data 1164 abc_ic_menu_copy_mtrl_am_alpha. _focused.9. _focused.9. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 237 PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1899 PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1752 select_dialog_item_material.xml data 648 ht_focused.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1375 abc_textfield_activated_mtrl_alpha.9. PNG image data, 38 x 33, 8-bit/color RGBA, non-interlaced 202 abc_ic_clear_mtrl_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 566 rk_focused.9. PNG image data, 222 x 96, 8-bit/color RGBA, non-interlaced 2656 abc_list_lopressed_holo.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 214 Copyright Joe Security LLC 2018 Page 15 of 32

16 Name Type Size PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 2051 ht_focused.9. rk_focused.9. PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 1330 abc_btn_check_to_on_mtrl_015. PNG image data, 128 x 128, 8-bit colormap, non-interlaced 551 ic_media_play. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 493 cast_ic_notification_1. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 384 abc_ic_go_search_api_mtrl_alpha.p PNG image data, 16 x 16, 8-bit colormap, non-interlaced 158 common_google_signin_btn_icon_da PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1843 rk_focused.9. abc_action_mode_close_item_mater ial.xml data 632 _normal.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1000 cast_ic_notification_on. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 445 abc_list_divider_mtrl_alpha.9. PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced 170 abc_text_cursor_mtrl_alpha.9. PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced 226 _focused.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1844 ic_cast_dark. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1358 _pressed.9. PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1587 abc_list_focused_holo.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 244 ht_focused.9. PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 1394 ic_media_route_on_0_mono_dark.pn PNG image data, 24 x 24, 8-bit colormap, non-interlaced 739 g abc_ic_menu_selectall_mtrl_alpha.p abc_textfield_search_default_mtrl_al pha.9. ht_focused.9. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 337 PNG image data, 36 x 10, 8-bit/color RGBA, non-interlaced 196 PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 2142 ic_setti_dark. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1712 abc_ic_menu_cut_mtrl_alpha. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 991 abc_cab_background_top_mtrl_alph a.9. PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced 246 abc_search_url_text.xml data 596 _pressed.9. abc_btn_rati_star_off_mtrl_alpha. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 991 PNG image data, 96 x 96, 8-bit colormap, non-interlaced 2215 ht_normal.9. PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 3249 _normal.9. PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1532 abc_spinner_mtrl_am_alpha.9. PNG image data, 27 x 36, 8-bit/color RGBA, non-interlaced 392 common_google_signin_btn_icon_da PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 3431 rk_normal.9. abc_ic_search_api_mtrl_alpha. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 681 powered_by_google_dark. PNG image data, 480 x 56, 8-bit colormap, non-interlaced 5375 _pressed.9. _pressed.9. PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1640 PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1526 ic_cast_disabled_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 485 abc_textfield_activated_mtrl_alpha.9. PNG image data, 19 x 16, 8-bit/color RGBA, non-interlaced 192 abc_btn_switch_to_on_mtrl_ PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced 2606 ic_cast_on_2_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1304 resources.arsc data abc_ic_menu_share_mtrl_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 1559 abc_primary_text_material_light.xml data 468 ht_normal.9. PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1742 ht_pressed.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1175 _normal.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1608 Copyright Joe Security LLC 2018 Page 16 of 32

17 Name Type Size abc_ic_menu_moreoverflow_mtrl_al pha. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 190 _pressed.9. PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 997 ic_cast_on_0_light. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1585 image_3. PNG image data, 128 x 144, 8-bit colormap, non-interlaced 2943 abc_ratibar_full_material.xml data 664 abc_list_menu_item_icon.xml data 688 ic_plusone_medium_off_client. PNG image data, 64 x 40, 8-bit colormap, non-interlaced 659 common_google_signin_btn_icon_da PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1716 rk_pressed.9. notification_template_big_media.xml data 1780 ic_cast_dark. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1864 _normal.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1615 package.html HTML document, ASCII text 228 _focused.9. ht_pressed.9. PNG image data, 222 x 96, 8-bit/color RGBA, non-interlaced 2139 PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 1189 abc_tab_indicator_mtrl_alpha.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 208 _pressed.9. PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1548 MANIFEST.MF ASCII text, with CRLF line terminators abc_btn_check_to_on_mtrl_015. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 556 abc_ic_menu_copy_mtrl_am_alpha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 237 abc_popup_exit.xml data 512 ic_launcher. PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced 9193 ht.xml data 836 abc_list_selector_holo_light.xml data 1208 ic_plusone_small_off_client. PNG image data, 48 x 28, 8-bit colormap, non-interlaced 752 abc_btn_check_to_on_mtrl_000. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 306 ic_plusone_tall_off_client. PNG image data, 75 x 30, 8-bit colormap, non-interlaced 444 ht.xml data 836 abc_list_pressed_holo_dark.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 212 mr_ic_audio_vol. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 840 ic_launcher. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 5057 abc_background_cache_hint_select or_material_light.xml data 344 cast_ic_notification_2. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 705 abc_ic_menu_paste_mtrl_am_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 680 _normal.9. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 1878 abc_btn_switch_to_on_mtrl_ PNG image data, 108 x 108, 8-bit/color RGBA, non-interlaced 3853 abc_list_lopressed_holo.9. PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced 221 abc_background_cache_hint_select or_material_light.xml data 472 ic_cast_on_1_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 766 common_full_open_on_phone. PNG image data, 128 x 128, 8-bit colormap, non-interlaced 494. xml data 716 cast_ic_notification_0. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 781 abc_switch_track_mtrl_alpha.9. PNG image data, 39 x 32, 8-bit/color RGBA, non-interlaced 762 _focused.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1192 ic_cast_dark. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1052 abc_btn_check_to_on_mtrl_000. PNG image data, 128 x 128, 8-bit colormap, non-interlaced 295 abc_btn_check_material.xml data 560 _normal.9. PNG image data, 222 x 96, 8-bit/color RGBA, non-interlaced 1970 CERT.SF ASCII text, with CRLF line terminators abc_btn_radio_to_on_mtrl_015. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 1467 abc_list_selector_background_transi tion_holo_dark.xml data 508 Copyright Joe Security LLC 2018 Page 17 of 32

18 Name Type Size abc_ab_share_pack_mtrl_alpha.9.pn PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 297 g abc_activity_chooser_view.xml data 1760 ic_setti_light. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 874 _pressed.9. PNG image data, 222 x 96, 8-bit/color RGBA, non-interlaced 1954 ic_media_pause. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 305 abc_background_cache_hint_select or_material_dark.xml data 472 abc_ic_clear_mtrl_alpha. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 236 _focused.9. PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 1206 ht_focused.9. PNG image data, 62 x 62, 8-bit/color RGBA, non-interlaced 1793 powered_by_google_light. PNG image data, 360 x 42, 8-bit/color RGBA, non-interlaced 7525 abc_ic_ab_back_mtrl_am_alpha. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 384 abc_list_selector_disabled_holo_dar k.9. PNG image data, 13 x 41, 8-bit/color RGBA, non-interlaced 226 ic_media_route_on_0_mono_dark.pn PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1583 g ic_plusone_tall_off_client. PNG image data, 100 x 40, 8-bit colormap, non-interlaced 667 ic_cast_dark. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 783 ic_media_route_off_mono_dark. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 693 notification_template_lines.xml data 2848 abc_tab_indicator_mtrl_alpha.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 210 cast_ic_notification_0. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 479 rk_focused.9. abc_btn_switch_to_on_mtrl_ abc_dialog_material_background_da rk.xml PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1939 PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced 1124 data 844 _normal.9. _focused.9. PNG image data, 109 x 46, 8-bit/color RGBA, non-interlaced 997 PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1600 abc_ic_menu_share_mtrl_alpha. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 791 image.xml data 928 _disabled.9. ht_focused.9. _pressed.9. _disabled.9. _pressed.9. PNG image data, 218 x 92, 8-bit/color RGBA, non-interlaced 1122 PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1985 PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 2734 PNG image data, 109 x 46, 8-bit/color RGBA, non-interlaced 679 PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1033 abc_ic_menu_paste_mtrl_am_alpha. abc_popup_background_mtrl_mult.9. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 234 PNG image data, 192 x 96, 8-bit/color RGBA, non-interlaced 2774 abc_list_pressed_holo_light.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 214 abc_item_background_holo_dark.xm l data 1136 wallet_secondary_text_holo_dark.x ml data 1208 common_google_signin_btn_icon_da PNG image data, 92 x 92, 8-bit/color RGBA, non-interlaced 1519 rk_disabled.9. ht_normal.9. _normal.9. PNG image data, 327 x 138, 8-bit/color RGBA, non-interlaced 3477 PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1608 ncell.xml data 8168 ht_disabled.9. PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced 716 abc_ic_ab_back_mtrl_am_alpha. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 570 _pressed.9. PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 3020 abc_list_focused_holo.9. PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced 245 ic_plusone_small_off_client. PNG image data, 72 x 42, 8-bit colormap, non-interlaced 603 Copyright Joe Security LLC 2018 Page 18 of 32

19 Name Type Size ic_media_route_on_mono_dark. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1043 abc_search_view.xml data 3736 common_google_signin_btn_icon_da PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1948 rk_focused.9. abc_btn_check_to_on_mtrl_000. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 354 notification_media_cancel_action.xm l ht_pressed.9. data 688 PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced 1654 abc_list_pressed_holo_dark.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 214 classes.dex Dalvik dex file version common_google_signin_btn_icon_da PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 3384 rk_pressed.9. ic_media_pause. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 384 fadess.xml data 720 abc_secondary_text_material_light.x ml abc_textfield_search_default_mtrl_al pha.9. _disabled.9. _normal.9. abc_ic_menu_copy_mtrl_am_alpha. data 468 PNG image data, 18 x 5, 8-bit/color RGBA, non-interlaced 182 PNG image data, 62 x 62, 8-bit/color RGBA, non-interlaced 934 PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1666 PNG image data, 24 x 24, 8-bit colormap, non-interlaced 185 ic_cast_on_light. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1044 rk_disabled.9. PNG image data, 218 x 92, 8-bit/color RGBA, non-interlaced 1630 abc_textfield_search_activated_mtrl _alpha.9. PNG image data, 24 x 6, 8-bit/color RGBA, non-interlaced 190 rk_pressed.9. PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1804 abc_btn_rati_star_off_mtrl_alpha. abc_ic_menu_copy_mtrl_am_alpha. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1619 PNG image data, 96 x 96, 8-bit colormap, non-interlaced 418 abc_ic_clear_mtrl_alpha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 365 abc_action_bar_up_container.xml data 448 ic_media_route_on_1_mono_dark.pn PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1273 g abc_simple_dropdown_hint.xml data 488 rk.xml data 836 ht_pressed.9. abc_btn_rati_star_off_mtrl_alpha. PNG image data, 148 x 65, 8-bit/color RGBA, non-interlaced 1720 PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1348 cast_ic_notification_on. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 795 abc_item_background_holo_light.xm l data 1136 ic_plusone_standard_off_client. PNG image data, 57 x 36, 8-bit colormap, non-interlaced 448 ic_media_pause. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 222 ic_media_route_on_0_mono_dark.pn PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1006 g _pressed.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1686 ic_pause_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 191 abc_btn_radio_material.xml data 560 abc_btn_radio_to_on_mtrl_000. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 1249 ic_cast_on_0_light. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 990 ht_normal.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1916 abc_ic_ab_back_mtrl_am_alpha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 428 support_simple_spinner_dropdown_it data 508 em.xml abc_action_mode_bar.xml data 508 _focused.9. PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 3494 ic_cast_on_1_light. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1693 _focused.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1105 Copyright Joe Security LLC 2018 Page 19 of 32

20 Name Type Size abc_ab_share_pack_mtrl_alpha.9.pn PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced 274 g ic_media_route_disabled_mono_dar k. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 688 mr_ic_settis_light.xml data 424 abc_ic_ab_back_mtrl_am_alpha. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 475 common_google_signin_btn_icon_da PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced 1835 rk_pressed.9. abc_ic_voice_search_api_mtrl_alpha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 730 mr_media_route_controller_material_ data 4280 dialog_b.xml abc_btn_radio_to_on_mtrl_015. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 493 abc_btn_rati_star_on_mtrl_alpha.p PNG image data, 144 x 144, 8-bit colormap, non-interlaced 1032 abc_slide_in_bottom.xml data 400 abc_ic_menu_cut_mtrl_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 1257 abc_textfield_search_default_mtrl_al pha.9. PNG image data, 24 x 6, 8-bit/color RGBA, non-interlaced 190 ic_media_route_on_2_mono_dark.pn PNG image data, 24 x 24, 8-bit colormap, non-interlaced 801 g abc_ic_menu_share_mtrl_alpha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 919 ic_plusone_standard_off_client. PNG image data, 50 x 31, 8-bit colormap, non-interlaced 429 common_google_signin_btn_icon_da data 836 rk.xml abc_ic_menu_cut_mtrl_alpha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 729 abc_btn_rati_star_off_mtrl_alpha. abc_ic_menu_copy_mtrl_am_alpha. PNG image data, 144 x 144, 8-bit colormap, non-interlaced 2401 PNG image data, 24 x 24, 8-bit colormap, non-interlaced 174 CERT.RSA data 1714 _focused.9. abc_ic_commit_search_api_mtrl_alp ha. PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 3800 PNG image data, 48 x 48, 8-bit colormap, non-interlaced 233 common_google_signin_btn_icon_da PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 3789 rk_focused.9. common_full_open_on_phone. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 740 powered_by_google_light. PNG image data, 480 x 56, 8-bit/color RGBA, non-interlaced abc_text_cursor_mtrl_alpha.9. PNG image data, 5 x 5, 8-bit gray+alpha, non-interlaced 229 abc_textfield_default_mtrl_alpha.9.p PNG image data, 25 x 22, 8-bit/color RGBA, non-interlaced 197 ic_launcher. PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced ic_plusone_tall_off_client. PNG image data, 66 x 26, 8-bit colormap, non-interlaced 445 ic_cast_light. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1045 switch_thumb_material_light.xml data 468 ic_cast_on_2_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 769 abc_switch_track_mtrl_alpha.9. PNG image data, 78 x 64, 8-bit/color RGBA, non-interlaced 1056 AndroidManifest.xml data 6372 abc_btn_borderless_material.xml data 700 abc_search_dropdown_item_icons_2 data 2244 line.xml abc_ic_menu_selectall_mtrl_alpha.p PNG image data, 24 x 24, 8-bit colormap, non-interlaced 186 abc_list_menu_item_checkbox.xml data 536 aa. PNG image data, 310 x 240, 8-bit/color RGBA, non-interlaced 7012 abc_alert_dialog_material.xml data 3828 mr_media_route_list_item.xml data 1204 abc_textfield_activated_mtrl_alpha.9. PNG image data, 25 x 22, 8-bit/color RGBA, non-interlaced 198 abc_btn_switch_to_on_mtrl_ PNG image data, 81 x 81, 8-bit/color RGBA, non-interlaced 3755 _focused.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1706 ic_cast_off_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 674 ads.xml data 1068 mr_ic_pause_dark.xml data 424 abc_activity_chooser_view_list_item. xml data 1272 Copyright Joe Security LLC 2018 Page 20 of 32

21 Name Type Size _pressed.9. PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 1034 ic_plusone_tall_off_client. PNG image data, 150 x 60, 8-bit colormap, non-interlaced 806 image_1. PNG image data, 185 x 139, 8-bit colormap, non-interlaced 3334 ic_plusone_medium_off_client. PNG image data, 96 x 60, 8-bit colormap, non-interlaced 889 abc_list_divider_mtrl_alpha.9. PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced 170 cast_ic_notification_connecti.xml data 828 cast_ic_notification_2. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 389 abc_ic_go_search_api_mtrl_alpha.p PNG image data, 48 x 48, 8-bit colormap, non-interlaced 176 cast_ic_notification_on. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 586 ht_disabled.9. PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced 981 ic_cast_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1340 ic_setti_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1129 ic_pause_dark. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 227 button_focused.xml data 1132 rk_pressed.9. PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 3650 abc_spinner_mtrl_am_alpha.9. PNG image data, 36 x 48, 8-bit/color RGBA, non-interlaced 507 _disabled.9. PNG image data, 92 x 92, 8-bit/color RGBA, non-interlaced 1305 abc_ic_search_api_mtrl_alpha. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 1571 abc_ic_menu_cut_mtrl_alpha. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 377 abc_slide_in_top.xml data 400 mr_ic_play_light.xml data 424 about.xml data 372 abc_slide_out_bottom.xml data 400 cast_ic_notification_0. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 572 abc_spinner_textfield_background_ material.xml data 1328 ic_media_route_on_mono_dark. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1287 abc_btn_radio_to_on_mtrl_000. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 428 _disabled.9. abc_ic_menu_moreoverflow_mtrl_al pha. abc_dialog_material_background_lig ht.xml PNG image data, 218 x 92, 8-bit/color RGBA, non-interlaced 1385 PNG image data, 96 x 96, 8-bit colormap, non-interlaced 378 data 844 abc_expanded_menu_layout.xml data 404 ic_play_light. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 413 abc_textfield_search_activated_mtrl _alpha.9. PNG image data, 18 x 5, 8-bit/color RGBA, non-interlaced 182 ic_media_route_on_2_mono_dark.pn PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1741 g ht_normal.9. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 2221 ic_pause_dark. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 235 _disabled.9. _focused.9. PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced 952 PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 1102 rk_pressed.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 1953 ic_plusone_small_off_client. PNG image data, 31 x 18, 8-bit colormap, non-interlaced 427 ic_plusone_standard_off_client. PNG image data, 114 x 72, 8-bit colormap, non-interlaced 868 rk_normal.9. PNG image data, 222 x 96, 8-bit/color RGBA, non-interlaced 2476 ic_cast_off_light. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 894 ic_media_play. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1034 abc_list_menu_item_layout.xml data 1412 abc_ic_go_search_api_mtrl_alpha.p PNG image data, 32 x 32, 8-bit colormap, non-interlaced 188 abc_screen_content_include.xml data 564 fade_in.xml data 396 abc_tab_indicator_mtrl_alpha.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 205 ic_plusone_small_off_client. PNG image data, 24 x 14, 8-bit colormap, non-interlaced 302 abc_edit_text_material.xml data 1040 Copyright Joe Security LLC 2018 Page 21 of 32

22 Name Type Size _normal.9. ht_disabled.9. PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 2718 PNG image data, 138 x 138, 8-bit/color RGBA, non-interlaced 1667 powered_by_google_light. PNG image data, 120 x 14, 8-bit/color RGBA, non-interlaced 1907 ic_cast_on_1_light. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1045 abc_switch_track_mtrl_alpha.9. PNG image data, 20 x 16, 8-bit/color RGBA, non-interlaced 426 ic_cast_on_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1315 rk_focused.9. abc_ic_voice_search_api_mtrl_alpha. PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 4012 PNG image data, 36 x 36, 8-bit colormap, non-interlaced 541 abc_ic_search_api_mtrl_alpha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1131 abc_ic_menu_moreoverflow_mtrl_al pha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 218 a.ttf TrueType font data abc_ic_menu_selectall_mtrl_alpha.p PNG image data, 48 x 48, 8-bit colormap, non-interlaced 238 ic_cast_on_2_light. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1744 abc_btn_rati_star_on_mtrl_alpha.p PNG image data, 96 x 96, 8-bit colormap, non-interlaced 1547 ic_media_route_off_mono_dark. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 914. xml data 836 ic_play_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 524 abc_ic_voice_search_api_mtrl_alpha. abc_menu_hardkey_panel_mtrl_mult.9. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 415 PNG image data, 128 x 48, 8-bit/color RGBA, non-interlaced 1141 mr_ic_pause_light.xml data 424 abc_shrink_fade_out_from_bottom.x ml data 860 ic_pause_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 223 powered_by_google_dark. PNG image data, 180 x 21, 8-bit colormap, non-interlaced 2462 cast_ic_notification_1. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 875 ht_disabled.9. PNG image data, 109 x 46, 8-bit/color RGBA, non-interlaced 730 abc_tab_indicator_material.xml data 564 ic_play_dark. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 517 abc_spinner_mtrl_am_alpha.9. PNG image data, 54 x 72, 8-bit/color RGBA, non-interlaced 632 abc_action_bar_title_item.xml data 940 abc_popup_background_mtrl_mult.9. PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced 863 abc_list_divider_mtrl_alpha.9. PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced 178 ht_focused.9. PNG image data, 222 x 96, 8-bit/color RGBA, non-interlaced 2825 ic_media_play. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 1369 abc_btn_switch_to_on_mtrl_ PNG image data, 41 x 41, 8-bit/color RGBA, non-interlaced 1748 _disabled.9. PNG image data, 146 x 62, 8-bit/color RGBA, non-interlaced 961 ic_plusone_medium_off_client. PNG image data, 32 x 20, 8-bit colormap, non-interlaced 341 abc_ic_menu_cut_mtrl_alpha. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 723 abc_textfield_default_mtrl_alpha.9.p PNG image data, 19 x 16, 8-bit/color RGBA, non-interlaced 202 abc_ic_ab_back_mtrl_am_alpha. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 351 abc_ic_search_api_mtrl_alpha. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1028 abc_list_lopressed_holo.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 211 abc_primary_text_disable_only_mat erial_dark.xml data 468 abc_primary_text_material_dark.xml data 468 abc_cab_background_top_mtrl_alph a.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 229 abc_ic_clear_mtrl_alpha. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 280 ic_media_route_on_mono_dark. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1791 ic_pause_light. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 193 notification_template_big_media_nar row.xml data 1920 abc_textfield_default_mtrl_alpha.9.p PNG image data, 12 x 11, 8-bit/color RGBA, non-interlaced 185 Copyright Joe Security LLC 2018 Page 22 of 32