ID: Sample Name: mimovistar_v3_0_25_1.apk Cookbook: defaultandroidfilecookbook.jbs Time: 15:29:38 Date: 26/02/2018 Version: 22.0.

Transcription

1 ID: Sample Name: mimovistar_v3_0_25_1.apk Cookbook: defaultandroidfilecookbook.jbs Time: 15:29:38 Date: 26/02/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Classification Signature Overview Change of System Appearance: Location Tracing: Spam, unwanted Advertisements and Ransom Demands: Networking: Boot Survival: Remote Access Functionality: Stealing of Sensitive Information: Data Obfuscation: System Summary: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Screenshot Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static APK Info General Activities Receivers Services Permission Requested Certificate Resources Network Behavior Network Port Distribution TCP Packets UDP Packets APK Behavior Installation Miscellaneous Simulated Events Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 By Permission (executed) By Permission (non-executed) By Class (executed) By Class (non-executed) By API Disassembly 0 Executed Methods 0 Non-Executed Methods Copyright Joe Security LLC 2018 Page 3 of 34

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 15:29:38 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 51s Analysis system description: Android 6.0 Detection: Classification: Warnings: false light mimovistar_v3_0_25_1.apk defaultandroidfilecookbook.jbs SUS Show All No interacted views Not all resource files were parsed Not all resource strings were parsed Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing dynamic data code. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Classification Copyright Joe Security LLC 2018 Page 4 of 34

5 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview of System Appearance Change Tracing Location unwanted Advertisements and Ransom Demands Spam, Networking Survival Boot Access Functionality Remote of Sensitive Information Stealing Obfuscation Data Summary System Analysis System Evasion Malware and other Techniques for Hiding and Protection Hooking Language, Device and Operating System Detection Click to jump to signature section Change of System Appearance: Copyright Joe Security LLC 2018 Page 5 of 34

6 Acquires a wake lock May access the Android keyguard (lock screen) Location Tracing: Queries the phones location (GPS) Spam, unwanted Advertisements and Ransom Demands: May use Google Cloud Messaging (GCM) or Google's Cloud to Device Messaging (C2DM) services Networking: Found strings which match to known social media urls Urls found in memory or binary data Uses HTTP for connecting to the internet Checks an internet connection is available Opens an internet connection Boot Survival: Installs a new wake lock (to get activate on phone screen on) Remote Access Functionality: Found parser code for incoming SMS (may be used to act on incoming SMS, BOT) Stealing of Sensitive Information: Has permission to query the current location Has permission to read contacts Has permission to read the phones state (phone number, device IDs, active call ect.) Has permission to receive SMS in the background Monitors incoming SMS Queries phone contact information Queries stored mail and application accounts (e.g. Gmail or Whatsup) Data Obfuscation: Obfuscates method names Uses reflection Found very long method strings System Summary: Classification label Reads shares settings Kills/terminates processes Requests potentially dangerous permissions Malware Analysis System Evasion: Accesses /proc Accesses android OS build fields Queries several sensitive phone informations Queries the unique operating system id (ANDROID_ID) Copyright Joe Security LLC 2018 Page 6 of 34

7 Hooking and other Techniques for Hiding and Protection: Uses Crypto APIs Queries list of running processes/tasks Language, Device and Operating System Detection: Queries the unqiue device ID (IMEI, MEID or ESN) Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Screenshot Copyright Joe Security LLC 2018 Page 7 of 34

8 Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs Copyright Joe Security LLC 2018 Page 8 of 34

9 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious United States GOOGLE-GoogleIncUS false Reserved unknown unknown false United States GOOGLE-GoogleIncUS false Static File Info General File type: Zip archive data, at least v2.0 to extract Entropy (8bit): TrID: OpenDocument Format (generic) (25004/1) 38.16% Android Package (19004/1) 29.01% Java Archive (13504/1) 20.61% ZIP compressed archive (4004/1) 6.11% Java Script embedded in Visual Basic Script (2000/0) 3.05% File name: File size: MD5: SHA1: SHA256: SHA512: File Content Preview: mimovistar_v3_0_25_1.apk 7c2cbd47e70cf bbab0b684bc 00b3f943d06f72ba8330cc3c4eaff2bff946744e d d9045d3fa2a29a3cf7a7d39d5b8c1e be1c30294e57310e 80e0017e74e1d166dddb5fd9f6e1f7c0dd79d2cf9f a8c5fa ab95a33bad84558a92ddf091733c ee5e5a7bec34d1c bb7ac6943 PK...GL...A...AndroidManifest.x.[il\W...[.Y.. File Icon Static APK Info Copyright Joe Security LLC 2018 Page 9 of 34

10 General Label: Mi Movistar Minimum SDK required: 15 Target SDK required: 25 Version Code: 40 Version Name: 40 Package Name: com.otecel.mimovistar Is Activity: true Is Receiver: true Is Service: true Requests System Level Permissions: false Play Store Compatible: true Activities Name com.otecel.mimovistarcom.otecel.mimovistar.activity.otcactsplash com.otecel.mimovistarcom.otecel.mimovistar.activity.otcactmain com.otecel.mimovistarcom.otecel.mimovistar.activity.otcactrecuperarclave com.otecel.mimovistarcom.otecel.mimovistar.activity.otcactlogin com.otecel.mimovistarcom.otecel.mimovistar.activity.otcactregistro com.otecel.mimovistarcom.otecel.mimovistar.activity.mis_datos.otc_acv_cambiar_informacion com.otecel.mimovistarcom.otecel.mimovistar.activity.mis_datos.otc_acv_mis_datos com.otecel.mimovistarcom.otecel.mimovistar.activity.otcactbrowser com.otecel.mimovistarcom.otecel.mimovistar.activity.frg_incidencias.otc_acv_incidenciadetalle com.otecel.mimovistarcom.otecel.mimovistar.util.dialogactivity com.otecel.mimovistarcom.otecel.mimovistar.activity.frg_recargas.otc_act_private_recargas com.otecel.mimovistarcom.otecel.mimovistar.activity.frg_recargas.paso5.otc_act_private_recarga_paso5 com.otecel.mimovistarcom.otecel.mimovistar.activity.frg_home.ofertador.otc_act_private_ofertador_loquiero com.otecel.mimovistarcom.otecel.mimovistar.activity.frg_home.ofertador.otc_act_private_ofertador_vermas com.otecel.mimovistarcom.otecel.mimovistar.activity.mainactivity com.otecel.mimovistarcom.otecel.mimovistar.activity.frg_home.saldos_resumen.detalleconsumofragment com.otecel.mimovistarcom.google.android.gms.common.api.googleapiactivity Is Entrypoint true Receivers com.google.android.gms.measurement.appmeasurementinstallreferrerreceiver com.google.android.gms.measurement.appmeasurementreceiver com.google.firebase.iid.firebaseinstanceidreceiver com.otecel.mimovistar.core.brsmsreader Intent: com.android.vending.install_referrer Intent: com.google.android.c2dm.intent.receive Intent: android.provider.telephony.sms_received Services com.google.android.gms.measurement.appmeasurementjobservice com.google.android.gms.measurement.appmeasurementservice com.google.firebase.iid.firebaseinstanceidservice Intent: com.google.firebase.instance_id_event (Priority -500) com.google.firebase.messaging.firebasemessagingservice Intent: com.google.firebase.messaging_event (Priority -500) com.otecel.mimovistar.gcm.gcmlistenerservice Intent: com.google.firebase.messaging_event (Priority 0) com.otecel.mimovistar.gcm.idlistenerservice Intent: com.google.firebase.instance_id_event (Priority 0) Permission Requested android.permission.access_coarse_location android.permission.access_fine_location android.permission.access_network_state android.permission.bind_job_service android.permission.internet android.permission.read_contacts android.permission.read_phone_state android.permission.receive_sms android.permission.wake_lock android.permission.write_external_storage com.google.android.c2dm.permission.receive com.google.android.providers.gsf.permission.read_gservices com.otecel.mimovistar.permission.c2d_message Copyright Joe Security LLC 2018 Page 10 of 34

11 com.vogella.android.locationapi.maps.permission.maps_receive Certificate Name: Issuer: Subject: classes.dex CN=Hugo Vidal,OU=Produccion TI,O=Telefonica SA,L=Quito,ST=Pichincha,C=EC CN=Hugo Vidal,OU=Produccion TI,O=Telefonica SA,L=Quito,ST=Pichincha,C=EC Resources img_selected_ball. PNG image data, 62 x 62, 8-bit colormap, non-interlaced 623 abc_ic_commit_search_api_mtrl_alp ha. PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced 173 abc_screen_simple.x data 872 abc_list_focused_holo.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 222 img_icon_white. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 696 ic_descarga. PNG image data, 62 x 56, 8-bit colormap, non-interlaced 454 abc_dialog_title_material.x data 1156 ic_localizador. PNG image data, 32 x 43, 8-bit colormap, non-interlaced 531 abc_btn_check_to_on_mtrl_015. PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced 321 paquetesbono_blue_x100_box.9. PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced 2596 item_incidencias_detalle.x data 3860 abc_list_pressed_holo_light.9. PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced 221 abc_edit_text_material.x data 1360 img_ab_recargar. PNG image data, 48 x 20, 8-bit colormap, non-interlaced 381 common_google_signin_btn_icon_da PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 610 rk_normal_background.9. abc_menu_hardkey_panel_mtrl_mult.9. PNG image data, 64 x 24, 8-bit/color RGBA, non-interlaced 589 btn_informacion_bluex PNG image data, 100 x 99, 8-bit/color RGBA, non-interlaced 4275 common_google_signin_btn_text_da rk_normal_background.9. PNG image data, 333 x 144, 8-bit/color RGBA, non-interlaced 1638 private_servicios_contratables.x data 572 ic_ayuda_manuales. PNG image data, 27 x 30, 8-bit colormap, non-interlaced 325 exit_to_left.x data 556 ios_splash960x640. PNG image data, 810 x 1440, 8-bit colormap, non-interlaced 4276 spinner_empty.x data 764 abc_scrubber_primary_mtrl_alpha.9. PNG image data, 15 x 18, 8-bit/color RGBA, non-interlaced 214 ic_ofertador_mas_roaming. PNG image data, 31 x 25, 8-bit colormap, non-interlaced 518 abc_switch_track_mtrl_alpha.9. PNG image data, 35 x 25, 8-bit/color RGBA, non-interlaced 538 ic_noticas. PNG image data, 28 x 31, 8-bit colormap, non-interlaced 336 ic_ofertador_mas_internet. PNG image data, 25 x 24, 8-bit colormap, non-interlaced 344 ic_spinner. PNG image data, 25 x 17, 8-bit colormap, non-interlaced 233 ic_actualizar_verde. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 2236 abc_switch_thumb_material.x data 560 activity_otc_acv_mis_datos.x data 7476 Google_internal.gwt.x exported SGML document, ASCII text 213 private_incidencia_detalle.x data 7952 ic_toolbar. PNG image data, 960 x 145, 8-bit colormap, non-interlaced 1420 ic_recargas. PNG image data, 28 x 42, 8-bit colormap, non-interlaced 390 notification_bg_low_pressed.9. PNG image data, 8 x 8, 8-bit/color RGB, non-interlaced 223 abc_btn_radio_to_on_mtrl_015. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 785 ic_ofertador_mas_face. PNG image data, 138 x 122, 8-bit colormap, non-interlaced 1340 item_home_list.x data 928 pb_home_valor_factura.x data 1888 ic_ofertador_mas_minutos. PNG image data, 70 x 62, 8-bit colormap, non-interlaced 651 list_menu_incidencias.x data 1832 ic_arrow_left. PNG image data, 12 x 19, 8-bit colormap, non-interlaced 157 abc_textfield_search_activated_mtrl _alpha.9. PNG image data, 36 x 10, 8-bit/color RGBA, non-interlaced 193 abc_ic_ab_back_material.x data 908 ic_img_btn_edit. PNG image data, 35 x 35, 8-bit colormap, non-interlaced 383 notification_template_big_media_nar row.x data 1668 Copyright Joe Security LLC 2018 Page 11 of 34

12 abc_tint_seek_thumb.x data 608 btn_cab_done_default_movistarv2.9. PNG image data, 2 x 30, 8-bit/color RGBA, non-interlaced 200 ic_terminos. PNG image data, 55 x 41, 8-bit colormap, non-interlaced 512 saldos_consumos_fragment_info.xm l data 3164 list_focused_movistarv2.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 264 abc_screen_toolbar.x data 1632 ic_celular. PNG image data, 28 x 43, 8-bit colormap, non-interlaced 359 ic_correo. PNG image data, 73 x 79, 8-bit colormap, non-interlaced 943 infoicon_purpura_135. PNG image data, 135 x 135, 8-bit colormap, non-interlaced 3366 ic_recargas. PNG image data, 106 x 163, 8-bit colormap, non-interlaced 1048 googleg_disabled_color_18. PNG image data, 54 x 54, 8-bit gray+alpha, non-interlaced 727 main_action_bar.x data 640 mis_incidencias_fragment.x data 2520 ic_ofertador_mas_mplay. PNG image data, 109 x 97, 8-bit colormap, non-interlaced 1184 abc_list_selector_disabled_holo_ligh t.9. PNG image data, 13 x 41, 8-bit/color RGBA, non-interlaced 227 img_recargas_t_guayaquil. PNG image data, 246 x 70, 8-bit/color RGBA, non-interlaced MovistarText-Bold.otf OpenType font data ic_menos. PNG image data, 23 x 6, 8-bit/color RGBA, non-interlaced 154 abc_seekbar_tick_mark_material.xm l data 600 ic_descarga. PNG image data, 32 x 29, 8-bit colormap, non-interlaced 324 abc_ic_menu_copy_mtrl_am_alpha. PNG image data, 96 x 96, 8-bit gray+alpha, non-interlaced 327 abc_btn_colored_material.x data 1908 abc_menu_hardkey_panel_mtrl_mult.9. PNG image data, 192 x 72, 8-bit/color RGBA, non-interlaced 1779 abc_list_divider_mtrl_alpha.9. PNG image data, 1 x 1, 8-bit grayscale, non-interlaced 167 ic_ayuda_manuales. PNG image data, 18 x 21, 8-bit colormap, non-interlaced 264 ic_home_dt. PNG image data, 92 x 90, 8-bit colormap, non-interlaced 1292 common_full_open_on_phone. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 681 abc_spinner_mtrl_am_alpha.9. PNG image data, 18 x 24, 8-bit/color RGBA, non-interlaced 340 private_web_browse.x data 736 ic_ofertador_internet. PNG image data, 24 x 28, 8-bit colormap, non-interlaced 363 img_recargas_t_mastercard. PNG image data, 180 x 105, 8-bit/color RGBA, non-interlaced ios_splash960x640. PNG image data, 1620 x 2880, 8-bit colormap, non-interlaced abc_btn_radio_to_on_mtrl_015. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 563 main.x data 1028 paquetesms_blue_x100_box.9. PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced 2315 abc_btn_radio_to_on_mtrl_000. PNG image data, 128 x 128, 8-bit gray+alpha, non-interlaced 785 ic_ayuda. PNG image data, 27 x 27, 8-bit colormap, non-interlaced 436 ic_ayuda. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 554 abc_btn_default_mtrl_shape.x data 1092 animation_loading.x data 632 item_geolocalizacion.x data 2204 ic_img_btn_edit. PNG image data, 105 x 105, 8-bit colormap, non-interlaced 1651 abc_ic_arrow_drop_right_black_24dp data 1248.x ic_ofertador_mas_roaming. PNG image data, 62 x 50, 8-bit colormap, non-interlaced 778 ic_check_false. PNG image data, 57 x 58, 8-bit colormap, non-interlaced 716 ic_localizador. PNG image data, 63 x 85, 8-bit colormap, non-interlaced 947 switch_thumb_material_dark.x data 468 ic_ofertador_mas_face. PNG image data, 70 x 62, 8-bit colormap, non-interlaced 724 radio_unchecked_left.x data 956 ic_spinner. PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced 157 ic_ayuda_solicitudes. PNG image data, 20 x 22, 8-bit colormap, non-interlaced 328 abc_list_focused_holo.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 244 abc_list_selector_background_transi tion_holo_light.x data 508 ic_mas. PNG image data, 46 x 46, 8-bit colormap, non-interlaced 291 ic_img_btn_delete. PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced 1770 ic_ofertador_mas_familia. PNG image data, 29 x 25, 8-bit colormap, non-interlaced 354 ic_ayuda_chat. PNG image data, 82 x 79, 8-bit colormap, non-interlaced 630 ic_close. PNG image data, 54 x 54, 8-bit colormap, non-interlaced 586 Copyright Joe Security LLC 2018 Page 12 of 34

13 btn_cab_done_pressed_movistarv2. 9. PNG image data, 2 x 39, 8-bit/color RGBA, non-interlaced 214 ic_home. PNG image data, 71 x 69, 8-bit colormap, non-interlaced 582 ic_ayuda. PNG image data, 71 x 71, 8-bit colormap, non-interlaced 927 abc_cab_background_top_mtrl_alph a.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 234 abc_fade_out.x data 396 ic_ayuda_localizar. PNG image data, 61 x 82, 8-bit colormap, non-interlaced 908 item_saldo_list_detalle.x data 2288 abc_list_pressed_holo_light.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 212 paquetesaldoweb_blue_box.9. PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced 4438 ic_menu_arror_next. PNG image data, 7 x 11, 8-bit colormap, non-interlaced 157 notify_panel_notification_icon_bg.pn g PNG image data, 14 x 14, 8-bit colormap, non-interlaced 93 edittextbox.9. PNG image data, 9 x 10, 8-bit gray+alpha, non-interlaced 299 img_tarjeta_dinersclub. PNG image data, 214 x 172, 8-bit/color RGBA, non-interlaced abc_ic_menu_copy_mtrl_am_alpha. PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced 127 ic_recargas. PNG image data, 141 x 217, 8-bit colormap, non-interlaced 1367 twitter. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 992 ic_mas. PNG image data, 31 x 31, 8-bit colormap, non-interlaced 246 TELEFONICATEXT-BOLD.OTF OpenType font data img_icon_white. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 1682 btn_atras_transparent. PNG image data, 146 x 146, 8-bit colormap, non-interlaced 539 ic_menu_blanco. PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 229 ic_ofertador_mas_ldi. PNG image data, 153 x 134, 8-bit colormap, non-interlaced 1872 abc_ic_menu_paste_mtrl_am_alpha. PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced 226 abc_alert_dialog_button_bar_materia data 1752 l.x ic_localizador. PNG image data, 94 x 127, 8-bit colormap, non-interlaced 1395 img_deselected_ball. PNG image data, 123 x 124, 8-bit colormap, non-interlaced 919 abc_spinner_mtrl_am_alpha.9. PNG image data, 72 x 96, 8-bit/color RGBA, non-interlaced 513 ic_close. PNG image data, 18 x 18, 8-bit colormap, non-interlaced 289 notification_template_media.x data 1440 common_google_signin_btn_text_da rk_normal_background.9. PNG image data, 168 x 73, 8-bit/color RGBA, non-interlaced 960 ic_incidencia_ticket. PNG image data, 48 x 49, 8-bit colormap, non-interlaced 450 chat_blue.9. PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced 5351 item_incidencias_group.x data 2508 ic_registro_paso2. PNG image data, 201 x 34, 8-bit colormap, non-interlaced 659 ic_ayuda_chat. PNG image data, 21 x 21, 8-bit colormap, non-interlaced 285 abc_list_selector_disabled_holo_dar k.9. PNG image data, 42 x 126, 8-bit/color RGBA, non-interlaced 307 ios_splash960x640. PNG image data, 1080 x 1920, 8-bit colormap, non-interlaced 6224 btn_cab_done_focused_movistarv2. 9. PNG image data, 4 x 78, 8-bit/color RGBA, non-interlaced 208 paquetesbono_blue_x100_box.9. PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced 2854 item_servicio_detalle.x data 2204 img_recargas_paso1. PNG image data, 1120 x 129, 8-bit colormap, non-interlaced 6577 ic_home. PNG image data, 28 x 26, 8-bit colormap, non-interlaced 307 registrase_paso1.x data 5036 abc_btn_check_to_on_mtrl_000. PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced 214 abc_text_select_handle_left_mtrl_lig ht. PNG image data, 44 x 22, 8-bit/color RGBA, non-interlaced 203 ic_close. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 448 ic_incidencia_ticket. PNG image data, 25 x 25, 8-bit colormap, non-interlaced 306 row_detalle_cosumo.x data 3360 ic_ofertador_redessociales. PNG image data, 17 x 37, 8-bit colormap, non-interlaced 489 notification_template_media_custom.x data 2628 ic_ayuda_manuales. PNG image data, 35 x 41, 8-bit colormap, non-interlaced 381 abc_list_pressed_holo_dark.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 211 ic_expand_more_white. PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced 409 ic_ayuda_localizar. PNG image data, 23 x 32, 8-bit colormap, non-interlaced 424 ic_clave. PNG image data, 73 x 103, 8-bit colormap, non-interlaced 764 Copyright Joe Security LLC 2018 Page 13 of 34

14 abc_hint_foreground_material_dark.x data 568 abc_list_selector_holo_dark.x data 1208 googleg_disabled_color_18. PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced 516 notification_action_background.x data 496 ic_celular. PNG image data, 19 x 29, 8-bit colormap, non-interlaced 298 ic_arrow_up. PNG image data, 19 x 11, 8-bit colormap, non-interlaced 185 abc_cab_background_internal_bg.x data 436 geomapas_list.x data 5336 ic_registro_paso1. PNG image data, 301 x 51, 8-bit colormap, non-interlaced 940 ic_ayuda_next. PNG image data, 13 x 22, 8-bit colormap, non-interlaced 187 ic_ofertador_mas_familia. PNG image data, 56 x 49, 8-bit colormap, non-interlaced 619 abc_ic_menu_copy_mtrl_am_alpha. PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced 263 ranges.kotlin_builtins data 2246 abc_ic_star_black_48dp. PNG image data, 192 x 192, 8-bit gray+alpha, non-interlaced 1680 ic_toolbar. PNG image data, 480 x 73, 8-bit colormap, non-interlaced 693 img_msg_info_clave. PNG image data, 688 x 267, 8-bit colormap, non-interlaced 6035 list_pressed_movistarv2.9. PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced 221 abc_secondary_text_material_dark.x data 468 abc_list_longpressed_holo.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 212 row_ultimas_facturas.x data 4756 abc_search_view.x data 3568 custom_horizontal_progressbar.x data 1888 edittextbox.9. PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced 349 otc_acv_incidencia_detalle.x data 464 activity_otc_acv_mis_datos2.x data 360 ic_arrow_up. PNG image data, 73 x 43, 8-bit colormap, non-interlaced 366 circle_progress_drawable_test_drive.x data 1380 edittext_movistarv2.x data 632 ic_recargas. PNG image data, 71 x 109, 8-bit colormap, non-interlaced 738 abc_btn_radio_to_on_mtrl_000. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 651 paquetesms_blue_x100_box.9. PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced 2148 btn_cab_done_movistarv2.x data 776 abc_text_select_handle_right_mtrl_d ark. PNG image data, 176 x 88, 8-bit colormap, non-interlaced 513 ic_correo. PNG image data, 37 x 40, 8-bit colormap, non-interlaced 528 Telefonica-Hand.otf OpenType font data ic_notification. PNG image data, 23 x 18, 8-bit colormap, non-interlaced 260 certificado.cer PEM certificate 1861 ic_menu_close. PNG image data, 12 x 12, 8-bit colormap, non-interlaced 182 ic_noticas. PNG image data, 71 x 81, 8-bit colormap, non-interlaced 544 noticiaspromociones.x data 2084 googleg_standard_color_18. PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced 1615 abc_ic_commit_search_api_mtrl_alp ha. PNG image data, 96 x 96, 8-bit gray+alpha, non-interlaced 224 abc_ic_menu_cut_mtrl_alpha. PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced 710 ic_menu_arror_next. PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced 143 common_google_signin_btn_text_da rk_normal.x data 692 abc_ic_menu_selectall_mtrl_alpha.p ng PNG image data, 96 x 96, 8-bit gray+alpha, non-interlaced 305 common_google_signin_btn_icon_lig ht_normal_background.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 564 ic_arrow_back. PNG image data, 128 x 128, 8-bit colormap, non-interlaced 941 ic_home_dt. PNG image data, 69 x 68, 8-bit colormap, non-interlaced 1007 abc_ic_star_half_black_48dp. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 310 notification_bg_normal_pressed.9.pn g abc_scrubber_control_to_pressed_m trl_005. PNG image data, 8 x 8, 8-bit/color RGB, non-interlaced 223 PNG image data, 18 x 18, 8-bit gray+alpha, non-interlaced 197 abc_list_selector_disabled_holo_ligh t.9. PNG image data, 21 x 63, 8-bit/color RGBA, non-interlaced 240 ic_terminos. PNG image data, 83 x 61, 8-bit colormap, non-interlaced 714 splash_screen.x data 604 Copyright Joe Security LLC 2018 Page 14 of 34

15 ic_tienda. PNG image data, 91 x 98, 8-bit colormap, non-interlaced 727 abc_fade_in.x data 396 common_google_signin_btn_text_lig ht.x select_dialog_multichoice_material.x data 716 data 788 ios_splash960x640. PNG image data, 2160 x 3840, 8-bit colormap, non-interlaced abc_ab_share_pack_mtrl_alpha.9.pn g PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 305 img_msg_info_clave. PNG image data, 258 x 101, 8-bit colormap, non-interlaced 2266 paquetesaldoweb_blue_box.9. PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced 3917 ic_ofertador_mas_sms. PNG image data, 49 x 28, 8-bit colormap, non-interlaced 428 Telefonica-Light.otf OpenType font data abc_action_bar_view_list_nav_layou t.x data 396 abc_scrubber_control_to_pressed_m trl_005. PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced 631 img_recargas_paso4. PNG image data, 1120 x 129, 8-bit colormap, non-interlaced 4880 abc_grow_fade_in_from_bottom.x data 860 common_google_signin_btn_text_da rk_focused.x data 1016 ic_ayuda_next. PNG image data, 18 x 29, 8-bit colormap, non-interlaced 199 abc_text_select_handle_right_mtrl_li ght. PNG image data, 132 x 66, 8-bit colormap, non-interlaced 422 abc_btn_switch_to_on_mtrl_ PNG image data, 81 x 81, 8-bit gray+alpha, non-interlaced 2804 abc_btn_radio_to_on_mtrl_000. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 464 abc_list_selector_disabled_holo_ligh t.9. private_recargar_saldo_paso3_tarjet a.x PNG image data, 28 x 84, 8-bit/color RGBA, non-interlaced 253 data 5636 btn_informacion_bluex PNG image data, 150 x 149, 8-bit/color RGBA, non-interlaced ic_ofertador_mas_whatsapp. PNG image data, 113 x 100, 8-bit colormap, non-interlaced 1213 ic_check_false. PNG image data, 39 x 39, 8-bit colormap, non-interlaced 535 ic_localizador. PNG image data, 25 x 33, 8-bit colormap, non-interlaced 439 paquetesaldovoz_x100_box.9. PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced 1473 img_perfil_azul.9. PNG image data, 225 x 225, 8-bit/color RGBA, non-interlaced 8178 ic_correo. PNG image data, 28 x 30, 8-bit colormap, non-interlaced 428 ic_arrow_back. PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 370 abc_ic_menu_share_mtrl_alpha. PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced 270 abc_cab_background_top_mtrl_alph a.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 225 ic_ofertador_mas_sms. PNG image data, 25 x 14, 8-bit colormap, non-interlaced 274 ic_ofertador_mas_face. PNG image data, 35 x 32, 8-bit colormap, non-interlaced 414 ic_expand_more. PNG image data, 10 x 10, 8-bit gray+alpha, non-interlaced 163 ic_ofertador_mas_ldi. PNG image data, 39 x 34, 8-bit colormap, non-interlaced 625 abc_ic_star_black_48dp. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 467 row_consumos.x data 1608 ic_arrow_up. PNG image data, 97 x 57, 8-bit colormap, non-interlaced 427 ic_ayuda_chat. PNG image data, 62 x 59, 8-bit colormap, non-interlaced 507 contactenos_blue_x PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced 9256 ic_menu_blanco. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 533 common_full_open_on_phone. PNG image data, 128 x 128, 8-bit colormap, non-interlaced 489 abc_ic_star_half_black_48dp. PNG image data, 192 x 192, 8-bit gray+alpha, non-interlaced 991 abc_hint_foreground_material_light.x data 568 Telefonica-Regular.otf OpenType font data ic_ayuda. PNG image data, 53 x 54, 8-bit colormap, non-interlaced 741 chat_blue.9. PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced 4023 img_icon_white. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1227 notification_template_media.x data 1348 abc_ic_menu_copy_mtrl_am_alpha. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 178 list_pressed_movistarv2.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 214 notification_template_icon_group.xm l data 400 notification_action.x data 1272 ic_toolbar. PNG image data, 320 x 49, 8-bit colormap, non-interlaced 499 Copyright Joe Security LLC 2018 Page 15 of 34

16 abc_scrubber_primary_mtrl_alpha.9. PNG image data, 30 x 36, 8-bit/color RGBA, non-interlaced 218 button_naranja_pantone_7564_movi starv3.x data 1176 ic_menu_close. PNG image data, 23 x 22, 8-bit colormap, non-interlaced 208 ic_tienda. PNG image data, 23 x 26, 8-bit colormap, non-interlaced 304 abc_scrubber_track_mtrl_alpha.9.pn g abc_list_selector_disabled_holo_dar k.9. PNG image data, 30 x 36, 8-bit/color RGBA, non-interlaced 212 PNG image data, 28 x 84, 8-bit/color RGBA, non-interlaced 254 item_ayuda.x data 2672 abc_ic_voice_search_api_material.x data 1208 ic_ofertador_mas_minutos. PNG image data, 140 x 123, 8-bit colormap, non-interlaced 1253 abc_scrubber_control_off_mtrl_alpha. PNG image data, 18 x 48, 8-bit gray+alpha, non-interlaced 201 ic_menu_back. PNG image data, 42 x 44, 8-bit colormap, non-interlaced 291 ic_ofertador_redessociales. PNG image data, 33 x 72, 8-bit colormap, non-interlaced 776 ic_launcher. PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced 2019 abc_ic_star_half_black_36dp. PNG image data, 54 x 54, 8-bit gray+alpha, non-interlaced 328 ic_menu_arror_next. PNG image data, 18 x 29, 8-bit colormap, non-interlaced 216 googleg_standard_color_18. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 982 abc_spinner_mtrl_am_alpha.9. PNG image data, 27 x 36, 8-bit/color RGBA, non-interlaced 367 ic_home. PNG image data, 54 x 52, 8-bit colormap, non-interlaced 436 private_recargar_saldo_paso1.x data 4332 ic_close. PNG image data, 28 x 28, 8-bit colormap, non-interlaced 365 ic_close. PNG image data, 14 x 14, 8-bit colormap, non-interlaced 256 common_google_signin_btn_icon_lig ht_normal_background.9. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 935 activity_otc_acv_mis_datos.x data 7412 ic_check_true. PNG image data, 77 x 76, 8-bit colormap, non-interlaced 533 ic_ofertador_mas_roaming. PNG image data, 41 x 34, 8-bit colormap, non-interlaced 579 common_google_signin_btn_icon_lig ht_focused.x data 1016 abc_text_select_handle_right_mtrl_li ght. PNG image data, 176 x 88, 8-bit colormap, non-interlaced 513 activity_otc_private_home_v2.x data 5252 ic_arrow_up. PNG image data, 49 x 29, 8-bit colormap, non-interlaced 268 abc_ic_star_black_16dp. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 599 ic_spinner. PNG image data, 7 x 5, 8-bit colormap, non-interlaced 143 ic_arrow_left. PNG image data, 22 x 37, 8-bit colormap, non-interlaced 198 ic_ayuda_mchek. PNG image data, 18 x 22, 8-bit colormap, non-interlaced 270 scroll_view_border_policy_movistar. x data 908 ic_launcher. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1244 ic_incidencia_ticket. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 537 dialog_drive_test_terminos.x data 2148 annotation.kotlin_builtins data 798 button_verde_pantene2287_movistar data 1584 v3.x abc_action_menu_layout.x data 584 img_check. PNG image data, 54 x 41, 8-bit colormap, non-interlaced 268 Annotations.gwt.x exported SGML document, ASCII text 375 ic_llamame. PNG image data, 77 x 76, 8-bit colormap, non-interlaced 541 ic_expand_more_white. PNG image data, 27 x 27, 8-bit colormap, non-interlaced 432 common_google_signin_btn_icon_lig ht_normal.x data 652 abc_ic_menu_cut_mtrl_alpha. PNG image data, 96 x 96, 8-bit gray+alpha, non-interlaced 910 common_google_signin_btn_text_lig ht_focused.x common_google_signin_btn_text_di sabled.x data 1016 data 1296 ic_home_dt. PNG image data, 35 x 34, 8-bit colormap, non-interlaced 592 ic_ofertador_mas_whatsapp. PNG image data, 76 x 67, 8-bit colormap, non-interlaced 778 img_ab_recargar. PNG image data, 96 x 40, 8-bit colormap, non-interlaced 629 ic_check_true. PNG image data, 20 x 19, 8-bit colormap, non-interlaced 249 abc_textfield_search_default_mtrl_al pha.9. PNG image data, 12 x 3, 8-bit/color RGBA, non-interlaced 180 Copyright Joe Security LLC 2018 Page 16 of 34

17 select_dialog_singlechoice_material. data 788 x ic_arrow_back. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 766 ic_menu_close. PNG image data, 30 x 30, 8-bit colormap, non-interlaced 278 abc_ic_star_half_black_16dp. PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced 146 mail_blue.9. PNG image data, 74 x 74, 8-bit/color RGBA, non-interlaced 2967 ic_menos. PNG image data, 62 x 13, 8-bit colormap, non-interlaced 232 list_item_incidencias.x data 1220 abc_popup_enter.x data 512 crashlytics-build.properties ASCII text 347 notification_template_part_time.x data 448 include_toolbar_blue.x data 1840 ic_menu_back. PNG image data, 63 x 65, 8-bit colormap, non-interlaced 305 abc_btn_switch_to_on_mtrl_ PNG image data, 41 x 41, 8-bit/color RGBA, non-interlaced 1548 btn_cab_done_pressed_movistarv2. 9. PNG image data, 4 x 78, 8-bit/color RGBA, non-interlaced 208 ic_ofertador_mas_face. PNG image data, 103 x 92, 8-bit colormap, non-interlaced 1013 abc_tab_indicator_mtrl_alpha.9. PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced 199 btn_cab_done_focused_movistarv2. 9. abc_textfield_activated_mtrl_alpha.9. abc_list_selector_disabled_holo_dar k.9. PNG image data, 3 x 54, 8-bit/color RGBA, non-interlaced 221 PNG image data, 12 x 11, 8-bit/color RGBA, non-interlaced 186 PNG image data, 21 x 63, 8-bit/color RGBA, non-interlaced 239 divider.x data 436 ic_menu_localizar. PNG image data, 37 x 49, 8-bit colormap, non-interlaced 603 mail_blue.9. PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced 2705 ic_expand_more. PNG image data, 30 x 30, 8-bit colormap, non-interlaced 443 ic_ayuda_solicitudes. PNG image data, 29 x 32, 8-bit colormap, non-interlaced 431 abc_btn_check_to_on_mtrl_015. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 404 circle_progress_drawable.x data 1380 private_recargar_saldo_paso3_2.x data 9588 geomapas_list.x data 5292 abc_dialog_title_material.x data 1112 abc_text_select_handle_middle_mtrl _dark. PNG image data, 60 x 72, 8-bit/color RGBA, non-interlaced 752 img_ab_recargar. PNG image data, 127 x 53, 8-bit colormap, non-interlaced 844 ic_check_false. PNG image data, 15 x 15, 8-bit colormap, non-interlaced 389 paquetesaldovoz_x100_box.9. PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced 2804 ic_arrow_left. PNG image data, 29 x 49, 8-bit colormap, non-interlaced 255 activity_factura.x data 3544 common_google_signin_btn_text_da rk_normal_background.9. PNG image data, 111 x 48, 8-bit/color RGBA, non-interlaced 615 ic_celular. PNG image data, 14 x 22, 8-bit colormap, non-interlaced 269 ic_ofertador_mas_mplay. PNG image data, 73 x 65, 8-bit colormap, non-interlaced 824 notification_bg_normal_pressed.9.pn g PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced 247 select_dialog_item_material.x data 648 list_focused_movistarv2.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 230 ic_ofertador_mas_familia. PNG image data, 37 x 33, 8-bit colormap, non-interlaced 436 abc_ic_star_black_16dp. PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced 193 abc_scrubber_track_mtrl_alpha.9.pn g PNG image data, 20 x 24, 8-bit/color RGBA, non-interlaced 207 noticiaspromociones.x data 2028 abc_alert_dialog_title_material.x data 1572 ic_ayuda_solicitudes. PNG image data, 15 x 17, 8-bit colormap, non-interlaced 280 private_recargar_saldo_paso4.x data 6232 abc_textfield_activated_mtrl_alpha.9. PNG image data, 38 x 33, 8-bit/color RGBA, non-interlaced 202 ic_menu_blanco. PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced 382 abc_text_select_handle_right_mtrl_li ght. PNG image data, 88 x 44, 8-bit/color RGBA, non-interlaced 318 fondo_bola_grande. PNG image data, 1200 x 675, 8-bit/color RGBA, non-interlaced img_check. PNG image data, 14 x 11, 8-bit colormap, non-interlaced 219 include_toolbar.x data 2304 bckg_layout_white_bordered.x data 1240 Copyright Joe Security LLC 2018 Page 17 of 34

18 ic_ofertador_internet. PNG image data, 48 x 54, 8-bit colormap, non-interlaced 611 abc_vector_test.x data 812 abc_text_select_handle_right_mtrl_li ght. PNG image data, 44 x 22, 8-bit/color RGBA, non-interlaced 186 ic_ofertador_mas_minutos. PNG image data, 105 x 93, 8-bit colormap, non-interlaced 953 abc_list_longpressed_holo.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 214 activity_otc_act_private_recarga_pa so5.x data 2112 ic_ofertador_mas_internet. PNG image data, 49 x 47, 8-bit colormap, non-interlaced 572 ic_img_btn_edit. PNG image data, 140 x 140, 8-bit colormap, non-interlaced 1360 abc_btn_check_to_on_mtrl_015. PNG image data, 128 x 128, 8-bit gray+alpha, non-interlaced 476 ic_ofertador_redessociales. PNG image data, 25 x 55, 8-bit colormap, non-interlaced 639 abc_ic_star_half_black_16dp. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 376 private_servicios_activados.x data 572 ic_ofertador_mas_sms. PNG image data, 65 x 37, 8-bit colormap, non-interlaced 542 abc_action_mode_close_item_mater ial.x data 796 private_frg_ayuda.x data 988 ic_llamame. PNG image data, 30 x 29, 8-bit colormap, non-interlaced 309 abc_ic_star_black_36dp. PNG image data, 54 x 54, 8-bit gray+alpha, non-interlaced 522 activity_otc_act_private_recarga_pa so5.x data 2164 ic_menu_verde. PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 289 abc_seekbar_thumb_material.x data 1232 control_saldo_view.x data 1572 abc_list_divider_mtrl_alpha.9. PNG image data, 1 x 1, 8-bit grayscale, non-interlaced 167 include_toolbar_blue.x data 1788 ic_tienda. PNG image data, 31 x 34, 8-bit colormap, non-interlaced 363 abc_tint_switch_track.x data 772 abc_list_focused_holo.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 244 ic_menu_localizar. PNG image data, 25 x 33, 8-bit colormap, non-interlaced 448 ic_ofertador_movil. PNG image data, 70 x 72, 8-bit colormap, non-interlaced 694 item_incidencia_detalle.x data 1060 abc_alert_dialog_button_bar_materia data 1704 l.x abc_ratingbar_indicator_material.x data 760 ic_actualizar_blanco. PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 530 abc_ic_menu_selectall_mtrl_alpha.p ng abc_textfield_search_default_mtrl_al pha.9. PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced 262 PNG image data, 36 x 10, 8-bit/color RGBA, non-interlaced 196 abc_ratingbar_material.x data 712 ic_men_arrow. PNG image data, 19 x 33, 8-bit colormap, non-interlaced 193 ic_launcher. PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced 4260 enter_from_right.x data 508 btn_cab_done_default_movistarv2.9. PNG image data, 2 x 42, 8-bit/color RGBA, non-interlaced 200 abc_cab_background_top_mtrl_alph a.9. PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced 246 abc_search_url_text.x data 596 common_google_signin_btn_icon_da PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 1032 rk_normal_background.9. kotlin-stdlib.kotlin_module data 1368 saldos_consumos_fragment_drive.x data 3460 ic_home_dt. PNG image data, 23 x 23, 8-bit colormap, non-interlaced 428 notification_template_icon_group.xm l data 996 ic_menu_localizar. PNG image data, 97 x 130, 8-bit colormap, non-interlaced 1427 paquetesaldo_blue_x100_box.9. PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced 1763 notification_action_tombstone.x data 1448 ic_check_true. PNG image data, 57 x 57, 8-bit colormap, non-interlaced 431 abc_spinner_mtrl_am_alpha.9. PNG image data, 27 x 36, 8-bit/color RGBA, non-interlaced 368 abc_tint_btn_checkable.x data 732 ic_llamame. PNG image data, 58 x 57, 8-bit colormap, non-interlaced 443 abc_scrubber_control_to_pressed_m trl_005. PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced 391 img_selected_ball. PNG image data, 93 x 93, 8-bit colormap, non-interlaced 727 Copyright Joe Security LLC 2018 Page 18 of 34

19 ic_ofertador_mas_whatsapp. PNG image data, 150 x 134, 8-bit colormap, non-interlaced 1566 abc_textfield_activated_mtrl_alpha.9. PNG image data, 19 x 16, 8-bit/color RGBA, non-interlaced 192 abc_btn_switch_to_on_mtrl_ PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced 2606 resources.arsc data abc_ic_menu_share_mtrl_alpha. PNG image data, 96 x 96, 8-bit gray+alpha, non-interlaced 899 abc_scrubber_control_to_pressed_m trl_000. PNG image data, 12 x 12, 8-bit gray+alpha, non-interlaced 145 abc_primary_text_material_light.x data 468 ic_men_arrow. PNG image data, 98 x 170, 8-bit colormap, non-interlaced 404 ic_ofertador_mas_mplay. PNG image data, 28 x 25, 8-bit colormap, non-interlaced 363 img_deselected_ball. PNG image data, 47 x 47, 8-bit colormap, non-interlaced 905 TELEFONICATEXT-REGULAR.OTF OpenType font data notification_action.x data 1212 ic_menu_back. PNG image data, 22 x 22, 8-bit colormap, non-interlaced 229 ic_terminos. PNG image data, 165 x 121, 8-bit colormap, non-interlaced 1320 abc_tint_btn_checkable.x data 628 abc_scrubber_control_to_pressed_m trl_000. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 415 common_google_signin_btn_icon_di sabled.x data 1276 abc_list_menu_item_icon.x data 688 paquetesbono_blue_x100_box.9. PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced 6994 notification_bg_normal_pressed.9.pn g PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced 225 olvido_clave.x data 1176 paquetesms_blue_x100_box.9. PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced 5581 paquetesaldovoz_x100_box.9. PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced 2835 color_cursor.x data 532 ic_menu_localizar. PNG image data, 19 x 25, 8-bit colormap, non-interlaced 351 ic_documento. PNG image data, 30 x 21, 8-bit colormap, non-interlaced 246 pinx128. PNG image data, 102 x 128, 8-bit/color RGBA, non-interlaced 7361 notification_bg_low_pressed.9. PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced 225 radio_checked_default.x data 812 googleg_disabled_color_18. PNG image data, 18 x 18, 8-bit gray+alpha, non-interlaced 281 ic_arrow_down. PNG image data, 97 x 57, 8-bit colormap, non-interlaced 448 ic_toolbar. PNG image data, 240 x 37, 8-bit colormap, non-interlaced 385 abc_tab_indicator_mtrl_alpha.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 208 abc_tint_spinner.x data 672 activity_ofertador.x data ic_ayuda_chat. PNG image data, 16 x 15, 8-bit colormap, non-interlaced 246 MANIFEST.MF ASCII text, with CRLF line terminators abc_text_select_handle_right_mtrl_d ark. PNG image data, 88 x 44, 8-bit/color RGBA, non-interlaced 319 abc_btn_check_to_on_mtrl_015. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 432 abc_text_select_handle_left_mtrl_da rk. btn_cab_done_focused_movistarv2. 9. abc_ic_menu_copy_mtrl_am_alpha. PNG image data, 132 x 66, 8-bit colormap, non-interlaced 420 PNG image data, 2 x 30, 8-bit/color RGBA, non-interlaced 213 PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 178 abc_popup_exit.x data 512 common_google_signin_btn_icon_lig ht.x data 700 abc_list_selector_holo_light.x data 1208 ic_lupa. PNG image data, 69 x 69, 8-bit colormap, non-interlaced 595 abc_scrubber_primary_mtrl_alpha.9. PNG image data, 20 x 24, 8-bit/color RGBA, non-interlaced 219 ic_expand_more. PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced 409 paquetesaldoweb_blue_box.9. PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced nav_draw_header.x data 3608 ic_llamame. PNG image data, 20 x 19, 8-bit colormap, non-interlaced 257 ic_ofertador_mas_ldi. PNG image data, 58 x 51, 8-bit colormap, non-interlaced 837 abc_btn_check_to_on_mtrl_000. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 227 ic_notification. PNG image data, 46 x 36, 8-bit colormap, non-interlaced 376 abc_ic_star_half_black_36dp. PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced 421 Copyright Joe Security LLC 2018 Page 19 of 34

20 common_google_signin_btn_text_lig data 700 ht.x ic_menu_verde. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 717 ic_actualizar_blanco. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 812 abc_list_pressed_holo_dark.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 212 notification_template_media_custom.x data 2856 common_google_signin_btn_tint.x data 468 consumos_activity.x data 3264 ic_arrow_down. PNG image data, 25 x 15, 8-bit colormap, non-interlaced 217 abc_ic_menu_paste_mtrl_am_alpha. PNG image data, 96 x 96, 8-bit gray+alpha, non-interlaced 461 abc_btn_colored_text_material.x data 504 abc_text_select_handle_right_mtrl_d ark. PNG image data, 132 x 66, 8-bit colormap, non-interlaced 422 saldos_consumos_fragment_dt_pro mo_b.x data 2036 item_servicio_footer.x data 2016 abc_text_select_handle_left_mtrl_da rk. PNG image data, 176 x 88, 8-bit colormap, non-interlaced 513 abc_btn_switch_to_on_mtrl_ abc_scrubber_control_to_pressed_m trl_005. PNG image data, 108 x 108, 8-bit/color RGBA, non-interlaced 3853 PNG image data, 54 x 54, 8-bit gray+alpha, non-interlaced 595 ic_menu_arror_next. PNG image data, 9 x 15, 8-bit colormap, non-interlaced 187 abc_list_longpressed_holo.9. PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced 221 abc_ic_star_black_36dp. PNG image data, 108 x 108, 8-bit gray+alpha, non-interlaced 983 abc_action_mode_close_item_mater ial.x data 884 abc_background_cache_hint_select or_material_light.x data 472 notification_bg_normal.9. PNG image data, 12 x 12, 8-bit grayscale, non-interlaced 212 ic_terminos. PNG image data, 218 x 161, 8-bit colormap, non-interlaced 1795 ic_actualizar_verde. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1036 ic_ofertador_mas_ldi. PNG image data, 30 x 26, 8-bit colormap, non-interlaced 544 abc_tint_seek_thumb.x data 504 abc_text_select_handle_middle_mtrl _dark. PNG image data, 20 x 24, 8-bit/color RGBA, non-interlaced 311 Annotations.gwt.x exported SGML document, ASCII text 119 button_amarillo_movistarv2.x data 1176 img_tarjeta_mastercard. PNG image data, 214 x 172, 8-bit/color RGBA, non-interlaced abc_switch_track_mtrl_alpha.9. PNG image data, 47 x 32, 8-bit/color RGBA, non-interlaced 741 abc_text_select_handle_right_mtrl_li ght. PNG image data, 66 x 33, 8-bit/color RGBA, non-interlaced 262 abc_btn_check_to_on_mtrl_000. PNG image data, 128 x 128, 4-bit colormap, non-interlaced 275 radio_unchecked_middle.x data 624 ic_documento. PNG image data, 44 x 31, 8-bit colormap, non-interlaced 302 abc_btn_check_material.x data 560 ic_check_false. PNG image data, 77 x 77, 8-bit colormap, non-interlaced 874 abc_scrubber_track_mtrl_alpha.9.pn g PNG image data, 15 x 18, 8-bit/color RGBA, non-interlaced 201 ic_ayuda. PNG image data, 141 x 141, 8-bit colormap, non-interlaced 1767 abc_text_select_handle_left_mtrl_lig ht. PNG image data, 176 x 88, 8-bit colormap, non-interlaced 513 CERT.SF ASCII text, with CRLF line terminators ic_notification. PNG image data, 61 x 48, 8-bit colormap, non-interlaced 426 ic_ayuda_solicitudes. PNG image data, 39 x 42, 8-bit colormap, non-interlaced 530 notification_template_big_media_cu stom.x data 3144 abc_btn_radio_to_on_mtrl_015. PNG image data, 96 x 96, 8-bit gray+alpha, non-interlaced 1208 abc_list_selector_background_transi tion_holo_dark.x data 508 abc_ab_share_pack_mtrl_alpha.9.pn g PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 297 abc_activity_chooser_view.x data 1728 ic_img_btn_delete. PNG image data, 105 x 105, 8-bit/color RGBA, non-interlaced 3225 main_actualizar.x data 556 notification_bg.x data 644 ic_ofertador_internet. PNG image data, 64 x 72, 8-bit colormap, non-interlaced 796 Copyright Joe Security LLC 2018 Page 20 of 34

21 img_recargas_paso2. PNG image data, 1120 x 129, 8-bit colormap, non-interlaced 6563 img_tarjeta_desconocida. PNG image data, 214 x 172, 8-bit/color RGBA, non-interlaced 3020 abc_background_cache_hint_select or_material_dark.x data 472 notification_template_big_media.x data 1652 ic_ofertador_mas_sms. PNG image data, 96 x 56, 8-bit colormap, non-interlaced 758 registrase_paso2.x data 2556 img_recargas_t_visa. PNG image data, 180 x 105, 8-bit/color RGBA, non-interlaced 9583 abc_text_select_handle_right_mtrl_d ark. PNG image data, 66 x 33, 8-bit/color RGBA, non-interlaced 263 abc_tint_edittext.x data 672 abc_ic_star_half_black_48dp. PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced 431 button_blanco_movistarv2.x data 1176 img_icon_white. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 1931 paquetesaldo_blue_x100_box.9. PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced 1986 ic_ayuda_mchek. PNG image data, 35 x 43, 8-bit colormap, non-interlaced 384 abc_text_select_handle_middle_mtrl _light. abc_text_select_handle_left_mtrl_da rk. PNG image data, 20 x 24, 8-bit/color RGBA, non-interlaced 310 PNG image data, 88 x 44, 8-bit/color RGBA, non-interlaced 336 ic_localizador. PNG image data, 125 x 169, 8-bit colormap, non-interlaced 1845 select_dialog_multichoice_material.x btn_cab_done_pressed_movistarv2. 9. data 872 PNG image data, 3 x 52, 8-bit/color RGBA, non-interlaced 220 ic_registro_paso1. PNG image data, 151 x 26, 8-bit colormap, non-interlaced 560 abc_list_selector_disabled_holo_dar k.9. PNG image data, 13 x 41, 8-bit/color RGBA, non-interlaced 226 img_recargas_t_produbanco. PNG image data, 258 x 70, 8-bit/color RGB, non-interlaced ic_registro_paso2. PNG image data, 301 x 51, 8-bit colormap, non-interlaced 885 MovistarHeadline-Bold.otf OpenType font data abc_tint_switch_track.x data 668 abc_tab_indicator_mtrl_alpha.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 210 notify_panel_notification_icon_bg.pn g PNG image data, 30 x 30, 8-bit colormap, non-interlaced 99 abc_btn_switch_to_on_mtrl_ PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced 1124 ic_menu_back. PNG image data, 32 x 33, 8-bit colormap, non-interlaced 275 ic_terminos. PNG image data, 110 x 81, 8-bit colormap, non-interlaced 893 abc_spinner_mtrl_am_alpha.9. PNG image data, 36 x 48, 8-bit/color RGBA, non-interlaced 483 abc_ic_menu_share_mtrl_alpha. PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced 389 list_pressed_movistarv2.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 211 ic_ofertador_mas_mplay. PNG image data, 145 x 129, 8-bit colormap, non-interlaced 1579 expandable_list_menu_saldos_cons umos_dt.x data 1612 edittext_movistarv3.x data 632 ic_ayuda_manuales. PNG image data, 53 x 60, 8-bit colormap, non-interlaced 458 activity_otc_acv_browser.x data 700 notification_action_tombstone.x data 1384 ic_documento. PNG image data, 22 x 16, 8-bit colormap, non-interlaced 239 contactenos_blue_x PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced 1674 ic_ayuda_mchek. PNG image data, 51 x 64, 8-bit colormap, non-interlaced 475 img_ab_recargar. PNG image data, 64 x 27, 8-bit colormap, non-interlaced 487 abc_spinner_mtrl_am_alpha.9. PNG image data, 54 x 72, 8-bit/color RGBA, non-interlaced 593 ic_ayuda_localizar. PNG image data, 31 x 42, 8-bit colormap, non-interlaced 529 ic_notification. PNG image data, 31 x 24, 8-bit colormap, non-interlaced 305 row_ultimas_facturas.x data 4808 ic_ofertador_mas_minutos. PNG image data, 27 x 24, 8-bit colormap, non-interlaced 308 ic_ofertador_mas_face. PNG image data, 27 x 23, 8-bit colormap, non-interlaced 353 notification_bg_low_normal.9. PNG image data, 8 x 8, 8-bit grayscale, non-interlaced 215 abc_seekbar_track_material.x data 1532 abc_ic_menu_paste_mtrl_am_alpha. abc_popup_background_mtrl_mult.9. PNG image data, 24 x 24, 8-bit gray+alpha, non-interlaced 152 PNG image data, 192 x 96, 8-bit/color RGBA, non-interlaced 2774 ic_terminos. PNG image data, 42 x 31, 8-bit colormap, non-interlaced 428 abc_list_pressed_holo_light.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 214 Copyright Joe Security LLC 2018 Page 21 of 34