ID: Sample Name: VCE.Mobile apk Cookbook: defaultandroidfilecookbook.jbs Time: 22:06:32 Date: 10/01/2018 Version: 20.0.

Transcription

1 ID: Sample Name: VCE.Mobile apk Cookbook: defaultandroidfilecookbook.jbs Time: 22:06:32 Date: 10/01/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Classification Signature Overview Location Traci: Operati System Destruction: Networki: Steali of Sensitive Information: Persistence and Installation Behavior: Data Obfuscation: Spreadi: System Summary: Malware Analysis System Evasion: Hooki and other Techniques for Hidi and Protection: Lauage, Device and Operati System Detection: Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Screenshot Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General Static APK Info General Activities Receivers Services Permission Requested Certificate Resources Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTPS Packets APK Behavior Installation Miscellaneous Copyright Joe Security LLC 2018 Page 2 of 31

3 Simulated Events Interacted Views By Permission (executed) By Permission (non-executed) By Class (executed) By Class (non-executed) By API Disassembly 0 Executed Methods 0 Non-Executed Methods Copyright Joe Security LLC 2018 Page 3 of 31

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 22:06:32 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 4m 4s false light VCE.Mobile apk Analysis system description: Android 6.0 Detection: Classification: Warnis: defaultandroidfilecookbook.jbs CLEAN Show All Not all executed log events are in report (maximum 10 identical API calls) Not all resource files were parsed Report size exceeded maximum capacity and may have missi behavior information. Report size exceeded maximum capacity and may have missi dynamic data code. Detection Strategy Score Rae Reporti Detection Threshold Report FP / FN Classification Copyright Joe Security LLC 2018 Page 4 of 31

5 Ransomware Miner Spreadi malicious malicious malicious Evader Phishi suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Traci Location System Destruction Operati Networki of Sensitive Information Steali and Installation Behavior Persistence Obfuscation Data Spreadi Summary System Analysis System Evasion Malware and other Techniques for Hidi and Protection Hooki Lauage, Device and Operati System Detection Click to jump to signature section Location Traci: Copyright Joe Security LLC 2018 Page 5 of 31

6 Queries the phones location (GPS) Operati System Destruction: Lists and deletes files in the same context Networki: Performs DNS lookups Urls found in memory or binary data Uses HTTP for connecti to the internet Uses HTTPS Checks an internet connection is available Opens an internet connection Performs DNS lookups (Java API) Steali of Sensitive Information: Has permissions to create, read or chae account settis (inlcudi account password settis) Queries stored mail and application accounts (e.g. Gmail or Whatsup) Persistence and Installation Behavior: Creates files Data Obfuscation: Uses reflection Spreadi: Accesses external storage location System Summary: Classification label Loads native libraries Reads shares settis Executes native commands Requests potentially daerous permissions Malware Analysis System Evasion: Accesses android OS build fields Queries several sensitive phone informations Queries the unique operati system id (ANDROID_ID) Hooki and other Techniques for Hidi and Protection: Uses Crypto APIs Queries list of runni processes/tasks Lauage, Device and Operati System Detection: Queries the network operator name Queries the unqiue device ID (IMEI, MEID or ESN) Copyright Joe Security LLC 2018 Page 6 of 31

7 Antivirus Detection Initial Sample Source Detection Cloud Link VCE.Mobile apk 0% virustotal Browse VCE.Mobile apk 0% metadefender Browse Dropped Files No Antivirus matches Domains Source Detection Cloud Link api.crittercism.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Screenshot Copyright Joe Security LLC 2018 Page 7 of 31

8 Created / dropped Files /storage/emulated/0/.vcemobile/standard Exam Sample.vce File Type: Size (bytes): 0 Entropy (8bit): 0.0 Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: data false C6E97D2507AA29B69E56CF0A10 C7CA4DDFBA82C05720EBAD3E45B19E6E0BB26FC7 CA09C72EB E95B51D60B5799D3D92D0B7C81554ECC294AD8B5EAB B B9952F342128B80205F82B285214E4AED1AE87D06B4D768B5CD4E514BBBF34A66C18FA48C A 8F327AB C112B1C5CAFC424ED10EF8A false low Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection api.crittercism.com true false 0%, virustotal, Browse Contacted IPs Copyright Joe Security LLC 2018 Page 8 of 31

9 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious United States AMAZON-02-AmazoncomIncUS false United States GOOGLE-GoogleIncUS false Reserved unknown unknown false United States GOOGLE-GoogleIncUS false Static File Info General File type: Java Jar file data (zip) Entropy (8bit): TrID: OpenOffice Extension (21504/1) 36.13% Android Package (19004/1) 31.93% Java Archive (13504/1) 22.69% ZIP compressed archive (4004/1) 6.73% Java Script embedded in Visual Basic Script (1500/0) 2.52% File name: File size: MD5: SHA1: SHA256: SHA512: File Content Preview: VCE.Mobile apk bb4a24e17b05746d66132fa17eb bd1a2c755751ade2857f366757a1a6694e5483 ea88ce5cdd2dfe47cb5d89708bdf10ab27b222fa5c4f460 a1758f46d55e226c0 b f e e1595ba bf2 fe1402e172333e1ac5a8077b0262a500ac6e4f b1 27fdda61213d0f2e921d640d06faa1db52 KSFy.._,.Ky...s..EZ I. l.e...%...qp{...l.a..g... Static APK Info General Label: VCE Mobile Minimum SDK required: 10 Target SDK required: 17 Version Code: 56 Copyright Joe Security LLC 2018 Page 9 of 31

10 General Version Name: 56 Package Name: Is Activity: Is Receiver: Is Service: Requests System Level Permissions: Play Store Compatible: com.avanset.vcemobileandroid true false true false true Activities Name com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.mainactivity com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.examfilesactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.exammodesactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.examvariantsactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.examsectionsactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.examdescriptionactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.questionactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.questionsraeactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.incorrectlyansweredmodeactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.randomquestionsactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.exhibitsactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.casestudyactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.imageactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.draganddropquestionactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.examresultsactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.exammodereviewactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.examresultsmodereviewactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.suspendedsessionsactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.completedsessionsactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.sectionreviewactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.aboutactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.preferencesactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.privateexamkeyactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.downloadexamfileactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.moveexamfilesactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.addlocalfilesactivity_ com.avanset.vcemobileandroidcom.avanset.vcemobileandroid.activity.addlocalfilesprogressactivity_ Is Entrypoint true Receivers Services com.octo.android.robospice.gsonspriandroidspiceservice Permission Requested android.permission.access_network_state android.permission.get_accounts android.permission.internet android.permission.write_external_storage Certificate Name: Issuer: Subject: classes.dex =# f f6d2e636f6d,CN=Diamondback,O=Virtuous Ten Studio,C=DE =# f f6d2e636f6d,CN=Diamondback,O=Virtuous Ten Studio,C=DE Resources Copyright Joe Security LLC 2018 Page 10 of 31

11 Name Type Size activity_exam_files.xml data 836 abs list_focused_holo.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 178 abs progress_primary_holo_dark.9. PNG image data, 33 x 24, 8-bit/color RGBA, non-interlaced 858 abs btn_cab_done_pressed_holo_ dark.9. PNG image data, 2 x 42, 8-bit/color RGBA, non-interlaced 183 ic_menu_score_report. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 177 appearance_preferences_with_title.x ml data 1080 groupbox_simulation.xml data 828 abs list_selector_background_tran sition_holo_dark.xml abs textfield_search_selected_hol o_dark.9. data 508 PNG image data, 19 x 9, 8-bit/color RGBA, non-interlaced 182 view_question_choice.xml data 2440 abs search_dropdown_light.xml data 832 abs primary_text_disable_only_hol o_light.xml vpi tab_unselected_pressed_holo. 9. data 468 PNG image data, 2 x 4, 8-bit/color RGBA, non-interlaced 157 ic_launcher. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 1544 abs list_divider_holo_dark.9. PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced 132 view_create_or_rename_exam_cate gory_dialog.xml data 1008 view_exam_section_item.xml data 1308 abs search_view.xml data 3804 abs ic_clear_disabled. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 1505 abs ab_bottom_transparent_light_h PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 224 olo.9. abs progress_secondary_holo_ligh t.9. PNG image data, 6 x 24, 8-bit/color RGBA, non-interlaced 183 ld_timepicker_down_btn.xml data 1136 ld_timepicker_down_normal.9. PNG image data, 117 x 60, 8-bit/color RGBA, non-interlaced 1208 abs ab_stacked_transparent_light_ holo.9. view_question_container_fill_in_the_ blank.xml PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 212 data 388 vpi tab_unselected_focused_holo. 9. PNG image data, 4 x 8, 8-bit/color RGBA, non-interlaced 156 ld_timepicker_input.xml data 1136 actionbar_background.9. PNG image data, 1 x 2, 8-bit/color RGBA, non-interlaced 144 abs menu_dropdown_panel_holo_d PNG image data, 128 x 64, 8-bit/color RGBA, non-interlaced 1278 ark.9. abs cab_background_bottom_holo _light.9. abs btn_cab_done_focused_holo_ dark.9. ld_timepicker_up_disabled_focused. 9. abs textfield_search_selected_hol o_light.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 229 PNG image data, 2 x 30, 8-bit/color RGBA, non-interlaced 171 PNG image data, 78 x 40, 8-bit/color RGBA, non-interlaced 810 PNG image data, 10 x 5, 8-bit/color RGBA, non-interlaced 182 abs spinner_ab_focused_holo_light PNG image data, 22 x 32, 8-bit/color RGBA, non-interlaced abs textfield_search_right_selecte d_holo_light.9. PNG image data, 19 x 9, 8-bit/color RGBA, non-interlaced 191 ic_launcher. PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced 3363 ic_menu_score_report. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 776 abs progress_primary_holo_dark.9. PNG image data, 44 x 32, 8-bit/color RGBA, non-interlaced 1239 abs ic_menu_share_holo_dark. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 464 abs ic_go. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 815 point_and_shoot_question.xml data 420 activity_review.xml data 1004 abs ic_cab_done_holo_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 605 footer_button.xml data 560 abs primary_text_holo_dark.xml data 976 vpi tab_unselected_focused_holo. 9. PNG image data, 2 x 4, 8-bit/color RGBA, non-interlaced 157 font_size_preference.xml data 2152 abs progress_bg_holo_dark.9. PNG image data, 8 x 32, 8-bit/color RGBA, non-interlaced 180 Copyright Joe Security LLC 2018 Page 11 of 31

12 Name Type Size vpi tab_unselected_holo.9. PNG image data, 2 x 4, 8-bit/color RGBA, non-interlaced 155 ld_timepicker_input_selected.9. PNG image data, 78 x 39, 8-bit/color RGBA, non-interlaced 539 ld_timepicker_up_normal.9. PNG image data, 78 x 40, 8-bit/color RGBA, non-interlaced 1104 abs item_background_holo_light.x ml data 1136 abs list_selector_disabled_holo_da rk.9. PNG image data, 21 x 63, 8-bit/color RGBA, non-interlaced 203 activity_random_questions.xml data 1556 abs ic_ab_back_holo_light. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 527 abs progress_secondary_holo_dar k.9. PNG image data, 8 x 32, 8-bit/color RGBA, non-interlaced 180 abs list_lopressed_holo.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 176 ld_timepicker_up_selected.9. PNG image data, 117 x 60, 8-bit/color RGBA, non-interlaced 2128 view_question_container_choice.xml data 380 abs ab_share_pack_holo_dark.9.p PNG image data, 48 x 56, 8-bit/color RGBA, non-interlaced 277 ic_menu_mark_checked. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 532 abs list_pressed_holo_dark.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 175 view_exam_file_item.xml data 2236 view_scorebar.xml data 920 ic_aim. PNG image data, 27 x 27, 8-bit colormap, non-interlaced 511 abs ic_menu_share_holo_light. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 869 abs spinner_48_outer_holo. PNG image data, 72 x 72, 8-bit colormap, non-interlaced 2380 abs ab_stacked_solid_light_holo.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 219 lib.js ASCII text 4707 abs progress_primary_holo_light.9. PNG image data, 44 x 32, 8-bit/color RGBA, non-interlaced 1239 abs ab_stacked_solid_dark_holo.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 219 activity_questions_rae.xml data 2044 select_and_place_question.xml data 420 abs tab_selected_pressed_holo.9. PNG image data, 4 x 16, 8-bit/color RGBA, non-interlaced 156 abs ic_clear_search_api_disabled_ holo_light. abs spinner_ab_default_holo_dark. 9. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 409 PNG image data, 44 x 64, 8-bit/color RGBA, non-interlaced 370 abs ic_commit_search_api_holo_d ark. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 450 abs ic_menu_moreoverflow_norma l_holo_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 136 abs list_focused_holo.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 176 abs ic_clear_disabled. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 996 abs cab_background_bottom_holo _dark.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 231 abs progress_secondary_holo_ligh t.9. abs progress_primary_holo_light.9. PNG image data, 4 x 16, 8-bit/color RGBA, non-interlaced 175 PNG image data, 22 x 16, 8-bit/color RGBA, non-interlaced 545 resources.arsc data abs action_menu_item_layout.xml data 1856 uncompleted_passages_list_item.xm l data 396 footer_buttons_separator.9. PNG image data, 1 x 58, 8-bit/color RGBA, non-interlaced 183 abs ab_solid_dark_holo.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 236 view_question_point_and_shoot.xml data 1632 abs ic_menu_share_holo_dark. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 833 exam_files.xml data 1172 activity_completed_sessions.xml data 360 CERT.RSA data 921 ic_menu_view_default. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 2177 abs progress_bg_holo_light.9. PNG image data, 6 x 24, 8-bit/color RGBA, non-interlaced 183 abs spinner_48_outer_holo. PNG image data, 96 x 96, 8-bit colormap, non-interlaced 3083 abs ab_stacked_solid_dark_holo.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 236 exam_files_context_menu.xml data 732 abs ab_bottom_solid_inverse_holo.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 199 Copyright Joe Security LLC 2018 Page 12 of 31

13 Name Type Size abs ic_clear_disabled. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 1525 abs ic_clear_search_api_holo_light. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 451 abs btn_cab_done_holo_dark.xml data 776 abs tab_unselected_pressed_holo. 9. view_question_container_select_and _place.xml PNG image data, 3 x 6, 8-bit/color RGBA, non-interlaced 153 data 388 abs ab_share_pack_holo_dark.9.p PNG image data, 24 x 28, 8-bit/color RGBA, non-interlaced 245 abs action_menu_layout.xml data 492 abs screen_simple_overlay_action _mode.xml data 888 abs ab_solid_shadow_holo.9. PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 343 abs textfield_search_right_default_ holo_light.9. PNG image data, 19 x 9, 8-bit/color RGBA, non-interlaced 192 abs btn_cab_done_default_holo_lig PNG image data, 2 x 30, 8-bit/color RGBA, non-interlaced 174 ht.9. abs ic_ab_back_holo_light. PNG image data, 16 x 16, 8-bit colormap, non-interlaced 312 abs ic_cab_done_holo_dark. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 1049 events_jelly_bean.js ASCII text 979 abs spinner_48_inner_holo. PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced 1819 abs btn_cab_done_default_holo_d ark.9. PNG image data, 2 x 30, 8-bit/color RGBA, non-interlaced 174 abs ic_go. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 1020 ic_exam_file_vce. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 1581 abs ic_menu_share_holo_light. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 607 ld_timepicker_up_normal.9. PNG image data, 117 x 60, 8-bit/color RGBA, non-interlaced 1493 ic_menu_move. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 991 activity_download_exam_file.xml data 3596 view_question_container_point_and_ shoot.xml data 384 abs btn_cab_done_pressed_holo_ dark.9. PNG image data, 3 x 54, 8-bit/color RGBA, non-interlaced 200 ic_menu_edit. PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced 1162 ld_timepicker_input_selected.9. PNG image data, 117 x 59, 8-bit/color RGBA, non-interlaced 625 abs action_mode_close_item.xml data 896 vpi tab_indicator.xml data 1580 abs tab_selected_holo.9. PNG image data, 2 x 8, 8-bit/color RGBA, non-interlaced 151 abs textfield_searchview_right_hol o_dark.xml data 560 abs ab_bottom_transparent_light_h PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 209 olo.9. abs screen_action_bar.xml data 1524 view_completed_session_item.xml data 1956 abs textfield_searchview_right_hol o_light.xml ic_menu_learni_mode_checked.p data 560 PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1219 ic_menu_delete. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 1650 footer_button_pressed.9. PNG image data, 1 x 58, 8-bit/color RGBA, non-interlaced 158 review_question_incorrect.xml data 784 question_case_study.xml data 612 abs ab_transparent_dark_holo.9.pn PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 242 g ic_aim. PNG image data, 18 x 18, 8-bit colormap, non-interlaced 349 main.xml data 1256 abs ab_transparent_dark_holo.9.pn PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 224 g abs list_activated_holo.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 178 ld_timepicker_input_disabled.9. PNG image data, 78 x 39, 8-bit/color RGBA, non-interlaced 302 abs textfield_search_right_default_ holo_dark.9. PNG image data, 14 x 7, 8-bit/color RGBA, non-interlaced 176 abs tab_selected_holo.9. PNG image data, 4 x 16, 8-bit/color RGBA, non-interlaced 150 abs ic_menu_share_holo_light. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 479 user_score_passed_score_bar.xml data 684 abs search_dropdown_item_icons_ data line.xml Copyright Joe Security LLC 2018 Page 13 of 31

14 Name Type Size abs ab_transparent_light_holo.9.pn PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 221 g ic_menu_delete. PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced 1000 ic_menu_learni_mode_default. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1437 abs ab_bottom_solid_light_holo.9. abs textfield_search_default_holo_ dark.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 199 PNG image data, 14 x 7, 8-bit/color RGBA, non-interlaced 173 abs spinner_48_inner_holo. PNG image data, 96 x 96, 8-bit gray+alpha, non-interlaced 2490 ld_timepicker_up_disabled.9. PNG image data, 117 x 60, 8-bit/color RGBA, non-interlaced 804 ld_timepicker_up_pressed.9. PNG image data, 117 x 60, 8-bit/color RGBA, non-interlaced 2098 ic_folder. PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 1132 behavior_preferences.xml data 984 ld_timepicker_input_normal.9. PNG image data, 117 x 59, 8-bit/color RGBA, non-interlaced 684 abs textfield_search_default_holo_ light.9. abs ab_bottom_solid_dark_holo.9. PNG image data, 19 x 9, 8-bit/color RGBA, non-interlaced 198 PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 199 ic_menu_view_checked. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1270 abs list_selector_disabled_holo_da rk.9. abs ic_menu_moreoverflow_norma l_holo_dark. PNG image data, 13 x 41, 8-bit/color RGBA, non-interlaced 190 PNG image data, 64 x 64, 8-bit colormap, non-interlaced 132 question_exhibits_container.xml data 1180 abs progress_bg_holo_dark.9. PNG image data, 6 x 24, 8-bit/color RGBA, non-interlaced 183 explanation_background.xml data 580 abs activity_chooser_view_list_ite m.xml data 1312 exam_sections_list_item.xml data 388 abs ic_clear_normal. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 1024 vpi tab_unselected_pressed_holo. 9. PNG image data, 4 x 8, 8-bit/color RGBA, non-interlaced 157 ic_aim. PNG image data, 14 x 14, 8-bit colormap, non-interlaced 267 abs action_bar_home.xml data 1124 abs ab_bottom_solid_dark_holo.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 213 ic_menu_view_default. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 1525 abs btn_cab_done_focused_holo_li PNG image data, 2 x 30, 8-bit/color RGBA, non-interlaced 182 ght.9. view_question_hot_area.xml data 1632 review_question_correct.xml data 784 abs ic_cab_done_holo_dark. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 554 abs ic_clear_search_api_disabled_ holo_light. PNG image data, 21 x 21, 8-bit colormap, non-interlaced 740 activity_question.xml data 1320 activity_case_study.xml data 396 style.css ASCII text 2382 ic_menu_learni_mode_checked.p PNG image data, 64 x 64, 8-bit colormap, non-interlaced 570 abs menu_dropdown_panel_holo_d PNG image data, 96 x 48, 8-bit/color RGBA, non-interlaced 885 ark.9. abs ic_voice_search_api_holo_ligh t. PNG image data, 21 x 21, 8-bit gray+alpha, non-interlaced 604 ic_exams_category. PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced 3666 abs spinner_ab_default_holo_dark. 9. abs cab_background_top_holo_dar k.9. PNG image data, 33 x 48, 8-bit/color RGBA, non-interlaced 324 PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 231 ic_menu_delete. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 1497 ic_apply. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 787 abs ic_search_api_holo_light. PNG image data, 21 x 21, 8-bit colormap, non-interlaced 1379 lite_version_nag.xml data 1212 activity_add_local_files_progress.xm l data 2116 abs textfield_search_right_default_ holo_dark.9. PNG image data, 19 x 9, 8-bit/color RGBA, non-interlaced 188 abs search_dropdown_dark.xml data 832 abs menu_dropdown_panel_holo_li PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced 717 ght.9. view_exam_mode_item.xml data 968 Copyright Joe Security LLC 2018 Page 14 of 31

15 Name Type Size ic_menu_learni_mode_default. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 833 abs spinner_ab_holo_dark.xml data 856 events.js ASCII text 2702 abs textfield_search_selected_hol o_light.9. PNG image data, 19 x 9, 8-bit/color RGBA, non-interlaced 199 vpi tab_selected_holo.9. PNG image data, 3 x 12, 8-bit/color RGBA, non-interlaced 149 abs list_pressed_holo_light.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 176 sherlock_spinner_dropdown_item.x ml data 516 abs list_activated_holo.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 175 abs ab_transparent_dark_holo.9.pn PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 255 g abs ab_solid_shadow_holo.9. PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced 238 view_local_files_item.xml data 1304 input_icons_sprite. PNG image data, 64 x 132, 8-bit/color RGBA, non-interlaced 6961 abs ic_ab_back_holo_dark. PNG image data, 16 x 16, 8-bit colormap, non-interlaced 384 abs progress_bg_holo_light.9. PNG image data, 8 x 32, 8-bit/color RGBA, non-interlaced 180 abs textfield_search_selected_hol o_dark.9. PNG image data, 14 x 7, 8-bit/color RGBA, non-interlaced 187 abs ic_menu_share_holo_dark. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 578 abs ic_menu_moreoverflow_holo_li ght.xml data 424 abs list_divider_holo_dark.9. PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced 132 ic_menu_edit. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 2445 behavior_preferences_with_title.xml data 1088 ic_launcher_lite. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 3943 abs list_selector_disabled_holo_lig ht.9. PNG image data, 13 x 41, 8-bit/color RGBA, non-interlaced 191 view_move_exam_files_item.xml data 1112 abs ic_clear_holo_light.xml data 560 ic_apply. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 963 ld_timepicker_input_disabled.9. PNG image data, 117 x 59, 8-bit/color RGBA, non-interlaced 351 abs ic_commit_search_api_holo_d ark. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 666 abs ic_menu_moreoverflow_holo_d data 424 ark.xml abs btn_cab_done_default_holo_d ark.9. PNG image data, 2 x 42, 8-bit/color RGBA, non-interlaced 174 exam_files_list_item.xml data 384 ic_menu_edit. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 1735 ld_timepicker_up_btn.xml data 1136 abs ab_bottom_transparent_light_h PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 236 olo.9. abs btn_cab_done_default_holo_lig PNG image data, 2 x 42, 8-bit/color RGBA, non-interlaced 174 ht.9. ic_exam_file_vce. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 1863 abs ic_clear_search_api_holo_light. PNG image data, 21 x 21, 8-bit gray+alpha, non-interlaced 552 ic_menu_mark_default. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 779 ic_menu_learni_mode_checked.p PNG image data, 48 x 48, 8-bit colormap, non-interlaced 669 view_question_component_choice_q uestion_answer.xml data 1160 abs menu_dropdown_panel_holo_d PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced 620 ark.9. abs ab_stacked_solid_dark_holo.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 206 jquery_1_7_1.js HTML document, UTF-8 Unicode text, with very lo lines abs list_selector_disabled_holo_lig ht.9. PNG image data, 28 x 84, 8-bit/color RGBA, non-interlaced 217 abs list_divider_holo_light.9. PNG image data, 2 x 2, 8-bit gray+alpha, non-interlaced 139 abs toast_frame.9. PNG image data, 144 x 60, 8-bit/color RGBA, non-interlaced 1239 ic_reset. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 731 abs spinner_ab_disabled_holo_ligh t.9. PNG image data, 44 x 64, 8-bit/color RGBA, non-interlaced 358 abs ab_bottom_solid_inverse_holo.9. abs textfield_search_default_holo_ dark.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 227 PNG image data, 19 x 9, 8-bit/color RGBA, non-interlaced 196 ic_menu_learni_mode_default. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 884 Copyright Joe Security LLC 2018 Page 15 of 31

16 Name Type Size ic_menu_score_report. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 374 ic_apply. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1468 abs ab_bottom_transparent_dark_ holo.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 209 ld_timepicker_input_pressed.9. PNG image data, 117 x 59, 8-bit/color RGBA, non-interlaced 928 abs list_selector_disabled_holo_da rk.9. PNG image data, 28 x 84, 8-bit/color RGBA, non-interlaced 218 activity_exam_modes.xml data 836 abs spinner_ab_pressed_holo_dar k.9. PNG image data, 22 x 32, 8-bit/color RGBA, non-interlaced 363 abs ab_stacked_solid_light_holo.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 236 abs primary_text_disable_only_hol o_dark.xml data 468 fragment_exhibit.xml data 440 view_suspended_session_item.xml data 1728 abs ic_voice_search. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 2039 abs spinner_ab_focused_holo_dar k.9. PNG image data, 33 x 48, 8-bit/color RGBA, non-interlaced 513 question.xml data 1628 abs textfield_search_default_holo_ dark.9. PNG image data, 10 x 5, 8-bit/color RGBA, non-interlaced 176 abs btn_cab_done_pressed_holo_li PNG image data, 2 x 30, 8-bit/color RGBA, non-interlaced 183 ght.9. abs textfield_search_right_default_ holo_light.9. abs ab_transparent_light_holo.9.pn g abs ab_stacked_solid_light_holo.9. PNG image data, 10 x 5, 8-bit/color RGBA, non-interlaced 167 PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 252 PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 206 activity_suspended_sessions.xml data 360 abs ic_ab_back_holo_dark. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 548 ld_timepicker_down_selected.9. PNG image data, 117 x 60, 8-bit/color RGBA, non-interlaced 1768 abs ab_solid_light_holo.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 218 abs ab_bottom_solid_dark_holo.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 227 title_background.xml data 584 ic_menu_mark_checked. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 574 ic_reset. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 858 passi_score_bar.xml data 684 abs ic_search. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 1688 ic_folder_up. PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 1481 abs spinner_ab_disabled_holo_dar k.9. PNG image data, 33 x 48, 8-bit/color RGBA, non-interlaced 315 view_question_fill_in_the_blank.xml data 2184 ld_timepicker_up_disabled_focused. 9. PNG image data, 117 x 60, 8-bit/color RGBA, non-interlaced 1039 abs progress_bg_holo_light.9. PNG image data, 4 x 16, 8-bit/color RGBA, non-interlaced 175 questions_rae.xml data 2044 abs cab_background_top_holo_dar k.9. abs screen_action_bar_overlay.xm l PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 217 data 1928 abs ic_voice_search. PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced 942 activity_image.xml data 440 abs list_divider_holo_light.9. PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced 132 ic_menu_mark_default. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 663 ic_menu_add. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 2848 abs ic_commit_search_api_holo_li ght. abs textfield_search_right_selecte d_holo_dark.9. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 597 PNG image data, 10 x 5, 8-bit/color RGBA, non-interlaced 175 ic_apply. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1020 view_question_container_hot_area.x ml data 380 abs ic_cab_done_holo_light. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 462 abs menu_dropdown_panel_holo_li PNG image data, 96 x 48, 8-bit/color RGBA, non-interlaced 997 ght.9. completed_passages.xml data 480 view_title_list_item.xml data 744 Copyright Joe Security LLC 2018 Page 16 of 31

17 Name Type Size abs btn_cab_done_pressed_holo_li PNG image data, 3 x 54, 8-bit/color RGBA, non-interlaced 199 ght.9. ic_arrow. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 1171 abs spinner_ab_disabled_holo_dar k.9. PNG image data, 44 x 64, 8-bit/color RGBA, non-interlaced 358 appearance_preferences.xml data 976 vpi tab_selected_pressed_holo.9.p abs btn_cab_done_focused_holo_ dark.9. exam_result_sections_review_list_it em.xml PNG image data, 2 x 8, 8-bit/color RGBA, non-interlaced 155 PNG image data, 2 x 42, 8-bit/color RGBA, non-interlaced 172 data 1144 MANIFEST.MF ASCII text, with CRLF line terminators ic_reset. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 820 abs ab_stacked_transparent_light_ holo.9. abs tab_unselected_pressed_holo. 9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 198 PNG image data, 2 x 4, 8-bit/color RGBA, non-interlaced 157 abs btn_cab_done_default_holo_lig PNG image data, 3 x 54, 8-bit/color RGBA, non-interlaced 180 ht.9. abs spinner_ab_default_holo_light. 9. PNG image data, 44 x 64, 8-bit/color RGBA, non-interlaced 369 abs spinner_48_outer_holo. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1527 passi_score_bar_background.xml data 684 activity_about.xml data 660 abs progress_secondary_holo_dar k.9. PNG image data, 6 x 24, 8-bit/color RGBA, non-interlaced 183 abs ab_solid_shadow_holo.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 261 ic_launcher_lite. PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced 4588 abs ic_voice_search_api_holo_ligh t. PNG image data, 43 x 43, 8-bit gray+alpha, non-interlaced 1215 abs ic_clear.xml data 560 add_local_file_list_item.xml data 384 abs ab_transparent_light_holo.9.pn g PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 241 abs ic_commit_search_api_holo_d ark. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 493 lite_version_nag_background.xml data 928 vpi tab_selected_focused_holo.9.p PNG image data, 2 x 8, 8-bit/color RGBA, non-interlaced 155 ic_menu_delete. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 1201 ic_menu_add. PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced 1329 abs ab_stacked_transparent_light_ holo.9. abs ic_menu_moreoverflow_norma l_holo_light. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 227 PNG image data, 64 x 64, 8-bit colormap, non-interlaced 148 activity_exam_results.xml data 3380 vpi tab_unselected_holo.9. PNG image data, 3 x 6, 8-bit/color RGBA, non-interlaced 147 abs progress_horizontal_holo_light.xml abs spinner_ab_disabled_holo_dar k.9. abs ic_menu_moreoverflow_norma l_holo_light. data 888 PNG image data, 22 x 32, 8-bit/color RGBA, non-interlaced 272 PNG image data, 32 x 32, 8-bit colormap, non-interlaced 123 abs textfield_search_default_holo_ light.9. PNG image data, 14 x 7, 8-bit/color RGBA, non-interlaced 170 abs screen_action_bar_overlay.xm l data 1580 drag_and_drop_question.xml data 592 abs btn_cab_done_default_holo_d ark.9. PNG image data, 3 x 54, 8-bit/color RGBA, non-interlaced 180 abs progress_primary_holo_dark.9. PNG image data, 22 x 16, 8-bit/color RGBA, non-interlaced 545 file_viewer_list_item_view.xml data 1256 exam_modes.xml data 452 uncompleted_passages_list_item_vi ew.xml data 1680 question.xml data 1432 ld_number_picker.xml data 1048 abs list_selector_holo_dark.xml data 1208 ic_exam_file_vce. PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced 2620 Copyright Joe Security LLC 2018 Page 17 of 31

18 Name Type Size abs ab_share_pack_holo_dark.9.p PNG image data, 36 x 42, 8-bit/color RGBA, non-interlaced 263 image_viewer.xml data 444 abs ab_bottom_solid_inverse_holo.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 213 AndroidManifest.xml data 9424 view_review_item.xml data 1964 vpi tab_unselected_pressed_holo. 9. PNG image data, 3 x 6, 8-bit/color RGBA, non-interlaced 153 ic_reset. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 982 ic_launcher. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 5953 abs list_pressed_holo_dark.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 178 footer_button_default.9. PNG image data, 1 x 58, 8-bit gray+alpha, non-interlaced 176 abs ic_go_search_api_holo_light.p PNG image data, 21 x 21, 8-bit colormap, non-interlaced 575 activity_exam_description.xml data 1120 activity_exhibits.xml data 1176 abs textfield_search_selected_hol o_dark.9. abs ab_bottom_solid_light_holo.9. PNG image data, 10 x 5, 8-bit/color RGBA, non-interlaced 182 PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 212 view_question_component_choice_q uestion_answers_container.xml data 372 view_pager_separator.xml data 412 question_review.xml data 536 abs list_menu_item_checkbox.xml data 536 abs action_bar_tab.xml data 400 abs list_divider_holo_light.9. PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced 132 ld_timepicker_down_disabled.9. PNG image data, 117 x 60, 8-bit/color RGBA, non-interlaced 637 fragment_question.xml data 884 abs spinner_48_inner_holo. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 1102 abs ic_go_search_api_holo_light.p PNG image data, 32 x 32, 8-bit colormap, non-interlaced 254 abs list_focused_holo.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 175 abs ab_stacked_transparent_dark_ holo.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 214 abs ic_cab_done_holo_light. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 782 abs cab_background_bottom_holo _light.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 214 Standard Exam Sample.vce data abs btn_cab_done_focused_holo_li PNG image data, 3 x 54, 8-bit/color RGBA, non-interlaced 199 ght.9. abs spinner_ab_focused_holo_light PNG image data, 44 x 64, 8-bit/color RGBA, non-interlaced ic_launcher_lite. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 2884 ic_menu_view_checked. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 853 abs list_menu_item_icon.xml data 688 abs tab_selected_holo.9. PNG image data, 3 x 12, 8-bit/color RGBA, non-interlaced 149 ld_timepicker_down_pressed.9. PNG image data, 78 x 43, 8-bit/color RGBA, non-interlaced 1238 abs ic_clear_search_api_holo_light. PNG image data, 43 x 43, 8-bit colormap, non-interlaced 1532 abs ic_clear_normal. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 1498 vpi tab_unselected_focused_holo. 9. PNG image data, 3 x 6, 8-bit/color RGBA, non-interlaced 153 abs btn_cab_done_pressed_holo_li PNG image data, 2 x 42, 8-bit/color RGBA, non-interlaced 183 ght.9. abs simple_dropdown_hint.xml data 640 abs textfield_search_right_selecte d_holo_dark.9. PNG image data, 14 x 7, 8-bit/color RGBA, non-interlaced 181 ic_menu_mark_checked. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 523 sherlock_spinner_item.xml data 500 abs ab_bottom_solid_light_holo.9. abs list_selector_background_tran sition_holo_light.xml PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 227 data 508 abs ic_ab_back_holo_dark. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 626 view_question_select_and_place.xm l data 1632 abs spinner_ab_focused_holo_dar k.9. PNG image data, 22 x 32, 8-bit/color RGBA, non-interlaced 418 Copyright Joe Security LLC 2018 Page 18 of 31

19 Name Type Size abs action_bar_tab_bar_view.xml data 340 ic_menu_view_default. PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced 1097 ld_timepicker_down_disabled.9. PNG image data, 78 x 43, 8-bit/color RGBA, non-interlaced 509 abs spinner_ab_disabled_holo_ligh t.9. PNG image data, 22 x 32, 8-bit/color RGBA, non-interlaced 272 ic_menu_mark_default. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 1031 abs ic_ab_back_holo_light. PNG image data, 24 x 24, 8-bit colormap, non-interlaced 438 abs spinner_ab_pressed_holo_dar k.9. PNG image data, 44 x 64, 8-bit/color RGBA, non-interlaced 548 ld_timepicker_up_pressed.9. PNG image data, 78 x 40, 8-bit/color RGBA, non-interlaced 1513 ld_timepicker_up_disabled.9. PNG image data, 78 x 40, 8-bit/color RGBA, non-interlaced 596 activity_private_exam_key.xml data 1616 sessions_context_menu.xml data 452 abs textfield_searchview_holo_dar k.xml data 560 abs cab_background_top_holo_dar k.9. abs ab_stacked_transparent_dark_ holo.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 199 PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 228 abs menu_dropdown_panel_holo_li PNG image data, 128 x 64, 8-bit/color RGBA, non-interlaced 1435 ght.9. abs list_pressed_holo_dark.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 176 abs textfield_searchview_holo_ligh t.xml data 560 ic_menu_move. PNG image data, 36 x 36, 8-bit colormap, non-interlaced 1471 abs tab_indicator_ab_holo.xml data 1580 abs progress_primary_holo_light.9. PNG image data, 33 x 24, 8-bit/color RGBA, non-interlaced 858 ld_timepicker_down_disabled_focus ed.9. abs cab_background_bottom_holo _dark.9. PNG image data, 78 x 43, 8-bit/color RGBA, non-interlaced 667 PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 199 ic_menu_move. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 707 ic_menu_learni_mode_checked.p PNG image data, 32 x 32, 8-bit colormap, non-interlaced 371 abs progress_secondary_holo_ligh t.9. PNG image data, 8 x 32, 8-bit/color RGBA, non-interlaced 180 vpi dark_theme.xml data 848 abs btn_cab_done_focused_holo_ dark.9. PNG image data, 3 x 54, 8-bit/color RGBA, non-interlaced 182 abs ic_clear_search_api_disabled_ holo_light. PNG image data, 43 x 43, 8-bit colormap, non-interlaced 1219 vpi tab_selected_pressed_holo.9.p PNG image data, 4 x 16, 8-bit/color RGBA, non-interlaced 156 abs ic_voice_search_api_holo_ligh t. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 705 abs progress_medium_holo.xml data 920 abs list_lopressed_holo.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 175 session_count_indicator.xml data 784 abs ic_go. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 1739 abs toast_frame.9. PNG image data, 96 x 40, 8-bit/color RGBA, non-interlaced 810 abs screen_action_bar.xml data 1752 ic_menu_learni_mode_default. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 479 abs ic_commit_search_api_holo_li ght. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 448 ld_timepicker_input_pressed.9. PNG image data, 78 x 39, 8-bit/color RGBA, non-interlaced 625 ic_launcher_lite. PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced 9008 abs activity_chooser_view.xml data 1680 activity_exam_sections.xml data 1004 abs btn_cab_done_pressed_holo_ dark.9. PNG image data, 2 x 30, 8-bit/color RGBA, non-interlaced 183 abs ab_solid_dark_holo.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 206 abs textfield_search_right_selecte d_holo_light.9. PNG image data, 10 x 5, 8-bit/color RGBA, non-interlaced 175 abs list_pressed_holo_light.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 178 ld_timepicker_down_normal.9. PNG image data, 78 x 43, 8-bit/color RGBA, non-interlaced 876 view_question_container_multiple_c hoice.xml data 388 abs spinner_ab_pressed_holo_light PNG image data, 33 x 48, 8-bit/color RGBA, non-interlaced Copyright Joe Security LLC 2018 Page 19 of 31

20 Name Type Size sherlock_spinner_item.xml data 508 abs textfield_search_right_selecte d_holo_light.9. PNG image data, 14 x 7, 8-bit/color RGBA, non-interlaced 181 abs popup_menu_item_layout.xml data 1448 abs progress_secondary_holo_dar k.9. PNG image data, 4 x 16, 8-bit/color RGBA, non-interlaced 175 ic_exams_category. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 1499 vpi tab_selected_focused_holo.9.p abs ab_bottom_transparent_dark_ holo.9. PNG image data, 4 x 16, 8-bit/color RGBA, non-interlaced 157 PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 237 exam_results_mode_review.xml data 452 abs btn_cab_done_focused_holo_li PNG image data, 2 x 42, 8-bit/color RGBA, non-interlaced 183 ght.9. exam_files_list_item_view.xml data 2164 ic_menu_view_checked. PNG image data, 64 x 45, 8-bit colormap, non-interlaced 1187 abs ic_cab_done_holo_dark. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 791 abs textfield_search_right_default_ holo_dark.9. abs spinner_ab_default_holo_light. 9. abs tab_unselected_pressed_holo. 9. PNG image data, 10 x 5, 8-bit/color RGBA, non-interlaced 174 PNG image data, 33 x 48, 8-bit/color RGBA, non-interlaced 325 PNG image data, 4 x 8, 8-bit/color RGBA, non-interlaced 157 ld_timepicker_down_selected.9. PNG image data, 78 x 43, 8-bit/color RGBA, non-interlaced 1247 abs ic_search. PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced 2783 abs toast_frame.9. PNG image data, 192 x 80, 8-bit/color RGBA, non-interlaced 1850 abs ab_share_pack_holo_light.9.p abs ab_share_pack_holo_light.9.p PNG image data, 36 x 42, 8-bit/color RGBA, non-interlaced 255 PNG image data, 24 x 28, 8-bit/color RGBA, non-interlaced 240 ic_menu_add. PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced 1148 user_score_failed_score_bar.xml data 684 abs cab_background_top_holo_ligh PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 214 t.9. abs spinner_ab_pressed_holo_light PNG image data, 44 x 64, 8-bit/color RGBA, non-interlaced ic_menu_score_report. PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced 535 ic_exams_category. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 1499 abs ab_solid_light_holo.9. PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 236 abs spinner_ab_default_holo_dark. 9. PNG image data, 22 x 32, 8-bit/color RGBA, non-interlaced 279 ld_timepicker_up_selected.9. PNG image data, 78 x 40, 8-bit/color RGBA, non-interlaced 1506 abs list_selector_disabled_holo_lig ht.9. abs ic_go_search_api_holo_light.p abs cab_background_bottom_holo _light.9. abs textfield_search_selected_hol o_light.9. abs activated_background_holo_d ark.xml PNG image data, 21 x 63, 8-bit/color RGBA, non-interlaced 204 PNG image data, 43 x 43, 8-bit colormap, non-interlaced 840 PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 199 PNG image data, 14 x 7, 8-bit/color RGBA, non-interlaced 187 data 564 abs ab_stacked_transparent_dark_ holo.9. PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 199 abs tab_selected_focused_holo.9. PNG image data, 4 x 16, 8-bit/color RGBA, non-interlaced 157 abs progress_horizontal_holo_dark.xml data 888 abs ic_search_api_holo_light. PNG image data, 43 x 43, 8-bit/color RGBA, non-interlaced 2761 view_exam_variant_item.xml data 1384 abs spinner_ab_holo_light.xml data 856 vpi tab_selected_pressed_holo.9.p PNG image data, 3 x 12, 8-bit/color RGBA, non-interlaced 155 abs cab_background_top_holo_ligh PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced 228 t.9. ic_menu_view_checked. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 879 abs list_lopressed_holo.9. PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced 178 view_exam_results_section_item.xm l data 1144 classes.dex Dalvik dex file version abs list_activated_holo.9. PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced 176 Copyright Joe Security LLC 2018 Page 20 of 31

21 Name Type Size vpi tab_selected_holo.9. PNG image data, 2 x 8, 8-bit/color RGBA, non-interlaced 151 uncompleted_passages.xml data 480 hot_area_question.xml data 412 exam_results_sections_review_sepa rator.xml data 560 abs textfield_search_default_holo_ light.9. abs ic_commit_search_api_holo_li ght. PNG image data, 10 x 5, 8-bit/color RGBA, non-interlaced 166 PNG image data, 32 x 32, 8-bit colormap, non-interlaced 440 abs primary_text_holo_light.xml data 976 abs tab_selected_pressed_holo.9. PNG image data, 2 x 8, 8-bit/color RGBA, non-interlaced 155 abs ic_menu_moreoverflow_norma l_holo_dark. PNG image data, 32 x 32, 8-bit colormap, non-interlaced 113 abs list_pressed_holo_light.9. PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced 175 abs ic_voice_search. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 2013 ic_exam_file_vce. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 1581 completed_passages_list_item.xml data 392 ic_menu_view_default. PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced 890 abs list_selector_holo_light.xml data 1208 vpi tab_selected_holo.9. PNG image data, 4 x 16, 8-bit/color RGBA, non-interlaced 150 abs spinner_ab_pressed_holo_light PNG image data, 22 x 32, 8-bit/color RGBA, non-interlaced abs list_divider_holo_dark.9. PNG image data, 2 x 2, 8-bit gray+alpha, non-interlaced 139 abs ic_menu_moreoverflow_norma l_holo_dark. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 126 ic_menu_edit. PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced 1004 abs spinner_ab_pressed_holo_dar k.9. PNG image data, 33 x 48, 8-bit/color RGBA, non-interlaced 445 abs screen_simple.xml data 892 abs btn_cab_done_holo_light.xml data 776 preferences_headers.xml data 644 abs item_background_holo_dark.x ml data 1136 abs spinner_ab_disabled_holo_ligh t.9. PNG image data, 33 x 48, 8-bit/color RGBA, non-interlaced 315 vpi tab_selected_focused_holo.9.p abs tab_selected_pressed_holo.9. sherlock_spinner_dropdown_item.x ml PNG image data, 3 x 12, 8-bit/color RGBA, non-interlaced 156 PNG image data, 3 x 12, 8-bit/color RGBA, non-interlaced 155 data 508 abs ic_search. PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced 1287 abs action_mode_bar.xml data 476 review_mark.xml data 784 abs activated_background_holo_lig ht.xml data 564 ic_menu_add. PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced 1990 abs textfield_search_right_selecte d_holo_dark.9. PNG image data, 19 x 9, 8-bit/color RGBA, non-interlaced 191 abs ab_solid_dark_holo.9. PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced 219 abs spinner_ab_default_holo_light. 9. PNG image data, 22 x 32, 8-bit/color RGBA, non-interlaced 292 ic_menu_move. PNG image data, 48 x 48, 8-bit colormap, non-interlaced 815 abs textfield_search_right_default_ holo_light.9. PNG image data, 14 x 7, 8-bit/color RGBA, non-interlaced 168 abs tab_selected_focused_holo.9. PNG image data, 2 x 8, 8-bit/color RGBA, non-interlaced 155 abs spinner_ab_focused_holo_light PNG image data, 33 x 48, 8-bit/color RGBA, non-interlaced abs ab_share_pack_holo_light.9.p PNG image data, 48 x 56, 8-bit/color RGBA, non-interlaced 268 activity_exam_variants.xml data 360 activity_add_local_files.xml data 360 abs cab_background_top_holo_ligh PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced 199 t.9. ic_menu_mark_checked. PNG image data, 64 x 64, 8-bit colormap, non-interlaced 558 activity_incorrectly_answered_mode. xml data 2296 Copyright Joe Security LLC 2018 Page 21 of 31