ID: Cookbook: urldownload.jbs Time: 22:26:00 Date: 30/12/2017 Version:

Transcription

1 ID: Cookbook: urldownload.jbs Time: 22:26:00 Date: 30/12/2017 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking: Persistence and Installation Behavior: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Code Manipulations Statistics Behavior Table of Contents Copyright Joe Security LLC 2017 Page 2 of

3 System Behavior Analysis Process: wget.exe PID: 3364 Parent PID: 1520 General File Activities Analysis Process: cmd.exe PID: 3460 Parent PID: 3024 General Analysis Process: 7za.exe PID: 3468 Parent PID: 3460 General File Activities File Created File Written Analysis Process: cmd.exe PID: 3480 Parent PID: 3024 General File Activities File Created Analysis Process: java.exe PID: 3508 Parent PID: 3480 General File Activities File Created File Written Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 3 of 407

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 22:26:00 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 2m 23s light urldownload.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 8 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: HCA enabled EGA enabled HDC enabled CLEAN clean1.win@7/648@1/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: java.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 2017 Page 4 of 407

5 Confidence Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 2017 Page 5 of 407

6 Networking Persistence and Installation Behavior System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Downloads compressed data via HTTP Downloads files from webservers via HTTP Performs DNS lookups Urls found in memory or binary data Persistence and Installation Behavior: May use bcdedit to modify the Windows boot settings System Summary: Tries to open an application configuration file (.cfg) Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Classification label Creates files inside the user directory Creates temporary files Executable is probably coded in java Reads software policies SQL strings found in memory and binary data Spawns processes HIPS / PFW / Operating System Protection Evasion: Very long cmdline option found, this is very uncommon (may be encrypted or packed) Anti Debugging: Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Copyright Joe Security LLC 2017 Page 6 of 407

7 Behavior Graph Behavior Graph ID: Sample: Startdate: 30/12/2017 Legend: Process Signature Created File DNS/IP Info Is Dropped Hide Legend Architecture: WINDOWS Is Windows Process Score: 1 Number of created Registry Values Number of created Files started started started Visual Basic Delphi wget.exe cmd.exe cmd.exe Java.Net C# or VB.NET 1 C, C++ or other language 1 Is malicious download-cf.jetbrains.com , 80 AMAZON-02-AmazoncomIncUS download-cf.jetbrains.com started started United States 7za.exe java.exe Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains Copyright Joe Security LLC 2017 Page 7 of 407

8 Detection Cloud Link download-cf.jetbrains.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 2017 Page 8 of 407

9 Startup System is w7 wget.exe (PID: 3364 cmdline: wget -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='mozilla/5.0 (Windows NT 6.1; WOW64; Trident/ 7.0; AS; rv:11.0) like Gecko' ' 834C709455BFEFB9B0E8976BAD13A8F4) cmd.exe (PID: 3460 cmdline: C:\Windows\system32\cmd.exe /c 7za.exe x -y -oc:\jar 'C:\Users\user\Desktop\download\hsqldb jar' AD7B9C14083B52BC532FBA B98) 7za.exe (PID: 3468 cmdline: 7za.exe x -y -oc:\jar 'C:\Users\user\Desktop\download\hsqldb jar' 42BADC1D2F03A8B1E D3D49336) cmd.exe (PID: 3480 cmdline: 'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\download\hsqldb jar' org.hsqldb.util.databasemanagerswing >> C:\ cmdlinestart.log 2>&1 AD7B9C14083B52BC532FBA B98) java.exe (PID: 3508 cmdline: java.exe -jar 'C:\Users\user\Desktop\download\hsqldb jar' org.hsqldb.util.databasemanagerswing 02E26F23B FB5E33DB36BF08C) cleanup Created / dropped Files C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c7c46.timestamp File Type: ASCII text, with CRLF line terminators 1B6A2A F8F98B902 7FEEBC E549D DA7C3C7A986F7 5963F9C6E570648B2C0BFDB E634E33392ABD F07E74B4DEE FA9FB520D9F6A20A6BAFF2258FBF70A88B6A5C012A01044F8D2B21C412245B10320C82D0D3DD1EE026EBFAAA27098 A1102C2175BF8B936793BB8E12AFCB45 Copyright Joe Security LLC 2017 Page 9 of 407

10 C:\Users\user\Desktop\download\hsqldb jar File Type: Java Jar file data (zip) 120A60438D6156EFC CFFF1 5564C057C826418F8E32DE5815A14AEE91781B37 05D9DB29E690DC84D4D359690A55EDDD7CBBCC245334BCCC9CC0D380E969F F35AF13E615684C2B4CA8C3BAD14C4931B7D1C36327CF4CB1BF1E567957F023253C15595C8DDF65EACF74A04B47660 E0377CC1F07A03435D47793A7560CB5 C:\cmdlinestart.log File Type: C source, ASCII text, with CRLF line terminators C4DF16E419D289E4F03043FB55D0A4F9 29B5DF5F27305B4EBD4C76341F979F988A872D4D 0EE317E9E55947C ACB0F0AEE0A1C9552B40391AE63E7DD A8ECAA505CAAE1DEEF F11EC5C8FFEBA1CA C14FE685A849938CF0AE2F85F9265A623626BF00 17E62989F51B83C8A7E98E8720A6CFA C:\jar\META-INF\MANIFEST.MF File Type: ASCII text, with CRLF line terminators F1E19DE96BB0D9EB F87C25A0AF22C829D4BE68C C0E3066EF 306F48FF E7C644026E11DEC8FFD2B1245B54456D ADFC91 6DDEF105D5A2506B9A6C97FB47A397D177FED4F AD855CEB2582BDC704A70A3AB02891B8756B6571C81B264B E3D A80AF0F5E9BE0B45265F9 C:\jar\META-INF\hsqldb_lic.txt File Type: ASCII text, with CRLF line terminators B7044D94151EC8875CD7C9F833F0A2DA 5C45A583E29F108674C3DE9F1BAA30E5464AF475 71A42A3328BEE5CA6F7CA4966D25D8EE2C10E1D E35D0044C74CF44B1 9C7F756A25C95A2C0A71044FAFEA403D0FA15AA5A551813E0DED64C66DEEA1EBFE433CAE41BF247EAB70290D1F9F EC0ECD36DCD25C5AFD C28 C:\jar\META-INF\hypersonic_lic.txt File Type: ASCII text, with CRLF line terminators C2852BF7FFE44B98A78028E3DB1023B4 D13A1039AF9238A4CED31C420DD28E23F9E20619 C4A4EBC030B554CAECFB8BBD C2C5E95B1E1C49A29F688CF25DDF AA7180F0F870DF9AF11AEEB7B E0274E657CB16FB7D55E C63D9613F905543BA738E141D74E 7B86ED01F2E1246C11A5B299C6A12 C:\jar\META-INF\services\java.sql.Driver File Type: ASCII text EC7268E7FE CA95D807FAF FAB65B794B15A31C761E9D0FF5E8902ADC78A9 4EC76F07AD5F430853D267045CCDFC3B7EB9F282B7A7D2FDB11E10F98365B5EE CFD202EFE3C5106EA3CEA93E883A0691CA1519C86E DC9DAF3593B00338DED71E9201E378B542A41184E61B 742EEF327EBC97A0F38D5E1D745B993 C:\jar\org\hsqldb\ClientConnection.class 0CAB17C21A44AD29317EB58250C6AC3D 4B1AF42F CB365AF6934A687A28EB5CB 7B7773EC6B6D9BC4B02AA72ABE7006F8879B60268F6236C93EF86D442A F6601AA0235E6C06E81C82C0EB290217C14C0A2AA2F90D5AC0816F4122A45A CE8A EC7D6C4F232D8D A4AD87F68DD45B66330AD1DDC40DEAD Copyright Joe Security LLC 2017 Page 10 of 407

11 C:\jar\org\hsqldb\ClientConnection.class C:\jar\org\hsqldb\ClientConnectionHTTP.class 45108AA19A30D3B483E6AF7DE9CD2EE E57079A614452D1BD0E959620F90DE9ECD 1E180BB341DC2CF6A60655E052B57EE66B9E5A326F4030A2290B43B6CD41B695 7A2BCD34C626AA41B A4A3885E2B92A71E93D69FDEB6CF2B904DEE69CD681AB578B567A0AF9A73DB27D69864E D0202A2C05EA9B13B48F972B C:\jar\org\hsqldb\ColumnBase.class 2996D62D6433EE9EEF F6A35 6EF8E9FF69F168AFC4DCE53A22A8009A2E7D99DE 3B2B055DF1ACDE9C30E8EC8424CE B035164A58268A2F87AFF3F9CA15 CD79D0DD11DF6135ACBE126C1CFD140B037D0ECE0FE640293FF5947C1A5F0B8EE59EED4BC43EC7DBC68BD31B3EE E93DDCC3C321B0A71008CF470B02B7 C:\jar\org\hsqldb\ColumnSchema.class E D DF121BB 4BF99E FEBA9005F47C3480F483CEA0BC DC3A550A7140E8F5016DD556DDAF149F3B83A5E39DBBC64EABAFF0EE71B6942C 3D3699C202F515A2A390FA7524D9CE3C5AD5AD304F23FD2ABCA45B4CA170DC47D1AE8AE061270A91894C03A2C63AE67F 1DA6D8527A81ED34974FAD83C435D984 C:\jar\org\hsqldb\Constraint.class 9FF51B46BBBC5538E5D BD3259 FDEB026465BF1DEDDC0588B29B2709A600CE40F8 B8DA7FBBF1120E D8A4410BAA8D7DB7DFDAC5D0DE83CB9E46289B2E4B C EC6C5C4311C212EF9B3AFCBC5D7E4A5EE3772BA722A8E9A71BC9C14BF5F6D1FBDC7EBB951AE03F3BF D198B2723E574AA197D3F67B2A5B C:\jar\org\hsqldb\ConstraintCore.class 360DD2DA9503C70799AF924B9C09C0A4 023D740CD54FD074A4940CF7B59266C73E5E961D 484C35734A63BE90B624BCDFADDFB087A06B9E6CA2BB0005DB30108CA678B19F E1A4F4DBE673AC3D96721FAB7456A8987B0E9EAC3CB0D DC1644ACCEB5A95A88D2A DB405E81E7 CAECAB09969D1B63E6EDCB3E58A4B45D C:\jar\org\hsqldb\Database$CheckpointRunner.class DFA190A6666EE371775BE3F15 7DD7E7BD8D94B265F76D4AA321AD198B009E8F2E B1612EAB6CF1E0B767CD5148E1282E6319B88C607F686AD06C5D9B2EDF4E648B D292DE98DDF7EAA99A49033CCC2A7FB8DAE313B0E51F770506E5C949EBF43145A21340F438242A940B646593AEDBE456 7C3A E4BBBB1D5772BDDBFB9B C:\jar\org\hsqldb\Database$TimeoutRunner.class 86E0DAD439A6D3AE3B1D13A36CB349A7 B867616A824219CBAF375CF22FE2F383CCC244E0 5580BE10CED031B930D2FB88BE6028DE83FB FC71A4B432D965BDDB6 Copyright Joe Security LLC 2017 Page 11 of 407

12 C:\jar\org\hsqldb\Database$TimeoutRunner.class B785EF C212B778A70A73D12D8E7423FA FD72D956F3965DF54E3E50F18E63AE0EAFB0F0D AB53 EA9CDF27C2F3A69E51DA297574E5B9 C:\jar\org\hsqldb\Database.class 313A4E2125D62A85E1B6964A6B3AF2CB E1FBA96B89ED0C208EE1402D228C3D20E05FFB0C 1988C316367DC2C48E59132CF72082EEA4B014F01CF64F128FA1C7578F4B4C66 2FAD1CABF301B1056E1C33BB497EE B24FFEF99AA3FF19C9A338A3B8CB8F0EC14558B3E75D9F39E20EED80E 0A5573C33A48096FA0B8F40F642B41149 C:\jar\org\hsqldb\DatabaseManager$1.class 19FBFF95DE112B6F518F9DD9806F B3EBFF4D1D17F6B4DF3568BC BE 1A4391ED7AC160FFE5CE71165E935D313549B41F72FF9D9261AC FC2CD4B0E14D068D5D60BFF29FF54C671DC81B1336E728BD991FDD3D5CF0887B61585F FCF9CB3E5AE BB05FF1B2158D08620DEE03E90 C:\jar\org\hsqldb\DatabaseManager.class 61F07531DD39DE27A4E24A33CB23A7FD 1042EE04AA7A584DECD20DB03D46F012C F085FF0D4D C6D00537E9B798EE56A AAE59510D5D47F EF7E6FB3DF032B8A744A FA5EAF DA81E4DCB5CFC9391BB35A0D713D95F30BA549DB2DFE6EEDD EABFF46467D6C1C277182AA2C69EA9E6 C:\jar\org\hsqldb\DatabaseType$1.class 22AB F43F5BC39B0C616FA32D0 73BEE0EA23FAA A11C75A28F460EF EC1A FC118C3328AE87EFA97B2DD2F6172CAFBF30D4B C8F8A8 9B36101A0BE12F F9570C1A900A9791F62DFB1912EA479C66E4A52DAA0CDE5B976CA1F0246FE80CD9058E1A15 FF7B1179B66D113F7AE9A88CDCCCDA3 C:\jar\org\hsqldb\DatabaseType.class BFF7163CD79CB440514D765CF8 8450DABA2B859FF9238FEC609D17B74BEAB9818D 3E3AFE09B6AF89F1FF8E AD6CFD1057B8EAC57BB6AAFD2441F8A195 F605F02C2D4C772F37DF3D895C2BEBD461E2B61DCDC02423F C94FF6D0E5B5267AAB16F2EABC1AFCA3A19653 A1CBAA483ED73F77990A62F214E0FD5A C:\jar\org\hsqldb\DatabaseURL.class 5E28EDF6AECC2778E39A2E1B58B B5781D377A84EEB2BBD23A1CB6727D F4728FEF571ADB E34A5CE20E3B115D15D5538F1A52F20DEB14FFCBB 6FC24ED20B6CBE70DFF7D376CE3B148084AA4146C51B4E8C0EE91C7AE3A729DCFF95F62F8BE0E07CBA236BEE3DCBE1 1A66B F039BE20399B EBA C:\jar\org\hsqldb\Expression.class Copyright Joe Security LLC 2017 Page 12 of 407

13 C:\jar\org\hsqldb\Expression.class E41E99F880B3FD8CDBEFCB4D6BC74FE6 91A4E2C287194F15D679D770830AEDA4B935430A 8493CE691EFFF0CA119FD7CB092D96E82068AFB4A231DAA6CA04E39C7A9FF703 AF29A1C42D822E4EFBE83CB9C271DC60536C265D5049E5E22B59C93C722AC7EE E95F7A C5ADEFF93C0 A51D20826B98BAA6D0CE69CB2F621BF C:\jar\org\hsqldb\ExpressionAccessor.class 5AC0B38EEDCEC77CF5B29925D14A C7BD22BBEC48575D1D2C2E9A1C6131D5B1 0BB8BBBB9F871B813A9D8AC83197E19F9BB66493A4B3AC7A9FA9030D05DB8CC5 67E79DA12F0885AFB74CDCC4761C0F0FB7994DDABBD20DE41137ACFB0A09A6B77693F D3D40E816E A2F59A50A59188C4AD C:\jar\org\hsqldb\ExpressionAggregate.class C1801B847D6FD8162C6C1541CE 71F13CE7490BDE6B4E37930B08BB2132A646DD25 BBDE675075B91CCBE6B37D47C5E54FAE230BBD C33FD6CE0AB0E60B27D E6AE2CBB8A31812AC4FE06EE1A59CE06FC55FE70B3ABB8CC7C28E2DD9F496865AE3A D7FB3FF2D5C764DF6 CE35CBDC1FC0D197FB D9EF265F C:\jar\org\hsqldb\ExpressionArithmetic.class F297CBF9EA9E66AB92F6363B7D65F1BA 0C766CC6F5C58F2EEC5D0AE2CA7C7E98C1AA C6EC3AB22ABAF8FFD830CE0AD09BB40A68BEC1702A64D4420A0C6633D83D 4A6E728010ED5678EA2ECC6D3F8673FE813591F4113B3BD6FFB5185CCF0BED8BD18A BBA3599BAAE3BAA98BFE A1B45818CF14D8F2B163CABD07B31A21A C:\jar\org\hsqldb\ExpressionArrayAggregate.class 770F6A3875C63B1438CCC6AA8386BD8F AC900FC60AFCF81DE227992F54B37D064F3C715F A C09B022F3FFD9F1B42848C81D9719F71E67239BF091CE641305A74 E2C83964DD90F E824CC8157A9BA9A33FB527FB7C022D9A546CBCD29A5F1FA63C196EF19978D41510A E A525BDA58479ED2A5A1769D0A135EC6 C:\jar\org\hsqldb\ExpressionColumn.class 3AE10C714889CE8FDBAA410580F1FC69 3F300C812A00C72BF78DE77466BBEFBF13E37EBC 5F7F2321EF7B700CF25B C B3CAD D74716EBAD7 7F11D84AA69C157442E44831E89DA9CD151BDAA30076FFC502DC258475FCBDF3DBD06F73EB B10BC20A05494D 4BCFC7B35BC7E13E9C56358E40EF98CD C:\jar\org\hsqldb\ExpressionColumnAccessor.class 83352D3A3DCEEBA110F99C5E007992BF C2000FB153520DFB99D93EF4BE2452E2699E5BD5 5D1E14068AF0B53D51212B908B43CC6310E9569FC63AC302E49794E17CB6917C 61AED2658B8B2AD7AA2CDA E139B1D898B22C0A2D167742C449B2AD7F946698CF29C96480BF5F9D466591DE05 04D04D EAF8137DCE2E3FDA8 Copyright Joe Security LLC 2017 Page 13 of 407

14 C:\jar\org\hsqldb\ExpressionLike.class CD6A6A2572D6BEE0F7E77E4B2973DBDB AE768BC9349B201730EDAC2E71DD041CF41B9BDD D7C04046FD24E7EF B7D1D3C35A17D1EA071D C8B96C6413C74 2E46C2DA6F7CFF D25DDCF1ADAEFE B4135CDD535FE1FD59A7A CF0EB87F58B7EB33C0B0 CB201E46E4EA069C586DA4C43E18A76A C:\jar\org\hsqldb\ExpressionLogical.class BAD402D11C0E4E7C55868B BD21A494201F9B886903E7D03964B149AEB84D04 D078B902F44DCEE2074A17D7174CD284CE E788487EB7796CDD BC146FD318A7C55C343EA231F3943EC B5DED6EA51E7157D2C327DB33371A5A084328E5B BA95A9 FB66D23202FB75974E724C6B9314C81 C:\jar\org\hsqldb\ExpressionOp.class 98F2A0B336502F38B77C0F4DFF5C3EFB F2E71A4512D2F081F F77B1F4132A82D0E 4B99A862E7166A5A04E6662E5376A E23E7CD563EEFCAAFF18E6A190 FEC816D7E BC27AFBC2AA875A EB1057B9F4B550CFA257B316FEF0EDDCB9571D0D8990F65D13D936DF C22F5D76E48F0C0EA0F3811D6D5D0972 C:\jar\org\hsqldb\ExpressionOrderBy.class EF0FDC0C9776B898C78DA65BB1D9AFC9 0F0C14C663862B553DB5D23B1877EF6042EDAACD 68254A3D1A340D7A40AEDB77442F5CABCD7363AA7DCB4F5BB3B C5C07 4E799B17F136A6E D4F4DFC3948DC9AEB28F7C0CAF B E781B10EC16355C195CCAE42F D AA79C24DB14312 C:\jar\org\hsqldb\ExpressionTable.class 39FABE1BCAD1EC91DABFB76CC3AE44B5 B70ED6A2BE36BA8D6F B00B5A28135A85E 9C44122E3E7F72395A326F0330DD22DBA5B969221E73BC18306A93A638A282EA EB93F32C7A991787A156B4CB27257CB7856B997E40817F6534F99D686BFFB2B2EFDFFC7DAD2ACFE3834CA9A1C2C41A5A 1BB361DC9F4BC3AF32EBBEE40BAF53D4 C:\jar\org\hsqldb\ExpressionValue.class 15A1D79FF6E32B1FF339AA6B1A3B0140 FA63AFD86D7264CD15060F8451E74AC52237ED75 D5D0478C2C0C E050E6F0D3E61CF0C3A867FF5E06ACD33972A68A380 EFA8BC984D753CBDC194378F35DF69F4B72714B5F497FDAEB205AD551D30E14C F D83F2A79A5C EA39C53F95A9F7F0CB125953EC91 C:\jar\org\hsqldb\FunctionCustom.class File Type: data 6C8533C8E42C31FFCE5630F841D126E3 1A9CD407158C FD2A C0EA C50C4E C482CC5D47B8A8AA5247E3AF260BBE63B4E95319FBBFCFE D1A5148B43A4ECB974EB5E93CB BED8AC7A3FCF49CCEB2E15B77EEE5E70DD6F8F8ED02C43EB04DAB90EC7E 1A300F040FC140F1216D85F2FDB580A952 Copyright Joe Security LLC 2017 Page 14 of 407

15 C:\jar\org\hsqldb\FunctionCustom.class C:\jar\org\hsqldb\FunctionSQL.class 9581C16F1E4CC8E748DC017382E7B959 65DC811179C A93156BDA2756A1AC2 64FA53B4AFFA82641E294A6A3EF3F3940B6D11F1DFE820C39A6EF2D59B CEFE1F4FA9603DE8E3FACB605E2FE42AEC59A44B2CBF1FC0B1AE9CF8772BA0111F542C80392E0C8EB6D8077F8E7F240 B DCDF BCB6EBEA615 C:\jar\org\hsqldb\FunctionSQLInvoked.class BFFBD3866A9F18F41B9E99F41101B528 89C173C2A6AD81C207405CAFA6336CA F6E4C1C03BC3DB3FE3A774B8A217E275F24A120C353F3ADFB2FA6DAE4FC95AF2 C3EF5B00A38BB2AB979EB92F3624D2F7F7F4D0C9620CB2AEF584BCE0B06FDD0067CBA17F77EADEB9031D6EFA07009CF 01E610DD6EF359FE0CFF67C7EEC C:\jar\org\hsqldb\HsqlDateTime$Tokenizer.class 9DF1D4B60ED41AFEBF4A42E4C FC42D143E2B58909B A0D2C45F27A DF88F845EB5053A49E5157E79FD63CD D1B78580E0D0866B5E1159C6D4 6108EFD62B63272AB628A73D41F7934A209502DFDA75BFBCFDCC5AAD2F48A C534EC70A575EE5A5AEC1144C2F BC3D65C85A8F04797ED8B2CE4FCB3E23 C:\jar\org\hsqldb\HsqlDateTime.class 5F7B86744E3B8F8BC67091A6AE4A302E BFB2C E1FC614C17F04227C575C626F901 1E7C6E2F9E180E041FBFAD80434F81B4B3DA63E4B338C CAEB73EF C4B7DF1D6BCFA3F253FE29E29B52858EDE86DF7F3DD1FED11795C898F82E73C F2DE4FAE51C99A E FF1CC8CC209CFF16C694CEB C:\jar\org\hsqldb\HsqlException$HsqlRuntimeMemoryError.class EAF991BFB06E536856A4720CA AF03ADB DE75FA28EC8EA7245C4CA9F 22FBAA1C2A990C268DD4EA0F761625DFFCC5C463F0A25FC7D4AC1B81B94E6AB1 A9050CAF8D6E9C620B5184CFA63E52D094F3B86B3C3C62B E1DCDD7BB8AD604A3A053765DAD7D0A519676B7D5 2178AEF B8F4C9E9DD100BF13D C:\jar\org\hsqldb\HsqlException.class 0F7C9413DA9051EBDEE2C6F551B9B01B 42F6A3D6468EF53E47656FE1A1983FA16B4F3AB1 63A3A2C C537BD5A700673A797527A526248E111D4F6B49FE744C23A 9BC33BFF98DE1A7A61D8864C41459A1BE7297C02A960DC E9DB6F4BD DB9E9F637117FC97716 A9FDD440EECA E63210ED2FA C:\jar\org\hsqldb\HsqlNameManager$1.class C5E08D0C0A8A C217FD3E10651 C80E8D2776B8DD766DB5136EC33BAE2B74292FE8 9495D5F CC2E4206EDD97B7C5BCE8CA17CE04DFC0F0F76AD0B9391 Copyright Joe Security LLC 2017 Page 15 of 407

16 C:\jar\org\hsqldb\HsqlNameManager$1.class A0684BDFD3C61E6C67C77335CC3DC0A92A764290A472D3F0F971A331C8B A3DE04E164F825156C79B2E07B21 D26EF152F13C9A65B2C29AAE0636F3 C:\jar\org\hsqldb\HsqlNameManager$HsqlName.class E74D28210A539D994FED783485BCC891 19B3E418BBA53E13E1E5AB739B48C0DB857B1A48 D63D9D5C5E9ADA307768ADB3F722D37DC59D8BC3754BA59AC7E60CF53F815CC9 7ED0DCF EB23CE8AD EC700115FA5DD1CE61375DDE972D34DF50CCAB9477A6918E9E5966E48CD DAE9F5D5DB96E920948AB7C2F69BE52F C:\jar\org\hsqldb\HsqlNameManager$SimpleName.class 6AA127A721B7F6F21912ACEFB1EB98CC B05F9EA322AE7EFF E6D3105C273281EA CE523BF784E942354B1119D6B6774CE88CD AE00E4FC5148C02CD5 C068C472C295E67E18C0CB06112FF1673E0070E1DE78D5559A673D08BAF AB6ECD84D981E1F48A33E9EA9DE B285C885E596193FFE6BCC28BEA29 C:\jar\org\hsqldb\HsqlNameManager.class F3A27DB1DBC15C6B726D1D1B5950B39C 55E0361F47EF CEE A1FDD7D3 D499F3C4DCF2FCBE87D582F19DE54075C3F7AB231EEB1B30FFC78951FAC207DF 1AA22FA543DDE6F570CBF29D19EA6972F4FDAB144F126D19CADB6F2A5B58254B50CBB311772B ECC2E01F395 40FBC2A3CB241AC454B042F56828C6F4 C:\jar\org\hsqldb\Like.class A80047D885FB0D3EDB037C97832F3319 B68DDD8CCAE5B897A2F798D7C40FF3CE733DA EFDBC93D B97A8F31904C61B58ED2C55DAD5C07E28FB7907E 0C CA6A72579F7C3225D01A89AC7AE331E8F04EF01C7A9B99334DC39A2E514B27D2FFA22BC635DEA6C4F287B21 DB927BC756AE5A71ADEBA68E28BE4101 C:\jar\org\hsqldb\NumberSequence.class 73B2E2480E23110D6B00C34B829AE A5D8245B0B45CC9452FF657BC5F3B251EE3 DFA9A37B38E07408DE F8CA5B31A22955A0F9C2C21C10658A BE A4BA4F3B8623F96CF160122FEF7B5EA1FC0AC1F8A046313C265B38AA2A3A2BE403FC13D58CEBEDCE04E2D3D8BD9B3B 5E D5CD300C5E706595E493F7B8F C:\jar\org\hsqldb\OpTypes.class CC5F81FD07BCEDE79E5A7673F85543DF 25FC5421F3B5760E3336ABE4CF554B48C50FFA8F 507F4964B1D782FF94E8107EF4DE6C8E2B7E469823C9BFF1B13FD0AE7D A3AE00E6A57BB1FB8C5F099F567F964573E5D74A02E115E FD995759F719D401C597A16FE09DC5474C58285F9 FB20377B5437FAD5EADC560A5C19E0 C:\jar\org\hsqldb\ParserBase.class Copyright Joe Security LLC 2017 Page 16 of 407

17 C:\jar\org\hsqldb\ParserBase.class E1142E8BBE83416ECC E212 D9D4DCB832687D18B CA0B9668D82F2122 BCC55C541557AF759C8532DACD25C2C80501A3E3DEC1C85AEEDBEE24CEE6EC5D 78DA1EFC96A36D922BD9C53CFFA B3CF99E5967ACFD359AA429AA A65FD10DCDC039EFBE7C0316BFD0 B86BEFE F80D334A5D C:\jar\org\hsqldb\ParserCommand.class 547BA6C4AD2D4A4EB3E4BAF2FDBDB9FD 27B596A84C1C128A53E7F5ACB372F5C0872E6FC7 7B11C6F8FAF794EBFCCEA07E74E2EE70C921D A98342FD D E53B5523EFF4019ACA75891C38B889F2CF33DF6EC21ED9BC8FDD3DEC64C09FC377D98DD C24EDEFF6C2C749698DFA C:\jar\org\hsqldb\ParserDDL.class 401A2EE114246C93C15634DE532B659D E2EDC4E5388C3B8F43770BB533AEEA2A9E692C15 8F582B7A82BF5DA3F1A49BE11A790BF06F82B20F68AEA898A25F4942B9A1B233 AD2392A632446D363064FC61FAB9C70DFE2AEE25B43A1DEF2C73A89608A5526B540774ABDB8BCC96E684058EAAC01A15 157A69E6CF0F3834E08DDEC A C:\jar\org\hsqldb\ParserDML.class FBB886B7A972B21039C80D4C6578EC3A 68AACF85C42DC4DABEEF2FA7E4994D85E121866D 76BBB14194F01E2E10189D53BE7F4C897C7382FCF438E95F48B754D89256A953 8E9049EA7C9A80170C47F865D1C94293ACD1FC3B81EF1A27308FEC7F7F1B74E228E51AF D5A706BAE D5F A9F6C B279DF695EC6FCE49B C:\jar\org\hsqldb\ParserDQL$CompileContext.class 1F77B88B75D1D3B926456A4B16A A346AB30DC61C20254A7A0EED274EA21F0E4BA 5B5C8522EC2D66A094E C05A97EEDEB3D7B68B41CA124E579BE5E93A A0E55F62F95684A919D37FA2AAD29B0C2B28806EE5B7666ED4A67EB095F972ABCF5D0C2EB05DA03C950700E5159A 76804BEDE581E5FDD4A83CD814F05AA8 C:\jar\org\hsqldb\ParserDQL.class File Type: data 21DB1743FA75CEE1C2A610C0F024648D DAC60FAD56F3F91EB6700AB5C C124C7B2 1BCF2F0A1DA623F3151E3A4D1C3AF A B834855A3848D65EC3 A949B1EE78B6EA7DCDF9A4C28C87588F218E5EEED73FC2A88D79E0CFF9A98D54A5DCD04D38D96F0EC97493F932FC2DE 25E5FF74DBCB28CB6DD9C4F83FB6F1CBB C:\jar\org\hsqldb\ParserRoutine.class 75C4FDE C27CD7D84EA EB33AB1AA B1CB42640B75D241308EE3 D668F43F5B9C25B8632DE354CC8C5E10C15F193C3820C72D654E8FAF748929CF DBD0608B527C5AE674A76F F58CAAF859629D10118BFB60975CE19338AF AB61473EFBA17B5FC C82DEDC03A4761EEF85E40ADF3F Copyright Joe Security LLC 2017 Page 17 of 407

18 C:\jar\org\hsqldb\ParserTable.class DE2DB2C1E168F192DAF DE7A28 5BE7DDBFF7BF9697B4B496050AC81D20B36AF939 53DFBE6CA16DAE30A7E57F2E63CC6B2DF22783A745058B1AD7CFBB53FE537C91 FFEE753CDF0F78675E83F7BB0D2CA7DE3D93F03B3BED51F78AE4CCB6571D623D8B676BA9A4F44FEB254100D3BCF6FD3 2EC347B3943C7C18946E99DC1D C:\jar\org\hsqldb\QueryExpression.class 6EE09EF8277D299AF91F2D643831FE88 AB2433E2FFC07D F24936C133DC151CE 1737D70BF937595AAB007E8CC5B5819D D70F7FF03C B58B6FB 2E783547B2259D9CCCC805ED5E28EA68CA708BA A35F9B4C7B36D561B8FE86FBA934C86EC1B19FF28E288D1EBB 7984EF48D368B3A5D40DAA7A97E9F9BD C:\jar\org\hsqldb\QuerySpecification.class File Type: PGP key public ring CAD4358D0177BA4277EEB954B8723C51 173CD0D0E9D9B9C3CE233515C8740B28EF771C69 44EA5B9B98F C1314D729C8E51BC83425C187DABFA2A8F278051DFCCED E2E8A3D0D C F4316B0FB D3D9E01103AA84DA41FEF20041A037DF69BADD C8B A08E433031ED EC9411F C:\jar\org\hsqldb\RangeGroup$RangeGroupEmpty.class AB275691D186226E12208F39150E03A2 27E11B46BE45A801C7B99AA3439C2D336BEB0202 A7FA9C0A3E620829BD5D903272EAC65AD D461FA2F9477FB3C5547F443 3EDFDC9DACB1FBD8CAA6823E48318DC C92D3CF8CC1A2F7418AB8360AE0D3BCEB63CA476D0C95766F3AB526F C5101F28750EE A96E5D2FA5A4 C:\jar\org\hsqldb\RangeGroup$RangeGroupSimple.class F4A92E987B3F6EF03D4BD59A13B0C3FE 9F F2DC59C9A54AA582C27808B E5510AFCB A98C9FD862C5F0DEDBCAAB395710FA68EC74D0C69F5C1F4 B890F70EB41F75196D2E8F6528F2A9BED731432A29C561A30E0A7DE4F190D26B84E40DC27B95BF4E0C98EB51E4BE F42DF446B13387E2C150884ABE8D15 C:\jar\org\hsqldb\RangeGroup.class 98376C514E6E1DD7D09B83DBCC1C72FE B260469F969D77B2BE0B47B879026AB 3D1FD6ED9DAA235D192ACC34A054FC9D4FEAE FB8959D3A6F FF583FEEE5885F9D2C45AB640EA2C517F9A045D660CD15E05A0F53D6936D6F7EDD F233F6BCF17FEFFDBA5E 66A274681ECAFF57C157387CB6B682C7 C:\jar\org\hsqldb\RangeVariable$1.class 9F195B0F9FD383924E4A46F3B11E3C25 30E026ADC29682D622B57937D94680D7AA65BC4F 48FF2FE87C856EA2A34F33E1A1EA8F138F8E734A400A8476F37584E480EDA09B D5BD4F54A5DA E7EA9B3729D8DB118E3444E987D186B0787D0A12EC3EFDCBB450F79CA5028D020EE7A266B3 A48B4F00CB9776BE49FAF7DE2716BA75 Copyright Joe Security LLC 2017 Page 18 of 407

19 C:\jar\org\hsqldb\RangeVariable$1.class C:\jar\org\hsqldb\RangeVariable$RangeIteratorBase.class 2F490A382AD2EF09EDD773F2BE81CE02 68D17DBCF0C4F7014DE898015C039FD3DA9AE3D1 4FF B45DBE639180CF0A57F16F52571E43E7502CEF16C0FF890B28C1 D5C38E031CF25B1C056FD3EA00060E37081F610A E93A08EE CE54C345D9EC17AAAF3CF3E1F1ED12283 DE60F09FF08C4D8957C636B89A79F13 C:\jar\org\hsqldb\RangeVariable$RangeIteratorJoined.class 041BB15D E87844F091EADB ED0FD56E8257C8101BC295DD6E9B14C963A44B D7D08FD62B48A BBF69F4E6657A212A3EBF753C6CDD2D917BB269 1F23002EBED989647A EC7E6457EF1F1F729B342C949BDE1968CB76FEE28E065CB02849BFC8FDD40D4B6F12A03 8C76C25F8716BE83A1606BDE47182A3 C:\jar\org\hsqldb\RangeVariable$RangeIteratorMain.class 71398F1D7E12885CA3D42EAE94503EAA 7DF050DBF23586CAE3FF6B63ABBB085D97E05AAB F052E2C04061D6A040D42E6909AB96DD48B76A1FDD6EE28DD59DCC B69 277AD95FD1B8C1AD961DE2136B5B1D3FF5A8BB181FE80453E1B52D6991BE049191E4AA51BEB537310FD857F1E64E55E4 0F6B452249EF920BF260B15A F C:\jar\org\hsqldb\RangeVariable$RangeIteratorRight.class F36CF0348D4565BE1F9E9BAF4CE982C0 ECD548820AB8D2CE19058BD77E5D08CEBD C5376F06DACFD049C46705EFABC3D80DE75C81D5D299D95C50E59F5BEF2F3AA 6899BDEF77E744C A854A2038BF75059C57E35053FADBCA0493F2B56281AAB39C69F8DE6AF64D99043B148CA F08BC9F DDA701487A2 C:\jar\org\hsqldb\RangeVariable$RangeVariableConditions.class C21F4B DD1C0B64D76B369CDB BCF5C78E306F9F49EFF01A7DD3266E7ACCDAC03D 52A7689ED0B8A84A051969EA6E7B954A073FC975DD1F6821AC FF83AF 3E7FA5BC8DC7DA04BD91A0C2A8F79225BCC993F00CB61FDE31D B1B549FEF9845BC29CD50ACA72126A203BB50 AA DCDC68CE32732A26E89ECEF C:\jar\org\hsqldb\RangeVariable.class 8288AD02D3D49C364E1ADA89CA7CC37E 6C4E33E799D2C BCE FC86AF0A B9E67DF4243A63B13648ABBDB51B3D8D8F2235DCCD70F4738EB1C121E2 31B0804F686AC4B19DDE609771F06AE3A32500E7A20719F2070AD460CC980B471FF1B9759A26F5CB39A60C38030F2D7BB 68BD62E1D76101E BA3827 C:\jar\org\hsqldb\RangeVariableJoined.class 6CF912AE5A45FF816230D2CB355C D1EFBE721452E0A4D66BD3F12AD03507B E38EA0C2D72895CE176EB702AF50A08F20E79C4B39509EE4A4E8A4DD257BEE Copyright Joe Security LLC 2017 Page 19 of 407

20 C:\jar\org\hsqldb\RangeVariableJoined.class A124AF506098E205722E6E746E C8A2F30CCB3FE2805FB246D10A2646EE0E559D2453FBB6A9DF66F98A69FC86BD 4A6CBEF2E3C8929EE52179AE5FC1135 C:\jar\org\hsqldb\RangeVariableResolver.class 6C72F6C284FCE89103A7939EFE80DE75 93DF4262D3B32F79B3B96ECA67013AD363B109BA 805BA5E44868F30CED6E6E9733D9789EB3E83E14CC0E1DEFFEC33D8B3F3468C6 20E0A01AC0896C509F6EDE17CEE4BC6A16F434D62F41E752A1A14D5E497B77AF9A425CB51550B56792E9DEC6FEE6D DBEDBA834A2887C C4EF C:\jar\org\hsqldb\ReferenceObject.class 2EE0997F148126E94C455C1833BBEC64 F9C521108D4BC666C20970C95891C030D DA989B55EF57DFF53C8A46CE90A1CBD8F9902CB16AC06183A446E351B EEDC30B5F481596EC6F20A0A67942EE3F3F03B57D191B2E7E87AA166194CF1CC3A148D0B3B5B F3C5E2F F839545E1885F5AE4177D173A65F8 C:\jar\org\hsqldb\Routine.class 0F010112BFF324094C26A99C64E EA7AA0732AE4D7BF2D8B3BD18871D5120D6EDC 1B05517D612F497E C4CE4DF81E31D5C6B463874E4D8F53BA46FBFC51 4D1C27EB8D223A440972C6059BA1E8B1F63E ADB9E809D25F6BB7A08E8A C1253A2FF5E7E581DC C6E1E87E52A976E776FBAA14E C:\jar\org\hsqldb\RoutineSchema.class 62C33B8B643793CC4E2A326CF6EFE663 DECD8A18F8D7FA2FAC696503BC71F C239 F157629AA26B046DE55E50E567C52B7D00E54BE06A5E44532CC839D35F8CFFCD 6063E861CA535565F A4EBBF5DE1490B52F0F EC54BE1994B51562B5D2142FAE2088DDB6B78C9C49F E43AD263F0B2CD93725FE356 C:\jar\org\hsqldb\Row.class CCED1F5BB9F36EA2D50AEDD185C FE77871BB862D12DB08758E1C3E2745B095C9F 9F1CC91A65B82E528FC114AD12C531E1248B6EBDC9D492BA850C8BCBADC6474C 543F852EB381E3F6DBB0BE0829D18EED708ADCC7E1CE4713B0B1E89F6C546282C A8CD5AFCD1119CE17ADBC5E E A9ED29FAB8946D6F5 C:\jar\org\hsqldb\RowAVL.class F45C3C47A2F4FB9C B7DBF0E03 373CCC744646FE8BA35F88EF17A5921CE0FA90C2 35CD141D406574F951584ADDF5F CD48B18122EA59B7178AEDEF684 BDBD9AEAF5B AE1ADD E2CB55412E00540C8996F32925F40B176FC ADC4197E99EE757C04A8E FD45F69CC7480A26C1794B6118E C:\jar\org\hsqldb\RowAVLDisk.class Copyright Joe Security LLC 2017 Page 20 of 407

21 C:\jar\org\hsqldb\RowAVLDisk.class EA48E84213E38A7BBA74E36C438CDD DAAF56A6F896852D88D6773FC989CA8F6DD 23D D05DFCB8FAF2E7F5EE55FBD19ADA4A22712BB24EACECF457EA6470 9E13835CF3753FC2B71D8BDF79C67017F6C0E6EEA1786C48B0EC1E3B740C2FEFEF A62D16E634F323E2A9F9BEA A5C D239B403BD72336ECB17 C:\jar\org\hsqldb\RowAVLDiskData.class FF9EDA745D240454FC0733A003CD1A09 2F1A9726F0915CBED1A87D42E0052F030CDF0604 BCF574A57DA9EECDD444E13D54FC7AF976A2C16B2B682BF39FDE7417B3DE0E51 CB3ADDF7201B F9F99838D00BA4E079ECF993C6210B1CDEED76C62AA92BD4F39A85860C7A75157AE56BD3F7 5380A7B108DC142D64C5E8912B6E98E7 C:\jar\org\hsqldb\RowAVLDiskLarge.class 38F744FF71E861C1861E2803E8FDD4B3 7270AEDFE8D6B872D2C90588B62BB9B219EEE603 E5DB1FD23361AB63C566C876439FF3B AC662EF D3806EF1B A70F480ADFC16E0D148D8E39BE8ED2D4729CDA668A C0140D3DFBA327EB47B58F4B3F038A0C2D38F0DA1BBE 2AC7863BB487340BD7DCE C3FDC C:\jar\org\hsqldb\RowAction.class E63D A4733DD42063C73997EF ED716FB7BB95C44AFAA70EA8411A597FEF7EF35E 4C9FBEFDDA46D DCB9FDE4B79ECC22C640DD5DB1582C36FA3EA F7BEF C94F1C54F9B71AFC76CC D7509C2504EF3602D24E567F2F0FEF61A0EB76E6A262A527DE8F319 AD7A9E78F756F274B772B460AAB4F2 C:\jar\org\hsqldb\RowActionBase.class 8FF48AF604DA61C53A07AF5E8C0838C6 4941B06F12CFA9E1F30FE3633FB98C4CDD7E4BFA ECE83E029EAE5B0F722F21814F10004E3E403FF49ED837A B 5387DADC031064F233D7A5E CBC60C C1F11F17DD912F10DA0B838484E1E279AC31F6E9CBA5C038A6 F5C9534C62FE7AAC44DBE9DA C:\jar\org\hsqldb\RowDiskDataChange.class 87058BA7A676413C9E32697B66D7FB6B 78CB39BE53FE060B9556E45A52CF5D05983D DC29674E56055D3D1F0E63F6D50197A85BAD51F63B0318B945DA1E9D551E F26D81B5CCBEA52F53BC9D FA6D217E8340A FBC123EB2241F060180F3E3AFF6B B17A31A770E614B793E27120A873C C:\jar\org\hsqldb\Scanner.class 1A1F97E2D4BE355EAC87193E39F080CA 791FEFE8AA49021C6DDB5DCFB3C9696CFC17EF54 C1845BEC514775D635AF185511FC4694B848337FA86B7AB696932D09CB C02E8FB F0BE06C5514AE7552B68DA20FB D7B1A8EDCAD745076A6E41F3A43FD74B006DD54F338 36F1F1BB795751C2B4E1B6EB5DCBCE Copyright Joe Security LLC 2017 Page 21 of 407

22 C:\jar\org\hsqldb\Schema.class 7D9AA0F81D633055BD89FFDE0DFC3D4B 6AD8CBDA9E315088A666E029A061336BC350EEF5 7D4BB2C09256D4AE13C1E515B78BE2EB431B553A9762B4DF080E07E B 21A0365D1BFD2AB262B5C84253FF7C2222C66BF598A4E7EE4A6F7E094CF9F375E11B29BB91D1CF92AF1F2DE448E4FDB F5F4C4762E7C1FBEEAD8D78C15 C:\jar\org\hsqldb\SchemaManager.class File Type: data BDDD009A3FA72493ACABC2629C1079A9 FA8D9293D96F195272E8C21BC8235BD19D302F52 5FE9D79C653BE3D44CE3439B7021D14CF0C D14C545DF58335D7B0E5DB 3D08C154837DC7220D FB8A6A1CD1044A54DC9BDB345DC1769D2B4CFDB03CC C37BEB3B3994B525 EF127B73EB2D BF4DE3A53B20 C:\jar\org\hsqldb\SchemaObject$ConstraintTypes.class 1B6CFFFC990D445B540203B4B09E0859 5E608B711010DB33FF4D64ABE8C595D891722C3B AED95AA0EA9351F8590D2995BD80AD261F152FF603CB4E E EB EC41A3BDF7E07920C8B1E69FC4A3AD CACB D05A672688DD25604F4F903D747C10A5AB5E D49BCEEE7CF776E3A309A1B7 C:\jar\org\hsqldb\SchemaObject$Deferable.class F2E27AB51F83FBA450C0F43C4A32F7DB 9839FEBA5502B1CF15C77EFD9279FE65180A74D0 4B4B01B5D1015E5E6D D728075B857B8FAF1A7160B5B8BD5F091FA254 F00C31A03A83581D7540E78CB36AAC5E9A15E43B9B5C047B B8095ED9E22B01764CF F1356FD4AAD21A4 0C28693DA34DFDCE31044D1327C995 C:\jar\org\hsqldb\SchemaObject$Nullability.class 8B3B70554FAAC4EBEDE9F8948BB58B BFC591CFB9C33E75C400C8E6E3CE8006CE E3932BCD61A7F89E7A23C AA807DEC C956D5EA088FCCA0D1EE 51EE40E94107DAD6819D24CD7A D41BC7DE82F8F6E0FFB258181A7F7341E6D595496C1AE92EA60C3F02435BF071 D3E5F4A38F70ED3808DC1AF67C874DF C:\jar\org\hsqldb\SchemaObject$ParameterModes.class F2804C31DBFB66A54418A24CBF00EE65 61D6E21AC6F8CDE0E7F0AA972A54A CB4 F18B0BB8A50FDC C92458C831AD361B38332DFE627E7BBF662DC1D9C7 BB6B20E1D85F09EE52AB EAC43C7622CAC53F0BEC72F774BE3F7A7130C63CF50C8C7B9B2FF6AA4FE794F332 AB1E5C9FB1F17F5BB3AC21DBB4CCC4A06 C:\jar\org\hsqldb\SchemaObject$ReferentialAction.class C25BA3FE9F95DDEBD7A6C 88EEE5C33FE8A5961CA9730EA95BBA9D3ECAFF6C FA1245A824CFF4C7D3D353BDAFC849483E6D459EA64D A29E D2F1A6449DD79D24BE481FD C985C90EA56ADF6A5BE9CD3B56FA199BFFBEB2E799EB FA1C7F511ABD C6CEA2CDCC F1B Copyright Joe Security LLC 2017 Page 22 of 407

23 C:\jar\org\hsqldb\SchemaObject$ReferentialAction.class C:\jar\org\hsqldb\SchemaObject$ViewCheckModes.class BCABBBBF02227EB096267FD99E2D BEAF40EAF2C6CF241E1C A8BE2E6A 58BFFE869B9FD7734B304663E3F894B36C983B16B69C279457B705F77EC28567 BC3AE73C9DF48F52C5F461D76F307ACDF5381FAFCC EDF7CFCC54896FF39C26EE841A0FD07E3B71B166009DB 8BA73314C32A8D0799E2245C39D3FA4B C:\jar\org\hsqldb\SchemaObject.class E72AC2411D0B5D509E73B4EBF72FE80F C1E8659E96BAD0EE71C1B2CD04EF8D257439A32D B42767AC4C3BCA304E8D71B03D6E40193CD9EE269B1A E83F5DA996 AF72116D23A8F5A207CD5389F5732D9A02D85A B3DE74C4E968D2237FCBFFD62D0ED1419A AE8 27C8B27044E74EDFF993B612101B58 C:\jar\org\hsqldb\SchemaObjectSet.class E C7C356704CE39C3A56A7C68 58F EDABED9A9ED4A98E900C831DF B2EC70FC540A2BA5373A6B842A65A93EA082A2A1C6B9AE1A320ADE406D5AC1B5 E6E467E EA66E4CD31A2BEA82FA216421D7983CA007674B7D62F24FCF6669F58C936C4F61C47F94555A6A88B5 E9A515978C91329C3AEDF9FF1060C4 C:\jar\org\hsqldb\Server.class A87BA68505D0DDC44175EBC5A0518A11 9C33AD90C4548CF1EF153450AD9F3F4FEBCE A795B7B4228C6DA3071E91745E D216A7E2720EC2276B263EAE E335A680C6325CDDB3721D6305F981A3C7B57CB5CA36F7EFB7FBD6BECF8BB2016EE832B6E84A16F2F2672E09BD9900D FE992C BD8358F29A0A82E95CB C:\jar\org\hsqldb\Session$TimeoutManager.class E8E63992A26B394A884FD41B7882EA2F 7078FE1D28A8CC4D69914CEAA E7EEA E76B B AFB31BC930E74522C E79F47F1A98FBF2A68E7 C11CD4ADDADDA47F A9B7F7FD31DA9800A950C864D017C7DE5407E C90A05E51F7996D60BF449773DB01 E36DAA7FD37AA3DB918D2ADDB625F12 C:\jar\org\hsqldb\Session.class B059936E753A384B9B337F37DB53D015 D0E32168A3B6382BC13368EA6663EAFAC6B C5FFC5019C08FDA02051AE1876C811997B3F8C7B5F883EEC6FE3CDF D2CC9B9E0EC84D5B58E57B192C1262CCA36F6008D623C5E1A62931DF92162FFCF5482E1D CD345A538D35C4158 E7D59C93D824A8AF70E90FBDA7F3761 C:\jar\org\hsqldb\SessionContext.class 0F35111D1071ACE897110BAF9E656E76 DC78818EC25A34CA36C7F84B5AA19AB85975CC99 156E40AEAAA738B5D6021C5C8922B8CD9D144AC25A8B416A91B627D5D6AABB3E Copyright Joe Security LLC 2017 Page 23 of 407

24 C:\jar\org\hsqldb\SessionContext.class B F08C DE86877E7BD4510F74BF97F3E96967EE995B D9FC CE23163BB2CC4F994A F2EEBC47F39FC2810CDB8F8218B13 C:\jar\org\hsqldb\SessionData.class 73074E931B12E141865E117EDCBF441F 2215AAA7C23ED154727BF D5043 1C34DEB5DD955CFECCF04BD03FE7C2865D20E26F3E5B42F3D7437B33C76A5B95 828ACA4572E9C844417B7AE9BE7DC1C39E1FF40F7A9A1A5FE459B605671CC60DA09F61F0976ADF8F881F5ADFF94DF593 1ED5E37DE21A16CC231DE45223FF67B5 C:\jar\org\hsqldb\SessionInterface.class E2510B11C F7066D8CB766 A7F6E0EBE8E1277BC6A3C604174F6D1E66DAFBD9 D329186E521AA C37261F584A6ABACB2C3D4ABA3182F72C1186F62228C E152FB8CB528D9C15F22FF8735D80D676A48C939507D002FBB8F60A3E170E06738E25C F5BC23443F6D90B74B97B 1B E9CD0F91E E8 C:\jar\org\hsqldb\SessionManager.class 7A0D013EB8CE0C7B92ADA1467A703CBD 7D255CE2EFA66D4365F58D3B4EA1F0A9E D FF8CBDB16B862F DF EAC4B93769A AC7A52DF77D3123DEAA7D388F140B800A368EA438BC005146C3796E27A21F3EEA9A379E031E880CE847EA36CD6B C43BFFBA43D626A9D2C264 C:\jar\org\hsqldb\SetFunction.class 6D24A1F3FA4C15902B90D2C7CCE A4C69FE7ECD414EE396DE2084A5E3DF0C3631 BE860B892F51BAC612AAAEB3B2CC46D6A4CDAA4E158040CE967CC0C6C0D7CD6F 0E86A7723A9BF3FBA40F76046EFE0706D34CFDBFA5F4A5ACD687815FF79D2FE5D9A878095B19BFEA80DAB0E6A5690B35 4B1FD223EF07437DEE64971F9095C303 C:\jar\org\hsqldb\SortAndSlice.class 16D D98E2088D429AC874CCB62 A8C21E9E83CF4BA36EC004F37C5E75A D176E1D2609FB C7C467A1C A15149A2CE22B5E B96701F170F7559F106425A8BBA12B683E5B029CF1E E7B1DD9567EBFC6E79F80B6D91D28D5CEFDD4D A70183A991EB9BF49498FF2 C:\jar\org\hsqldb\SqlInvariants.class 29EC28AB2F9044B5A1C93EFC48F25958 BF86E9D42768D92BC2C2DD597CB948F20D0F1BAB F3A B7834EB2F7B81B2062A851D16EE119CAF249F216BC2128B8E14 D36B701BA E08BDE9383EABB1045DB95D2A5419A0DCE188B51E8B2F761638B02A8E4846C5E3D8CF260871C8BFA 061A4CC1B3A02C95FDEF4CB599EB331B C:\jar\org\hsqldb\Statement.class Copyright Joe Security LLC 2017 Page 24 of 407

25 C:\jar\org\hsqldb\Statement.class FC30AD781120E AAF33F06B28 E5EEC98B819D8AFEFFBD2979FC7DFA80E D689093F A2847BDB8122A9FA9EFF2D176E86DD144D5F65F9070A9 E9270FBDC80C6CB907FBE80D1E5305A5E137CF638ADC8ED843D804FED9E0DE3F62E358A72B7B03851FFE4B F9 2F78A BC B7B6CF359C C:\jar\org\hsqldb\StatementCommand.class 36C1A07C6DF3B9027FFF48A22BBA47DB 20769D10EF1C9ECA139A7F6E5F1A8017A836419F AA830A50D5A2125C63A4634A6E0185FA02FB85165BD2D3BE1FEE8696A698AF5E 46FA8A7BFC44F7F40FDD1E05AC7D83F3F2CCBD41A150FB698811BC0B6B4B1C33A356EC9E15C751377F484F F B3DDA0C0FF5C229804D9D6A0E C:\jar\org\hsqldb\StatementCompound.class 574CA46C13B F13106C3F6D6FB 22C E0AE224CAF EBA96F366E A574BEAF4C432CB737D4856D7FC80C7F95E88E134DAC FAD05B38B 7A0531E0A15981A009B3A0B40A6CC67D57C8B9099DD99BC25033AD79B3F26DC4AB27728D591481DF6DC7ACA6ED9ED46E 19CB628974B7A20D9C89675F20C9EC2B C:\jar\org\hsqldb\StatementCursor.class 5AA15E5E0DD0C129C9F93E7B9BAA E56CABF2D024E1D195F95B108DC680AE A1B8BA19C0AF426838BAA4EC8BCCA0C36165B202F686486B46A5E5EEAF FE7C3A6A0627A82CD6819B4DD01805FE475E711F6941B947DCF51C F33EE7CCC941B2655C344 99A1CF28BECA09811CF136661DFDC C:\jar\org\hsqldb\StatementDML.class 03B349DA9E0B6D21F4B01019EA62BEEC 33AE83C36A0F2A168DC176187E574158B3B0574C 0D5E367A5D3716D1E16054D57A78A8384B26F860632E388716A52BD3DEC4DC16 8B349F6269CBF2987D7A658F759FBF4D9CED656F5DB04B5EDDC8F2B1695B68E58E643AF02FAF1C4CB70AA8E502A409B C FB1BF28E0DD1925DF0980 C:\jar\org\hsqldb\StatementDMQL.class 4E2B1B59FF68EBADEF3F9258E85C1F5C 3018BAEC6AD7A289EA80D6F6CBE825D742EA C97BA2EEC2E44B747CAF F482288E300B8C10969E49B455E0D5E FDAD1C56F70851F339BB79AC56B251F62016CFEC041B92D7B433F4C3F4ADFE58349C50F682B7F3607AA96B91C9C3F1519 E FB3FDD48C472D257F45B29 C:\jar\org\hsqldb\StatementExpression.class B3D405B411984F5010C213C379 B A80874D E70B2B3F8EAAD4D5 5B8555C28F96C7D1F065A514BD61071A080102DD7436EEAFEA7B90028E26A6A8 A1C78C8926A6B517E4369A66E662300AB209D6CEE5D8E43453B68B40A0AC94FD858B63F28989B6814CFE2A2BFE81FE29 BA836079AE22583D5F6C8761FF44261B Copyright Joe Security LLC 2017 Page 25 of 407

26 C:\jar\org\hsqldb\StatementHandler.class CCBB8CBB29BA79C C62 5FE66D1AC6DC96FF7C7AA088C C70F F8F69CBF820869C79AEA58F74A0AB03C5EE EC1ED A6D2DC019A3DBB44F B5AD47A A6AC52088E2D7717B338AD0E37255D824D8483D3486BD232 B491A8AD09C7DC D46FA C:\jar\org\hsqldb\StatementInsert.class 1CF940E8733B40C028F259CFAA DA6C5E EE8E6AA7B130F50EB1B67C64AC9 1364B949B88EFB41219D4F865E40FE285F2A41E5EA32E948CA34DA45B5FF0EB0 A3044FBD999465D69B21CCBE21DFB9ED4567DDE5AA0027A EF22A9283BC0632CFF56C93CA27892FF449A4A8 8DA4A04EEB15284CD67DEC61C4E22A4 C:\jar\org\hsqldb\StatementManager.class 325C4B17ADE39953F7A07419F77DBF2F 7FEF DFF36CF9D013EE9F32C6783A913 5AAB9831A49BA93B324D4A48EC1E357CD20885F9795AFC438C7524CA147804E9 48F7497D500CBEAE C356A79B463FB87056BC40B11AB496DBFDBA28E6A5C4C0EC2A02EDE9AE3DDEE568AA044 94F0717FB1B2FFAEC6C1EA00FCEC2A9BD C:\jar\org\hsqldb\StatementProcedure.class E345F00CF3A126ED7C0253E35DD08198 E0B6E76DCA012EDFBF3DB655CCFCE1C84D487E8A 66B11CB B1A81A8453A30DA4E8BFD5074F4B94B16BB599D00CA2CD7 041BFBD66F23019F8E1A0A5E1EA98C A52AFD1BCC918ACD A8325FFE2A3D4B66B073BBB531F2CF BFD0F3F18C12A4FE03AEB4A5154AA8 C:\jar\org\hsqldb\StatementQuery.class 324EE23C E0BFE D2 9D7FDCD927D963F184C8048F79A37ACB561CF6C4 6C580FAD49D65EC654C68C1D03B0C9A3CE19A8B C2DB56F C EF0AB9DABC28820E2C7DE04C CF7998B3557AA6A688E372F707E A5E ECE908B 5852ABD7E56D9C2CAAB9D07FC69122 C:\jar\org\hsqldb\StatementResultUpdate.class C7F0B99073D198F3203D8DED5F2C2FC AD7B6D D3F020AB2D3B8D 51F33A91D060FEA6E6430CD2CB12CE897BD30B3ADE49521DFF30E52C4D66CAA6 550D9BBCC43CBB47DDAFB6EAA9A9269BE5DD4C11094D84A76E4A1E44FA94ECF EBBED38256D255B10C2F6 9C15C913C5046C635ADCDEF659DC0873D C:\jar\org\hsqldb\StatementSchema.class 2CAFA3672D1ED85B5DFE7B01EA43C3A1 AD59DE122C9F30CEF7BCB03331B423709E94FE80 D16F929078ADC86BE9EA3B7A3539BA4CE099266B499BF7F2D7DB7CFA00BDCFE D15C6B476493F78E779D24E0C5C38CBCC2E5A932213B6B574A0289FFC6316BF3FE9E0B F B E8D93EC8204AAE65B DCE29B Copyright Joe Security LLC 2017 Page 26 of 407

27 C:\jar\org\hsqldb\StatementSchema.class C:\jar\org\hsqldb\StatementSchemaDefinition.class EEE574144E CB6E8F9 53DBE811C03980B2454BE364C195F96BF01E906F A113FB69BBD08EB EB992EE7772F8F053212F8FB2094F9973BCC74AE7A 0DA98FCAFDB90F7627A1C3C752B84AF4B9D6FF2B B3C75C915B2F9DB91A318401B0DC2601D42EB569D23A32F F67A6CCA32F8A7B0BABB8B7D1588BAC8 C:\jar\org\hsqldb\StatementSession.class A94371B5E19A9FBC17F9205CC75DD674 B55B54BB32F8A69EEBFA1199B1E80045DBD AE7D D23E8A2A9F42E8BB1F600EDD5B07637B9E570E3A4437B CE56ECDB526461B18506CE091291B6EB7A3532A395E6F6BBDE46EF30E858E56D52A602E7BE2BF413DF89CA52DCE C3DEC11961A8B A3E12849EA5C C:\jar\org\hsqldb\StatementSet.class 1AB07ADD84F80AEED68F600E0AC B BD32E8C1B755EE7250BD583CCD B8B019D904325FA7438A1AC591065F78E C4F3B5E2FDF2D90D29 CBAD9EA7B9C7B775080CDD61C85971C2A33010CDF9B99B7D5A91B B159BBB1BF1B19789BF E541C 24C156BDB32E AA43EF903F3C C:\jar\org\hsqldb\StatementSignal.class EA110CCF76D26EA F C284FDC022FC5DBE657EB7CA7DB58E4BE065FC15 01B9286C1B EAF00BB513CAD405A80C CFD281DDBC13412D9 0AFB241EB2EB86029EC99CBCDEB9CA92F18530DA5F6AA5B69D01B8B309CB1BB54ED89D7AD460605DF9A0EBC94E42F3 535B34BE8B27666F7B71E9BEAEA35B5E18 C:\jar\org\hsqldb\StatementSimple.class 7CF199D2B86EF66E0DBFDCD7DCC2C205 8C9188F23C59B0991FE605D9673F5AB03044F390 3B3FCE2F36F9C7FBDC2DAD185FCBFAEF871ED70DA02A5CC8F87B1E3A62B CCE8B25D2D6C5C7B0B8E7CCCB2F1BEEFAFCAAF586D73D19B480118D2CC64798BC687C29517E01AEA062D9DE4C7F77 FE242D4059D64BB810F21F F17 C:\jar\org\hsqldb\StatementTypes.class F79162DD8AA11A2D1B6B5D D 8039E30F5F70F F9A6625FE3A5E84B5C86 7A DD1555CC7D0B0ED2F5A79076D08F4AF89F929411D0B1ACA C C205DD57018F3A3B78E061C83A8FA DEE16431ECD0304C1B56EF75B47F21C81036F B7473E4AD599F E7B A4A65B19CF2F C:\jar\org\hsqldb\Table.class File Type: PDP-11 UNIX/RT ldp 393CDD944F0A486F663594DC438C999B 74627AE4E5A E697C4B4EA079E137DC03E 02F8C8204FF0AE7A6639A4CD3150E1C82C AA1ABA2F9BF691E71952ACD Copyright Joe Security LLC 2017 Page 27 of 407

28 C:\jar\org\hsqldb\Table.class 1EB392558EDC9144EC5126C3E2BB542338AD8112D CD882AE8155C91E581029ED02334E9B40BF133328E0 ECC46F037C9126C759E73577D4DCA8 C:\jar\org\hsqldb\TableBase.class 7053DD38BEC0CE36EE F4AC77 DCAD64870A70E F3FAC6BE09F76D A04266AE85965F719EC9BA0F94D2364ED1F33E59DF FEB0B33A1BF0E2C 353FD34B25CDD5690FA922A74A98E78D BB0E43D5F0DEE00F034AC50C4F6B03AD3C135A5A5AE4E5E9AFDB A4E9321C870CBBF809F65BB9D8 C:\jar\org\hsqldb\TableDerived.class E0A03C3F0AB8BDF07CB79652C90C0575 B59A A0ECFA2CEACF54011CD41C4FB5167 4DFBE C1FCCEEE94C653F D1381ACF6F4DA713FB5C9B93DB 11FCEB0F3D8123F422C877D2B5BD60216D8A2AD632C94C8DB5A64E2639ACD9D35DD8ADCB4199B43780B3D005038F700F 99A432C51C29E21576E9331C21BFFCC0 C:\jar\org\hsqldb\TableUtil.class 4E7C6916EA4CC6EBD4F2C6FDA505B79F 1088FA4605D24F601819A1F3492A4F9FBE E9CCA6CD214ABB7686E8387A31BEF8DF284C38C4B83B D6D8AB E100767D75787F481D34545DFD6793F61E5A049519B705187B6CDE802C403B45124B A B67C7371E857BEEABE8922D044 C:\jar\org\hsqldb\TableWorks.class 6E756DEA0966CE2C44613F64F02B81F3 5FD6DB8A7D2EC561C0BFEB89CDABA7ED2517E0EA D2A8EA9FBBC7D876D5C424C31A BEDEDE3F3D94E3E33CDA146E8E197 55DA1EFE20F988B D6F73C573793D6F DE0C2C00BEC D6D379EDC7803C6F12CFFECAF34F9D D A2F2B46AF657714AA8BB C:\jar\org\hsqldb\TextTable.class CA346DC60876A5E10A2B5A AB CFCE295F12A30E91ABCE986CD6A3A55A7DC708B1 4065D23DCD8E8FE2F155B F4E8A490CC459F09C169646E374AE4E0E F249D820EFBAECC9FCE7ECD1B59CBEB2FB73E6F9DE687DA7C6B1F4BD11C3384CE30D8E160B74E848 DA A0AE9DC6A548BE2FB70 C:\jar\org\hsqldb\Token.class DAB7FCC6A7FCC41CC F2 BC3F2BD708E6F C1E5D4CDE FB71EA290EE62D10552FBCAA66EBB6D0BE8084DCE5FC70ABD5193BDB823A665F F570E5FFA4FA8C349A54B70B081109BC420FC B94F553A7F77AB183EBC4AAA784F5B591B2C CE4372C3 6EDA3D3877EA2AA1C979C2E9AC9C491 C:\jar\org\hsqldb\Tokens.class File Type: data Copyright Joe Security LLC 2017 Page 28 of 407

29 C:\jar\org\hsqldb\Tokens.class B83D EDB5620A803167E14F 046A78375A1F0C0F4F3B70B1AA7AEA984A341F5D 90DD190336D11787CC931CBEE513055B86CD BC627AF1A24615ECAAE9 C935D232DAD65C44AF112F167CDB0F9DFB44D339486D00B10E21147BC505F1C814238A059B C33FE5B669BF6128 BCCCC5F138C23E13A2214BE C:\jar\org\hsqldb\TransactionManager.class 3FBF336823DB BD82D7DEFDE 5C3C6E9E6CEA841E3126CFD C1B63AF C057A68DFD8E14E0B3D37F D5F0C07324B1ACF1E7B9C29A7391C D097E26D7115A369DFD58798BE1DD2EEBEC64CE5E4C5849C21CB4E04AF A5AE71E4B5C8BF A7AA76E4F5FA60FD4C C:\jar\org\hsqldb\TransactionManager2PL.class FF49C61AAABC1473A1EDE3525E 779F18254DD494234C BB0174F4FF EBEFAE10154B51DA5B19AF7A1A494D D4D0E7F9B65EFC8A B9CCE3E9C484D45B05181FE16B6BF389B58F828C666B211A375BBCABB0A21912A1BEB0EEDAEE8E31D9B3F2A6D6F0 CE85BBCD6C85913FD6DFBDDE0D739B8BA C:\jar\org\hsqldb\TransactionManagerCommon.class D1CD8D0DF3899E40196CEC9E39E4BF6B EB8A563B521B7C65DB775F3BD14C674A8DBD0B60 291DF0B93182B5BE2A418711B5234C4D6096C1ACE22F46DCBB0E1B75D FD21EAF2BA404DE9B7BB5EADFA9836FCDA8CFE7E57B323D954D80C597DF3F3DC2C8BE8D350E1F9A6D8147FB C10EFF1AC BCEDD501C154A C:\jar\org\hsqldb\TransactionManagerMV2PL.class 940C C02B3CCFFE5FB36F3EE7 8F1797F18ED1AA F6B03E6E90E2188ADB1 9AD9F4DC06DBF7FA7B93CBBEA7375AFC EAD91FB78C5225A0D3ADF5453 D1868CC0E6A15155C1DC7C024AA7ABA9C6416BE50A04760B794124FC2F492001A684BDC8601C DD16C427EF606 F5C8A837716A6DCFD2F2828E336416D C:\jar\org\hsqldb\TransactionManagerMVCC.class 07D29C9041C3D5F8416C5E4CD2D1C59C 2DC41C AA10444EAD8B03B0F5E3533FB A758AC540FC4BAC44CAC93A0916D73D677B7ADA A6FFB89D 32840B4EEB2EFAD92E40CDBC22544EBE85CB6FB31CBE D810D5B29DFEA9F093AB88C0B8FFA86D2FAC2E0E91 DD124E442B685146D45C5634F8E2907AF2 C:\jar\org\hsqldb\Trigger.class F6D799206D3E964B96104BD13FD2B7DA FA37C719263B23DCFD CB3BD4ADA7CF8 061A D80D88578A37B1B7203C5A8AADA0BFF219F7077F434E03EC0FFEB F9375AAB6CFDE5CB57C33466CB9FD273D4EF32FA1CE1E8736A1A3C50B72366F2D224C4B76B38BA59BE1F4FDB748335C 467E6A2FA732EDE2E4803C234A6C14DEA Copyright Joe Security LLC 2017 Page 29 of 407