Avred

File 5A67B4365B569C43.SharpUp.exe.avg.exe

Name:	5A67B4365B569C43.SharpUp.exe.avg.exe
Size:	38,912 bytes
Type:	EXE PE.NET
MD5:	320349c343b691b41cbbebf6eb3461ca

Scanner Name:	avg
Appraisal:	Fragile (AND) based
Scan Debug:	Duration: 12s / Chunks: 217 / Matches: 49
Scan date:	2023-07-21 22:00:56

Matches

#	Iteration	Offset	Size	Section	Detail	SectionType	Conclusion
0	0	11985	10	.text #~		DATA	Dominant. Modify this to make file undetected
1	0	12000	36	.text #~		DATA	Dominant. Modify this to make file undetected
2	0	12914	5	.text #~	TypeDef	DATA	Dominant. Modify this to make file undetected
3	0	12924	21	.text #~	TypeDef	DATA	Dominant. Modify this to make file undetected
4	0	13379	11	.text #~	Field	DATA	Dominant. Modify this to make file undetected
5	0	14263	8	.text #~	MethodDef	DATA	Dominant. Modify this to make file undetected
6	0	14305	10	.text #~	MethodDef	DATA	Dominant. Modify this to make file undetected
7	0	15193	8	.text #~	Param MemberRef InterfaceImpl	DATA	Dominant. Modify this to make file undetected
13	1	19600	6	.text #Strings		DATA	Dominant. Modify this to make file undetected
14	1	21221	6	.text #Strings		DATA	Dominant. Modify this to make file undetected
22	1	22900	12	.text #Strings		DATA	Dominant. Modify this to make file undetected
23	2	34552	18	.text #Blob		DATA	Dominant. Modify this to make file undetected
24	2	34700	9	.text #Blob		DATA	Dominant. Modify this to make file undetected
25	2	36208	9	.text #Blob		DATA	Dominant. Modify this to make file undetected

Match 0: 11985 (size: 10)

Dominant. Modify this to make file undetected

.text #~

00002ED1   00 00 01 57 BF 02 3C 09 0A 00                      ...W..<...

Match 1: 12000 (size: 36)

Dominant. Modify this to make file undetected

.text #~

00002EE0   00 16 00 00 01 00 00 00 7A 00 00 00 26 00 00 00    ........z...&...
00002EF0   5B 00 00 00 47 00 00 00 31 00 00 00 01 00 00 00    [...G...1.......
00002F00   D4 00 00 00                                        ....

Match 2: 12914 (size: 5)

Dominant. Modify this to make file undetected

.text #~ TypeDef

00003272   A1 00 00 00 C8                                     .....

0x3272: TypeDef[7]: TypeName: IVulnerabilityCheck TypeNamespace: SharpUp.Interfaces Extends: ref table TypeDef[0] FieldList: (empty) MethodList: ref table MethodDef[26] ref table MethodDef[27] ref table MethodDef[28] Flags: tdAbstract tdAnsiClass tdAutoLayout tdInterface tdPublic

Match 3: 12924 (size: 21)

Dominant. Modify this to make file undetected

.text #~ TypeDef

0000327C   04 00 1A 00 81 00 10 00 C9 0A 91 11 3D 00 04 00    ............=...
0000328C   1D 00 01 00 10                                     .....

0x3280: TypeDef[8]: TypeName: VulnerabilityCheck TypeNamespace: SharpUp.Classes Extends: ref table TypeRef[15] FieldList: ref table Field[4] ref table Field[5] ref table Field[6] MethodList: ref table MethodDef[29] ref table MethodDef[30] ref table MethodDef[31] ref table MethodDef[32] Flags: tdAbstract tdAnsiClass tdAutoLayout tdBeforeFieldInit tdClass tdPublic

0x328e: TypeDef[9]: TypeName: AlwaysInstallElevated TypeNamespace: SharpUp.Checks Extends: ref table TypeDef[8] FieldList: ref table Field[7] ref table Field[8] MethodList: ref table MethodDef[33] ref table MethodDef[34] Flags: tdAnsiClass tdAutoLayout tdBeforeFieldInit tdClass tdPublic

Match 4: 13379 (size: 11)

Dominant. Modify this to make file undetected

.text #~ Field

00003443   06 04 00 DB 04 F5 06 04 00 6F 12                   .........o.

0x343e: Field[3]: Name: TokenGroups Signature: 0608 Flags: fdHasDefault fdLiteral fdPublic fdStatic

0x3444: Field[4]: Name: _isVulnerable Signature: 0602 Flags: fdFamily

0x344a: Field[5]: Name: _details Signature: 06151245010e Flags: fdFamily

Match 5: 14263 (size: 8)

Dominant. Modify this to make file undetected

.text #~ MethodDef

000037B7   00 C6 05 AE 06 0F 01 2C                            .......,

0x37b2: MethodDef[26]: Rva: 0x0 Name: Name Signature: 20000e ParamList: (empty) ImplFlags: miIL miManaged Flags: mdAbstract mdHideBySig mdNewSlot mdPublic mdVirtual

Match 6: 14305 (size: 10)

Dominant. Modify this to make file undetected

.text #~ MethodDef

000037E1   00 C6 01 CE 04 80 00 2C 00 68                      .......,.h

0x37dc: MethodDef[29]: Rva: 0x3460 Name: IsVulnerable Signature: 200002 ParamList: (empty) ImplFlags: miIL miManaged Flags: mdHideBySig mdNewSlot mdPublic mdVirtual

0x37ea: MethodDef[30]: Rva: 0x3468 Name: Details Signature: 20001d0e ParamList: (empty) ImplFlags: miIL miManaged Flags: mdHideBySig mdNewSlot mdPublic mdVirtual

Match 7: 15193 (size: 8)

Dominant. Modify this to make file undetected

.text #~ Param MemberRef InterfaceImpl

00003B59   00 B4 06 08 00 1C 00 09                            ........

0x3b56: Param[49]: Sequence: 0x1 Name: name Flags: (none)

0x3b5c: InterfaceImpl[1]: Class: ref table TypeDef[8] Interface: ref table TypeDef[7]

0x3b60: MemberRef[1]: Class: ref table TypeRef[1] Name: .ctor Signature: 20010108

Match 13: 19600 (size: 6)

Dominant. Modify this to make file undetected

.text #Strings

00004C90   65 00 67 65 74 5F                                  e.get_

Match 14: 21221 (size: 6)

Dominant. Modify this to make file undetected

.text #Strings

000052E5   74 6F 72 00 2E 63                                  tor..c

Match 22: 22900 (size: 12)

Dominant. Modify this to make file undetected

.text #Strings

00005974   54 6F 41 72 72 61 79 00 54 6F 6B 65                ToArray.Toke

Match 23: 34552 (size: 18)

Dominant. Modify this to make file undetected

.text #Blob

000086F8   01 12 49 04 20 00 13 00 03 20 00 02 03 20 00 08    ..I. .... ... ..
00008708   06 15                                              ..

Match 24: 34700 (size: 9)

Dominant. Modify this to make file undetected

.text #Blob

0000878C   0A 01 0E 03 20 00 0E 05 00                         .... ....

Match 25: 36208 (size: 9)

Dominant. Modify this to make file undetected

.text #Blob

00008D70   02 1E 23 01 02 02 06 02 02                         ..#......

Test #	MatchOrder	ModifyPosition	Match#0 #~ 10b	Match#1 #~ 36b	Match#2 #~ 5b	Match#3 #~ 21b	Match#4 #~ 11b	Match#5 #~ 8b	Match#6 #~ 10b	Match#7 #~ 8b	Match#8 #Strings 12b	Match#9 #Strings 11b	Match#10 #Strings 18b	Match#11 #Strings 11b	Match#12 #Strings 24b	Match#13 #Strings 6b	Match#14 #Strings 6b	Match#15 #Strings 24b	Match#16 #Strings 12b	Match#17 #Strings 12b	Match#18 #Strings 12b	Match#19 #Strings 12b	Match#20 #Strings 12b	Match#21 #Strings 12b	Match#22 #Strings 12b	Match#23 #Blob 18b	Match#24 #Blob 9b	Match#25 #Blob 9b
0	ISOLATED	MIDDLE8
1	ISOLATED	THIRDS4
2	ISOLATED	FULL
3	ISOLATED	FULLB
4	INCREMENTAL	MIDDLE8		1		3							10		12			15								23
5	INCREMENTAL	FULL	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25
6	DECREMENTAL	FULL	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
7	ALL	MIDDLE8			0								0			0		0							0		0
8	ALL	THIRDS4			0								0			0		0							0		0
9	ALL	FULL	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
Result			d	d	d	d	d	d	d	d	d	d	d	d	d	d

Explanation

Colors

Green: Not detected
Red: Detected by AV

Match Order

Isolated: Test each match individually, by themselves. At most one match is modified per scan
Incremental: Modify each match after another, additive. At the end, all matches are modified
Decremental: Modify each match after another, additive, downwards (last first)

Position

ModifyPosition FULL: Overwrite complete match: MMMMMMMMMMMM
ModifyPosition MIDDLE8: Overwrite 8 bytes in the middle of the match (partial): aaaaMMMMMMMMaaaa
ModifyPosition THIRD8: Overwrite 8 bytes in the first and second third of the match (partial): aaaaMMMMMMMMaaaaMMMMMMMMaaaa

[INFO    ][2023-07-21 22:00:54,563] main() :: Using file: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-07-21 22:00:54,564] handleFile() :: Handle file: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-07-21 22:00:54,564] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-07-21 22:00:54,597] getDotNetSections() :: Offset: 7680
[INFO    ][2023-07-21 22:00:54,597] handleFile() :: Using scanner from command line: avg
[INFO    ][2023-07-21 22:00:54,598] load() :: Loading HashCache
[INFO    ][2023-07-21 22:00:54,681] load() ::   62290 hashes loaded
[INFO    ][2023-07-21 22:00:56,965] handleFile() :: QuickCheck: 5A67B4365B569C43.SharpUp.exe.avg.exe is detected by avg and not hash based
[INFO    ][2023-07-21 22:00:56,965] handleFile() :: Scanning for matches...
[INFO    ][2023-07-21 22:00:56,965] scanForMatchesInPe() :: Section Detection: Zero section (leave all others intact)
[INFO    ][2023-07-21 22:00:56,979] findDetectedSections() :: Hide: .text -> Detected: False
[INFO    ][2023-07-21 22:00:56,979] findDetectedSections() :: Hide: .rsrc -> Detected: True
[INFO    ][2023-07-21 22:00:56,980] findDetectedSections() :: Hide: .reloc -> Detected: True
[INFO    ][2023-07-21 22:00:57,044] findDetectedSections() :: Hide: Header -> Detected: False
[INFO    ][2023-07-21 22:00:57,113] findDetectedSections() :: Hide: DotNet Header -> Detected: False
[INFO    ][2023-07-21 22:00:57,177] findDetectedSections() :: Hide: Metadata Header -> Detected: False
[INFO    ][2023-07-21 22:00:57,178] findDetectedSections() :: Hide: methods -> Detected: True
[INFO    ][2023-07-21 22:00:57,243] findDetectedSections() :: Hide: #~ Stream Header -> Detected: False
[INFO    ][2023-07-21 22:00:57,313] findDetectedSections() :: Hide: #Strings Stream Header -> Detected: False
[INFO    ][2023-07-21 22:00:58,047] findDetectedSections() :: Hide: #US Stream Header -> Detected: True
[INFO    ][2023-07-21 22:00:58,115] findDetectedSections() :: Hide: #GUID Stream Header -> Detected: False
[INFO    ][2023-07-21 22:00:58,177] findDetectedSections() :: Hide: #Blob Stream Header -> Detected: False
[INFO    ][2023-07-21 22:00:58,178] findDetectedSections() :: Hide: #~ -> Detected: False
[INFO    ][2023-07-21 22:00:58,178] findDetectedSections() :: Hide: #Strings -> Detected: False
[INFO    ][2023-07-21 22:00:58,179] findDetectedSections() :: Hide: #US -> Detected: True
[INFO    ][2023-07-21 22:00:58,179] findDetectedSections() :: Hide: #GUID -> Detected: True
[INFO    ][2023-07-21 22:00:58,179] findDetectedSections() :: Hide: #Blob -> Detected: False
[INFO    ][2023-07-21 22:00:58,179] scanForMatchesInPe() :: 3 section(s) trigger the antivirus independantly
[INFO    ][2023-07-21 22:00:58,179] scanForMatchesInPe() ::   section: #~
[INFO    ][2023-07-21 22:00:58,179] scanForMatchesInPe() ::   section: #Strings
[INFO    ][2023-07-21 22:00:58,179] scanForMatchesInPe() ::   section: #Blob
[INFO    ][2023-07-21 22:01:00,410] scanForMatchesInPe() :: Launching bytes analysis on section: #~ (11980-17272)
[INFO    ][2023-07-21 22:01:00,410] scan() :: Reducer Start: ScanSpeed:Normal Iteration:0 MinChunkSize:2 MinMatchSize:4
[INFO    ][2023-07-21 22:01:00,410] _printStatus() :: Reducing: 1 chunks done, found 0 matches (0 added)
[INFO    ][2023-07-21 22:01:00,412] _scanDataPart() :: Result: 11985-11990 (5b minChunk:2 X)
00002ED1   00 00 01 57 BF                                     ...W.
[INFO    ][2023-07-21 22:01:00,412] _scanDataPart() :: Result: 11990-11995 (5b minChunk:2 X)
00002ED6   02 3C 09 0A 00                                     .<...
[INFO    ][2023-07-21 22:01:00,412] _scanDataPart() :: Result: 12000-12005 (5b minChunk:2 X)
00002EE0   00 16 00 00 01                                     .....
[INFO    ][2023-07-21 22:01:00,413] _scanDataPart() :: Result: 12005-12010 (5b minChunk:2 X)
00002EE5   00 00 00 7A 00                                     ...z.
[INFO    ][2023-07-21 22:01:00,413] _scanDataPart() :: Result: 12010-12015 (5b minChunk:2 X)
00002EEA   00 00 26 00 00                                     ..&..
[INFO    ][2023-07-21 22:01:00,478] _scanDataPart() :: Result: 12015-12021 (6 bytes)
00002EEF   00 5B 00 00 00 47                                  .[...G
[INFO    ][2023-07-21 22:01:00,478] _scanDataPart() :: Result: 12021-12026 (5b minChunk:2 X)
00002EF5   00 00 00 31 00                                     ...1.
[INFO    ][2023-07-21 22:01:00,478] _scanDataPart() :: Result: 12026-12031 (5b minChunk:2 X)
00002EFA   00 00 01 00 00                                     .....
[INFO    ][2023-07-21 22:01:00,479] _scanDataPart() :: Result: 12031-12036 (5b minChunk:2 X)
00002EFF   00 D4 00 00 00                                     .....
[INFO    ][2023-07-21 22:01:00,480] _scanDataPart() :: Result: 12914-12919 (5b minChunk:2 X)
00003272   A1 00 00 00 C8                                     .....
[INFO    ][2023-07-21 22:01:00,480] _scanDataPart() :: Result: 12924-12930 (6 bytes)
0000327C   04 00 1A 00 81 00                                  ......
[INFO    ][2023-07-21 22:01:00,481] _scanDataPart() :: Result: 12930-12935 (5b minChunk:2 X)
00003282   10 00 C9 0A 91                                     .....
[INFO    ][2023-07-21 22:01:00,481] _scanDataPart() :: Result: 12935-12940 (5b minChunk:2 X)
00003287   11 3D 00 04 00                                     .=...
[INFO    ][2023-07-21 22:01:00,481] _scanDataPart() :: Result: 12940-12945 (5b minChunk:2 X)
0000328C   1D 00 01 00 10                                     .....
[INFO    ][2023-07-21 22:01:00,482] _scanDataPart() :: Result: 13379-13385 (6 bytes)
00003443   06 04 00 DB 04 F5                                  ......
[INFO    ][2023-07-21 22:01:00,483] _scanDataPart() :: Result: 13385-13390 (5b minChunk:2 X)
00003449   06 04 00 6F 12                                     ...o.
[INFO    ][2023-07-21 22:01:00,484] _scanDataPart() :: Result: 14263-14268 (5b minChunk:2 X)
000037B7   00 C6 05 AE 06                                     .....
[INFO    ][2023-07-21 22:01:00,484] _scanDataPart() :: Result: 14268-14271 (3b minChunk:2 X)
000037BC   0F 01 2C                                           ..,
[INFO    ][2023-07-21 22:01:00,485] _scanDataPart() :: Result: 14305-14310 (5b minChunk:2 X)
000037E1   00 C6 01 CE 04                                     .....
[INFO    ][2023-07-21 22:01:00,485] _scanDataPart() :: Result: 14310-14315 (5b minChunk:2 X)
000037E6   80 00 2C 00 68                                     ..,.h
[INFO    ][2023-07-21 22:01:00,487] _scanDataPart() :: Result: 15193-15198 (5b minChunk:2 X)
00003B59   00 B4 06 08 00                                     .....
[INFO    ][2023-07-21 22:01:01,325] _scanDataPart() :: Result: 15198-15201 (3b minChunk:2 X)
00003B5E   1C 00 09                                           ...
[INFO    ][2023-07-21 22:01:01,325] scan() :: Reducer Result: Time:1 Chunks:88 MatchesAdded:22 MatchesFinal:8
[INFO    ][2023-07-21 22:01:02,849] scanForMatchesInPe() :: Launching bytes analysis on section: #Strings (17272-23264)
[INFO    ][2023-07-21 22:01:02,849] scan() :: Reducer Start: ScanSpeed:Normal Iteration:1 MinChunkSize:2 MinMatchSize:4
[INFO    ][2023-07-21 22:01:02,849] _printStatus() :: Reducing: 89 chunks done, found 0 matches (22 added)
[INFO    ][2023-07-21 22:01:02,987] _scanDataPart() :: Result: 18452-18458 (6 bytes)
00004814   41 64 64 52 61 6E                                  AddRan
[INFO    ][2023-07-21 22:01:02,987] _scanDataPart() :: Doubling: minChunkSize: 2  minMatchSize: 4
[INFO    ][2023-07-21 22:01:02,987] _scanDataPart() :: Result: 18458-18464 (6b minChunk:4 X)
0000481A   67 65 00 49 6E 76                                  ge.Inv
[INFO    ][2023-07-21 22:01:02,988] _scanDataPart() :: Result: 18529-18535 (6b minChunk:4 X)
00004861   49 44 69 73 70 6F                                  IDispo
[INFO    ][2023-07-21 22:01:02,988] _scanDataPart() :: Result: 18535-18540 (5b minChunk:4 X)
00004867   73 61 62 6C 65                                     sable
[INFO    ][2023-07-21 22:01:02,989] _scanDataPart() :: Result: 18552-18558 (6b minChunk:4 X)
00004878   52 75 6E 74 69 6D                                  Runtim
[INFO    ][2023-07-21 22:01:02,989] _scanDataPart() :: Result: 18558-18570 (12 bytes)
0000487E   65 46 69 65 6C 64 48 61 6E 64 6C 65                eFieldHandle
[INFO    ][2023-07-21 22:01:02,991] _scanDataPart() :: Result: 18980-18991 (11 bytes)
00004A24   72 79 4E 61 6D 65 00 5F 6E 61 6D                   ryName._nam
[INFO    ][2023-07-21 22:01:02,991] _scanDataPart() :: Result: 19120-19132 (12 bytes)
00004AB0   65 00 52 65 61 64 4F 6E 6C 79 43 6F                e.ReadOnlyCo
[INFO    ][2023-07-21 22:01:02,992] _scanDataPart() :: Result: 19132-19144 (12 bytes)
00004ABC   6C 6C 65 63 74 69 6F 6E 42 61 73 65                llectionBase
[INFO    ][2023-07-21 22:01:02,993] _scanDataPart() :: Result: 19600-19606 (6b minChunk:4 X)
00004C90   65 00 67 65 74 5F                                  e.get_
[INFO    ][2023-07-21 22:01:02,994] _scanDataPart() :: Result: 21221-21227 (6b minChunk:4 X)
000052E5   74 6F 72 00 2E 63                                  tor..c
[INFO    ][2023-07-21 22:01:02,995] _scanDataPart() :: Result: 21823-21835 (12 bytes)
0000553F   75 74 65 73 00 46 69 6C 65 41 74 74                utes.FileAtt
[INFO    ][2023-07-21 22:01:02,996] _scanDataPart() :: Result: 21835-21847 (12 bytes)
0000554B   72 69 62 75 74 65 73 00 47 65 74 41                ributes.GetA
[INFO    ][2023-07-21 22:01:02,997] _scanDataPart() :: Result: 22034-22046 (12 bytes)
00005612   69 6C 73 00 43 6F 6E 74 61 69 6E 73                ils.Contains
[INFO    ][2023-07-21 22:01:02,997] _scanDataPart() :: Result: 22128-22140 (12 bytes)
00005670   6F 6E 73 00 53 79 73 74 65 6D 2E 43                ons.System.C
[INFO    ][2023-07-21 22:01:03,801] _scanDataPart() :: Result: 22660-22666 (6b minChunk:4 X)
00005884   00 45 6E 76 69 72                                  .Envir
[INFO    ][2023-07-21 22:01:04,589] _scanDataPart() :: Result: 22666-22672 (6b minChunk:4 X)
0000588A   6F 6E 6D 65 6E 74                                  onment
[INFO    ][2023-07-21 22:01:05,406] _printStatus() :: Reducing: 176 chunks done, found 11 matches (39 added)
[INFO    ][2023-07-21 22:01:05,406] _scanDataPart() :: Result: 22684-22690 (6b minChunk:4 X)
0000589C   00 67 65 74 5F 43                                  .get_C
[INFO    ][2023-07-21 22:01:06,235] _scanDataPart() :: Result: 22690-22696 (6b minChunk:4 X)
000058A2   75 72 72 65 6E 74                                  urrent
[INFO    ][2023-07-21 22:01:07,044] _scanDataPart() :: Result: 22800-22806 (6b minChunk:4 X)
00005910   00 43 6F 6E 76 65                                  .Conve
[INFO    ][2023-07-21 22:01:07,843] _printStatus() :: Reducing: 186 chunks done, found 13 matches (42 added)
[INFO    ][2023-07-21 22:01:07,844] _scanDataPart() :: Result: 22806-22812 (6b minChunk:4 X)
00005916   72 74 00 58 6D 6C                                  rt.Xml
[INFO    ][2023-07-21 22:01:07,844] _scanDataPart() :: Result: 22830-22842 (12 bytes)
0000592E   00 4D 6F 76 65 4E 65 78 74 00 53 79                .MoveNext.Sy
[INFO    ][2023-07-21 22:01:07,845] _scanDataPart() :: Result: 22900-22912 (12 bytes)
00005974   54 6F 41 72 72 61 79 00 54 6F 6B 65                ToArray.Toke
[INFO    ][2023-07-21 22:01:07,845] scan() :: Reducer Result: Time:5 Chunks:194 MatchesAdded:45 MatchesFinal:15
[INFO    ][2023-07-21 22:01:09,366] scanForMatchesInPe() :: Launching bytes analysis on section: #Blob (34432-36652)
[INFO    ][2023-07-21 22:01:09,366] scan() :: Reducer Start: ScanSpeed:Normal Iteration:2 MinChunkSize:2 MinMatchSize:4
[INFO    ][2023-07-21 22:01:09,366] _printStatus() :: Reducing: 195 chunks done, found 0 matches (45 added)
[INFO    ][2023-07-21 22:01:09,367] _scanDataPart() :: Doubling: minChunkSize: 2  minMatchSize: 4
[INFO    ][2023-07-21 22:01:09,367] _scanDataPart() :: Result: 34552-34561 (9b minChunk:4 X)
000086F8   01 12 49 04 20 00 13 00 03                         ..I. ....
[INFO    ][2023-07-21 22:01:09,367] _scanDataPart() :: Result: 34561-34570 (9b minChunk:4 X)
00008701   20 00 02 03 20 00 08 06 15                          ... ....
[INFO    ][2023-07-21 22:01:09,368] _scanDataPart() :: Result: 34700-34709 (9b minChunk:4 X)
0000878C   0A 01 0E 03 20 00 0E 05 00                         .... ....
[INFO    ][2023-07-21 22:01:09,369] _scanDataPart() :: Result: 36208-36217 (9b minChunk:4 X)
00008D70   02 1E 23 01 02 02 06 02 02                         ..#......
[INFO    ][2023-07-21 22:01:09,369] scan() :: Reducer Result: Time:0 Chunks:217 MatchesAdded:49 MatchesFinal:3
[INFO    ][2023-07-21 22:01:09,369] handleFile() :: Result: 26 matches
[INFO    ][2023-07-21 22:01:09,369] saveToFile() :: Saving results to: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-07-21 22:01:09,436] save() :: Saving HashCache (62327)
[INFO    ][2023-07-21 22:01:09,505] verifyFile() :: Perform verification of matches
[INFO    ][2023-07-21 22:01:09,505] runVerifications() :: Verify 26 matches
[INFO    ][2023-07-21 22:01:09,507] runVerifications() :: Verification run: 0 MIDDLE8 ISOLATED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED

[INFO    ][2023-07-21 22:01:09,509] runVerifications() :: Verification run: 1 THIRDS4 ISOLATED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED

[INFO    ][2023-07-21 22:01:12,053] runVerifications() :: Verification run: 2 FULL ISOLATED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED

[INFO    ][2023-07-21 22:01:14,581] runVerifications() :: Verification run: 3 FULLB ISOLATED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_DETECTED

[INFO    ][2023-07-21 22:01:14,645] runVerifications() :: Verification run: 4 MIDDLE8 INCREMENTAL
  result: ScanResult.NOT_SCANNED
  Idx: 1  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  Idx: 3  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 10  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  Idx: 12  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 15  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 23  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED

[INFO    ][2023-07-21 22:01:16,018] runVerifications() :: Verification run: 5 FULL INCREMENTAL
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 1  result: ScanResult.NOT_DETECTED
  Idx: 2  result: ScanResult.NOT_DETECTED
  Idx: 3  result: ScanResult.NOT_DETECTED
  Idx: 4  result: ScanResult.NOT_DETECTED
  Idx: 5  result: ScanResult.NOT_DETECTED
  Idx: 6  result: ScanResult.NOT_DETECTED
  Idx: 7  result: ScanResult.NOT_DETECTED
  Idx: 8  result: ScanResult.NOT_DETECTED
  Idx: 9  result: ScanResult.NOT_DETECTED
  Idx: 10  result: ScanResult.NOT_DETECTED
  Idx: 11  result: ScanResult.NOT_DETECTED
  Idx: 12  result: ScanResult.NOT_DETECTED
  Idx: 13  result: ScanResult.NOT_DETECTED
  Idx: 14  result: ScanResult.NOT_DETECTED
  Idx: 15  result: ScanResult.NOT_DETECTED
  Idx: 16  result: ScanResult.NOT_DETECTED
  Idx: 17  result: ScanResult.NOT_DETECTED
  Idx: 18  result: ScanResult.NOT_DETECTED
  Idx: 19  result: ScanResult.NOT_DETECTED
  Idx: 20  result: ScanResult.NOT_DETECTED
  Idx: 21  result: ScanResult.NOT_DETECTED
  Idx: 22  result: ScanResult.NOT_DETECTED
  Idx: 23  result: ScanResult.NOT_DETECTED
  Idx: 24  result: ScanResult.NOT_DETECTED
  Idx: 25  result: ScanResult.NOT_DETECTED

[INFO    ][2023-07-21 22:01:17,620] runVerifications() :: Verification run: 6 FULL DECREMENTAL
  Idx: 25  result: ScanResult.NOT_DETECTED
  Idx: 24  result: ScanResult.NOT_DETECTED
  Idx: 23  result: ScanResult.NOT_DETECTED
  Idx: 22  result: ScanResult.NOT_DETECTED
  Idx: 21  result: ScanResult.NOT_DETECTED
  Idx: 20  result: ScanResult.NOT_DETECTED
  Idx: 19  result: ScanResult.NOT_DETECTED
  Idx: 18  result: ScanResult.NOT_DETECTED
  Idx: 17  result: ScanResult.NOT_DETECTED
  Idx: 16  result: ScanResult.NOT_DETECTED
  Idx: 15  result: ScanResult.NOT_DETECTED
  Idx: 14  result: ScanResult.NOT_DETECTED
  Idx: 13  result: ScanResult.NOT_DETECTED
  Idx: 12  result: ScanResult.NOT_DETECTED
  Idx: 11  result: ScanResult.NOT_DETECTED
  Idx: 10  result: ScanResult.NOT_DETECTED
  Idx: 9  result: ScanResult.NOT_DETECTED
  Idx: 8  result: ScanResult.NOT_DETECTED
  Idx: 7  result: ScanResult.NOT_DETECTED
  Idx: 6  result: ScanResult.NOT_DETECTED
  Idx: 5  result: ScanResult.NOT_DETECTED
  Idx: 4  result: ScanResult.NOT_DETECTED
  Idx: 3  result: ScanResult.NOT_DETECTED
  Idx: 2  result: ScanResult.NOT_DETECTED
  Idx: 1  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED

[INFO    ][2023-07-21 22:01:17,621] runVerifications() :: Verification run: 7 MIDDLE8 ALL
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED

[INFO    ][2023-07-21 22:01:17,687] runVerifications() :: Verification run: 8 THIRDS4 ALL
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED
  Idx: 0  result: ScanResult.NOT_DETECTED
  result: ScanResult.NOT_SCANNED

[INFO    ][2023-07-21 22:01:17,687] runVerifications() :: Verification run: 9 FULL ALL
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED
  Idx: 0  result: ScanResult.NOT_DETECTED

[INFO    ][2023-07-21 22:01:17,687] saveToFile() :: Saving results to: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-07-21 22:01:17,688] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-07-21 22:01:17,707] getDotNetSections() :: Offset: 7680
[INFO    ][2023-07-21 22:01:17,818] saveToFile() :: Saving results to: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-07-21 22:01:17,818] outflankFile() :: Attempt to outflank the file
[INFO    ][2023-07-21 22:01:17,818] outflankDotnet() :: Outflank failed with attempted 0 patches
[INFO    ][2023-07-21 22:01:17,818] saveToFile() :: Saving results to: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-07-21 22:01:17,819] save() :: Saving HashCache (62388)
[INFO    ][2023-08-04 18:25:35,594] main() :: Using file: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-08-04 18:25:35,595] handleFile() :: Handle file: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-08-04 18:25:35,595] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-08-04 18:25:35,627] getDotNetSections() :: Offset: 7680
[WARNING ][2023-08-04 18:25:35,628] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-08-04 18:25:35,628] load() :: Loading HashCache
[INFO    ][2023-08-04 18:25:35,721] load() ::   77569 hashes loaded
[INFO    ][2023-08-04 18:25:35,722] save() :: Saving HashCache (77569)
[INFO    ][2023-08-04 18:25:35,799] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-08-04 18:25:35,818] getDotNetSections() :: Offset: 7680
[INFO    ][2023-08-04 18:25:36,064] init() :: DotnetData entries: 739
[INFO    ][2023-08-04 18:25:36,066] saveToFile() :: Saving results to: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-08-04 18:25:36,067] save() :: Saving HashCache (77569)
[INFO    ][2023-08-06 16:51:16,181] main() :: Using file: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-08-06 16:51:16,181] handleFile() :: Handle file: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-08-06 16:51:16,182] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-08-06 16:51:16,213] getDotNetSections() :: Offset: 7680
[WARNING ][2023-08-06 16:51:16,214] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-08-06 16:51:16,214] load() :: Loading HashCache
[INFO    ][2023-08-06 16:51:16,311] load() ::   77569 hashes loaded
[INFO    ][2023-08-06 16:51:16,311] save() :: Saving HashCache (77569)
[INFO    ][2023-08-06 16:51:16,389] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-08-06 16:51:16,408] getDotNetSections() :: Offset: 7680
[INFO    ][2023-08-06 16:51:16,652] init() :: DotnetData entries: 739
[INFO    ][2023-08-06 16:51:16,654] saveToFile() :: Saving results to: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-08-06 16:51:16,655] save() :: Saving HashCache (77569)
[INFO    ][2023-08-06 17:25:28,035] main() :: Using file: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-08-06 17:25:28,035] handleFile() :: Handle file: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-08-06 17:25:28,036] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-08-06 17:25:28,068] getDotNetSections() :: Offset: 7680
[WARNING ][2023-08-06 17:25:28,068] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-08-06 17:25:28,069] load() :: Loading HashCache
[INFO    ][2023-08-06 17:25:28,166] load() ::   77569 hashes loaded
[INFO    ][2023-08-06 17:25:28,166] save() :: Saving HashCache (77569)
[INFO    ][2023-08-06 17:25:28,245] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-08-06 17:25:28,265] getDotNetSections() :: Offset: 7680
[INFO    ][2023-08-06 17:25:28,507] init() :: DotnetData entries: 739
[INFO    ][2023-08-06 17:25:28,509] saveToFile() :: Saving results to: app/upload/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-08-06 17:25:28,510] save() :: Saving HashCache (77569)
[INFO    ][2023-09-01 05:26:44,474] main() :: Using file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-01 05:26:44,474] handleFile() :: Handle file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-01 05:26:44,483] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-09-01 05:26:44,514] getDotNetSections() :: Offset: 7680
[WARNING ][2023-09-01 05:26:44,515] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-09-01 05:26:44,515] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-01 05:26:44,516] load() :: Loading HashCache
[INFO    ][2023-09-01 05:26:44,612] load() ::   85943 hashes loaded
[INFO    ][2023-09-01 05:26:44,612] save() :: Saving HashCache (85943)
[INFO    ][2023-09-01 05:26:44,692] save() :: Saving HashCache (85943)
[INFO    ][2023-09-24 19:21:26,561] main() :: Using file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-24 19:21:26,561] handleFile() :: Handle file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-24 19:21:26,570] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-09-24 19:21:26,570] parseFile() :: FilePe: Parse File
[INFO    ][2023-09-24 19:21:26,574] parsePeSections() :: FilePe: Parse PE Sections
[INFO    ][2023-09-24 19:21:26,574] parsePeRegions() :: FilePe: Parse PE Regions
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 0 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 3 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 4 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 6 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 7 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 8 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 9 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 10 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 11 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 13 has address 0, skipping
[WARNING ][2023-09-24 19:21:26,574] parsePeRegions() :: Data Directory Section 15 has address 0, skipping
[INFO    ][2023-09-24 19:21:26,574] parseDotNetSections() :: FilePe: Parse DotNet Sections
[INFO    ][2023-09-24 19:21:26,602] parseDotNetRegions() :: FilePe: Parse DotNet Regions
[WARNING ][2023-09-24 19:21:26,621] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-09-24 19:21:26,622] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-24 19:21:26,622] load() :: Loading HashCache
[INFO    ][2023-09-24 19:21:26,751] load() ::   101712 hashes loaded
[INFO    ][2023-09-24 19:21:26,751] save() :: Saving HashCache (101712)
[INFO    ][2023-09-24 19:21:26,845] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-09-24 19:21:27,059] init() :: DotnetData entries: 739
[INFO    ][2023-09-24 19:21:27,061] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-24 19:21:27,061] save() :: Saving HashCache (101712)
[INFO    ][2023-09-25 18:14:44,001] main() :: Using file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-25 18:14:44,002] handleFile() :: Handle file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-25 18:14:44,002] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-09-25 18:14:44,002] parseFile() :: FilePe: Parse File
[INFO    ][2023-09-25 18:14:44,006] parsePeSections() :: FilePe: Parse PE Sections
[INFO    ][2023-09-25 18:14:44,006] parsePeRegions() :: FilePe: Parse PE Regions
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 0 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 3 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 4 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 6 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 7 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 8 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 9 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 10 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 11 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 13 has address 0, skipping
[WARNING ][2023-09-25 18:14:44,006] parsePeRegions() :: Data Directory Section 15 has address 0, skipping
[INFO    ][2023-09-25 18:14:44,006] parseDotNetSections() :: FilePe: Parse DotNet Sections
[INFO    ][2023-09-25 18:14:44,025] parseDotNetRegions() :: FilePe: Parse DotNet Regions
[WARNING ][2023-09-25 18:14:44,051] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-09-25 18:14:44,052] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-25 18:14:44,052] load() :: Loading HashCache
[INFO    ][2023-09-25 18:14:44,177] load() ::   101712 hashes loaded
[INFO    ][2023-09-25 18:14:44,178] save() :: Saving HashCache (101712)
[INFO    ][2023-09-25 18:14:44,275] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-09-25 18:14:44,499] init() :: DotnetData entries: 739
[INFO    ][2023-09-25 18:14:44,501] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-25 18:14:44,502] save() :: Saving HashCache (101712)
[INFO    ][2023-09-25 18:21:45,748] main() :: Using file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-25 18:21:45,749] handleFile() :: Handle file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-25 18:21:45,749] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-09-25 18:21:45,749] parseFile() :: FilePe: Parse File
[INFO    ][2023-09-25 18:21:45,752] parsePeSections() :: FilePe: Parse PE Sections
[INFO    ][2023-09-25 18:21:45,752] parsePeRegions() :: FilePe: Parse PE Regions
[WARNING ][2023-09-25 18:21:45,752] parsePeRegions() :: Data Directory Section 0 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,752] parsePeRegions() :: Data Directory Section 3 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,752] parsePeRegions() :: Data Directory Section 4 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,753] parsePeRegions() :: Data Directory Section 6 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,753] parsePeRegions() :: Data Directory Section 7 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,753] parsePeRegions() :: Data Directory Section 8 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,753] parsePeRegions() :: Data Directory Section 9 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,753] parsePeRegions() :: Data Directory Section 10 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,753] parsePeRegions() :: Data Directory Section 11 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,753] parsePeRegions() :: Data Directory Section 13 has address 0, skipping
[WARNING ][2023-09-25 18:21:45,753] parsePeRegions() :: Data Directory Section 15 has address 0, skipping
[INFO    ][2023-09-25 18:21:45,753] parseDotNetSections() :: FilePe: Parse DotNet Sections
[INFO    ][2023-09-25 18:21:45,772] parseDotNetRegions() :: FilePe: Parse DotNet Regions
[WARNING ][2023-09-25 18:21:45,798] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-09-25 18:21:45,799] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-25 18:21:45,799] load() :: Loading HashCache
[INFO    ][2023-09-25 18:21:45,925] load() ::   101712 hashes loaded
[INFO    ][2023-09-25 18:21:45,925] save() :: Saving HashCache (101712)
[INFO    ][2023-09-25 18:21:46,019] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-09-25 18:21:46,240] init() :: DotnetData entries: 739
[INFO    ][2023-09-25 18:21:46,242] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-25 18:21:46,242] save() :: Saving HashCache (101712)
[INFO    ][2023-09-29 10:07:19,559] main() :: Using file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-29 10:07:19,559] handleFile() :: Handle file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-29 10:07:19,560] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-09-29 10:07:19,560] parseFile() :: FilePe: Parse File
[INFO    ][2023-09-29 10:07:19,563] parsePeSections() :: FilePe: Parse PE Sections
[INFO    ][2023-09-29 10:07:19,563] parsePeRegions() :: FilePe: Parse PE Regions
[WARNING ][2023-09-29 10:07:19,563] parsePeRegions() :: Data Directory Section 0 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,563] parsePeRegions() :: Data Directory Section 3 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,563] parsePeRegions() :: Data Directory Section 4 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,563] parsePeRegions() :: Data Directory Section 6 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,563] parsePeRegions() :: Data Directory Section 7 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,563] parsePeRegions() :: Data Directory Section 8 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,563] parsePeRegions() :: Data Directory Section 9 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,564] parsePeRegions() :: Data Directory Section 10 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,564] parsePeRegions() :: Data Directory Section 11 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,564] parsePeRegions() :: Data Directory Section 13 has address 0, skipping
[WARNING ][2023-09-29 10:07:19,564] parsePeRegions() :: Data Directory Section 15 has address 0, skipping
[INFO    ][2023-09-29 10:07:19,564] parseDotNetSections() :: FilePe: Parse DotNet Sections
[WARNING ][2023-09-29 10:07:19,583] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-09-29 10:07:19,584] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-29 10:07:19,584] load() :: Loading HashCache
[INFO    ][2023-09-29 10:07:19,718] load() ::   102070 hashes loaded
[INFO    ][2023-09-29 10:07:19,718] save() :: Saving HashCache (102070)
[INFO    ][2023-09-29 10:07:19,814] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-09-29 10:07:20,036] init() :: DotnetData entries: 739
[INFO    ][2023-09-29 10:07:20,038] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-29 10:07:20,038] save() :: Saving HashCache (102070)
[INFO    ][2023-09-29 12:11:52,926] main() :: Using file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-29 12:11:52,926] handleFile() :: Handle file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-29 12:11:52,927] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-09-29 12:11:52,927] parseFile() :: FilePe: Parse File
[INFO    ][2023-09-29 12:11:52,930] parsePeSections() :: FilePe: Parse PE Sections
[INFO    ][2023-09-29 12:11:52,930] parsePeRegions() :: FilePe: Parse PE Regions
[WARNING ][2023-09-29 12:11:52,930] parsePeRegions() :: Data Directory Section 0 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,930] parsePeRegions() :: Data Directory Section 3 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,930] parsePeRegions() :: Data Directory Section 4 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,930] parsePeRegions() :: Data Directory Section 6 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,931] parsePeRegions() :: Data Directory Section 7 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,931] parsePeRegions() :: Data Directory Section 8 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,931] parsePeRegions() :: Data Directory Section 9 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,931] parsePeRegions() :: Data Directory Section 10 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,931] parsePeRegions() :: Data Directory Section 11 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,931] parsePeRegions() :: Data Directory Section 13 has address 0, skipping
[WARNING ][2023-09-29 12:11:52,931] parsePeRegions() :: Data Directory Section 15 has address 0, skipping
[INFO    ][2023-09-29 12:11:52,931] parseDotNetSections() :: FilePe: Parse DotNet Sections
[WARNING ][2023-09-29 12:11:52,950] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-09-29 12:11:52,951] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-29 12:11:52,951] load() :: Loading HashCache
[INFO    ][2023-09-29 12:11:53,087] load() ::   102070 hashes loaded
[INFO    ][2023-09-29 12:11:53,087] save() :: Saving HashCache (102070)
[INFO    ][2023-09-29 12:11:53,185] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-09-29 12:11:53,406] init() :: DotnetData entries: 739
[INFO    ][2023-09-29 12:11:53,408] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-29 12:11:53,409] save() :: Saving HashCache (102070)
[INFO    ][2023-09-30 10:32:47,635] main() :: Using file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-30 10:32:47,636] handleFile() :: Handle file: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe
[INFO    ][2023-09-30 10:32:47,636] handleFile() :: Using parser for file type DOTNET
[INFO    ][2023-09-30 10:32:47,637] parseFile() :: FilePe: Parse File
[INFO    ][2023-09-30 10:32:47,639] parsePeSections() :: FilePe: Parse PE Sections
[INFO    ][2023-09-30 10:32:47,640] parsePeRegions() :: FilePe: Parse PE Regions
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 0 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 3 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 4 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 6 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 7 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 8 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 9 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 10 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 11 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 13 has address 0, skipping
[WARNING ][2023-09-30 10:32:47,640] parsePeRegions() :: Data Directory Section 15 has address 0, skipping
[INFO    ][2023-09-30 10:32:47,640] parseDotNetSections() :: FilePe: Parse DotNet Sections
[WARNING ][2023-09-30 10:32:47,660] handleFile() :: Using scanner as defined in outcome: avg
[INFO    ][2023-09-30 10:32:47,660] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-30 10:32:47,661] load() :: Loading HashCache
[INFO    ][2023-09-30 10:32:47,795] load() ::   102072 hashes loaded
[INFO    ][2023-09-30 10:32:47,795] save() :: Saving HashCache (102072)
[INFO    ][2023-09-30 10:32:47,892] augmentFile() :: Perform augmentation of matches
[INFO    ][2023-09-30 10:32:48,114] init() :: DotnetData entries: 739
[INFO    ][2023-09-30 10:32:48,116] saveToFile() :: Saving results to: app/examples/5A67B4365B569C43.SharpUp.exe.avg.exe.outcome
[INFO    ][2023-09-30 10:32:48,116] save() :: Saving HashCache (102072)

File 5A67B4365B569C43.SharpUp.exe.avg.exe

Matches

Match 0: 11985 (size: 10)

Info

Hexdump

Match 1: 12000 (size: 36)

Info

Hexdump

Match 2: 12914 (size: 5)

Info

Hexdump

Disassembly

Match 3: 12924 (size: 21)

Info

Hexdump

Disassembly

Match 4: 13379 (size: 11)

Info

Hexdump

Disassembly

Match 5: 14263 (size: 8)

Info

Hexdump

Disassembly

Match 6: 14305 (size: 10)

Info

Hexdump

Disassembly

Match 7: 15193 (size: 8)

Info

Hexdump

Disassembly

Match 13: 19600 (size: 6)

Info

Hexdump

Match 14: 21221 (size: 6)

Info

Hexdump

Match 22: 22900 (size: 12)

Info

Hexdump

Match 23: 34552 (size: 18)

Info

Hexdump

Match 24: 34700 (size: 9)

Info

Hexdump

Match 25: 36208 (size: 9)

Info

Hexdump

Explanation

Colors

Match Order

Position