877d65755a4d7a655c1c8e7d1f2fbeb18ba76fb04385f210f24338f96083b458

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jul-17 10:12:16
Debug artifacts D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
CompanyName SupermarketPOS
FileDescription SupermarketPOS
FileVersion 1.0.0.0
InternalName SupermarketPOS.dll
LegalCopyright
OriginalFilename SupermarketPOS.dll
ProductName SupermarketPOS
ProductVersion 1.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • go.microsoft.com
  • https://aka.ms
  • https://go.microsoft.com
  • https://go.microsoft.com/fwlink/?linkid
  • microsoft.com
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryA
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Can access the registry:
  • RegOpenKeyExW
  • RegGetValueW
  • RegCloseKey
 Possibly launches other programs:
  • ShellExecuteW
Safe VirusTotal score: 0/71 (Scanned on 2026-10-16 09:45:03) All the AVs think this file is safe.

Hashes

MD5 c7656ac0a50f976307c6c442081fdf61 🔍
SHA1 b98dec7b00f93e40b4eb4bf67d6abad08bfbc939 🔍
SHA256 877d65755a4d7a655c1c8e7d1f2fbeb18ba76fb04385f210f24338f96083b458 🔍
SHA3 296da10f4275a7d58592255f0c6d3b0c8a79cfe7e44e0ba018230805c1306f71 🔍
SSDeep 3072:AqeXA/4yIg9vkNPNu6H6xCYOiEUE2657JA:AvgvkNFNaxm0EbJ 🔍
Imports Hash bb3ac2c21e02c68abcad237dc3fa6d00 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jul-17 10:12:16
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x16400
SizeOfInitializedData 0xf800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000011AD0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x180000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 bd8169b934831f0d7c307541e15d253d 🔍
SHA1 7e23ea546068ff285112721e96d3ecbcf6e3ef7c 🔍
SHA256 fda83b7bc7753790cdb67b0cfc6cbd3ae7ae6d51e0303b1a18245142bdb4be85 🔍
SHA3 b03811287b26f9b48755371e7cded6fd71ffb50b7c7c601dfc05e45ab76d6aa2 🔍
VirtualSize 0x1629c
VirtualAddress 0x1000
SizeOfRawData 0x16400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.34558

.rdata

MD5 36a098c61cc46b6d2266424f7e582e85 🔍
SHA1 2eb3fdf9c55488cfc79af9293cbc700abc92c8e4 🔍
SHA256 2d23cc6d7b82d7325372ec26e945fd4748a08f7024a104077c7d694cdf461bfb 🔍
SHA3 6a22d5b5a4d6328020ce7df99eea50901591f14455d2f4a84fd76821d8b380f4 🔍
VirtualSize 0xbd1e
VirtualAddress 0x18000
SizeOfRawData 0xbe00
PointerToRawData 0x16800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.83613

.data

MD5 9a761c63f02d43863f5fefac88c5c6dc 🔍
SHA1 5782376c75e6c1fd8f5f1972aa840ed3340f7ab6 🔍
SHA256 c3ce93d4270a783dabcd7ef8984ac1da5e355de08d69befcd3686bb79d6d2d61 🔍
SHA3 7aae07cce6ae00653e5471d7055a6d4e5952d52e6ce2bf53058e4404f0292a0e 🔍
VirtualSize 0x1838
VirtualAddress 0x24000
SizeOfRawData 0xa00
PointerToRawData 0x22600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.39605

.pdata

MD5 837cf48bc20406f18cd363be8c3165c1 🔍
SHA1 6fd2ba564659c7a99523601241bd84a8e1c1df97 🔍
SHA256 8ec64d1641e6c662f6c059f8dd795fb6576f7e2578ef7b24bb02b1473260e3fe 🔍
SHA3 5d5ee6c8b0655201e420c7105a304733c76bb76757b33777aca844a8514a4c81 🔍
VirtualSize 0x141c
VirtualAddress 0x26000
SizeOfRawData 0x1600
PointerToRawData 0x23000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.85413

.reloc

MD5 37812f81534460a128d06d0d29b2cb00 🔍
SHA1 8dcae4bb04c6e5e5d5a68d9e1d0bdc85c923ad95 🔍
SHA256 7d1932eae9901ec74760eb2c44a2df4a20f3a8bfb1a595db5dd20e43af7c73cf 🔍
SHA3 fa934fd7324404a9d4dd0c78dee6a4cbae71cf80f9cf2820ab6a74fe3716a019 🔍
VirtualSize 0x338
VirtualAddress 0x28000
SizeOfRawData 0x400
PointerToRawData 0x24600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.80573

.rsrc

MD5 e8728ee578c2b4449662af39c216dded 🔍
SHA1 12dba7740db00631bf2a66d96ab8b7683d1b018d 🔍
SHA256 ee0dee6511f611678b2b7e96a9476f9749d5ebdb714c7a1814e5ae54c0e51259 🔍
SHA3 53a1dbf12cfd0386eca1fbf759e29c5c08a59ba7a72eb1564b7c623b91233d5c 🔍
VirtualSize 0x588
VirtualAddress 0x29000
SizeOfRawData 0x600
PointerToRawData 0x24a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.07577

Imports

KERNEL32.dll FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
USER32.dll MessageBoxW
SHELL32.dll ShellExecuteW
ADVAPI32.dll RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0.dll _invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0.dll calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0.dll wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0.dll wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0.dll wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0.dll ___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0.dll __setusermatherr

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23069
MD5 3d3e4905332ba91743503cde100dda12 🔍
SHA1 45379bab8f556e8a9ac9c96e4b365eb0e4ed3fac 🔍
SHA256 7e8b5cecd08429b095101bf25b073dd9135cb2d8989724683510138c9c2e4518 🔍
SHA3 d0a225b7f6faf517b24a0e5a59c42845f279bfd63d01abc9e207c41cd91b2b0a 🔍

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9 🔍
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734 🔍
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName SupermarketPOS
FileDescription SupermarketPOS
FileVersion (#2) 1.0.0.0
InternalName SupermarketPOS.dll
LegalCopyright
OriginalFilename SupermarketPOS.dll
ProductName SupermarketPOS
ProductVersion (#2) 1.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jul-17 21:40:39
Version 0.0
SizeofData 109
AddressOfRawData 0x2079c
PointerToRawData 0x1ef9c
Referenced File D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Jul-17 21:40:39
Version 0.0
SizeofData 20
AddressOfRawData 0x2080c
PointerToRawData 0x1f00c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jul-17 21:40:39
Version 0.0
SizeofData 988
AddressOfRawData 0x20820
PointerToRawData 0x1f020

TLS Callbacks

StartAddressOfRawData 0x140020c48
EndAddressOfRawData 0x140020c58
AddressOfIndex 0x140025820
AddressOfCallbacks 0x1400184f0
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140024080
GuardCFCheckFunctionPointer 5368808480
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x55c5a4c0
Unmarked objects 0
ASM objects (35207) 10
C objects (35207) 12
C++ objects (35207) 87
Imports (VS2008 SP1 build 30729) 16
Imports (33145) 9
Total imports 204
C++ objects (LTCG) (35223) 10
Linker (35223) 1

Errors

Leave a comment

No comments yet.