.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ---- -------------.
! WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV !
`-------------- - --- ---------- -------- -------- -------- -------- ----------------- - ---- ---- --'
ATM MALWARE NOTICE
5c838658b25d44edab79a4bd2af7c56bef96768b93addbbaaaea36da604fca62
Date...........: 2017-03-14
Family.........: Atmosphere
File name......: ZFS.DLL
File size......: 40.00 KB
Type file......: DLL/Windows
Virscan........: VT - HA
Documentation..: https://www.symantec.com/security-center/writeup/2017-050414-0706-99
Entropy:
Binary Histogram:
=== PEDUMP REPORT ===
=== MZ Header ===
signature: "MZ"
bytes_in_last_block: 144 0x90
blocks_in_file: 3 3
num_relocs: 0 0
header_paragraphs: 4 4
min_extra_paragraphs: 0 0
max_extra_paragraphs: 65535 0xffff
ss: 0 0
sp: 184 0xb8
checksum: 0 0
ip: 0 0
cs: 0 0
reloc_table_offset: 64 0x40
overlay_number: 0 0
reserved0: 0 0
oem_id: 0 0
oem_info: 0 0
reserved2: 0 0
reserved3: 0 0
reserved4: 0 0
reserved5: 0 0
reserved6: 0 0
lfanew: 240 0xf0
=== DOS STUB ===
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
=== RICH Header ===
LIB_ID VERSION TIMES_USED
0 0 0 0 4 4
19 13 8034 1f62 2 2
14 e 7299 1c83 1 1
10 a 8168 1fe8 4 4
1 1 0 0 69 45
11 b 8168 1fe8 7 7
6 6 1720 6b8 1 1
4 4 8168 1fe8 8 8
=== PE Header ===
signature: "PE\x00\x00"
# IMAGE_FILE_HEADER:
Machine: 332 0x14c x86
NumberOfSections: 5 5
TimeDateStamp: "2017-01-19 14:16:56"
PointerToSymbolTable: 0 0
NumberOfSymbols: 0 0
SizeOfOptionalHeader: 224 0xe0
Characteristics: 8462 0x210e EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
# IMAGE_OPTIONAL_HEADER32:
Magic: 267 0x10b 32-bit executable
LinkerVersion: 6.0
SizeOfCode: 16384 0x4000
SizeOfInitializedData: 20480 0x5000
SizeOfUninitializedData: 0 0
AddressOfEntryPoint: 14907 0x3a3b
BaseOfCode: 4096 0x1000
BaseOfData: 20480 0x5000
ImageBase: 38141952 0x2460000
SectionAlignment: 4096 0x1000
FileAlignment: 4096 0x1000
OperatingSystemVersion: 4.0
ImageVersion: 0.0
SubsystemVersion: 4.0
Reserved1: 0 0
SizeOfImage: 40960 0xa000
SizeOfHeaders: 4096 0x1000
CheckSum: 0 0
Subsystem: 2 2 WINDOWS_GUI
DllCharacteristics: 0 0
SizeOfStackReserve: 1048576 0x100000
SizeOfStackCommit: 4096 0x1000
SizeOfHeapReserve: 1048576 0x100000
SizeOfHeapCommit: 4096 0x1000
LoaderFlags: 0 0
NumberOfRvaAndSizes: 16 0x10
=== DATA DIRECTORY ===
EXPORT rva:0x 6140 size:0x 30
IMPORT rva:0x 5d78 size:0x 78
RESOURCE rva:0x 8000 size:0x 330
EXCEPTION rva:0x 0 size:0x 0
SECURITY rva:0x 0 size:0x 0
BASERELOC rva:0x 9000 size:0x 558
DEBUG rva:0x 0 size:0x 0
ARCHITECTURE rva:0x 0 size:0x 0
GLOBALPTR rva:0x 0 size:0x 0
TLS rva:0x 0 size:0x 0
LOAD_CONFIG rva:0x 0 size:0x 0
Bound_IAT rva:0x 0 size:0x 0
IAT rva:0x 5000 size:0x 130
Delay_IAT rva:0x 0 size:0x 0
CLR_Header rva:0x 0 size:0x 0
rva:0x 0 size:0x 0
=== SECTIONS ===
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
.text 1000 3026 4000 1000 0 0 0 0 60000020 R-X CODE
.rdata 5000 1170 2000 5000 0 0 0 0 40000040 R-- IDATA
.data 7000 874 1000 7000 0 0 0 0 c0000040 RW- IDATA
.rsrc 8000 330 1000 8000 0 0 0 0 40000040 R-- IDATA
.reloc 9000 600 1000 9000 0 0 0 0 42000040 R-- IDATA DISCARDABLE
=== RESOURCES ===
FILE_OFFSET CP LANG SIZE TYPE NAME
0x8060 0 0x409 720 VERSION #1
=== IMPORTS ===
MODULE_NAME HINT ORD FUNCTION_NAME
MFC42.DLL 219
MFC42.DLL e4f
MFC42.DLL 339
MFC42.DLL 337
MFC42.DLL 35a
MFC42.DLL 35c
MFC42.DLL 3ad
MFC42.DLL 299
MFC42.DLL 7bb
MFC42.DLL 18f1
MFC42.DLL 1442
MFC42.DLL 162
MFC42.DLL 4e5
MFC42.DLL 156
MFC42.DLL 4b0
MFC42.DLL 49e
MFC42.DLL 21c
MFC42.DLL 18fa
MFC42.DLL 1540
MFC42.DLL 18ef
MFC42.DLL 3ab
MFC42.DLL b02
MFC42.DLL 19f8
MFC42.DLL acc
MFC42.DLL 31e
MFC42.DLL 7cd
MFC42.DLL 1548
MFC42.DLL cf6
MFC42.DLL 144a
MFC42.DLL 215
MFC42.DLL 990
MFC42.DLL 16ca
MFC42.DLL 7fc
MFC42.DLL b63
MFC42.DLL 15c4
MFC42.DLL 1633
MFC42.DLL 10b6
MFC42.DLL 217
MFC42.DLL 320
MFC42.DLL 154a
MFC42.DLL 490
MSVCRT.dll 25e free
MSVCRT.dll 10f _initterm
MSVCRT.dll 291 malloc
MSVCRT.dll 9d _adjust_fdiv
MSVCRT.dll 297 memcpy
MSVCRT.dll e ??1type_info@@UAE@XZ
MSVCRT.dll 2be strlen
MSVCRT.dll 23d atoi
MSVCRT.dll 2db vprintf
MSVCRT.dll 1e1 _vsnprintf
MSVCRT.dll 42 _EH_prolog
MSVCRT.dll 49 __CxxFrameHandler
MSVCRT.dll 186 _onexit
MSVCRT.dll 55 __dllonexit
MSVCRT.dll 192 _purecall
MSVCRT.dll 41 _CxxThrowException
MSVCRT.dll 299 memset
KERNEL32.dll 124 GetModuleFileNameA
KERNEL32.dll 296 Sleep
KERNEL32.dll 13e GetProcAddress
KERNEL32.dll 1c2 LoadLibraryA
KERNEL32.dll 4a CreateThread
KERNEL32.dll 57 DeleteFileA
KERNEL32.dll 29f TerminateThread
MSVCP60.dll a5 ??0_Winit@std@@QAE@XZ
MSVCP60.dll 109 ??1Init@ios_base@std@@QAE@XZ
MSVCP60.dll 9e ??0Init@ios_base@std@@QAE@XZ
MSVCP60.dll 10d ??1_Winit@std@@QAE@XZ
SHLWAPI.dll b PathAppendA
SHLWAPI.dll 1b PathFileExistsA
=== EXPORTS ===
# module "ZFS.dll"
# flags=0x0 ts="2017-01-19 14:16:56" version=0.0 ord_base=1
# nFuncs=0 nNames=0
=== VERSION INFO ===
# VS_FIXEDFILEINFO:
FileVersion : 1.0.0.1
ProductVersion : 1.0.0.1
StrucVersion : 0x10000
FileFlagsMask : 0x3f
FileFlags : 0
FileOS : 4
FileType : 2
FileSubtype : 0
# StringTable 040904B0:
CompanyName : ""
FileDescription : "ZFS DLL"
FileVersion : "1, 0, 0, 1"
InternalName : "ZFS"
LegalCopyright : "Copyright (C) 2016"
LegalTrademarks : ""
OriginalFilename : "ZFS.DLL"
ProductName : "ZFS Dynamic Link Library"
ProductVersion : "1, 0, 0, 1"
VarFileInfo : [ 0x409, 0x4b0 ]
=== Packer / Compiler ===
MS Visual C++ 6.0 DLL
File pos Mem pos ID Text
======== ======= == ====
00000000004D 00000246004D 0 !This program cannot be run in DOS mode.
0000000001E8 0000024601E8 0 .text
000000000210 000002460210 0 .rdata
000000000237 000002460237 0 @.data
000000000260 000002460260 0 .rsrc
000000000287 000002460287 0 @.reloc
0000000018D6 0000024618D6 0 @ PQF
000000001BA6 000002461BA6 0 WWhxrF
000000001C1B 000002461C1B 0 tMWh@xF
000000001C5E 000002461C5E 0 YWh@xF
00000000247E 00000246247E 0 HtlHtTHt5Ht
0000000024C2 0000024624C2 0 Ph\sF
0000000024E5 0000024624E5 0 PhDsF
000000002C9B 000002462C9B 0 QSUVW
000000002D12 000002462D12 0 QSUVW3
000000003061 000002463061 0 t2HHt%+
0000000030DA 0000024630DA 0 PhDwF
0000000030EC 0000024630EC 0 Ph$wF
000000003A68 000002463A68 0 t WVS
000000003A95 000002463A95 0 u7WPS
000000003AA6 000002463AA6 0 u&WVS
000000005F20 000002465F20 0 MFC42.DLL
000000005F2C 000002465F2C 0 __CxxFrameHandler
000000005F40 000002465F40 0 _EH_prolog
000000005F4E 000002465F4E 0 _vsnprintf
000000005F5C 000002465F5C 0 vprintf
000000005F6E 000002465F6E 0 strlen
000000005F78 000002465F78 0 _CxxThrowException
000000005F8E 000002465F8E 0 memcpy
000000005F98 000002465F98 0 memset
000000005FA2 000002465FA2 0 _purecall
000000005FAE 000002465FAE 0 __dllonexit
000000005FBC 000002465FBC 0 _onexit
000000005FC4 000002465FC4 0 MSVCRT.dll
000000005FD2 000002465FD2 0 ??1type_info@@UAE@XZ
000000005FF2 000002465FF2 0 _initterm
000000005FFE 000002465FFE 0 malloc
000000006008 000002466008 0 _adjust_fdiv
000000006018 000002466018 0 GetModuleFileNameA
00000000602E 00000246602E 0 TerminateThread
000000006040 000002466040 0 Sleep
000000006048 000002466048 0 GetProcAddress
00000000605A 00000246605A 0 LoadLibraryA
00000000606A 00000246606A 0 CreateThread
00000000607A 00000246607A 0 DeleteFileA
000000006086 000002466086 0 KERNEL32.dll
000000006096 000002466096 0 ??0Init@ios_base@std@@QAE@XZ
0000000060B6 0000024660B6 0 ??1Init@ios_base@std@@QAE@XZ
0000000060D6 0000024660D6 0 ??0_Winit@std@@QAE@XZ
0000000060EE 0000024660EE 0 ??1_Winit@std@@QAE@XZ
000000006104 000002466104 0 MSVCP60.dll
000000006112 000002466112 0 PathFileExistsA
000000006124 000002466124 0 PathAppendA
000000006130 000002466130 0 SHLWAPI.dll
000000006168 000002466168 0 ZFS.dll
00000000703C 00000246703C 0 Unload func called.
000000007050 000002467050 0 command file found
000000007070 000002467070 0 .?AVFileNotFoundException@@
00000000708C 00000246708C 0 Main dll, Can't process command.
0000000070B0 0000024670B0 0 Command file not found. Some shit happened, dude.
File pos Mem pos ID Text
======== ======= == ====
0000000070E2 0000024670E2 0 Smativay udochki!!!
0000000070F8 0000024670F8 0 Begin processing command.
000000007114 000002467114 0 log.txt
00000000711C 00000246711C 0 Logger is now on new TraceLevel: %s
000000007140 000002467140 0 UNKNOWN
00000000714C 00000246714C 0 TRACE
000000007154 000002467154 0 NOTICE
00000000715C 00000246715C 0 WARNING
000000007164 000002467164 0 ERROR
00000000716C 00000246716C 0 FATAL
000000007178 000002467178 0 Can't init XFS
000000007188 000002467188 0 msxfs.dll
000000007194 000002467194 0 Xfs init into dll
0000000071B0 0000024671B0 0 .?AVObject@System@@
0000000071D0 0000024671D0 0 .?AVException@System@CUniFramework@@
000000007200 000002467200 0 .?AVXfsException@@
000000007214 000002467214 0 WFSOpen
00000000721C 00000246721C 0 WFSStartUp
000000007228 000002467228 0 WFSFreeResult
000000007238 000002467238 0 WFSExecute
000000007244 000002467244 0 WFSGetInfo
000000007250 000002467250 0 Can't load xfs module.
000000007268 000002467268 0 System::Object
000000007278 000002467278 0 cant init ext mod
00000000728C 00000246728C 0 CommandProcessor created
0000000072B0 0000024672B0 0 .?AVXfsDispenseException@@
0000000072CC 0000024672CC 0 Trying to receive balance.
0000000072E8 0000024672E8 0 Can't dispense, Error code is: %d
00000000730C 00000246730C 0 Trying t dispense from CU %d
00000000732C 00000246732C 0 Processing dispense.
000000007344 000002467344 0 Setting device Id to %d
00000000735C 00000246735C 0 CDM HSERVICE is: %d
000000007374 000002467374 0 Unloading.
000000007380 000002467380 0 Received command "None". Is it really possible?
0000000073B0 0000024673B0 0 Begin process command.
0000000073C8 0000024673C8 0 XFS-> dispense end
0000000073DC 0000024673DC 0 Dispense, dispense device is %d
0000000073FC 0000024673FC 0 Currency ID: %s
00000000740C 00000246740C 0 XFS-> dispense start
000000007430 000002467430 0 .?AVXfsGetInfoException@@
00000000744C 00000246744C 0 Cash info-> unhandled exception.
000000007470 000002467470 0 %d dispenser id is invalid.
00000000748C 00000246748C 0 Valid CDM id is %d, dispense cash info received.
0000000074C0 0000024674C0 0 ICommandProcessor-> else block. Getting XFS-cash info
0000000074F8 0000024674F8 0 ICommandProcessor-> else block. get disp ID
000000007524 000002467524 0 ICommandProcessor-> else block.
000000007544 000002467544 0 %d dispenser id is invalid.
000000007560 000002467560 0 Xfs error code is %d
000000007578 000002467578 0 Trying auto determine CDM device id.
0000000075A0 0000024675A0 0 ICommandProcessor-> if-statement.
0000000075C4 0000024675C4 0 ICommandProcessor-> enter try block.
0000000075EC 0000024675EC 0 XFS-> before return result List<WFSCDMCASHUNIT>
00000000761C 00000246761C 0 XFS-> found info about %d cash units
000000007644 000002467644 0 Received cash info:
000000007658 000002467658 0 ========== %d =========
000000007671 000002467671 0 CU state: %d Type: %d
000000007689 000002467689 0 Values: %d
000000007695 000002467695 0 Currency ID:%s
0000000076A5 0000024676A5 0 Money count: %d
0000000076B8 0000024676B8 0 Begin format %d CU
File pos Mem pos ID Text
======== ======= == ====
0000000076CC 0000024676CC 0 -command file name is %s
0000000076E8 0000024676E8 0 Command provider created
000000007704 000002467704 0 Found command code: %d command.
000000007724 000002467724 0 COM-Provider->dispense count %d
000000007744 000002467744 0 COM-Provider->Cassete number %d
000000007764 000002467764 0 Unknown command abbreviature %s
000000007788 000002467788 0 found %d command lines
0000000077A0 0000024677A0 0 command file removed
0000000077B8 0000024677B8 0 Command file name is: %s
0000000077E0 0000024677E0 0 .?AVIOException@@
000000007808 000002467808 0 .?AVtype_info@@
000000009008 000002469008 0 1070<0H0N0]0c0h0t0z0
000000009021 000002469021 0 1C1}1
000000009039 000002469039 0 2\2r2x2
00000000904B 00000246904B 0 243G3M3b3
000000009081 000002469081 0 6.646:6L6[6
000000009095 000002469095 0 7&737:7@7V7r7
0000000090A7 0000024690A7 0 788>8
0000000090B3 0000024690B3 0 909_9y9
0000000090D5 0000024690D5 0 :A:M:]:j:o:w:
0000000090F3 0000024690F3 0 ;2;Z;n;y;
00000000910B 00000246910B 0 <4<:<F<a<
000000009121 000002469121 0 =2>C>
000000009149 000002469149 0 434[4
00000000915B 00000246915B 0 5D5T5\5
00000000916B 00000246916B 0 757=7g7x7
00000000917F 00000246917F 0 8$8C8Z8
0000000091CB 0000024691CB 0 >+>1>9>\>b>
00000000921B 00000246921B 0 4&414W4
000000009239 000002469239 0 8"8(8.848:8@8F8L8R8X8
00000000924F 00000246924F 0 8d8j8p8v8|8
00000000928D 00000246928D 0 9D9R9t9z9
0000000092B7 0000024692B7 0 :(:.:P:b:
0000000092C9 0000024692C9 0 ;@;U;i;
0000000092D5 0000024692D5 0 ;8<P<e<y<
0000000092EB 0000024692EB 0 =1=E=Y=
0000000092F9 0000024692F9 0 ><>Q>e>
000000009305 000002469305 0 >@?l?
000000009328 000002469328 0 014181<1@1D1H1L1P1T1X1\1
000000009341 000002469341 0 1d1h1l1p1t1x1|1
00000000939F 00000246939F 0 2 2(2@2T2d2h2x2
0000000093BF 0000024693BF 0 3$30383L3\3
0000000093DF 0000024693DF 0 4$4,444<4D4L4X4t4|4
000000009403 000002469403 0 5 5<5H5d5p5x5
00000000941F 00000246941F 0 6$6(6,646<6H6d6p6x6
00000000943F 00000246943F 0 7 7<7D7P7X7l7t7|7
000000009467 000002469467 0 8$808L8X8
000000009471 000002469471 0 8t8|8
000000009487 000002469487 0 9,949H9T9X9\9
000000009495 000002469495 0 9l9t9
0000000094AD 0000024694AD 0 :,:4:<:H:d:p:
0000000094CD 0000024694CD 0 ;$;,;4;<;D;L;X;t;|;
0000000094FB 0000024694FB 0 <$<(<,<4<<<D<L<X<t<|<
00000000951F 00000246951F 0 =$=0=L=X=t=
000000009541 000002469541 0 0 00040h0
000000008066 000002468066 0 VS_VERSION_INFO
0000000080C2 0000024680C2 0 StringFileInfo
0000000080E6 0000024680E6 0 040904B0
0000000080FE 0000024680FE 0 CompanyName
00000000811E 00000246811E 0 FileDescription
File pos Mem pos ID Text
======== ======= == ====
000000008140 000002468140 0 ZFS DLL
000000008156 000002468156 0 FileVersion
000000008170 000002468170 0 1, 0, 0, 1
00000000818E 00000246818E 0 InternalName
0000000081B6 0000024681B6 0 LegalCopyright
0000000081D4 0000024681D4 0 Copyright (C) 2016
000000008202 000002468202 0 LegalTrademarks
00000000822A 00000246822A 0 OriginalFilename
00000000824C 00000246824C 0 ZFS.DLL
000000008262 000002468262 0 ProductName
00000000827C 00000246827C 0 ZFS Dynamic Link Library
0000000082B6 0000024682B6 0 ProductVersion
0000000082D4 0000024682D4 0 1, 0, 0, 1
0000000082F2 0000024682F2 0 VarFileInfo
000000008312 000002468312 0 Translation
00000000004D 00000246004D 0 !This program cannot be run in DOS mode.
0000000001E8 0000024601E8 0 .text
000000000210 000002460210 0 .rdata
000000000237 000002460237 0 @.data
000000000260 000002460260 0 .rsrc
000000000287 000002460287 0 @.reloc
0000000018D6 0000024618D6 0 @ PQF
000000001BA6 000002461BA6 0 WWhxrF
000000001C1B 000002461C1B 0 tMWh@xF
000000001C5E 000002461C5E 0 YWh@xF
00000000247E 00000246247E 0 HtlHtTHt5Ht
0000000024C2 0000024624C2 0 Ph\sF
0000000024E5 0000024624E5 0 PhDsF
000000002C9B 000002462C9B 0 QSUVW
000000002D12 000002462D12 0 QSUVW3
000000003061 000002463061 0 t2HHt%+
0000000030DA 0000024630DA 0 PhDwF
0000000030EC 0000024630EC 0 Ph$wF
000000003A68 000002463A68 0 t WVS
000000003A95 000002463A95 0 u7WPS
000000003AA6 000002463AA6 0 u&WVS
000000005F20 000002465F20 0 MFC42.DLL
000000005F2C 000002465F2C 0 __CxxFrameHandler
000000005F40 000002465F40 0 _EH_prolog
000000005F4E 000002465F4E 0 _vsnprintf
000000005F5C 000002465F5C 0 vprintf
000000005F6E 000002465F6E 0 strlen
000000005F78 000002465F78 0 _CxxThrowException
000000005F8E 000002465F8E 0 memcpy
000000005F98 000002465F98 0 memset
000000005FA2 000002465FA2 0 _purecall
000000005FAE 000002465FAE 0 __dllonexit
000000005FBC 000002465FBC 0 _onexit
000000005FC4 000002465FC4 0 MSVCRT.dll
000000005FD2 000002465FD2 0 ??1type_info@@UAE@XZ
000000005FF2 000002465FF2 0 _initterm
000000005FFE 000002465FFE 0 malloc
000000006008 000002466008 0 _adjust_fdiv
000000006018 000002466018 0 GetModuleFileNameA
00000000602E 00000246602E 0 TerminateThread
000000006040 000002466040 0 Sleep
000000006048 000002466048 0 GetProcAddress
00000000605A 00000246605A 0 LoadLibraryA
00000000606A 00000246606A 0 CreateThread
00000000607A 00000246607A 0 DeleteFileA
File pos Mem pos ID Text
======== ======= == ====
000000006086 000002466086 0 KERNEL32.dll
000000006096 000002466096 0 ??0Init@ios_base@std@@QAE@XZ
0000000060B6 0000024660B6 0 ??1Init@ios_base@std@@QAE@XZ
0000000060D6 0000024660D6 0 ??0_Winit@std@@QAE@XZ
0000000060EE 0000024660EE 0 ??1_Winit@std@@QAE@XZ
000000006104 000002466104 0 MSVCP60.dll
000000006112 000002466112 0 PathFileExistsA
000000006124 000002466124 0 PathAppendA
000000006130 000002466130 0 SHLWAPI.dll
000000006168 000002466168 0 ZFS.dll
00000000703C 00000246703C 0 Unload func called.
000000007050 000002467050 0 command file found
000000007070 000002467070 0 .?AVFileNotFoundException@@
00000000708C 00000246708C 0 Main dll, Can't process command.
0000000070B0 0000024670B0 0 Command file not found. Some shit happened, dude.
0000000070E2 0000024670E2 0 Smativay udochki!!!
0000000070F8 0000024670F8 0 Begin processing command.
000000007114 000002467114 0 log.txt
00000000711C 00000246711C 0 Logger is now on new TraceLevel: %s
000000007140 000002467140 0 UNKNOWN
00000000714C 00000246714C 0 TRACE
000000007154 000002467154 0 NOTICE
00000000715C 00000246715C 0 WARNING
000000007164 000002467164 0 ERROR
00000000716C 00000246716C 0 FATAL
000000007178 000002467178 0 Can't init XFS
000000007188 000002467188 0 msxfs.dll
000000007194 000002467194 0 Xfs init into dll
0000000071B0 0000024671B0 0 .?AVObject@System@@
0000000071D0 0000024671D0 0 .?AVException@System@CUniFramework@@
000000007200 000002467200 0 .?AVXfsException@@
000000007214 000002467214 0 WFSOpen
00000000721C 00000246721C 0 WFSStartUp
000000007228 000002467228 0 WFSFreeResult
000000007238 000002467238 0 WFSExecute
000000007244 000002467244 0 WFSGetInfo
000000007250 000002467250 0 Can't load xfs module.
000000007268 000002467268 0 System::Object
000000007278 000002467278 0 cant init ext mod
00000000728C 00000246728C 0 CommandProcessor created
0000000072B0 0000024672B0 0 .?AVXfsDispenseException@@
0000000072CC 0000024672CC 0 Trying to receive balance.
0000000072E8 0000024672E8 0 Can't dispense, Error code is: %d
00000000730C 00000246730C 0 Trying t dispense from CU %d
00000000732C 00000246732C 0 Processing dispense.
000000007344 000002467344 0 Setting device Id to %d
00000000735C 00000246735C 0 CDM HSERVICE is: %d
000000007374 000002467374 0 Unloading.
000000007380 000002467380 0 Received command "None". Is it really possible?
0000000073B0 0000024673B0 0 Begin process command.
0000000073C8 0000024673C8 0 XFS-> dispense end
0000000073DC 0000024673DC 0 Dispense, dispense device is %d
0000000073FC 0000024673FC 0 Currency ID: %s
00000000740C 00000246740C 0 XFS-> dispense start
000000007430 000002467430 0 .?AVXfsGetInfoException@@
00000000744C 00000246744C 0 Cash info-> unhandled exception.
000000007470 000002467470 0 %d dispenser id is invalid.
00000000748C 00000246748C 0 Valid CDM id is %d, dispense cash info received.
0000000074C0 0000024674C0 0 ICommandProcessor-> else block. Getting XFS-cash info
0000000074F8 0000024674F8 0 ICommandProcessor-> else block. get disp ID
File pos Mem pos ID Text
======== ======= == ====
000000007524 000002467524 0 ICommandProcessor-> else block.
000000007544 000002467544 0 %d dispenser id is invalid.
000000007560 000002467560 0 Xfs error code is %d
000000007578 000002467578 0 Trying auto determine CDM device id.
0000000075A0 0000024675A0 0 ICommandProcessor-> if-statement.
0000000075C4 0000024675C4 0 ICommandProcessor-> enter try block.
0000000075EC 0000024675EC 0 XFS-> before return result List<WFSCDMCASHUNIT>
00000000761C 00000246761C 0 XFS-> found info about %d cash units
000000007644 000002467644 0 Received cash info:
000000007658 000002467658 0 ========== %d =========
000000007671 000002467671 0 CU state: %d Type: %d
000000007689 000002467689 0 Values: %d
000000007695 000002467695 0 Currency ID:%s
0000000076A5 0000024676A5 0 Money count: %d
0000000076B8 0000024676B8 0 Begin format %d CU
0000000076CC 0000024676CC 0 -command file name is %s
0000000076E8 0000024676E8 0 Command provider created
000000007704 000002467704 0 Found command code: %d command.
000000007724 000002467724 0 COM-Provider->dispense count %d
000000007744 000002467744 0 COM-Provider->Cassete number %d
000000007764 000002467764 0 Unknown command abbreviature %s
000000007788 000002467788 0 found %d command lines
0000000077A0 0000024677A0 0 command file removed
0000000077B8 0000024677B8 0 Command file name is: %s
0000000077E0 0000024677E0 0 .?AVIOException@@
000000007808 000002467808 0 .?AVtype_info@@
000000009008 000002469008 0 1070<0H0N0]0c0h0t0z0
000000009021 000002469021 0 1C1}1
000000009039 000002469039 0 2\2r2x2
00000000904B 00000246904B 0 243G3M3b3
000000009081 000002469081 0 6.646:6L6[6
000000009095 000002469095 0 7&737:7@7V7r7
0000000090A7 0000024690A7 0 788>8
0000000090B3 0000024690B3 0 909_9y9
0000000090D5 0000024690D5 0 :A:M:]:j:o:w:
0000000090F3 0000024690F3 0 ;2;Z;n;y;
00000000910B 00000246910B 0 <4<:<F<a<
000000009121 000002469121 0 =2>C>
000000009149 000002469149 0 434[4
00000000915B 00000246915B 0 5D5T5\5
00000000916B 00000246916B 0 757=7g7x7
00000000917F 00000246917F 0 8$8C8Z8
0000000091CB 0000024691CB 0 >+>1>9>\>b>
00000000921B 00000246921B 0 4&414W4
000000009239 000002469239 0 8"8(8.848:8@8F8L8R8X8
00000000924F 00000246924F 0 8d8j8p8v8|8
00000000928D 00000246928D 0 9D9R9t9z9
0000000092B7 0000024692B7 0 :(:.:P:b:
0000000092C9 0000024692C9 0 ;@;U;i;
0000000092D5 0000024692D5 0 ;8<P<e<y<
0000000092EB 0000024692EB 0 =1=E=Y=
0000000092F9 0000024692F9 0 ><>Q>e>
000000009305 000002469305 0 >@?l?
000000009328 000002469328 0 014181<1@1D1H1L1P1T1X1\1
000000009341 000002469341 0 1d1h1l1p1t1x1|1
00000000939F 00000246939F 0 2 2(2@2T2d2h2x2
0000000093BF 0000024693BF 0 3$30383L3\3
0000000093DF 0000024693DF 0 4$4,444<4D4L4X4t4|4
000000009403 000002469403 0 5 5<5H5d5p5x5
00000000941F 00000246941F 0 6$6(6,646<6H6d6p6x6
File pos Mem pos ID Text
======== ======= == ====
00000000943F 00000246943F 0 7 7<7D7P7X7l7t7|7
000000009467 000002469467 0 8$808L8X8
000000009471 000002469471 0 8t8|8
000000009487 000002469487 0 9,949H9T9X9\9
000000009495 000002469495 0 9l9t9
0000000094AD 0000024694AD 0 :,:4:<:H:d:p:
0000000094CD 0000024694CD 0 ;$;,;4;<;D;L;X;t;|;
0000000094FB 0000024694FB 0 <$<(<,<4<<<D<L<X<t<|<
00000000951F 00000246951F 0 =$=0=L=X=t=
000000009541 000002469541 0 0 00040h0
000000008066 000002468066 0 VS_VERSION_INFO
0000000080C2 0000024680C2 0 StringFileInfo
0000000080E6 0000024680E6 0 040904B0
0000000080FE 0000024680FE 0 CompanyName
00000000811E 00000246811E 0 FileDescription
000000008140 000002468140 0 ZFS DLL
000000008156 000002468156 0 FileVersion
000000008170 000002468170 0 1, 0, 0, 1
00000000818E 00000246818E 0 InternalName
0000000081B6 0000024681B6 0 LegalCopyright
0000000081D4 0000024681D4 0 Copyright (C) 2016
000000008202 000002468202 0 LegalTrademarks
00000000822A 00000246822A 0 OriginalFilename
00000000824C 00000246824C 0 ZFS.DLL
000000008262 000002468262 0 ProductName
00000000827C 00000246827C 0 ZFS Dynamic Link Library
0000000082B6 0000024682B6 0 ProductVersion
0000000082D4 0000024682D4 0 1, 0, 0, 1
0000000082F2 0000024682F2 0 VarFileInfo
000000008312 000002468312 0 Translation