.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ----  -------------.
!  WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV                                                      !
`--------------  - ---  ---------- -------- -------- -------- -------- ----------------- -  ---- ---- --'

                                           ATM MALWARE NOTICE 
                    5f70c76b6771b7c56bc5da34e424eb9a090cedeb807c795795a88c415a2e772c
 
Date...........: 2017-07-17
Family.........: DispCash.10
File name......: cuinfo.exe
File size......: 49.00 KB
Type file......: EXE/Windows
Virscan........: VT - HA
Additional note: Might be 'legitimate' but as this file is questionable we added it to the wall.
Used for obtaining information on the number of banknote in casettes.
Apparently used by Cobalt group, "Cobalt evolution and joint operations" (group-ib, may 2018)

Entropy:


Binary Histogram:



=== SCREENSHOT === 



=== PEDUMP REPORT === 
=== MZ Header === signature: "MZ" bytes_in_last_block: 144 0x90 blocks_in_file: 3 3 num_relocs: 0 0 header_paragraphs: 4 4 min_extra_paragraphs: 0 0 max_extra_paragraphs: 65535 0xffff ss: 0 0 sp: 184 0xb8 checksum: 0 0 ip: 0 0 cs: 0 0 reloc_table_offset: 64 0x40 overlay_number: 0 0 reserved0: 0 0 oem_id: 0 0 oem_info: 0 0 reserved2: 0 0 reserved3: 0 0 reserved4: 0 0 reserved5: 0 0 reserved6: 0 0 lfanew: 128 0x80 === DOS STUB === 00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......| === PE Header === signature: "PE\x00\x00" # IMAGE_FILE_HEADER: Machine: 332 0x14c x86 NumberOfSections: 8 8 TimeDateStamp: "2015-07-13 22:43:23" PointerToSymbolTable: 0 0 NumberOfSymbols: 0 0 SizeOfOptionalHeader: 224 0xe0 Characteristics: 783 0x30f RELOCS_STRIPPED, EXECUTABLE_IMAGE LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED 32BIT_MACHINE, DEBUG_STRIPPED # IMAGE_OPTIONAL_HEADER32: Magic: 267 0x10b 32-bit executable LinkerVersion: 2.23 SizeOfCode: 35840 0x8c00 SizeOfInitializedData: 49152 0xc000 SizeOfUninitializedData: 3072 0xc00 AddressOfEntryPoint: 5488 0x1570 BaseOfCode: 4096 0x1000 BaseOfData: 40960 0xa000 ImageBase: 4194304 0x400000 SectionAlignment: 4096 0x1000 FileAlignment: 512 0x200 OperatingSystemVersion: 4.0 ImageVersion: 1.0 SubsystemVersion: 4.0 Reserved1: 0 0 SizeOfImage: 73728 0x12000 SizeOfHeaders: 1024 0x400 CheckSum: 93371 0x16cbb Subsystem: 3 3 WINDOWS_CUI DllCharacteristics: 0 0 SizeOfStackReserve: 2097152 0x200000 SizeOfStackCommit: 4096 0x1000 SizeOfHeapReserve: 1048576 0x100000 SizeOfHeapCommit: 4096 0x1000 LoaderFlags: 0 0 NumberOfRvaAndSizes: 16 0x10 === DATA DIRECTORY === EXPORT rva:0x 0 size:0x 0 IMPORT rva:0x f000 size:0x 790 RESOURCE rva:0x 0 size:0x 0 EXCEPTION rva:0x 0 size:0x 0 SECURITY rva:0x 0 size:0x 0 BASERELOC rva:0x 0 size:0x 0 DEBUG rva:0x 0 size:0x 0 ARCHITECTURE rva:0x 0 size:0x 0 GLOBALPTR rva:0x 0 size:0x 0 TLS rva:0x 11000 size:0x 18 LOAD_CONFIG rva:0x 0 size:0x 0 Bound_IAT rva:0x 0 size:0x 0 IAT rva:0x f194 size:0x 11c Delay_IAT rva:0x 0 size:0x 0 CLR_Header rva:0x 0 size:0x 0 rva:0x 0 size:0x 0 === SECTIONS === NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS .text 1000 8b74 8c00 400 0 0 0 0 60500060 R-X CODE IDATA .data a000 28 200 9000 0 0 0 0 c0300040 RW- IDATA .rdata b000 fc4 1000 9200 0 0 0 0 40600040 R-- IDATA .eh_fram c000 1500 1600 a200 0 0 0 0 40300040 R-- IDATA .bss e000 a30 0 0 0 0 0 0 c0600080 RW- UDATA .idata f000 790 800 b800 0 0 0 0 c0300040 RW- IDATA .CRT 10000 18 200 c000 0 0 0 0 c0300040 RW- IDATA .tls 11000 20 200 c200 0 0 0 0 c0300040 RW- IDATA === TLS === RAW_START RAW_END INDEX CALLBKS ZEROFILL FLAGS 411019 41101c 40e02c 410004 0 0 [?] can't find file_offset of VA 0xe02c === IMPORTS === MODULE_NAME HINT ORD FUNCTION_NAME kernel32.dll cf DeleteCriticalSection kernel32.dll ec EnterCriticalSection kernel32.dll 117 ExitProcess kernel32.dll 184 GetCommandLineA kernel32.dll 1fe GetLastError kernel32.dll 211 GetModuleHandleA kernel32.dll 241 GetProcAddress kernel32.dll 2de InitializeCriticalSection kernel32.dll 2e8 InterlockedExchange kernel32.dll 2fb IsDBCSLeadByteEx kernel32.dll 32e LeaveCriticalSection kernel32.dll 35c MultiByteToWideChar kernel32.dll 474 SetUnhandledExceptionFilter kernel32.dll 480 Sleep kernel32.dll 495 TlsGetValue kernel32.dll 4bd VirtualProtect kernel32.dll 4bf VirtualQuery kernel32.dll 4df WideCharToMultiByte msvcrt.dll 50 _strdup msvcrt.dll 52 _stricoll msvcrt.dll 3b __getmainargs msvcrt.dll 46 __mb_cur_max msvcrt.dll 52 __p__environ msvcrt.dll 54 __p__fmode msvcrt.dll 69 __set_app_type msvcrt.dll 9a _cexit msvcrt.dll c0 _errno msvcrt.dll d7 _findclose msvcrt.dll d8 _findfirst msvcrt.dll de _findnext msvcrt.dll fe _fullpath msvcrt.dll 128 _iob msvcrt.dll 1a1 _onexit msvcrt.dll 1d2 _setmode msvcrt.dll 27f abort msvcrt.dll 286 atexit msvcrt.dll 288 atoi msvcrt.dll 28b calloc msvcrt.dll 2a4 fputc msvcrt.dll 2a9 free msvcrt.dll 2b1 fwrite msvcrt.dll 2b5 getenv msvcrt.dll 2c4 isspace msvcrt.dll 2d7 localeconv msvcrt.dll 2dc malloc msvcrt.dll 2de mbstowcs msvcrt.dll 2e2 memcpy msvcrt.dll 2f2 realloc msvcrt.dll 2f8 setlocale msvcrt.dll 2fa signal msvcrt.dll 302 strchr msvcrt.dll 304 strcoll msvcrt.dll 309 strlen msvcrt.dll 30c strncpy msvcrt.dll 318 system msvcrt.dll 31e tolower msvcrt.dll 324 vfprintf msvcrt.dll 331 wcslen msvcrt.dll 33c wcstombs MSXFS.dll 22 WFSStartUp MSXFS.dll 1f WFSOpen MSXFS.dll 1e WFSLock MSXFS.dll 1a WFSFreeResult MSXFS.dll 1b WFSGetInfo MSXFS.dll 14 WFSCleanUp MSXFS.dll 15 WFSClose MSXFS.dll 24 WFSUnlock
=== Strings ===
File pos Mem pos ID Text ======== ======= == ==== 00000000004D 00000040004D 0 !This program cannot be run in DOS mode. 000000000178 000000400178 0 .text 0000000001A0 0000004001A0 0 .data 0000000001C8 0000004001C8 0 .rdata 0000000001EF 0000004001EF 0 @.eh_fram 000000000216 000000400216 0 0@.bss 000000000240 000000400240 0 .idata 000000000C52 000000401852 0 SUBKf 000000000C8D 00000040188D 0 VALUf 000000000CCA 0000004018CA 0 EMPTf 000000000D01 000000401901 0 _LONf 000000000D3A 00000040193A 0 ITEMf 000000000D71 000000401971 0 O_LOf 000000000DA5 0000004019A5 0 READf 000000000DD5 0000004019D5 0 _ERRf 000000000E09 000000401A09 0 _ERRf 000000000E7A 000000401A7A 0 HANDf 000000000EB3 000000401AB3 0 BUFFf 000000000FBC 000000401BBC 0 VIDEf 000000001083 000000401C83 0 REQ_f 0000000010B7 000000401CB7 0 RESUf 000000001123 000000401D23 0 TIMEf 00000000115A 000000401D5A 0 ELEVf 000000001185 000000401D85 0 LOCKf 000000001213 000000401E13 0 THREf 000000001264 000000401E64 0 LOCKf 0000000012F3 000000401EF3 0 STERf 000000001327 000000401F27 0 OGREf 00000000135B 000000401F5B 0 EMORf 000000001392 000000401F92 0 FOUNf 00000000142A 00000040202A 0 _HIGf 0000000014E3 0000004020E3 0 OMMAf 000000001525 000000402125 0 _SRVf 000000001583 000000402183 0 _ERRf 0000000015DE 0000004021DE 0 _ERRf 0000000016AF 0000004022AF 0 ERROf 00000000176A 00000040236A 0 CYMIf 0000000017A1 0000004023A1 0 NSABf 00000000180E 00000040240E 0 ITIOf 00000000187C 00000040247C 0 OTOPf 0000000018EA 0000004024EA 0 LOSEf 000000001981 000000402581 0 ACTIf 000000001A3A 00000040263A 0 OITEf 000000001AAC 0000004026AC 0 NKNOf 000000001AE3 0000004026E3 0 STAKf 000000001BA8 0000004027A8 0 SITIf 000000001BEA 0000004027EA 0 CTARf 000000001CAA 0000004028AA 0 TAKEf 000000001CDA 0000004028DA 0 SLEFf 000000002F4E 000000403B4E 0 <\t?</t; 000000005519 000000406119 0 D$p9D$0 0000000061FD 000000406DFD 0 )D$,) 0000000065B9 0000004071B9 0 L$\9L$ 0000000071BE 000000407DBE 0 9l$Xv, 00000000723C 000000407E3C 0 9|$Xv7 0000000088B3 0000004094B3 0 r/9D$ 000000008DF3 0000004099F3 0 EMPTf 000000009200 00000040B000 0 libgcc_s_dw2-1.dll 000000009213 00000040B013 0 __register_frame_info 000000009229 00000040B029 0 libgcj-13.dll File pos Mem pos ID Text ======== ======= == ==== 000000009237 00000040B037 0 _Jv_RegisterClasses 00000000924B 00000040B04B 0 __deregister_frame_info 0000000097A8 00000040B5A8 0 Usage: %s <Service Logical Name> 0000000097CC 00000040B5CC 0 WFSStartUp failed with error: %s 0000000097F0 00000040B5F0 0 WFSVERSION: 0000000097FC 00000040B5FC 0 wVersion: 0x%X 00000000980C 00000040B60C 0 wLowVersion: 0x%X 00000000981F 00000040B61F 0 wHighVersion: 0x%X 000000009833 00000040B633 0 szDescription: %s 000000009846 00000040B646 0 szSystemStatus: %s 00000000985C 00000040B65C 0 WFSOpen(%s) failed with error: %s 00000000987F 00000040B67F 0 pause 000000009888 00000040B688 0 WFSLock failed with error: %s 0000000098A8 00000040B6A8 0 WFSFreeResult failed with error: %s 0000000098D0 00000040B6D0 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s 00000000990F 00000040B70F 0 REJECTCASSETTE 00000000991E 00000040B71E 0 BILLCASSETTE 00000000992B 00000040B72B 0 COINCYLINDER 000000009938 00000040B738 0 COINDISPENSER 000000009946 00000040B746 0 RETRACTCASSETTE 000000009956 00000040B756 0 COUPON 00000000995D 00000040B75D 0 DOCUMENT 000000009966 00000040B766 0 REPCONTAINER 000000009973 00000040B773 0 RECYCLINGCASSETTE 000000009985 00000040B785 0 NOTAPPLICABLE 000000009993 00000040B793 0 NOVALUES 00000000999C 00000040B79C 0 NOREFERENCE 0000000099A8 00000040B7A8 0 MANIPULATED 0000000099B4 00000040B7B4 0 INOPERATIVE 0000000099C0 00000040B7C0 0 ---------------------------- 0000000099E0 00000040B7E0 0 Cash Unit # %d 0000000099EF 00000040B7EF 0 Type: %s 0000000099F8 00000040B7F8 0 Status: %s 000000009A03 00000040B803 0 Currency ID: %.3s 000000009A15 00000040B815 0 Note Value: %u 000000009A24 00000040B824 0 Notes Count: %u 000000009A34 00000040B834 0 Notes Initial Count: %u 000000009A4C 00000040B84C 0 Notes Minimum Count: %u 000000009A64 00000040B864 0 Notes Maximum Count: %u 000000009A80 00000040B880 0 WFSUnlock failed with error: %s 000000009AA4 00000040B8A4 0 WFSClose failed with error: %s 000000009AC4 00000040B8C4 0 WFSCleanUp failed with error: %s 000000009AE7 00000040B8E7 0 Success 000000009B4C 00000040B94C 0 Mingw runtime failure: 000000009B64 00000040B964 0 VirtualQuery failed for %d bytes at address %p 000000009B98 00000040B998 0 Unknown pseudo relocation protocol version %d. 000000009BCC 00000040B9CC 0 Unknown pseudo relocation bit size %d. 000000009BFA 00000040B9FA 0 glob-1.0-mingw32 000000009C2A 00000040BA2A 0 (null) 000000009C31 00000040BA31 0 PRINTF_EXPONENT_DIGITS 000000009DB8 00000040BBB8 0 Infinity 000000009DDF 00000040BBDF 0 ?aCoc 000000009DFF 00000040BBFF 0 <2ZGU 000000009F80 00000040BD80 0 GCC: (GNU) 4.8.1 000000009F94 00000040BD94 0 GCC: (GNU) 4.8.1 000000009FA8 00000040BDA8 0 GCC: (GNU) 4.8.1 000000009FBC 00000040BDBC 0 GCC: (GNU) 4.8.1 000000009FD0 00000040BDD0 0 GCC: (GNU) 4.8.1 000000009FE4 00000040BDE4 0 GCC: (GNU) 4.8.1 000000009FF8 00000040BDF8 0 GCC: (GNU) 4.8.1 File pos Mem pos ID Text ======== ======= == ==== 00000000A00C 00000040BE0C 0 GCC: (GNU) 4.8.1 00000000A020 00000040BE20 0 GCC: (GNU) 4.8.1 00000000A034 00000040BE34 0 GCC: (GNU) 4.8.1 00000000A048 00000040BE48 0 GCC: (GNU) 4.8.1 00000000A05C 00000040BE5C 0 GCC: (GNU) 4.8.1 00000000A070 00000040BE70 0 GCC: (GNU) 4.8.1 00000000A084 00000040BE84 0 GCC: (GNU) 4.8.1 00000000A098 00000040BE98 0 GCC: (GNU) 4.8.1 00000000A0AC 00000040BEAC 0 GCC: (GNU) 4.8.1 00000000A0C0 00000040BEC0 0 GCC: (GNU) 4.8.1 00000000A0D4 00000040BED4 0 GCC: (GNU) 4.8.1 00000000A0E8 00000040BEE8 0 GCC: (GNU) 4.8.1 00000000A0FC 00000040BEFC 0 GCC: (GNU) 4.8.1 00000000A110 00000040BF10 0 GCC: (GNU) 4.8.1 00000000A124 00000040BF24 0 GCC: (GNU) 4.8.1 00000000A138 00000040BF38 0 GCC: (GNU) 4.8.1 00000000A14C 00000040BF4C 0 GCC: (GNU) 4.8.1 00000000A160 00000040BF60 0 GCC: (GNU) 4.8.1 00000000A174 00000040BF74 0 GCC: (GNU) 4.8.1 00000000A188 00000040BF88 0 GCC: (GNU) 4.8.1 00000000A19C 00000040BF9C 0 GCC: (GNU) 4.8.1 00000000A1B0 00000040BFB0 0 GCC: (GNU) 4.8.1 00000000BAB2 00000040F2B2 0 DeleteCriticalSection 00000000BACA 00000040F2CA 0 EnterCriticalSection 00000000BAE2 00000040F2E2 0 ExitProcess 00000000BAF0 00000040F2F0 0 GetCommandLineA 00000000BB02 00000040F302 0 GetLastError 00000000BB12 00000040F312 0 GetModuleHandleA 00000000BB26 00000040F326 0 GetProcAddress 00000000BB38 00000040F338 0 InitializeCriticalSection 00000000BB54 00000040F354 0 InterlockedExchange 00000000BB6A 00000040F36A 0 IsDBCSLeadByteEx 00000000BB7E 00000040F37E 0 LeaveCriticalSection 00000000BB96 00000040F396 0 MultiByteToWideChar 00000000BBAC 00000040F3AC 0 SetUnhandledExceptionFilter 00000000BBCA 00000040F3CA 0 Sleep 00000000BBD2 00000040F3D2 0 TlsGetValue 00000000BBE0 00000040F3E0 0 VirtualProtect 00000000BBF2 00000040F3F2 0 VirtualQuery 00000000BC02 00000040F402 0 WideCharToMultiByte 00000000BC18 00000040F418 0 _strdup 00000000BC22 00000040F422 0 _stricoll 00000000BC2E 00000040F42E 0 __getmainargs 00000000BC3E 00000040F43E 0 __mb_cur_max 00000000BC4E 00000040F44E 0 __p__environ 00000000BC5E 00000040F45E 0 __p__fmode 00000000BC6C 00000040F46C 0 __set_app_type 00000000BC7E 00000040F47E 0 _cexit 00000000BC88 00000040F488 0 _errno 00000000BC92 00000040F492 0 _findclose 00000000BCA0 00000040F4A0 0 _findfirst 00000000BCAE 00000040F4AE 0 _findnext 00000000BCBA 00000040F4BA 0 _fullpath 00000000BCCE 00000040F4CE 0 _onexit 00000000BCD8 00000040F4D8 0 _setmode 00000000BCE4 00000040F4E4 0 abort 00000000BCEC 00000040F4EC 0 atexit 00000000BCFE 00000040F4FE 0 calloc 00000000BD08 00000040F508 0 fputc 00000000BD18 00000040F518 0 fwrite File pos Mem pos ID Text ======== ======= == ==== 00000000BD22 00000040F522 0 getenv 00000000BD2C 00000040F52C 0 isspace 00000000BD36 00000040F536 0 localeconv 00000000BD44 00000040F544 0 malloc 00000000BD4E 00000040F54E 0 mbstowcs 00000000BD5A 00000040F55A 0 memcpy 00000000BD64 00000040F564 0 realloc 00000000BD6E 00000040F56E 0 setlocale 00000000BD7A 00000040F57A 0 signal 00000000BD84 00000040F584 0 strchr 00000000BD8E 00000040F58E 0 strcoll 00000000BD98 00000040F598 0 strlen 00000000BDA2 00000040F5A2 0 strncpy 00000000BDAC 00000040F5AC 0 system 00000000BDB6 00000040F5B6 0 tolower 00000000BDC0 00000040F5C0 0 vfprintf 00000000BDCC 00000040F5CC 0 wcslen 00000000BDD6 00000040F5D6 0 wcstombs 00000000BDE0 00000040F5E0 0 MSXFS.dll 00000000BDEE 00000040F5EE 0 WFSStartUp 00000000BE02 00000040F602 0 WFSOpen 00000000BE12 00000040F612 0 WFSLock 00000000BE22 00000040F622 0 WFSFreeResult 00000000BE36 00000040F636 0 WFSGetInfo 00000000BE4A 00000040F64A 0 WFSCleanUp 00000000BE5E 00000040F65E 0 WFSClose 00000000BE6E 00000040F66E 0 WFSUnlock 00000000BEC4 00000040F6C4 0 kernel32.dll 00000000BEDC 00000040F6DC 0 msvcrt.dll 00000000BF84 00000040F784 0 msvcrt.dll 000000009C1B 00000040BA1B 0 f(null) 00000000004D 00000040004D 0 !This program cannot be run in DOS mode. 000000000178 000000400178 0 .text 0000000001A0 0000004001A0 0 .data 0000000001C8 0000004001C8 0 .rdata 0000000001EF 0000004001EF 0 @.eh_fram 000000000216 000000400216 0 0@.bss 000000000240 000000400240 0 .idata 000000000C52 000000401852 0 SUBKf 000000000C8D 00000040188D 0 VALUf 000000000CCA 0000004018CA 0 EMPTf 000000000D01 000000401901 0 _LONf 000000000D3A 00000040193A 0 ITEMf 000000000D71 000000401971 0 O_LOf 000000000DA5 0000004019A5 0 READf 000000000DD5 0000004019D5 0 _ERRf 000000000E09 000000401A09 0 _ERRf 000000000E7A 000000401A7A 0 HANDf 000000000EB3 000000401AB3 0 BUFFf 000000000FBC 000000401BBC 0 VIDEf 000000001083 000000401C83 0 REQ_f 0000000010B7 000000401CB7 0 RESUf 000000001123 000000401D23 0 TIMEf 00000000115A 000000401D5A 0 ELEVf 000000001185 000000401D85 0 LOCKf 000000001213 000000401E13 0 THREf 000000001264 000000401E64 0 LOCKf 0000000012F3 000000401EF3 0 STERf 000000001327 000000401F27 0 OGREf 00000000135B 000000401F5B 0 EMORf File pos Mem pos ID Text ======== ======= == ==== 000000001392 000000401F92 0 FOUNf 00000000142A 00000040202A 0 _HIGf 0000000014E3 0000004020E3 0 OMMAf 000000001525 000000402125 0 _SRVf 000000001583 000000402183 0 _ERRf 0000000015DE 0000004021DE 0 _ERRf 0000000016AF 0000004022AF 0 ERROf 00000000176A 00000040236A 0 CYMIf 0000000017A1 0000004023A1 0 NSABf 00000000180E 00000040240E 0 ITIOf 00000000187C 00000040247C 0 OTOPf 0000000018EA 0000004024EA 0 LOSEf 000000001981 000000402581 0 ACTIf 000000001A3A 00000040263A 0 OITEf 000000001AAC 0000004026AC 0 NKNOf 000000001AE3 0000004026E3 0 STAKf 000000001BA8 0000004027A8 0 SITIf 000000001BEA 0000004027EA 0 CTARf 000000001CAA 0000004028AA 0 TAKEf 000000001CDA 0000004028DA 0 SLEFf 000000002F4E 000000403B4E 0 <\t?</t; 000000005519 000000406119 0 D$p9D$0 0000000061FD 000000406DFD 0 )D$,) 0000000065B9 0000004071B9 0 L$\9L$ 0000000071BE 000000407DBE 0 9l$Xv, 00000000723C 000000407E3C 0 9|$Xv7 0000000088B3 0000004094B3 0 r/9D$ 000000008DF3 0000004099F3 0 EMPTf 000000009200 00000040B000 0 libgcc_s_dw2-1.dll 000000009213 00000040B013 0 __register_frame_info 000000009229 00000040B029 0 libgcj-13.dll 000000009237 00000040B037 0 _Jv_RegisterClasses 00000000924B 00000040B04B 0 __deregister_frame_info 0000000097A8 00000040B5A8 0 Usage: %s <Service Logical Name> 0000000097CC 00000040B5CC 0 WFSStartUp failed with error: %s 0000000097F0 00000040B5F0 0 WFSVERSION: 0000000097FC 00000040B5FC 0 wVersion: 0x%X 00000000980C 00000040B60C 0 wLowVersion: 0x%X 00000000981F 00000040B61F 0 wHighVersion: 0x%X 000000009833 00000040B633 0 szDescription: %s 000000009846 00000040B646 0 szSystemStatus: %s 00000000985C 00000040B65C 0 WFSOpen(%s) failed with error: %s 00000000987F 00000040B67F 0 pause 000000009888 00000040B688 0 WFSLock failed with error: %s 0000000098A8 00000040B6A8 0 WFSFreeResult failed with error: %s 0000000098D0 00000040B6D0 0 WFSGetInfo (WFS_INF_CDM_CASH_UNIT_INFO) failed with error: %s 00000000990F 00000040B70F 0 REJECTCASSETTE 00000000991E 00000040B71E 0 BILLCASSETTE 00000000992B 00000040B72B 0 COINCYLINDER 000000009938 00000040B738 0 COINDISPENSER 000000009946 00000040B746 0 RETRACTCASSETTE 000000009956 00000040B756 0 COUPON 00000000995D 00000040B75D 0 DOCUMENT 000000009966 00000040B766 0 REPCONTAINER 000000009973 00000040B773 0 RECYCLINGCASSETTE 000000009985 00000040B785 0 NOTAPPLICABLE 000000009993 00000040B793 0 NOVALUES 00000000999C 00000040B79C 0 NOREFERENCE 0000000099A8 00000040B7A8 0 MANIPULATED 0000000099B4 00000040B7B4 0 INOPERATIVE File pos Mem pos ID Text ======== ======= == ==== 0000000099C0 00000040B7C0 0 ---------------------------- 0000000099E0 00000040B7E0 0 Cash Unit # %d 0000000099EF 00000040B7EF 0 Type: %s 0000000099F8 00000040B7F8 0 Status: %s 000000009A03 00000040B803 0 Currency ID: %.3s 000000009A15 00000040B815 0 Note Value: %u 000000009A24 00000040B824 0 Notes Count: %u 000000009A34 00000040B834 0 Notes Initial Count: %u 000000009A4C 00000040B84C 0 Notes Minimum Count: %u 000000009A64 00000040B864 0 Notes Maximum Count: %u 000000009A80 00000040B880 0 WFSUnlock failed with error: %s 000000009AA4 00000040B8A4 0 WFSClose failed with error: %s 000000009AC4 00000040B8C4 0 WFSCleanUp failed with error: %s 000000009AE7 00000040B8E7 0 Success 000000009B4C 00000040B94C 0 Mingw runtime failure: 000000009B64 00000040B964 0 VirtualQuery failed for %d bytes at address %p 000000009B98 00000040B998 0 Unknown pseudo relocation protocol version %d. 000000009BCC 00000040B9CC 0 Unknown pseudo relocation bit size %d. 000000009BFA 00000040B9FA 0 glob-1.0-mingw32 000000009C2A 00000040BA2A 0 (null) 000000009C31 00000040BA31 0 PRINTF_EXPONENT_DIGITS 000000009DB8 00000040BBB8 0 Infinity 000000009DDF 00000040BBDF 0 ?aCoc 000000009DFF 00000040BBFF 0 <2ZGU 000000009F80 00000040BD80 0 GCC: (GNU) 4.8.1 000000009F94 00000040BD94 0 GCC: (GNU) 4.8.1 000000009FA8 00000040BDA8 0 GCC: (GNU) 4.8.1 000000009FBC 00000040BDBC 0 GCC: (GNU) 4.8.1 000000009FD0 00000040BDD0 0 GCC: (GNU) 4.8.1 000000009FE4 00000040BDE4 0 GCC: (GNU) 4.8.1 000000009FF8 00000040BDF8 0 GCC: (GNU) 4.8.1 00000000A00C 00000040BE0C 0 GCC: (GNU) 4.8.1 00000000A020 00000040BE20 0 GCC: (GNU) 4.8.1 00000000A034 00000040BE34 0 GCC: (GNU) 4.8.1 00000000A048 00000040BE48 0 GCC: (GNU) 4.8.1 00000000A05C 00000040BE5C 0 GCC: (GNU) 4.8.1 00000000A070 00000040BE70 0 GCC: (GNU) 4.8.1 00000000A084 00000040BE84 0 GCC: (GNU) 4.8.1 00000000A098 00000040BE98 0 GCC: (GNU) 4.8.1 00000000A0AC 00000040BEAC 0 GCC: (GNU) 4.8.1 00000000A0C0 00000040BEC0 0 GCC: (GNU) 4.8.1 00000000A0D4 00000040BED4 0 GCC: (GNU) 4.8.1 00000000A0E8 00000040BEE8 0 GCC: (GNU) 4.8.1 00000000A0FC 00000040BEFC 0 GCC: (GNU) 4.8.1 00000000A110 00000040BF10 0 GCC: (GNU) 4.8.1 00000000A124 00000040BF24 0 GCC: (GNU) 4.8.1 00000000A138 00000040BF38 0 GCC: (GNU) 4.8.1 00000000A14C 00000040BF4C 0 GCC: (GNU) 4.8.1 00000000A160 00000040BF60 0 GCC: (GNU) 4.8.1 00000000A174 00000040BF74 0 GCC: (GNU) 4.8.1 00000000A188 00000040BF88 0 GCC: (GNU) 4.8.1 00000000A19C 00000040BF9C 0 GCC: (GNU) 4.8.1 00000000A1B0 00000040BFB0 0 GCC: (GNU) 4.8.1 00000000BAB2 00000040F2B2 0 DeleteCriticalSection 00000000BACA 00000040F2CA 0 EnterCriticalSection 00000000BAE2 00000040F2E2 0 ExitProcess 00000000BAF0 00000040F2F0 0 GetCommandLineA 00000000BB02 00000040F302 0 GetLastError 00000000BB12 00000040F312 0 GetModuleHandleA 00000000BB26 00000040F326 0 GetProcAddress File pos Mem pos ID Text ======== ======= == ==== 00000000BB38 00000040F338 0 InitializeCriticalSection 00000000BB54 00000040F354 0 InterlockedExchange 00000000BB6A 00000040F36A 0 IsDBCSLeadByteEx 00000000BB7E 00000040F37E 0 LeaveCriticalSection 00000000BB96 00000040F396 0 MultiByteToWideChar 00000000BBAC 00000040F3AC 0 SetUnhandledExceptionFilter 00000000BBCA 00000040F3CA 0 Sleep 00000000BBD2 00000040F3D2 0 TlsGetValue 00000000BBE0 00000040F3E0 0 VirtualProtect 00000000BBF2 00000040F3F2 0 VirtualQuery 00000000BC02 00000040F402 0 WideCharToMultiByte 00000000BC18 00000040F418 0 _strdup 00000000BC22 00000040F422 0 _stricoll 00000000BC2E 00000040F42E 0 __getmainargs 00000000BC3E 00000040F43E 0 __mb_cur_max 00000000BC4E 00000040F44E 0 __p__environ 00000000BC5E 00000040F45E 0 __p__fmode 00000000BC6C 00000040F46C 0 __set_app_type 00000000BC7E 00000040F47E 0 _cexit 00000000BC88 00000040F488 0 _errno 00000000BC92 00000040F492 0 _findclose 00000000BCA0 00000040F4A0 0 _findfirst 00000000BCAE 00000040F4AE 0 _findnext 00000000BCBA 00000040F4BA 0 _fullpath 00000000BCCE 00000040F4CE 0 _onexit 00000000BCD8 00000040F4D8 0 _setmode 00000000BCE4 00000040F4E4 0 abort 00000000BCEC 00000040F4EC 0 atexit 00000000BCFE 00000040F4FE 0 calloc 00000000BD08 00000040F508 0 fputc 00000000BD18 00000040F518 0 fwrite 00000000BD22 00000040F522 0 getenv 00000000BD2C 00000040F52C 0 isspace 00000000BD36 00000040F536 0 localeconv 00000000BD44 00000040F544 0 malloc 00000000BD4E 00000040F54E 0 mbstowcs 00000000BD5A 00000040F55A 0 memcpy 00000000BD64 00000040F564 0 realloc 00000000BD6E 00000040F56E 0 setlocale 00000000BD7A 00000040F57A 0 signal 00000000BD84 00000040F584 0 strchr 00000000BD8E 00000040F58E 0 strcoll 00000000BD98 00000040F598 0 strlen 00000000BDA2 00000040F5A2 0 strncpy 00000000BDAC 00000040F5AC 0 system 00000000BDB6 00000040F5B6 0 tolower 00000000BDC0 00000040F5C0 0 vfprintf 00000000BDCC 00000040F5CC 0 wcslen 00000000BDD6 00000040F5D6 0 wcstombs 00000000BDE0 00000040F5E0 0 MSXFS.dll 00000000BDEE 00000040F5EE 0 WFSStartUp 00000000BE02 00000040F602 0 WFSOpen 00000000BE12 00000040F612 0 WFSLock 00000000BE22 00000040F622 0 WFSFreeResult 00000000BE36 00000040F636 0 WFSGetInfo 00000000BE4A 00000040F64A 0 WFSCleanUp 00000000BE5E 00000040F65E 0 WFSClose 00000000BE6E 00000040F66E 0 WFSUnlock 00000000BEC4 00000040F6C4 0 kernel32.dll 00000000BEDC 00000040F6DC 0 msvcrt.dll File pos Mem pos ID Text ======== ======= == ==== 00000000BF84 00000040F784 0 msvcrt.dll 000000009C1B 00000040BA1B 0 f(null)
=== DOWNLOAD === Mirror provided by vx-underground.org, thx!