.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ---- -------------.
! WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV !
`-------------- - --- ---------- -------- -------- -------- -------- ----------------- - ---- ---- --'
ATM MALWARE NOTICE
d60126545fa68b14c36cd4cffa3f81ed487381482582acbba786fa88884f636b
Date...........: 2017-03-14
Family.........: Atmosphere
File name......: ZFS.DLL
File size......: 40.00 KB
Type file......: DLL/Windows
Virscan........: VT - HA
Documentation..: https://www.symantec.com/security-center/writeup/2017-050414-0706-99
Entropy:
Binary Histogram:
=== PEDUMP REPORT ===
=== MZ Header ===
signature: "MZ"
bytes_in_last_block: 144 0x90
blocks_in_file: 3 3
num_relocs: 0 0
header_paragraphs: 4 4
min_extra_paragraphs: 0 0
max_extra_paragraphs: 65535 0xffff
ss: 0 0
sp: 184 0xb8
checksum: 0 0
ip: 0 0
cs: 0 0
reloc_table_offset: 64 0x40
overlay_number: 0 0
reserved0: 0 0
oem_id: 0 0
oem_info: 0 0
reserved2: 0 0
reserved3: 0 0
reserved4: 0 0
reserved5: 0 0
reserved6: 0 0
lfanew: 240 0xf0
=== DOS STUB ===
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
=== RICH Header ===
LIB_ID VERSION TIMES_USED
0 0 0 0 4 4
19 13 8034 1f62 2 2
14 e 7299 1c83 1 1
10 a 8168 1fe8 4 4
1 1 0 0 69 45
11 b 8168 1fe8 7 7
6 6 1720 6b8 1 1
4 4 8168 1fe8 8 8
=== PE Header ===
signature: "PE\x00\x00"
# IMAGE_FILE_HEADER:
Machine: 332 0x14c x86
NumberOfSections: 5 5
TimeDateStamp: "2017-01-19 14:23:03"
PointerToSymbolTable: 0 0
NumberOfSymbols: 0 0
SizeOfOptionalHeader: 224 0xe0
Characteristics: 8462 0x210e EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
# IMAGE_OPTIONAL_HEADER32:
Magic: 267 0x10b 32-bit executable
LinkerVersion: 6.0
SizeOfCode: 16384 0x4000
SizeOfInitializedData: 20480 0x5000
SizeOfUninitializedData: 0 0
AddressOfEntryPoint: 14875 0x3a1b
BaseOfCode: 4096 0x1000
BaseOfData: 20480 0x5000
ImageBase: 268435456 0x10000000
SectionAlignment: 4096 0x1000
FileAlignment: 4096 0x1000
OperatingSystemVersion: 4.0
ImageVersion: 0.0
SubsystemVersion: 4.0
Reserved1: 0 0
SizeOfImage: 40960 0xa000
SizeOfHeaders: 4096 0x1000
CheckSum: 0 0
Subsystem: 2 2 WINDOWS_GUI
DllCharacteristics: 0 0
SizeOfStackReserve: 1048576 0x100000
SizeOfStackCommit: 4096 0x1000
SizeOfHeapReserve: 1048576 0x100000
SizeOfHeapCommit: 4096 0x1000
LoaderFlags: 0 0
NumberOfRvaAndSizes: 16 0x10
=== DATA DIRECTORY ===
EXPORT rva:0x 6150 size:0x 30
IMPORT rva:0x 5d88 size:0x 78
RESOURCE rva:0x 8000 size:0x 330
EXCEPTION rva:0x 0 size:0x 0
SECURITY rva:0x 0 size:0x 0
BASERELOC rva:0x 9000 size:0x 550
DEBUG rva:0x 0 size:0x 0
ARCHITECTURE rva:0x 0 size:0x 0
GLOBALPTR rva:0x 0 size:0x 0
TLS rva:0x 0 size:0x 0
LOAD_CONFIG rva:0x 0 size:0x 0
Bound_IAT rva:0x 0 size:0x 0
IAT rva:0x 5000 size:0x 130
Delay_IAT rva:0x 0 size:0x 0
CLR_Header rva:0x 0 size:0x 0
rva:0x 0 size:0x 0
=== SECTIONS ===
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
.text 1000 3006 4000 1000 0 0 0 0 60000020 R-X CODE
.rdata 5000 1180 2000 5000 0 0 0 0 40000040 R-- IDATA
.data 7000 844 1000 7000 0 0 0 0 c0000040 RW- IDATA
.rsrc 8000 330 1000 8000 0 0 0 0 40000040 R-- IDATA
.reloc 9000 600 1000 9000 0 0 0 0 42000040 R-- IDATA DISCARDABLE
=== RESOURCES ===
FILE_OFFSET CP LANG SIZE TYPE NAME
0x8060 0 0x409 720 VERSION #1
=== IMPORTS ===
MODULE_NAME HINT ORD FUNCTION_NAME
MFC42.DLL 219
MFC42.DLL e4f
MFC42.DLL 339
MFC42.DLL 337
MFC42.DLL 35a
MFC42.DLL 35c
MFC42.DLL 3ad
MFC42.DLL 299
MFC42.DLL 7bb
MFC42.DLL 18f1
MFC42.DLL 1442
MFC42.DLL 162
MFC42.DLL 4e5
MFC42.DLL 156
MFC42.DLL 4b0
MFC42.DLL 49e
MFC42.DLL 21c
MFC42.DLL 18fa
MFC42.DLL 1540
MFC42.DLL 18ef
MFC42.DLL 3ab
MFC42.DLL b02
MFC42.DLL 19f8
MFC42.DLL acc
MFC42.DLL 31e
MFC42.DLL 7cd
MFC42.DLL 1548
MFC42.DLL cf6
MFC42.DLL 144a
MFC42.DLL 215
MFC42.DLL 990
MFC42.DLL 16ca
MFC42.DLL 7fc
MFC42.DLL b63
MFC42.DLL 15c4
MFC42.DLL 1633
MFC42.DLL 10b6
MFC42.DLL 217
MFC42.DLL 320
MFC42.DLL 154a
MFC42.DLL 490
MSVCRT.dll 25e free
MSVCRT.dll 10f _initterm
MSVCRT.dll 291 malloc
MSVCRT.dll 9d _adjust_fdiv
MSVCRT.dll 297 memcpy
MSVCRT.dll e ??1type_info@@UAE@XZ
MSVCRT.dll 2be strlen
MSVCRT.dll 23d atoi
MSVCRT.dll 2db vprintf
MSVCRT.dll 1e1 _vsnprintf
MSVCRT.dll 42 _EH_prolog
MSVCRT.dll 49 __CxxFrameHandler
MSVCRT.dll 186 _onexit
MSVCRT.dll 55 __dllonexit
MSVCRT.dll 192 _purecall
MSVCRT.dll 41 _CxxThrowException
MSVCRT.dll 299 memset
KERNEL32.dll 124 GetModuleFileNameA
KERNEL32.dll 296 Sleep
KERNEL32.dll 13e GetProcAddress
KERNEL32.dll 1c2 LoadLibraryA
KERNEL32.dll 4a CreateThread
KERNEL32.dll 57 DeleteFileA
KERNEL32.dll 29f TerminateThread
MSVCP60.dll a5 ??0_Winit@std@@QAE@XZ
MSVCP60.dll 109 ??1Init@ios_base@std@@QAE@XZ
MSVCP60.dll 9e ??0Init@ios_base@std@@QAE@XZ
MSVCP60.dll 10d ??1_Winit@std@@QAE@XZ
SHLWAPI.dll b PathAppendA
SHLWAPI.dll 1b PathFileExistsA
=== EXPORTS ===
# module "ZFS.dll"
# flags=0x0 ts="2017-01-19 14:23:03" version=0.0 ord_base=1
# nFuncs=0 nNames=0
=== VERSION INFO ===
# VS_FIXEDFILEINFO:
FileVersion : 1.0.0.1
ProductVersion : 1.0.0.1
StrucVersion : 0x10000
FileFlagsMask : 0x3f
FileFlags : 0
FileOS : 4
FileType : 2
FileSubtype : 0
# StringTable 040904B0:
CompanyName : ""
FileDescription : "ZFS DLL"
FileVersion : "1, 0, 0, 1"
InternalName : "ZFS"
LegalCopyright : "Copyright (C) 2016"
LegalTrademarks : ""
OriginalFilename : "ZFS.DLL"
ProductName : "ZFS Dynamic Link Library"
ProductVersion : "1, 0, 0, 1"
VarFileInfo : [ 0x409, 0x4b0 ]
=== Packer / Compiler ===
MS Visual C++ 6.0 DLL
File pos Mem pos ID Text
======== ======= == ====
00000000004D 00001000004D 0 !This program cannot be run in DOS mode.
0000000001E8 0000100001E8 0 .text
000000000210 000010000210 0 .rdata
000000000237 000010000237 0 @.data
000000000260 000010000260 0 .rsrc
000000000287 000010000287 0 @.reloc
000000001BA6 000010001BA6 0 WWhxr
00000000247E 00001000247E 0 HtlHtTHt5Ht
000000002CB4 000010002CB4 0 QSUVW
000000002D2B 000010002D2B 0 QSUVW3
00000000307C 00001000307C 0 t/HHt"+
000000003A48 000010003A48 0 t WVS
000000003A75 000010003A75 0 u7WPS
000000003A86 000010003A86 0 u&WVS
000000005F30 000010005F30 0 MFC42.DLL
000000005F3C 000010005F3C 0 __CxxFrameHandler
000000005F50 000010005F50 0 _EH_prolog
000000005F5E 000010005F5E 0 _vsnprintf
000000005F6C 000010005F6C 0 vprintf
000000005F7E 000010005F7E 0 strlen
000000005F88 000010005F88 0 _CxxThrowException
000000005F9E 000010005F9E 0 memcpy
000000005FA8 000010005FA8 0 memset
000000005FB2 000010005FB2 0 _purecall
000000005FBE 000010005FBE 0 __dllonexit
000000005FCC 000010005FCC 0 _onexit
000000005FD4 000010005FD4 0 MSVCRT.dll
000000005FE2 000010005FE2 0 ??1type_info@@UAE@XZ
000000006002 000010006002 0 _initterm
00000000600E 00001000600E 0 malloc
000000006018 000010006018 0 _adjust_fdiv
000000006028 000010006028 0 GetModuleFileNameA
00000000603E 00001000603E 0 TerminateThread
000000006050 000010006050 0 Sleep
000000006058 000010006058 0 GetProcAddress
00000000606A 00001000606A 0 LoadLibraryA
00000000607A 00001000607A 0 CreateThread
00000000608A 00001000608A 0 DeleteFileA
000000006096 000010006096 0 KERNEL32.dll
0000000060A6 0000100060A6 0 ??0Init@ios_base@std@@QAE@XZ
0000000060C6 0000100060C6 0 ??1Init@ios_base@std@@QAE@XZ
0000000060E6 0000100060E6 0 ??0_Winit@std@@QAE@XZ
0000000060FE 0000100060FE 0 ??1_Winit@std@@QAE@XZ
000000006114 000010006114 0 MSVCP60.dll
000000006122 000010006122 0 PathFileExistsA
000000006134 000010006134 0 PathAppendA
000000006140 000010006140 0 SHLWAPI.dll
000000006178 000010006178 0 ZFS.dll
00000000703C 00001000703C 0 Unload func called.
000000007050 000010007050 0 command file found
000000007070 000010007070 0 .?AVFileNotFoundException@@
00000000708C 00001000708C 0 Main dll, Can't process command.
0000000070B0 0000100070B0 0 Command file not found. Some shit happened, dude.
0000000070E2 0000100070E2 0 Smativay udochki!!!
0000000070F8 0000100070F8 0 Begin processing command.
000000007114 000010007114 0 log.txt
00000000711C 00001000711C 0 Logger is now on new TraceLevel: %s
000000007140 000010007140 0 UNKNOWN
00000000714C 00001000714C 0 TRACE
000000007154 000010007154 0 NOTICE
File pos Mem pos ID Text
======== ======= == ====
00000000715C 00001000715C 0 WARNING
000000007164 000010007164 0 ERROR
00000000716C 00001000716C 0 FATAL
000000007178 000010007178 0 Can't init XFS
000000007188 000010007188 0 msxfs.dll
000000007194 000010007194 0 Xfs init into dll
0000000071B0 0000100071B0 0 .?AVObject@System@@
0000000071D0 0000100071D0 0 .?AVException@System@CUniFramework@@
000000007200 000010007200 0 .?AVXfsException@@
000000007214 000010007214 0 WFSOpen
00000000721C 00001000721C 0 WFSStartUp
000000007228 000010007228 0 WFSFreeResult
000000007238 000010007238 0 WFSExecute
000000007244 000010007244 0 WFSGetInfo
000000007250 000010007250 0 Can't load xfs module.
000000007268 000010007268 0 System::Object
000000007278 000010007278 0 cant init ext mod
00000000728C 00001000728C 0 CommandProcessor created
0000000072B0 0000100072B0 0 .?AVXfsDispenseException@@
0000000072CC 0000100072CC 0 Trying to receive balance.
0000000072E8 0000100072E8 0 Internal in-dispense error
000000007304 000010007304 0 Can't dispense, Error code is: %d
000000007328 000010007328 0 Trying t dispense from CU %d
000000007348 000010007348 0 Processing dispense.
000000007360 000010007360 0 Setting device Id to %d
000000007378 000010007378 0 CDM HSERVICE is: %d
000000007390 000010007390 0 Unloading.
00000000739C 00001000739C 0 Received command "None". Is it really possible?
0000000073CC 0000100073CC 0 Begin process command.
0000000073E4 0000100073E4 0 XFS-> dispense end
0000000073F8 0000100073F8 0 Dispense, dispense device is %d
000000007418 000010007418 0 Currency ID: %s
000000007428 000010007428 0 XFS-> dispense start
000000007448 000010007448 0 .?AVXfsGetInfoException@@
000000007464 000010007464 0 Cash info-> unhandled exception.
000000007488 000010007488 0 %d dispenser id is invalid.
0000000074A4 0000100074A4 0 Valid CDM id is %d, dispense cash info received.
0000000074D8 0000100074D8 0 ICommandProcessor-> else block. Getting XFS-cash info
000000007510 000010007510 0 ICommandProcessor-> else block. get disp ID
00000000753C 00001000753C 0 ICommandProcessor-> else block.
00000000755C 00001000755C 0 %d dispenser id is invalid.
000000007578 000010007578 0 Xfs error code is %d
000000007590 000010007590 0 Trying auto determine CDM device id.
0000000075B8 0000100075B8 0 ICommandProcessor-> if-statement.
0000000075DC 0000100075DC 0 ICommandProcessor-> enter try block.
000000007604 000010007604 0 XFS-> before return result List<WFSCDMCASHUNIT>
000000007634 000010007634 0 XFS-> found info about %d cash units
00000000765C 00001000765C 0 Received cash info:
000000007670 000010007670 0 ========== %d =========
000000007689 000010007689 0 CU state: %d Type: %d
0000000076A1 0000100076A1 0 Values: %d
0000000076AD 0000100076AD 0 Currency ID:%s
0000000076BD 0000100076BD 0 Money count: %d
0000000076D0 0000100076D0 0 Begin format %d CU
0000000076E4 0000100076E4 0 -command file name is %s
000000007700 000010007700 0 Command provider created
00000000771C 00001000771C 0 Found command code: %d command.
00000000773C 00001000773C 0 Unknown command abbreviature %s
000000007760 000010007760 0 found %d command lines
000000007778 000010007778 0 command file removed
File pos Mem pos ID Text
======== ======= == ====
000000007790 000010007790 0 Command file name is: %s
0000000077B8 0000100077B8 0 .?AVIOException@@
0000000077D8 0000100077D8 0 .?AVtype_info@@
000000009008 000010009008 0 1070<0H0N0]0c0h0t0z0
000000009021 000010009021 0 1C1}1
000000009039 000010009039 0 2\2r2x2
00000000904B 00001000904B 0 243G3M3b3
000000009081 000010009081 0 6.646:6L6[6
000000009095 000010009095 0 7&737:7@7V7r7
0000000090A7 0000100090A7 0 788>8
0000000090B3 0000100090B3 0 909_9y9
0000000090D5 0000100090D5 0 :A:M:]:j:o:w:
0000000090F3 0000100090F3 0 ;2;Z;n;y;
00000000910B 00001000910B 0 <4<:<F<a<
000000009121 000010009121 0 =2>C>
000000009149 000010009149 0 434[4
00000000915B 00001000915B 0 5E5U5
000000009161 000010009161 0 5l5u5
00000000916D 00001000916D 0 6,7N7V7
000000009181 000010009181 0 858=8\8s8
000000009191 000010009191 0 9$9]9
0000000091A1 0000100091A1 0 : :8:V:
0000000091B5 0000100091B5 0 ;,<s<
0000000091C9 0000100091C9 0 >->3>8>D>J>R>u>{>
0000000091DF 0000100091DF 0 >,?]?v?
00000000921F 00001000921F 0 424u4
000000009245 000010009245 0 8 8&8,82888>8D8J8P8V8\8b8h8n8t8z8
00000000928F 00001000928F 0 929T9Z9
000000009297 000010009297 0 9f9l9z9
0000000092BB 0000100092BB 0 :0:B:
0000000092C9 0000100092C9 0 : ;5;I;e;y;
0000000092D7 0000100092D7 0 <0<E<Y<p<}<
0000000092ED 0000100092ED 0 =%=9=t=
0000000092FB 0000100092FB 0 >1>E>l>
000000009305 000010009305 0 > ?L?
000000009320 000010009320 0 014181<1@1D1H1L1P1T1X1\1
000000009339 000010009339 0 1d1h1l1p1t1x1|1
000000009397 000010009397 0 2 2(2@2T2d2h2x2
0000000093B7 0000100093B7 0 3$30383L3\3
0000000093D7 0000100093D7 0 4$4,444<4D4L4X4t4|4
0000000093FB 0000100093FB 0 5 5<5H5d5p5x5
000000009417 000010009417 0 6$6(6,646<6H6d6p6x6
000000009437 000010009437 0 7 7<7D7P7X7l7t7|7
000000009461 000010009461 0 848@8\8h8p8
00000000947D 00001000947D 0 9$9,9<9D9X9d9h9l9p9|9
0000000094A5 0000100094A5 0 : :<:D:L:X:t:
0000000094C3 0000100094C3 0 ;$;,;4;<;D;L;T;\;h;
0000000094F3 0000100094F3 0 <(<4<8<<<D<L<T<\<h<
000000009519 000010009519 0 =4=@=\=h=
000000009539 000010009539 0 0 00040h0
000000008066 000010008066 0 VS_VERSION_INFO
0000000080C2 0000100080C2 0 StringFileInfo
0000000080E6 0000100080E6 0 040904B0
0000000080FE 0000100080FE 0 CompanyName
00000000811E 00001000811E 0 FileDescription
000000008140 000010008140 0 ZFS DLL
000000008156 000010008156 0 FileVersion
000000008170 000010008170 0 1, 0, 0, 1
00000000818E 00001000818E 0 InternalName
0000000081B6 0000100081B6 0 LegalCopyright
File pos Mem pos ID Text
======== ======= == ====
0000000081D4 0000100081D4 0 Copyright (C) 2016
000000008202 000010008202 0 LegalTrademarks
00000000822A 00001000822A 0 OriginalFilename
00000000824C 00001000824C 0 ZFS.DLL
000000008262 000010008262 0 ProductName
00000000827C 00001000827C 0 ZFS Dynamic Link Library
0000000082B6 0000100082B6 0 ProductVersion
0000000082D4 0000100082D4 0 1, 0, 0, 1
0000000082F2 0000100082F2 0 VarFileInfo
000000008312 000010008312 0 Translation
00000000004D 00001000004D 0 !This program cannot be run in DOS mode.
0000000001E8 0000100001E8 0 .text
000000000210 000010000210 0 .rdata
000000000237 000010000237 0 @.data
000000000260 000010000260 0 .rsrc
000000000287 000010000287 0 @.reloc
000000001BA6 000010001BA6 0 WWhxr
00000000247E 00001000247E 0 HtlHtTHt5Ht
000000002CB4 000010002CB4 0 QSUVW
000000002D2B 000010002D2B 0 QSUVW3
00000000307C 00001000307C 0 t/HHt"+
000000003A48 000010003A48 0 t WVS
000000003A75 000010003A75 0 u7WPS
000000003A86 000010003A86 0 u&WVS
000000005F30 000010005F30 0 MFC42.DLL
000000005F3C 000010005F3C 0 __CxxFrameHandler
000000005F50 000010005F50 0 _EH_prolog
000000005F5E 000010005F5E 0 _vsnprintf
000000005F6C 000010005F6C 0 vprintf
000000005F7E 000010005F7E 0 strlen
000000005F88 000010005F88 0 _CxxThrowException
000000005F9E 000010005F9E 0 memcpy
000000005FA8 000010005FA8 0 memset
000000005FB2 000010005FB2 0 _purecall
000000005FBE 000010005FBE 0 __dllonexit
000000005FCC 000010005FCC 0 _onexit
000000005FD4 000010005FD4 0 MSVCRT.dll
000000005FE2 000010005FE2 0 ??1type_info@@UAE@XZ
000000006002 000010006002 0 _initterm
00000000600E 00001000600E 0 malloc
000000006018 000010006018 0 _adjust_fdiv
000000006028 000010006028 0 GetModuleFileNameA
00000000603E 00001000603E 0 TerminateThread
000000006050 000010006050 0 Sleep
000000006058 000010006058 0 GetProcAddress
00000000606A 00001000606A 0 LoadLibraryA
00000000607A 00001000607A 0 CreateThread
00000000608A 00001000608A 0 DeleteFileA
000000006096 000010006096 0 KERNEL32.dll
0000000060A6 0000100060A6 0 ??0Init@ios_base@std@@QAE@XZ
0000000060C6 0000100060C6 0 ??1Init@ios_base@std@@QAE@XZ
0000000060E6 0000100060E6 0 ??0_Winit@std@@QAE@XZ
0000000060FE 0000100060FE 0 ??1_Winit@std@@QAE@XZ
000000006114 000010006114 0 MSVCP60.dll
000000006122 000010006122 0 PathFileExistsA
000000006134 000010006134 0 PathAppendA
000000006140 000010006140 0 SHLWAPI.dll
000000006178 000010006178 0 ZFS.dll
00000000703C 00001000703C 0 Unload func called.
000000007050 000010007050 0 command file found
File pos Mem pos ID Text
======== ======= == ====
000000007070 000010007070 0 .?AVFileNotFoundException@@
00000000708C 00001000708C 0 Main dll, Can't process command.
0000000070B0 0000100070B0 0 Command file not found. Some shit happened, dude.
0000000070E2 0000100070E2 0 Smativay udochki!!!
0000000070F8 0000100070F8 0 Begin processing command.
000000007114 000010007114 0 log.txt
00000000711C 00001000711C 0 Logger is now on new TraceLevel: %s
000000007140 000010007140 0 UNKNOWN
00000000714C 00001000714C 0 TRACE
000000007154 000010007154 0 NOTICE
00000000715C 00001000715C 0 WARNING
000000007164 000010007164 0 ERROR
00000000716C 00001000716C 0 FATAL
000000007178 000010007178 0 Can't init XFS
000000007188 000010007188 0 msxfs.dll
000000007194 000010007194 0 Xfs init into dll
0000000071B0 0000100071B0 0 .?AVObject@System@@
0000000071D0 0000100071D0 0 .?AVException@System@CUniFramework@@
000000007200 000010007200 0 .?AVXfsException@@
000000007214 000010007214 0 WFSOpen
00000000721C 00001000721C 0 WFSStartUp
000000007228 000010007228 0 WFSFreeResult
000000007238 000010007238 0 WFSExecute
000000007244 000010007244 0 WFSGetInfo
000000007250 000010007250 0 Can't load xfs module.
000000007268 000010007268 0 System::Object
000000007278 000010007278 0 cant init ext mod
00000000728C 00001000728C 0 CommandProcessor created
0000000072B0 0000100072B0 0 .?AVXfsDispenseException@@
0000000072CC 0000100072CC 0 Trying to receive balance.
0000000072E8 0000100072E8 0 Internal in-dispense error
000000007304 000010007304 0 Can't dispense, Error code is: %d
000000007328 000010007328 0 Trying t dispense from CU %d
000000007348 000010007348 0 Processing dispense.
000000007360 000010007360 0 Setting device Id to %d
000000007378 000010007378 0 CDM HSERVICE is: %d
000000007390 000010007390 0 Unloading.
00000000739C 00001000739C 0 Received command "None". Is it really possible?
0000000073CC 0000100073CC 0 Begin process command.
0000000073E4 0000100073E4 0 XFS-> dispense end
0000000073F8 0000100073F8 0 Dispense, dispense device is %d
000000007418 000010007418 0 Currency ID: %s
000000007428 000010007428 0 XFS-> dispense start
000000007448 000010007448 0 .?AVXfsGetInfoException@@
000000007464 000010007464 0 Cash info-> unhandled exception.
000000007488 000010007488 0 %d dispenser id is invalid.
0000000074A4 0000100074A4 0 Valid CDM id is %d, dispense cash info received.
0000000074D8 0000100074D8 0 ICommandProcessor-> else block. Getting XFS-cash info
000000007510 000010007510 0 ICommandProcessor-> else block. get disp ID
00000000753C 00001000753C 0 ICommandProcessor-> else block.
00000000755C 00001000755C 0 %d dispenser id is invalid.
000000007578 000010007578 0 Xfs error code is %d
000000007590 000010007590 0 Trying auto determine CDM device id.
0000000075B8 0000100075B8 0 ICommandProcessor-> if-statement.
0000000075DC 0000100075DC 0 ICommandProcessor-> enter try block.
000000007604 000010007604 0 XFS-> before return result List<WFSCDMCASHUNIT>
000000007634 000010007634 0 XFS-> found info about %d cash units
00000000765C 00001000765C 0 Received cash info:
000000007670 000010007670 0 ========== %d =========
000000007689 000010007689 0 CU state: %d Type: %d
File pos Mem pos ID Text
======== ======= == ====
0000000076A1 0000100076A1 0 Values: %d
0000000076AD 0000100076AD 0 Currency ID:%s
0000000076BD 0000100076BD 0 Money count: %d
0000000076D0 0000100076D0 0 Begin format %d CU
0000000076E4 0000100076E4 0 -command file name is %s
000000007700 000010007700 0 Command provider created
00000000771C 00001000771C 0 Found command code: %d command.
00000000773C 00001000773C 0 Unknown command abbreviature %s
000000007760 000010007760 0 found %d command lines
000000007778 000010007778 0 command file removed
000000007790 000010007790 0 Command file name is: %s
0000000077B8 0000100077B8 0 .?AVIOException@@
0000000077D8 0000100077D8 0 .?AVtype_info@@
000000009008 000010009008 0 1070<0H0N0]0c0h0t0z0
000000009021 000010009021 0 1C1}1
000000009039 000010009039 0 2\2r2x2
00000000904B 00001000904B 0 243G3M3b3
000000009081 000010009081 0 6.646:6L6[6
000000009095 000010009095 0 7&737:7@7V7r7
0000000090A7 0000100090A7 0 788>8
0000000090B3 0000100090B3 0 909_9y9
0000000090D5 0000100090D5 0 :A:M:]:j:o:w:
0000000090F3 0000100090F3 0 ;2;Z;n;y;
00000000910B 00001000910B 0 <4<:<F<a<
000000009121 000010009121 0 =2>C>
000000009149 000010009149 0 434[4
00000000915B 00001000915B 0 5E5U5
000000009161 000010009161 0 5l5u5
00000000916D 00001000916D 0 6,7N7V7
000000009181 000010009181 0 858=8\8s8
000000009191 000010009191 0 9$9]9
0000000091A1 0000100091A1 0 : :8:V:
0000000091B5 0000100091B5 0 ;,<s<
0000000091C9 0000100091C9 0 >->3>8>D>J>R>u>{>
0000000091DF 0000100091DF 0 >,?]?v?
00000000921F 00001000921F 0 424u4
000000009245 000010009245 0 8 8&8,82888>8D8J8P8V8\8b8h8n8t8z8
00000000928F 00001000928F 0 929T9Z9
000000009297 000010009297 0 9f9l9z9
0000000092BB 0000100092BB 0 :0:B:
0000000092C9 0000100092C9 0 : ;5;I;e;y;
0000000092D7 0000100092D7 0 <0<E<Y<p<}<
0000000092ED 0000100092ED 0 =%=9=t=
0000000092FB 0000100092FB 0 >1>E>l>
000000009305 000010009305 0 > ?L?
000000009320 000010009320 0 014181<1@1D1H1L1P1T1X1\1
000000009339 000010009339 0 1d1h1l1p1t1x1|1
000000009397 000010009397 0 2 2(2@2T2d2h2x2
0000000093B7 0000100093B7 0 3$30383L3\3
0000000093D7 0000100093D7 0 4$4,444<4D4L4X4t4|4
0000000093FB 0000100093FB 0 5 5<5H5d5p5x5
000000009417 000010009417 0 6$6(6,646<6H6d6p6x6
000000009437 000010009437 0 7 7<7D7P7X7l7t7|7
000000009461 000010009461 0 848@8\8h8p8
00000000947D 00001000947D 0 9$9,9<9D9X9d9h9l9p9|9
0000000094A5 0000100094A5 0 : :<:D:L:X:t:
0000000094C3 0000100094C3 0 ;$;,;4;<;D;L;T;\;h;
0000000094F3 0000100094F3 0 <(<4<8<<<D<L<T<\<h<
000000009519 000010009519 0 =4=@=\=h=
000000009539 000010009539 0 0 00040h0
File pos Mem pos ID Text
======== ======= == ====
000000008066 000010008066 0 VS_VERSION_INFO
0000000080C2 0000100080C2 0 StringFileInfo
0000000080E6 0000100080E6 0 040904B0
0000000080FE 0000100080FE 0 CompanyName
00000000811E 00001000811E 0 FileDescription
000000008140 000010008140 0 ZFS DLL
000000008156 000010008156 0 FileVersion
000000008170 000010008170 0 1, 0, 0, 1
00000000818E 00001000818E 0 InternalName
0000000081B6 0000100081B6 0 LegalCopyright
0000000081D4 0000100081D4 0 Copyright (C) 2016
000000008202 000010008202 0 LegalTrademarks
00000000822A 00001000822A 0 OriginalFilename
00000000824C 00001000824C 0 ZFS.DLL
000000008262 000010008262 0 ProductName
00000000827C 00001000827C 0 ZFS Dynamic Link Library
0000000082B6 0000100082B6 0 ProductVersion
0000000082D4 0000100082D4 0 1, 0, 0, 1
0000000082F2 0000100082F2 0 VarFileInfo
000000008312 000010008312 0 Translation