shadowbrokers-exploits/oddjob/Not-For-Release/oddjob_v3_x64.dllstrings.txt

!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.pdata
@.rsrc
@.reloc
x ATAUAVH
L$(3
yxxxI
A^A]A\
D$ ~>
T$PH
D$PH
T$PH
T$PH
L$PL
D$PL+
L$ H
D$ H
L$dA
D$ H
L$ A
D$dH
T$ H
D$ H
T$ H
L$ A
D$dH
T$dA
D$dH
D$ H
T$ H
D$dH
T$dH
D$dH
T$dH
L$dA
T$ H
D$dH
T$ A
D$ H
L$dH
D$dH
D$ H
D$ H
D$ H
D$dA
D$ H
L$dA
T$ H
T$ H
D$dH
T$ H
D$ H
D$X3
L$XH
T$@H
9\$@
L$XE3
D$PH
L$PH
T$ H
L$PH
;\$@s
L$XH
D$PH
\$HH
SUVWATH
D$HH
L$0L
L$0I;
d$0H
D$0H
L$HH3
PA\_^][
D$HL
L$0L
L$0H
L$HH3
T$0A
;|$0
\$8H
p WATAUAVAWH
l$(H
D$`H
L$`H
L$`I;
|$`I;
l$pH
\$hH
0A_A^A]A\_
L$8L
D$0E3
L$0H
T$@H
L$0H
L$8H
L$8L
D$0E3
L$0H
T$@H
L$0H
L$8H
UVWH
D$hH
L$hL
D$`H
T$ H
L$`H
t;H;t$`v4H
T$`D
D$PH
L$hH
L$ H
T$`H
\$XH
0_^]
T$ H
T$PH
uf!D$X3
D$\D
D$(D
D$dH
D$hH;D$`v
T$PH+D$`i
WATAUAVAW
t$xI
D$xL
D$xL
D$ D
\$pE;
\$pA;
L$pA;
T$p;
L$ H
L$(H
PHA;
L$pA;
P8A;
\$pA;
L$p;
L$(H
L$p;
\$pH
\$pA;
d$xM;
L$pH
\$pH
\$pA;
|$ A
|$ A
L$pI;
gfffD
gfff
gfffH
D$`D
|$XD
t$PD
l$HD
|$pA;
|$pI;
P8A;
|$pH
uhI;
L$xH
d$xM;
A_A^A]A\_
[ UVWATAUAVAWH
D$PL
T$pA
l$hH;
L$XI
T$XL
L$pL
l$0E3
L$`D
9|$`u
tNL;
uLL;
r-H;
|$PH
D$hH
L$hM
|$0E3
L$\H
9D$\tN
D$xE3
D$HH
D$@H
l$8H
l$0I
D$hH;
A_A^A]A\_^]
WATAUAVAWH
L$HE
D$ H
L$HH
D$PE3
L$PE3
D$PH
L$HH
D$@E3
L$@H
l$0H
D$(E3
L$@H
l$0H
D$(E3
L$@H
D$(E3
L$@H
D$(E
L$PH
L$@H
L$HH
A_A^A]A\_
UVWATAUAVAWH
D$8E3
L$@E
u#M;
L$(L
|$$E3
L$ M
L$PH
D$ H
DDPfA
D$ #
DLPHc
D$"H
DLPfA
DDPfA
F<fA
l$0L
l$8D
|$$E3
A_A^A]A\_^]
@SUVWATAUAVAWH
D$8E3
T$=E3
-t	A;
Ll0I
L$0D
D$"fD9T$4u
fD9T$6
r4Hc
T$ L
L$(D
L$8H3
HA_A^A]A\_^][
H VWATH
D$?H
L$0E
D$ @
L$0E
D$ H
L$0L
L$0H
A\_^
UVWATAUH
D$ A
D$!P
D$"A
D$#Q
D$$A
D$%R
D$&A
D$'S
D$(A
D$)T
D$*A
D$+U
D$,A
D$-V
D$.A
D$/W
D$0U
D$1V
D$2W
D$3R
D$4Q
D$5S
D$6P
D$7j
D$Z 
D$^@
T$ H
A]A\_^]
s WATAUAVAWH
|$@fE
|$0H
L$@E
A_A^A]A\_
T$PH
D$P8
L$lD
L$pD
D$XH
D$|H
L$ H
T$PH
t	A;
\$0H
L$$3
!\$ A
T$ H
D$ 8
tw;l$(t
T$ H
L$LH;
|$@H
T$ H
t.;|$(t
T$ H
s WH
T$DH
9l$Dt
T$@H
L$@H
l$8H
l$0L
l$(H
L$@H
l$8H
l$0L
L$@@
T$@H
L$@H
l$8H
l$0L
l$(H
L$@H
l$8H
l$0L
UVWATAUAVAWH
L$ A
D$0M
|$(H
T$0L
t.L;
T$0L
@A_A^A]A\_^]
x ATAUAWH
\$hD
D$`D
\$@H
l$HH
|$XH
 A_A]A\
VWATH
L$"E3
SuTL
L$ H
T$ A
T$*H
A\_^
UVWATAUAVAWH
D$XL
L$0L
D$`I;
D$@I;
L$8M
|$8A
T$HA;
T$HI
L$LA
|$@Ic
T$8I
D$HE
D$(H
T$8L
L$0I
T$8L
L$0M
|$`H
L$XE3
l$XH
D$hH
|$@M;
pA_A^A]A\_^]
l$ VWATH
L$B3
d$0D
D$@H
|$(i
A\_^
WATAUH
D$ A
d$ A
L$hH
D$`E3
\$`E;
L$`H
L$hH
D$`L
D9#v/H
T$pH
A]A\_
t7SH
\$0H
t$8H
L$@H
L$0H
D$HB
L$0H
T$03
T$03
T$0I
*!Nb
\$@H
\$0H
\$0H
t$8H
L$0I
\$0A
t<f;
T$0f
\$`H
l$hH
t$pH
twH;
t$H+
u-fD!
D$0A
\$0H
t$8H
SVWH
uoE3
\$ E3
\$ H
EP=csm
Ep=csm
E`=csm
=csm
E(=csm
E@=csm
EX=csm
Ex=csm
\$0H
t$8H
D$XE3
T$`H
D$PH
D$HH
D$0H
D$@H
D$(H
D$ L
L$PL
D$XH
T$`3
D$hH
D$p3
D$0A
D$0A
\$0H
\$0H
D$ H
\$ H;
\$@H
t$HH
|$XH
|$ AUH
t,Hc
L$HH!D$ H
\$@H
l$PH
|$XH
D$0H
\$8H
l$@H
t$HH
\$0H
\$0H
l$8H
t$@H
\$0H
l$8H
t$@H
UVWATAUAVAWH
L$p3
L$PD
L$DH
H!l$ E3
t$@H
D$XD
d$Dt=
D$TH
T$TH
d$DH
D$xA
D$\0
t$xH
L$LA
t$@H
l$H+
guKA
l$H~.A
l$HI
L$0H
t$(D
t$@D
D$\-
D$\+
D$\ 
|$LD
l$PH
t$pE+
L$@L
L$@H
L$\L
|$pt
L$@L
L$XLc
L$XL
L$@L
L$@L
t$@D
l$HH
T$dA
A_A^A]A\_^]
T$pL
D$@A
!D$h!D$P!D$LA
D$DD
T$@H
T$@H
L$HH
L$0H
L$PL
L$(H
L$`L
L$ 3
D$`H
\$0H
\$0H
L$0H
L$0H;
H;=4
\$8H
\$0H
t$8H
D$p H
D$(H
D$8H
\$0H
D$(L
L$pD
D$8H
\$0H
D$(L
L$pA
\$0H;
L$0H;
\$8H
L$ 3
UVWATAUH
D$8H
D9d$ 
8\$&H
D$&t18X
t18Y
L$8H3
@A]A\_^]
` AUH
T$ L
\$@H
t$HH
|$PL
d$XH
\$0H
t$8H
\$@A
L$pA
D$@f
T$pH
L$pH
D$8H
D$pt
\$0H
l$8H
t$@H
` AUH
D$hH
tHHc
\$0H
\$@H
l$HH
|$PH
t$ WATAUAVAWH
d$pE
D$pD
|$PA
D$pA9
;"u<
E9<$
< tO<	tK
D$pA9
\$XH
l$`H
t$hH
 A_A^A]A\_
D$HL
L$@E3
D$HH
t>HcD$@L
L$@H
D$HH
\$@A
\$PH
l$(H
\$PH
l$XH
t$`H
L$8D
\$8L3
\$@H
WATAUAVAWH
)IcyHM
a8M+
A;<$
L$0H
>csm
D$(H
A;<$sr
q I+
A;<$s\H
s8H;
A;<$r
\$@I
A_A^A]A\_
u,Hc
\$0H
t$8H
|$@H
\$0H
l$8H
t$@H
\$0H
t$8H
|$@H
\$0H
\$0H
9MZu
HcQ<
LcA<E3
@SUH
WATAUAVAWH
|$p3
H!t$ E3
|$8D
|$8H
}+Hc
\$@I
A_A^A]A\_
WATAUH
!l$0H9-6
H!l$ E3
H9=F
L$4A
L$ A
D$8H
H!l$ E3
\$PI
A]A\_
T$8L
D$<D
D$8u
D$8H
\$0H
WATAUAVAWH
|$ E3
|$ E3
\$hH
t$pH
0A_A^A]A\_
\$ UVWATAUAVAWH
t$Du
H!t$ E3
l$XMk
T$LH
!t$PE
D$LI
L$@H
\$LD
L$@A
D$`L
D$@A
D$XH
L$PH
T$`I
t$P9l$P
D$XH
L$PH
T$`H
D$@A
f;D$@u:
f;D$@u
|$p3
H!\$ H
D$pD
D$XH
L$HH
T$pI
t$HH
D$pH+
HcD$HH;
|$p3
H!\$ H
D$pD
D$XH
L$HH
T$pI
t3HcL$HH
D$pH+
D$pH
D$XH
L$HD+
l$HD;
H!t$ L
L$HE
t$H3
l$XH
A_A^A]A\_^]
WATAUAVAWH
|$ E3
|$ E3
\$hH
t$pH
0A_A^A]A\_
s'Hc
w&H+
w&H+
l$ VWAUH
L$!H
T$$H
L$ D
9\$ ~
;\$ |
L$0H3
\$pH
l$xH
@A]_^
\$`H
t$hH
L$0I
\$0A
L$0D
~0A;
D$(H
L$0u
D$(H
D$0H
D$ D
L$ 3
D$ D
x ATH
l$8H
t$@H
|$HH
\$0H
L$ D
UVWATAUAVAWH
l$@H
!|$(H!|$ E
t$@H
u"Ic
|$(H
t$ E
L$(H
D$ E
|$@H
l$(H
|$ E
!D$(H
D$(H
D$ E
MHH3
ePA_A^A]A\_^]
L$PI
L$PD
D$0H
\$pI
@UATAUAVAWH
l$0H
\$0H;
d$(H
A_A^A]A\]
L$@A
L$@D
D$(H
\$pH
t$xH
tBSH
K H;
K(H;
K0H;
K8H;
K@H;
KHH;
tuH+
L$0I
D$(H
\$`H
t$hH
L$@I
D$pH
D$0A
D$(H
D$xH
f#D$x
D$xt
L$ A
D$(D
D$ H
\$PH
t$XH
L$03
D$@H
D$ H
smHc
\$0H
l$8H
sSHc
` AUH
\$0H
t$8H
|$@L
d$HH
L$HH
T$@A
\$ ;
}kLc
\$@H
t$HH
t$8H
\$0H
AUAVAWH
|$ A
t$(H
t$PH
|$XL
d$`H
0A_A^A]
HcM H
VWATH
\$@H
l$PH
 A\_^
L$ UVWH
\$@A9k
vLH;
@8l$X
`_^]
tCH;
@8l$X
@8l$X
D$8H
l$0L
|$(H
@8l$X
x ATH
\$0H
l$8H
t$@H
@UATAUH
l$ H
d$ A
MhH3
epA]A\]
L$ A
L$pD
\$PH
t$XH
H!\$ E3
\$@H
\$HH
VWATH
;=nz
\$`H
0A\_^
\$0H
WATAUH
\$`H
t$hH
0A]A\_
CorExitProcess
runtime error 
TLOSS error
SING error
DOMAIN error
R6034
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
R6033
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
R6032
- not enough space for locale information
R6031
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
R6030
- CRT not initialized
R6028
- unable to initialize heap
R6027
- not enough space for lowio initialization
R6026
- not enough space for stdio initialization
R6025
- pure virtual function call
R6024
- not enough space for _onexit/atexit table
R6019
- unable to open console device
R6018
- unexpected heap error
R6017
- unexpected multithread lock error
R6016
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
R6009
- not enough space for environment
R6008
- not enough space for arguments
R6002
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program: 
(null)
Invalid parameter passed to C runtime function.
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
( 8PX
700WP
`h````
xpxxxx
('8PW
700PP
`h`hhh
xppwpp
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
July
June
April
March
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
IsWow64Process
alwo
p	Pf
E%C 
GetSystemTimeAsFileTime
GetModuleFileNameW
SetErrorMode
GetFileAttributesW
TerminateProcess
GetTempPathW
MoveFileW
CloseHandle
GetWindowsDirectoryW
DeleteFileW
GetCurrentProcessId
GetTempFileNameW
GetFileSize
MoveFileExW
WriteFile
ReadFile
CreateFileW
GetLastError
ExitProcess
VirtualQuery
CreateProcessW
VirtualFree
OpenProcess
SetLastError
VirtualAlloc
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetEnvironmentVariableW
GetCurrentProcess
GetComputerNameW
GetModuleHandleW
WideCharToMultiByte
GetVersionExW
GetProcAddress
LocalAlloc
LocalFree
FindResourceW
LoadResource
SizeofResource
LockResource
HeapFree
HeapAlloc
HeapReAlloc
FlsSetValue
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
OutputDebugStringA
EncodePointer
DecodePointer
FlsFree
FlsGetValue
GetCurrentThreadId
FlsAlloc
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
RtlUnwindEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
Sleep
LCMapStringW
GetStringTypeW
SetStdHandle
WriteConsoleW
VirtualProtect
SetThreadStackGuarantee
GetSystemInfo
FlushFileBuffers
KERNEL32.dll
wsprintfW
USER32.dll
CryptAcquireContextW
CryptDeriveKey
CryptReleaseContext
CryptGenRandom
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
OpenProcessToken
GetUserNameW
GetTokenInformation
EqualSid
AllocateAndInitializeSid
FreeSid
ADVAPI32.dll
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitializeEx
ole32.dll
ABABABABABABABABABAB.dll
start
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
mscoree.dll
(null)
USER32.DLL
         (((((                  H
         h((((                  H
                                 H
CONOUT$
kernel32
https
https
https
version
%s%s%d%d%s
COMMONPROGRAMFILES(x86)
<Process pid=%d ppid=%d threadCount=%d %s\>
%s\%s
rundll
rundll32
rundll32
BINARY
Microsoft Enhanced Cryptographic Provider v1.0
Microsoft Enhanced Cryptographic Provider v1.0
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-
Microsoft Enhanced Cryptographic Provider v1.0
Microsoft Enhanced Cryptographic Provider v1.0
Process id: %lu
%s/%s%s
%s\Temp\%s
%s%s
%s%d%dupdate.xml
%s/%d%dupdate.xml
%s/uploads/%d%d%d%d%d%d%d%d%d%s
rundll32.exe "%s",%S %s%s
rundll32.exe