.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ----  -------------.
!  WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV                                                      !
`--------------  - ---  ---------- -------- -------- -------- -------- ----------------- -  ---- ---- --'

                                           ATM MALWARE NOTICE 
                    d99339d3dc6891cdd832754c5739640c62cd229c84e04e9e3cad743c6f66b1b9
 
Date...........: 2013-10-24
Family.........: Ploutus
File name......: pulsar.exe
File size......: 32.00 KB
Type file......: EXE/Windows
Virscan........: VT - HA
Documentation..: https://www.symantec.com/connect/blogs/backdoorploutus-reloaded-ploutus-leaves-mexico

Entropy:


Binary Histogram:


=== PEDUMP REPORT === 
=== MZ Header === signature: "MZ" bytes_in_last_block: 144 0x90 blocks_in_file: 3 3 num_relocs: 0 0 header_paragraphs: 4 4 min_extra_paragraphs: 0 0 max_extra_paragraphs: 65535 0xffff ss: 0 0 sp: 184 0xb8 checksum: 0 0 ip: 0 0 cs: 0 0 reloc_table_offset: 64 0x40 overlay_number: 0 0 reserved0: 0 0 oem_id: 0 0 oem_info: 0 0 reserved2: 0 0 reserved3: 0 0 reserved4: 0 0 reserved5: 0 0 reserved6: 0 0 lfanew: 128 0x80 === DOS STUB === 00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......| === PE Header === signature: "PE\x00\x00" # IMAGE_FILE_HEADER: Machine: 332 0x14c x86 NumberOfSections: 3 3 TimeDateStamp: "2013-07-24 07:09:14" PointerToSymbolTable: 0 0 NumberOfSymbols: 0 0 SizeOfOptionalHeader: 224 0xe0 Characteristics: 258 0x102 EXECUTABLE_IMAGE, 32BIT_MACHINE # IMAGE_OPTIONAL_HEADER32: Magic: 267 0x10b 32-bit executable LinkerVersion: 8.0 SizeOfCode: 30208 0x7600 SizeOfInitializedData: 2048 0x800 SizeOfUninitializedData: 0 0 AddressOfEntryPoint: 37966 0x944e BaseOfCode: 8192 0x2000 BaseOfData: 0 0 ImageBase: 4194304 0x400000 SectionAlignment: 8192 0x2000 FileAlignment: 512 0x200 OperatingSystemVersion: 4.0 ImageVersion: 0.0 SubsystemVersion: 4.0 Reserved1: 0 0 SizeOfImage: 57344 0xe000 SizeOfHeaders: 512 0x200 CheckSum: 0 0 Subsystem: 2 2 WINDOWS_GUI DllCharacteristics: 34112 0x8540 DYNAMIC_BASE, NX_COMPAT, NO_SEH TERMINAL_SERVER_AWARE SizeOfStackReserve: 1048576 0x100000 SizeOfStackCommit: 4096 0x1000 SizeOfHeapReserve: 1048576 0x100000 SizeOfHeapCommit: 4096 0x1000 LoaderFlags: 0 0 NumberOfRvaAndSizes: 16 0x10 === DATA DIRECTORY === EXPORT rva:0x 0 size:0x 0 IMPORT rva:0x 93fc size:0x 4f RESOURCE rva:0x a000 size:0x 600 EXCEPTION rva:0x 0 size:0x 0 SECURITY rva:0x 0 size:0x 0 BASERELOC rva:0x c000 size:0x c DEBUG rva:0x 0 size:0x 0 ARCHITECTURE rva:0x 0 size:0x 0 GLOBALPTR rva:0x 0 size:0x 0 TLS rva:0x 0 size:0x 0 LOAD_CONFIG rva:0x 0 size:0x 0 Bound_IAT rva:0x 0 size:0x 0 IAT rva:0x 2000 size:0x 8 Delay_IAT rva:0x 0 size:0x 0 CLR_Header rva:0x 2008 size:0x 48 rva:0x 0 size:0x 0 === SECTIONS === NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS .text 2000 7454 7600 200 0 0 0 0 60000020 R-X CODE .rsrc a000 600 600 7800 0 0 0 0 40000040 R-- IDATA .reloc c000 c 200 7e00 0 0 0 0 42000040 R-- IDATA DISCARDABLE === RESOURCES === FILE_OFFSET CP LANG SIZE TYPE NAME 0x78a0 0 0 736 VERSION #1 0x7b80 0 0 490 MANIFEST #1 === IMPORTS === MODULE_NAME HINT ORD FUNCTION_NAME mscoree.dll 0 _CorExeMain === VERSION INFO === # VS_FIXEDFILEINFO: FileVersion : 1.0.0.0 ProductVersion : 1.0.0.0 StrucVersion : 0x10000 FileFlagsMask : 0x3f FileFlags : 0 FileOS : 4 FileType : 1 FileSubtype : 0 VarFileInfo : [ 0x0, 0x4b0 ] # StringTable 000004b0: CompanyName : "Ploutos" FileDescription : "Ploutos" FileVersion : "1.0.0.0" InternalName : "Ploutos.exe" LegalCopyright : "Copyright \u00A9 Ploutos 2013" OriginalFilename : "Ploutos.exe" ProductName : "Ploutos" ProductVersion : "1.0.0.0" Assembly Version : "1.0.0.0" === Packer / Compiler === MS Visual C# / Basic .NET
=== Strings ===
File pos Mem pos ID Text ======== ======= == ==== 00000000004D 00000040004D 0 !This program cannot be run in DOS mode. 000000000178 000000400178 0 .text 0000000001A0 0000004001A0 0 .rsrc 0000000001C7 0000004001C7 0 @.reloc 0000000002A7 0000004020A7 0 aaX ; 0000000002AF 0000004020AF 0 9#8wY 0000000002C4 0000004020C4 0 a +l7EXY 0000000002D4 0000004020D4 0 UKY z 0000000002DE 0000004020DE 0 MrG AB.m 0000000002E9 0000004020E9 0 AkaaYYaaYa 00000000032E 00000040212E 0 ,O s 0000000003E7 0000004021E7 0 LYXaa 0000000003FF 0000004021FF 0 zG7YYa 0000000005AD 0000004023AD 0 ZXYa 0000000005B4 0000004023B4 0 _laYc 0000000007C3 0000004025C3 0 FQyaa 0000000007D5 0000004025D5 0 '[aXYj!$ 00000000089C 00000040269C 0 !LVY= 000000000906 000000402706 0 XaaXY 000000000C74 000000402A74 0 XYa _ 000000000C7E 000000402A7E 0 I)bY 1m 000000000C9C 000000402A9C 0 SXaaY j! 000000000CB6 000000402AB6 0 XaaXYa 000000000CF7 000000402AF7 0 d@Y \J 000000000D13 000000402B13 0 Y qvzRXXa 000000000D40 000000402B40 0 +YXYaXYY h 000000000D6E 000000402B6E 0 |-a [ 000000000D7A 000000402B7A 0 }Xaa4 000000000E11 000000402C11 0 [d?QYXX 000000000E20 000000402C20 0 %$dX 000000000E33 000000402C33 0 vYY ~ 000000000E3F 000000402C3F 0 5Yaaa} 000000000EBF 000000402CBF 0 l~7lXX = 000000000FAD 000000402DAD 0 =$aXX V:pl 000000000FEA 000000402DEA 0 wX 2z 000000000FF4 000000402DF4 0 VLaX 000000001023 000000402E23 0 SXXX V 000000001035 000000402E35 0 qaYaaaXX_b 0000000010BD 000000402EBD 0 ZYYYaYaXXYX_bj 000000001134 000000402F34 0 q92 r 00000000114D 000000402F4D 0 fXXaY 000000001160 000000402F60 0 5,a l 000000001177 000000402F77 0 AYXaa_bY* 0000000011CD 000000402FCD 0 jvaaa eU 0000000011EB 000000402FEB 0 _aYYYX B 000000001204 000000403004 0 HXXY ] 00000000127B 00000040307B 0 6Y *P 00000000128B 00000040308B 0 0waXXaX 000000001296 000000403096 0 HaX_b 000000001331 000000403131 0 =X ! 00000000133D 00000040313D 0 {XaY 000000001442 000000403242 0 M{AXY 000000001466 000000403266 0 ".4 MR 000000001472 000000403272 0 tYX R 000000001483 000000403283 0 ?XYa { 0000000014A1 0000004032A1 0 #YYa 0000000014B9 0000004032B9 0 ~YYaaYX(# 000000001513 000000403313 0 AT@_XY 00000000152C 00000040332C 0 ]}YYa 000000001535 000000403335 0 )YaX File pos Mem pos ID Text ======== ======= == ==== 00000000154B 00000040334B 0 xIYY 000000001553 000000403353 0 8aXa 2 000000001574 000000403374 0 ?sYa jo 00000000158B 00000040338B 0 ->GXXX B 0000000015A0 0000004033A0 0 maYYa_b 0000000016D9 0000004034D9 0 DY,3X 000000001ACE 0000004038CE 0 ]1XXX 000000001ADD 0000004038DD 0 p#ywX 000000001AE8 0000004038E8 0 aXYa 000000001AEE 0000004038EE 0 dY/ x5 000000001AFF 0000004038FF 0 |ZaYa_bX 000000001CEB 000000403AEB 0 FMc> _ 000000001CF9 000000403AF9 0 /aXXX_b 000000001D3F 000000403B3F 0 =YXY "9 000000001D51 000000403B51 0 yXXaXY_b 000000001DD2 000000403BD2 0 4YXaa 000000001DF4 000000403BF4 0 NdYXXY ,=s F_l:YYY_b 000000001E60 000000403C60 0 XYY R 000000001E70 000000403C70 0 8kYYY_b 000000001EBB 000000403CBB 0 mzX C 000000001EC7 000000403CC7 0 sYXaXY_cX* 000000001F3F 000000403D3F 0 80KGXaYX 000000001F50 000000403D50 0 |CYX ? 000000001F66 000000403D66 0 ,raY rb"~ X 000000001F77 000000403D77 0 ]ubYY -C 000000001F97 000000403D97 0 /YYXa 000000001FA3 000000403DA3 0 _!QY 000000001FBD 000000403DBD 0 bY ER 000000001FCD 000000403DCD 0 <aYaY 00000000201A 000000403E1A 0 XY MN 000000002025 000000403E25 0 dYa [ 00000000203F 000000403E3F 0 3 YX 000000002056 000000403E56 0 vXaX 00000000205E 000000403E5E 0 WaXaaaX 0000000020B1 000000403EB1 0 BiYY ! 0000000020CC 000000403ECC 0 'faa bQ>c 0000000020E3 000000403EE3 0 jYYa 0000000020F0 000000403EF0 0 4XYX 0000000020F6 000000403EF6 0 z\faYXXX , 000000002103 000000403F03 0 )&oZX 000000002128 000000403F28 0 bYY k 000000002133 000000403F33 0 *<YaXYY 0000000021B4 000000403FB4 0 QXX n'8 0000000021D1 000000403FD1 0 e gu 0000000022F4 0000004040F4 0 F(.|T 0000000023E0 0000004041E0 0 z0k'T 0000000025F1 0000004043F1 0 ?x"(BmfZ 0000000027E4 0000004045E4 0 XrXVp 000000002990 000000404790 0 ZsiGdAp 000000002B2D 00000040492D 0 Q[xYs 000000002D05 000000404B05 0 wbZ*X 000000002DEC 000000404BEC 0 'qe Z 000000002E38 000000404C38 0 RB::oGK 000000003079 000000404E79 0 UsOPfrQ[ 000000003106 000000404F06 0 4y_\z 00000000321A 00000040501A 0 7}fd@ 00000000333F 00000040513F 0 \%WA1 00000000347A 00000040527A 0 +J _"m 000000003567 000000405367 0 =zioS 0000000035E6 0000004053E6 0 hq.(kp6C File pos Mem pos ID Text ======== ======= == ==== 0000000036B4 0000004054B4 0 +~4Ks 0000000036F6 0000004054F6 0 /f(k? 0000000037DB 0000004055DB 0 S#Ft]- 00000000384C 00000040564C 0 V4*ui 000000003889 000000405689 0 lncOoW 000000003A75 000000405875 0 c23:J 000000003A7B 00000040587B 0 n!pd| 000000003C01 000000405A01 0 TZY+* 000000003C9B 000000405A9B 0 xKtHg 000000003CF9 000000405AF9 0 ;)3+=)8 000000003D0D 000000405B0D 0 /kL B5W 000000003E25 000000405C25 0 !aOLM 000000003E42 000000405C42 0 r_jlX 000000003F5B 000000405D5B 0 WG4zT 00000000428D 00000040608D 0 i_{;U 00000000439B 00000040619B 0 ka_rH 000000004475 000000406275 0 anL#/ 00000000448D 00000040628D 0 zd;.%k 000000004785 000000406585 0 xJ@Fu 000000004A30 000000406830 0 \b.![} 000000004AB5 0000004068B5 0 -SGE) 000000004CBD 000000406ABD 0 0/:[K<U 000000004D26 000000406B26 0 f9rlSu 000000004DBE 000000406BBE 0 H=@ R- 000000004E00 000000406C00 0 k1vJ% 000000004E3B 000000406C3B 0 u;ut7.TcJ 000000004EF2 000000406CF2 0 Uw(VEB 00000000505F 000000406E5F 0 P_l\? 0000000050FD 000000406EFD 0 \wf2M 000000005188 000000406F88 0 Y6$o{E+ 000000005190 000000406F90 0 qD:q@ 000000005216 000000407016 0 12Z a 000000005230 000000407030 0 q'~NbZ 00000000552F 00000040732F 0 sF&$x 00000000557E 00000040737E 0 Kn}c- 0000000055A6 0000004073A6 0 Z_~5@ 000000005630 000000407430 0 !N}7! 000000005810 000000407610 0 o:zp 000000005AC4 0000004078C4 0 ;CR?8 000000005B73 000000407973 0 -HF>g2K 000000005BA0 0000004079A0 0 $WeZEcs 000000005CBC 000000407ABC 0 ~:7{Jv# 000000005D20 000000407B20 0 2z R\ 000000005D26 000000407B26 0 sHy4* 000000005DB4 000000407BB4 0 6c APV 000000005EBF 000000407CBF 0 5ZW,1# 000000005F6A 000000407D6A 0 n)n1aXz 0000000061D4 000000407FD4 0 v2.0.50727 0000000061F8 000000407FF8 0 #Strings 000000006218 000000408018 0 #GUID 000000006228 000000408028 0 #Blob 000000006AD1 0000004088D1 0 Ploutos.exe 000000006ADD 0000004088DD 0 Ploutos 000000006AE5 0000004088E5 0 mscorlib 000000006B07 000000408907 0 <Module> 000000006B10 000000408910 0 .cctor 000000006B17 000000408917 0 CompressShell 000000006B25 000000408925 0 Object 000000006B2C 00000040892C 0 System 000000006B3F 00000040893F 0 Module File pos Mem pos ID Text ======== ======= == ==== 000000006B46 000000408946 0 System.Reflection 000000006B58 000000408958 0 GetLenToPosState 000000006B6D 00000040896D 0 BinaryReader 000000006B7A 00000040897A 0 System.IO 000000006B84 000000408984 0 Stream 000000006B8B 00000040898B 0 Assembly 000000006B94 000000408994 0 Encoding 000000006B9D 00000040899D 0 System.Text 000000006BA9 0000004089A9 0 get_UTF8 000000006BB2 0000004089B2 0 ResolveEventArgs 000000006BC3 0000004089C3 0 get_Name 000000006BCC 0000004089CC 0 GetBytes 000000006BD5 0000004089D5 0 GetString 000000006BE4 0000004089E4 0 GetTypeFromHandle 000000006BF6 0000004089F6 0 RuntimeTypeHandle 000000006C08 000000408A08 0 get_Assembly 000000006C15 000000408A15 0 GetManifestResourceStream 000000006C2F 000000408A2F 0 .ctor 000000006C35 000000408A35 0 get_Length 000000006C40 000000408A40 0 ReadBytes 000000006C4A 000000408A4A 0 IDisposable 000000006C56 000000408A56 0 Dispose 000000006C68 000000408A68 0 Buffer 000000006C6F 000000408A6F 0 BlockCopy 000000006C79 000000408A79 0 Array 000000006C7F 000000408A7F 0 DecryptAsm 000000006C8A 000000408A8A 0 sender 000000006C93 000000408A93 0 ResolveResource 000000006CA3 000000408AA3 0 CryptoStream 000000006CB0 000000408AB0 0 System.Security.Cryptography 000000006CCD 000000408ACD 0 RijndaelManaged 000000006CDD 000000408ADD 0 MemoryStream 000000006CEA 000000408AEA 0 ReadInt32 000000006CF4 000000408AF4 0 SymmetricAlgorithm 000000006D07 000000408B07 0 CreateDecryptor 000000006D17 000000408B17 0 ICryptoTransform 000000006D28 000000408B28 0 CryptoStreamMode 000000006D3E 000000408B3E 0 BitConverter 000000006D4B 000000408B4B 0 ToUInt32 000000006D54 000000408B54 0 ReadByte 000000006D5D 000000408B5D 0 Exception 000000006D67 000000408B67 0 Decrypt 000000006D73 000000408B73 0 modPow 000000006D86 000000408B86 0 MethodBase 000000006D91 000000408B91 0 GetEntryAssembly 000000006DA2 000000408BA2 0 LoadModule 000000006DAD 000000408BAD 0 AppDomain 000000006DB7 000000408BB7 0 get_CurrentDomain 000000006DC9 000000408BC9 0 ResolveEventHandler 000000006DDD 000000408BDD 0 add_AssemblyResolve 000000006DF1 000000408BF1 0 ResolveMethod 000000006DFF 000000408BFF 0 GetParameters 000000006E0D 000000408C0D 0 ParameterInfo 000000006E1B 000000408C1B 0 Invoke 000000006E22 000000408C22 0 Int32 000000006E32 000000408C32 0 STAThreadAttribute 000000006E45 000000408C45 0 State 000000006E4B 000000408C4B 0 ValueType 000000006E55 000000408C55 0 Index 000000006E60 000000408C60 0 UpdateChar File pos Mem pos ID Text ======== ======= == ==== 000000006E6B 000000408C6B 0 UpdateMatch 000000006E77 000000408C77 0 UpdateRep 000000006E81 000000408C81 0 UpdateShortRep 000000006E90 000000408C90 0 IsCharState 000000006E9C 000000408C9C 0 OutWindow 000000006EA6 000000408CA6 0 _buffer 000000006EB3 000000408CB3 0 _windowSize 000000006EBF 000000408CBF 0 _streamPos 000000006ECA 000000408CCA 0 _stream 000000006ED2 000000408CD2 0 Create 000000006ED9 000000408CD9 0 windowSize 000000006EE4 000000408CE4 0 stream 000000006EEB 000000408CEB 0 solid 000000006EF1 000000408CF1 0 ReleaseStream 000000006EFF 000000408CFF 0 Write 000000006F05 000000408D05 0 Flush 000000006F0B 000000408D0B 0 CopyBlock 000000006F15 000000408D15 0 distance 000000006F1E 000000408D1E 0 PutByte 000000006F28 000000408D28 0 GetByte 000000006F30 000000408D30 0 Decoder 000000006F38 000000408D38 0 Range 000000006F43 000000408D43 0 Normalize 000000006F4D 000000408D4D 0 DecodeDirectBits 000000006F5E 000000408D5E 0 numTotalBits 000000006F6B 000000408D6B 0 BitDecoder 000000006F7B 000000408D7B 0 Decode 000000006F82 000000408D82 0 rangeDecoder 000000006F8F 000000408D8F 0 BitTreeDecoder 000000006F9E 000000408D9E 0 Models 000000006FA5 000000408DA5 0 NumBitLevels 000000006FB2 000000408DB2 0 numBitLevels 000000006FBF 000000408DBF 0 ReverseDecode 000000006FCD 000000408DCD 0 startIndex 000000006FD8 000000408DD8 0 LzmaDecoder 000000006FE4 000000408DE4 0 m_OutWindow 000000006FF0 000000408DF0 0 m_RangeDecoder 000000006FFF 000000408DFF 0 m_IsMatchDecoders 000000007011 000000408E11 0 m_IsRepDecoders 000000007021 000000408E21 0 m_IsRepG0Decoders 000000007033 000000408E33 0 m_IsRepG1Decoders 000000007045 000000408E45 0 m_IsRepG2Decoders 000000007057 000000408E57 0 m_IsRep0LongDecoders 00000000706C 000000408E6C 0 m_PosSlotDecoder 00000000707D 000000408E7D 0 m_PosDecoders 00000000708B 000000408E8B 0 m_PosAlignDecoder 00000000709D 000000408E9D 0 m_LenDecoder 0000000070AA 000000408EAA 0 m_RepLenDecoder 0000000070BA 000000408EBA 0 m_LiteralDecoder 0000000070CB 000000408ECB 0 m_DictionarySize 0000000070DC 000000408EDC 0 m_DictionarySizeCheck 0000000070F2 000000408EF2 0 m_PosStateMask 000000007101 000000408F01 0 _solid 000000007111 000000408F11 0 SetDictionarySize 000000007123 000000408F23 0 dictionarySize 000000007132 000000408F32 0 SetLiteralProperties 00000000714D 000000408F4D 0 SetPosBitsProperties 000000007165 000000408F65 0 inStream 00000000716E 000000408F6E 0 outStream 000000007178 000000408F78 0 inSize File pos Mem pos ID Text ======== ======= == ==== 00000000717F 000000408F7F 0 outSize 000000007187 000000408F87 0 SetDecoderProperties 00000000719C 000000408F9C 0 properties 0000000071A7 000000408FA7 0 LenDecoder 0000000071B2 000000408FB2 0 m_Choice 0000000071BB 000000408FBB 0 m_Choice2 0000000071C5 000000408FC5 0 m_LowCoder 0000000071D0 000000408FD0 0 m_MidCoder 0000000071DB 000000408FDB 0 m_HighCoder 0000000071E7 000000408FE7 0 m_NumPosStates 0000000071F6 000000408FF6 0 numPosStates 000000007203 000000409003 0 posState 00000000720C 00000040900C 0 LiteralDecoder 00000000721B 00000040901B 0 m_Coders 000000007224 000000409024 0 m_NumPrevBits 000000007232 000000409032 0 m_NumPosBits 00000000723F 00000040903F 0 m_PosMask 000000007249 000000409049 0 numPosBits 000000007254 000000409054 0 numPrevBits 000000007260 000000409060 0 GetState 00000000726D 00000040906D 0 prevByte 000000007276 000000409076 0 DecodeNormal 000000007283 000000409083 0 DecodeWithMatchByte 000000007297 000000409097 0 matchByte 0000000072A1 0000004090A1 0 Decoder2 0000000072AA 0000004090AA 0 m_Decoders 0000000072B5 0000004090B5 0 ConfusedByAttribute 0000000072C9 0000004090C9 0 Attribute 0000000072D3 0000004090D3 0 ___.netmodule 0000000072E1 0000004090E1 0 Ploutos.Properties.Resources.resources 000000007308 000000409108 0 Ploutos.Panel.resources 0000000075D3 0000004093D3 0 Confuser v1.9.0.0 000000007632 000000409432 0 _CorExeMain 00000000763E 00000040943E 0 mscoree.dll 000000007B83 00000040A383 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?> 000000007BBC 00000040A3BC 0 <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> 000000007C07 00000040A407 0 <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> 000000007C49 00000040A449 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> 000000007C81 00000040A481 0 <security> 000000007C91 00000040A491 0 <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> 000000007CD7 00000040A4D7 0 <requestedExecutionLevel level="asInvoker" uiAccess="false"/> 000000007D1E 00000040A51E 0 </requestedPrivileges> 000000007D3C 00000040A53C 0 </security> 000000007D4D 00000040A54D 0 </trustInfo> 000000007D5D 00000040A55D 0 </assembly> 000000007323 000000409123 0 Can't Read 1 00000000733D 00000040913D 0 ___.netmodule 0000000078A6 00000040A0A6 0 VS_VERSION_INFO 000000007902 00000040A102 0 VarFileInfo 000000007922 00000040A122 0 Translation 000000007946 00000040A146 0 StringFileInfo 00000000796A 00000040A16A 0 000004b0 000000007982 00000040A182 0 CompanyName 00000000799C 00000040A19C 0 Ploutos 0000000079B2 00000040A1B2 0 FileDescription 0000000079D4 00000040A1D4 0 Ploutos 0000000079EA 00000040A1EA 0 FileVersion 000000007A04 00000040A204 0 1.0.0.0 000000007A1A 00000040A21A 0 InternalName 000000007A34 00000040A234 0 Ploutos.exe File pos Mem pos ID Text ======== ======= == ==== 000000007A52 00000040A252 0 LegalCopyright 000000007A86 00000040A286 0 Ploutos 2013 000000007AAA 00000040A2AA 0 OriginalFilename 000000007ACC 00000040A2CC 0 Ploutos.exe 000000007AEA 00000040A2EA 0 ProductName 000000007B04 00000040A304 0 Ploutos 000000007B1A 00000040A31A 0 ProductVersion 000000007B38 00000040A338 0 1.0.0.0 000000007B4E 00000040A34E 0 Assembly Version 000000007B70 00000040A370 0 1.0.0.0 00000000004D 00000040004D 0 !This program cannot be run in DOS mode. 000000000178 000000400178 0 .text 0000000001A0 0000004001A0 0 .rsrc 0000000001C7 0000004001C7 0 @.reloc 0000000002A7 0000004020A7 0 aaX ; 0000000002AF 0000004020AF 0 9#8wY 0000000002C4 0000004020C4 0 a +l7EXY 0000000002D4 0000004020D4 0 UKY z 0000000002DE 0000004020DE 0 MrG AB.m 0000000002E9 0000004020E9 0 AkaaYYaaYa 00000000032E 00000040212E 0 ,O s 0000000003E7 0000004021E7 0 LYXaa 0000000003FF 0000004021FF 0 zG7YYa 0000000005AD 0000004023AD 0 ZXYa 0000000005B4 0000004023B4 0 _laYc 0000000007C3 0000004025C3 0 FQyaa 0000000007D5 0000004025D5 0 '[aXYj!$ 00000000089C 00000040269C 0 !LVY= 000000000906 000000402706 0 XaaXY 000000000C74 000000402A74 0 XYa _ 000000000C7E 000000402A7E 0 I)bY 1m 000000000C9C 000000402A9C 0 SXaaY j! 000000000CB6 000000402AB6 0 XaaXYa 000000000CF7 000000402AF7 0 d@Y \J 000000000D13 000000402B13 0 Y qvzRXXa 000000000D40 000000402B40 0 +YXYaXYY h 000000000D6E 000000402B6E 0 |-a [ 000000000D7A 000000402B7A 0 }Xaa4 000000000E11 000000402C11 0 [d?QYXX 000000000E20 000000402C20 0 %$dX 000000000E33 000000402C33 0 vYY ~ 000000000E3F 000000402C3F 0 5Yaaa} 000000000EBF 000000402CBF 0 l~7lXX = 000000000FAD 000000402DAD 0 =$aXX V:pl 000000000FEA 000000402DEA 0 wX 2z 000000000FF4 000000402DF4 0 VLaX 000000001023 000000402E23 0 SXXX V 000000001035 000000402E35 0 qaYaaaXX_b 0000000010BD 000000402EBD 0 ZYYYaYaXXYX_bj 000000001134 000000402F34 0 q92 r 00000000114D 000000402F4D 0 fXXaY 000000001160 000000402F60 0 5,a l 000000001177 000000402F77 0 AYXaa_bY* 0000000011CD 000000402FCD 0 jvaaa eU 0000000011EB 000000402FEB 0 _aYYYX B 000000001204 000000403004 0 HXXY ] 00000000127B 00000040307B 0 6Y *P 00000000128B 00000040308B 0 0waXXaX 000000001296 000000403096 0 HaX_b 000000001331 000000403131 0 =X ! File pos Mem pos ID Text ======== ======= == ==== 00000000133D 00000040313D 0 {XaY 000000001442 000000403242 0 M{AXY 000000001466 000000403266 0 ".4 MR 000000001472 000000403272 0 tYX R 000000001483 000000403283 0 ?XYa { 0000000014A1 0000004032A1 0 #YYa 0000000014B9 0000004032B9 0 ~YYaaYX(# 000000001513 000000403313 0 AT@_XY 00000000152C 00000040332C 0 ]}YYa 000000001535 000000403335 0 )YaX 00000000154B 00000040334B 0 xIYY 000000001553 000000403353 0 8aXa 2 000000001574 000000403374 0 ?sYa jo 00000000158B 00000040338B 0 ->GXXX B 0000000015A0 0000004033A0 0 maYYa_b 0000000016D9 0000004034D9 0 DY,3X 000000001ACE 0000004038CE 0 ]1XXX 000000001ADD 0000004038DD 0 p#ywX 000000001AE8 0000004038E8 0 aXYa 000000001AEE 0000004038EE 0 dY/ x5 000000001AFF 0000004038FF 0 |ZaYa_bX 000000001CEB 000000403AEB 0 FMc> _ 000000001CF9 000000403AF9 0 /aXXX_b 000000001D3F 000000403B3F 0 =YXY "9 000000001D51 000000403B51 0 yXXaXY_b 000000001DD2 000000403BD2 0 4YXaa 000000001DF4 000000403BF4 0 NdYXXY ,=s F_l:YYY_b 000000001E60 000000403C60 0 XYY R 000000001E70 000000403C70 0 8kYYY_b 000000001EBB 000000403CBB 0 mzX C 000000001EC7 000000403CC7 0 sYXaXY_cX* 000000001F3F 000000403D3F 0 80KGXaYX 000000001F50 000000403D50 0 |CYX ? 000000001F66 000000403D66 0 ,raY rb"~ X 000000001F77 000000403D77 0 ]ubYY -C 000000001F97 000000403D97 0 /YYXa 000000001FA3 000000403DA3 0 _!QY 000000001FBD 000000403DBD 0 bY ER 000000001FCD 000000403DCD 0 <aYaY 00000000201A 000000403E1A 0 XY MN 000000002025 000000403E25 0 dYa [ 00000000203F 000000403E3F 0 3 YX 000000002056 000000403E56 0 vXaX 00000000205E 000000403E5E 0 WaXaaaX 0000000020B1 000000403EB1 0 BiYY ! 0000000020CC 000000403ECC 0 'faa bQ>c 0000000020E3 000000403EE3 0 jYYa 0000000020F0 000000403EF0 0 4XYX 0000000020F6 000000403EF6 0 z\faYXXX , 000000002103 000000403F03 0 )&oZX 000000002128 000000403F28 0 bYY k 000000002133 000000403F33 0 *<YaXYY 0000000021B4 000000403FB4 0 QXX n'8 0000000021D1 000000403FD1 0 e gu 0000000022F4 0000004040F4 0 F(.|T 0000000023E0 0000004041E0 0 z0k'T 0000000025F1 0000004043F1 0 ?x"(BmfZ 0000000027E4 0000004045E4 0 XrXVp 000000002990 000000404790 0 ZsiGdAp 000000002B2D 00000040492D 0 Q[xYs File pos Mem pos ID Text ======== ======= == ==== 000000002D05 000000404B05 0 wbZ*X 000000002DEC 000000404BEC 0 'qe Z 000000002E38 000000404C38 0 RB::oGK 000000003079 000000404E79 0 UsOPfrQ[ 000000003106 000000404F06 0 4y_\z 00000000321A 00000040501A 0 7}fd@ 00000000333F 00000040513F 0 \%WA1 00000000347A 00000040527A 0 +J _"m 000000003567 000000405367 0 =zioS 0000000035E6 0000004053E6 0 hq.(kp6C 0000000036B4 0000004054B4 0 +~4Ks 0000000036F6 0000004054F6 0 /f(k? 0000000037DB 0000004055DB 0 S#Ft]- 00000000384C 00000040564C 0 V4*ui 000000003889 000000405689 0 lncOoW 000000003A75 000000405875 0 c23:J 000000003A7B 00000040587B 0 n!pd| 000000003C01 000000405A01 0 TZY+* 000000003C9B 000000405A9B 0 xKtHg 000000003CF9 000000405AF9 0 ;)3+=)8 000000003D0D 000000405B0D 0 /kL B5W 000000003E25 000000405C25 0 !aOLM 000000003E42 000000405C42 0 r_jlX 000000003F5B 000000405D5B 0 WG4zT 00000000428D 00000040608D 0 i_{;U 00000000439B 00000040619B 0 ka_rH 000000004475 000000406275 0 anL#/ 00000000448D 00000040628D 0 zd;.%k 000000004785 000000406585 0 xJ@Fu 000000004A30 000000406830 0 \b.![} 000000004AB5 0000004068B5 0 -SGE) 000000004CBD 000000406ABD 0 0/:[K<U 000000004D26 000000406B26 0 f9rlSu 000000004DBE 000000406BBE 0 H=@ R- 000000004E00 000000406C00 0 k1vJ% 000000004E3B 000000406C3B 0 u;ut7.TcJ 000000004EF2 000000406CF2 0 Uw(VEB 00000000505F 000000406E5F 0 P_l\? 0000000050FD 000000406EFD 0 \wf2M 000000005188 000000406F88 0 Y6$o{E+ 000000005190 000000406F90 0 qD:q@ 000000005216 000000407016 0 12Z a 000000005230 000000407030 0 q'~NbZ 00000000552F 00000040732F 0 sF&$x 00000000557E 00000040737E 0 Kn}c- 0000000055A6 0000004073A6 0 Z_~5@ 000000005630 000000407430 0 !N}7! 000000005810 000000407610 0 o:zp 000000005AC4 0000004078C4 0 ;CR?8 000000005B73 000000407973 0 -HF>g2K 000000005BA0 0000004079A0 0 $WeZEcs 000000005CBC 000000407ABC 0 ~:7{Jv# 000000005D20 000000407B20 0 2z R\ 000000005D26 000000407B26 0 sHy4* 000000005DB4 000000407BB4 0 6c APV 000000005EBF 000000407CBF 0 5ZW,1# 000000005F6A 000000407D6A 0 n)n1aXz 0000000061D4 000000407FD4 0 v2.0.50727 0000000061F8 000000407FF8 0 #Strings 000000006218 000000408018 0 #GUID File pos Mem pos ID Text ======== ======= == ==== 000000006228 000000408028 0 #Blob 000000006AD1 0000004088D1 0 Ploutos.exe 000000006ADD 0000004088DD 0 Ploutos 000000006AE5 0000004088E5 0 mscorlib 000000006B07 000000408907 0 <Module> 000000006B10 000000408910 0 .cctor 000000006B17 000000408917 0 CompressShell 000000006B25 000000408925 0 Object 000000006B2C 00000040892C 0 System 000000006B3F 00000040893F 0 Module 000000006B46 000000408946 0 System.Reflection 000000006B58 000000408958 0 GetLenToPosState 000000006B6D 00000040896D 0 BinaryReader 000000006B7A 00000040897A 0 System.IO 000000006B84 000000408984 0 Stream 000000006B8B 00000040898B 0 Assembly 000000006B94 000000408994 0 Encoding 000000006B9D 00000040899D 0 System.Text 000000006BA9 0000004089A9 0 get_UTF8 000000006BB2 0000004089B2 0 ResolveEventArgs 000000006BC3 0000004089C3 0 get_Name 000000006BCC 0000004089CC 0 GetBytes 000000006BD5 0000004089D5 0 GetString 000000006BE4 0000004089E4 0 GetTypeFromHandle 000000006BF6 0000004089F6 0 RuntimeTypeHandle 000000006C08 000000408A08 0 get_Assembly 000000006C15 000000408A15 0 GetManifestResourceStream 000000006C2F 000000408A2F 0 .ctor 000000006C35 000000408A35 0 get_Length 000000006C40 000000408A40 0 ReadBytes 000000006C4A 000000408A4A 0 IDisposable 000000006C56 000000408A56 0 Dispose 000000006C68 000000408A68 0 Buffer 000000006C6F 000000408A6F 0 BlockCopy 000000006C79 000000408A79 0 Array 000000006C7F 000000408A7F 0 DecryptAsm 000000006C8A 000000408A8A 0 sender 000000006C93 000000408A93 0 ResolveResource 000000006CA3 000000408AA3 0 CryptoStream 000000006CB0 000000408AB0 0 System.Security.Cryptography 000000006CCD 000000408ACD 0 RijndaelManaged 000000006CDD 000000408ADD 0 MemoryStream 000000006CEA 000000408AEA 0 ReadInt32 000000006CF4 000000408AF4 0 SymmetricAlgorithm 000000006D07 000000408B07 0 CreateDecryptor 000000006D17 000000408B17 0 ICryptoTransform 000000006D28 000000408B28 0 CryptoStreamMode 000000006D3E 000000408B3E 0 BitConverter 000000006D4B 000000408B4B 0 ToUInt32 000000006D54 000000408B54 0 ReadByte 000000006D5D 000000408B5D 0 Exception 000000006D67 000000408B67 0 Decrypt 000000006D73 000000408B73 0 modPow 000000006D86 000000408B86 0 MethodBase 000000006D91 000000408B91 0 GetEntryAssembly 000000006DA2 000000408BA2 0 LoadModule 000000006DAD 000000408BAD 0 AppDomain 000000006DB7 000000408BB7 0 get_CurrentDomain 000000006DC9 000000408BC9 0 ResolveEventHandler 000000006DDD 000000408BDD 0 add_AssemblyResolve File pos Mem pos ID Text ======== ======= == ==== 000000006DF1 000000408BF1 0 ResolveMethod 000000006DFF 000000408BFF 0 GetParameters 000000006E0D 000000408C0D 0 ParameterInfo 000000006E1B 000000408C1B 0 Invoke 000000006E22 000000408C22 0 Int32 000000006E32 000000408C32 0 STAThreadAttribute 000000006E45 000000408C45 0 State 000000006E4B 000000408C4B 0 ValueType 000000006E55 000000408C55 0 Index 000000006E60 000000408C60 0 UpdateChar 000000006E6B 000000408C6B 0 UpdateMatch 000000006E77 000000408C77 0 UpdateRep 000000006E81 000000408C81 0 UpdateShortRep 000000006E90 000000408C90 0 IsCharState 000000006E9C 000000408C9C 0 OutWindow 000000006EA6 000000408CA6 0 _buffer 000000006EB3 000000408CB3 0 _windowSize 000000006EBF 000000408CBF 0 _streamPos 000000006ECA 000000408CCA 0 _stream 000000006ED2 000000408CD2 0 Create 000000006ED9 000000408CD9 0 windowSize 000000006EE4 000000408CE4 0 stream 000000006EEB 000000408CEB 0 solid 000000006EF1 000000408CF1 0 ReleaseStream 000000006EFF 000000408CFF 0 Write 000000006F05 000000408D05 0 Flush 000000006F0B 000000408D0B 0 CopyBlock 000000006F15 000000408D15 0 distance 000000006F1E 000000408D1E 0 PutByte 000000006F28 000000408D28 0 GetByte 000000006F30 000000408D30 0 Decoder 000000006F38 000000408D38 0 Range 000000006F43 000000408D43 0 Normalize 000000006F4D 000000408D4D 0 DecodeDirectBits 000000006F5E 000000408D5E 0 numTotalBits 000000006F6B 000000408D6B 0 BitDecoder 000000006F7B 000000408D7B 0 Decode 000000006F82 000000408D82 0 rangeDecoder 000000006F8F 000000408D8F 0 BitTreeDecoder 000000006F9E 000000408D9E 0 Models 000000006FA5 000000408DA5 0 NumBitLevels 000000006FB2 000000408DB2 0 numBitLevels 000000006FBF 000000408DBF 0 ReverseDecode 000000006FCD 000000408DCD 0 startIndex 000000006FD8 000000408DD8 0 LzmaDecoder 000000006FE4 000000408DE4 0 m_OutWindow 000000006FF0 000000408DF0 0 m_RangeDecoder 000000006FFF 000000408DFF 0 m_IsMatchDecoders 000000007011 000000408E11 0 m_IsRepDecoders 000000007021 000000408E21 0 m_IsRepG0Decoders 000000007033 000000408E33 0 m_IsRepG1Decoders 000000007045 000000408E45 0 m_IsRepG2Decoders 000000007057 000000408E57 0 m_IsRep0LongDecoders 00000000706C 000000408E6C 0 m_PosSlotDecoder 00000000707D 000000408E7D 0 m_PosDecoders 00000000708B 000000408E8B 0 m_PosAlignDecoder 00000000709D 000000408E9D 0 m_LenDecoder 0000000070AA 000000408EAA 0 m_RepLenDecoder 0000000070BA 000000408EBA 0 m_LiteralDecoder 0000000070CB 000000408ECB 0 m_DictionarySize File pos Mem pos ID Text ======== ======= == ==== 0000000070DC 000000408EDC 0 m_DictionarySizeCheck 0000000070F2 000000408EF2 0 m_PosStateMask 000000007101 000000408F01 0 _solid 000000007111 000000408F11 0 SetDictionarySize 000000007123 000000408F23 0 dictionarySize 000000007132 000000408F32 0 SetLiteralProperties 00000000714D 000000408F4D 0 SetPosBitsProperties 000000007165 000000408F65 0 inStream 00000000716E 000000408F6E 0 outStream 000000007178 000000408F78 0 inSize 00000000717F 000000408F7F 0 outSize 000000007187 000000408F87 0 SetDecoderProperties 00000000719C 000000408F9C 0 properties 0000000071A7 000000408FA7 0 LenDecoder 0000000071B2 000000408FB2 0 m_Choice 0000000071BB 000000408FBB 0 m_Choice2 0000000071C5 000000408FC5 0 m_LowCoder 0000000071D0 000000408FD0 0 m_MidCoder 0000000071DB 000000408FDB 0 m_HighCoder 0000000071E7 000000408FE7 0 m_NumPosStates 0000000071F6 000000408FF6 0 numPosStates 000000007203 000000409003 0 posState 00000000720C 00000040900C 0 LiteralDecoder 00000000721B 00000040901B 0 m_Coders 000000007224 000000409024 0 m_NumPrevBits 000000007232 000000409032 0 m_NumPosBits 00000000723F 00000040903F 0 m_PosMask 000000007249 000000409049 0 numPosBits 000000007254 000000409054 0 numPrevBits 000000007260 000000409060 0 GetState 00000000726D 00000040906D 0 prevByte 000000007276 000000409076 0 DecodeNormal 000000007283 000000409083 0 DecodeWithMatchByte 000000007297 000000409097 0 matchByte 0000000072A1 0000004090A1 0 Decoder2 0000000072AA 0000004090AA 0 m_Decoders 0000000072B5 0000004090B5 0 ConfusedByAttribute 0000000072C9 0000004090C9 0 Attribute 0000000072D3 0000004090D3 0 ___.netmodule 0000000072E1 0000004090E1 0 Ploutos.Properties.Resources.resources 000000007308 000000409108 0 Ploutos.Panel.resources 0000000075D3 0000004093D3 0 Confuser v1.9.0.0 000000007632 000000409432 0 _CorExeMain 00000000763E 00000040943E 0 mscoree.dll 000000007B83 00000040A383 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?> 000000007BBC 00000040A3BC 0 <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> 000000007C07 00000040A407 0 <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> 000000007C49 00000040A449 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> 000000007C81 00000040A481 0 <security> 000000007C91 00000040A491 0 <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> 000000007CD7 00000040A4D7 0 <requestedExecutionLevel level="asInvoker" uiAccess="false"/> 000000007D1E 00000040A51E 0 </requestedPrivileges> 000000007D3C 00000040A53C 0 </security> 000000007D4D 00000040A54D 0 </trustInfo> 000000007D5D 00000040A55D 0 </assembly> 000000007323 000000409123 0 Can't Read 1 00000000733D 00000040913D 0 ___.netmodule 0000000078A6 00000040A0A6 0 VS_VERSION_INFO 000000007902 00000040A102 0 VarFileInfo 000000007922 00000040A122 0 Translation File pos Mem pos ID Text ======== ======= == ==== 000000007946 00000040A146 0 StringFileInfo 00000000796A 00000040A16A 0 000004b0 000000007982 00000040A182 0 CompanyName 00000000799C 00000040A19C 0 Ploutos 0000000079B2 00000040A1B2 0 FileDescription 0000000079D4 00000040A1D4 0 Ploutos 0000000079EA 00000040A1EA 0 FileVersion 000000007A04 00000040A204 0 1.0.0.0 000000007A1A 00000040A21A 0 InternalName 000000007A34 00000040A234 0 Ploutos.exe 000000007A52 00000040A252 0 LegalCopyright 000000007A86 00000040A286 0 Ploutos 2013 000000007AAA 00000040A2AA 0 OriginalFilename 000000007ACC 00000040A2CC 0 Ploutos.exe 000000007AEA 00000040A2EA 0 ProductName 000000007B04 00000040A304 0 Ploutos 000000007B1A 00000040A31A 0 ProductVersion 000000007B38 00000040A338 0 1.0.0.0 000000007B4E 00000040A34E 0 Assembly Version 000000007B70 00000040A370 0 1.0.0.0
=== DOWNLOAD === Mirror provided by vx-underground.org, thx!