.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ---- -------------.
! WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV !
`-------------- - --- ---------- -------- -------- -------- -------- ----------------- - ---- ---- --'
ATM MALWARE NOTICE
0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025
Date...........: 2013-08-28
Family.........: Ploutus
File name......: ploutusservice.exe
File size......: 40.00 KB
Type file......: EXE/Windows
Virscan........: VT - HA
Documentation..: http://blog.spiderlabs.com/2013/10/having-a-fiesta-with-ploutus.html
Entropy:
Binary Histogram:
=== PEDUMP REPORT ===
=== MZ Header ===
signature: "MZ"
bytes_in_last_block: 144 0x90
blocks_in_file: 3 3
num_relocs: 0 0
header_paragraphs: 4 4
min_extra_paragraphs: 0 0
max_extra_paragraphs: 65535 0xffff
ss: 0 0
sp: 184 0xb8
checksum: 0 0
ip: 0 0
cs: 0 0
reloc_table_offset: 64 0x40
overlay_number: 0 0
reserved0: 0 0
oem_id: 0 0
oem_info: 0 0
reserved2: 0 0
reserved3: 0 0
reserved4: 0 0
reserved5: 0 0
reserved6: 0 0
lfanew: 128 0x80
=== DOS STUB ===
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
=== PE Header ===
signature: "PE\x00\x00"
# IMAGE_FILE_HEADER:
Machine: 332 0x14c x86
NumberOfSections: 3 3
TimeDateStamp: "2013-08-21 03:30:29"
PointerToSymbolTable: 0 0
NumberOfSymbols: 0 0
SizeOfOptionalHeader: 224 0xe0
Characteristics: 258 0x102 EXECUTABLE_IMAGE, 32BIT_MACHINE
# IMAGE_OPTIONAL_HEADER32:
Magic: 267 0x10b 32-bit executable
LinkerVersion: 8.0
SizeOfCode: 35328 0x8a00
SizeOfInitializedData: 2048 0x800
SizeOfUninitializedData: 0 0
AddressOfEntryPoint: 43486 0xa9de
BaseOfCode: 8192 0x2000
BaseOfData: 0 0
ImageBase: 4194304 0x400000
SectionAlignment: 8192 0x2000
FileAlignment: 512 0x200
OperatingSystemVersion: 4.0
ImageVersion: 0.0
SubsystemVersion: 4.0
Reserved1: 0 0
SizeOfImage: 65536 0x10000
SizeOfHeaders: 512 0x200
CheckSum: 0 0
Subsystem: 2 2 WINDOWS_GUI
DllCharacteristics: 34112 0x8540 DYNAMIC_BASE, NX_COMPAT, NO_SEH
TERMINAL_SERVER_AWARE
SizeOfStackReserve: 1048576 0x100000
SizeOfStackCommit: 4096 0x1000
SizeOfHeapReserve: 1048576 0x100000
SizeOfHeapCommit: 4096 0x1000
LoaderFlags: 0 0
NumberOfRvaAndSizes: 16 0x10
=== DATA DIRECTORY ===
EXPORT rva:0x 0 size:0x 0
IMPORT rva:0x a984 size:0x 57
RESOURCE rva:0x c000 size:0x 600
EXCEPTION rva:0x 0 size:0x 0
SECURITY rva:0x 0 size:0x 0
BASERELOC rva:0x e000 size:0x c
DEBUG rva:0x 0 size:0x 0
ARCHITECTURE rva:0x 0 size:0x 0
GLOBALPTR rva:0x 0 size:0x 0
TLS rva:0x 0 size:0x 0
LOAD_CONFIG rva:0x 0 size:0x 0
Bound_IAT rva:0x 0 size:0x 0
IAT rva:0x 2000 size:0x 8
Delay_IAT rva:0x 0 size:0x 0
CLR_Header rva:0x 2008 size:0x 48
rva:0x 0 size:0x 0
=== SECTIONS ===
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
.text 2000 89e4 8a00 200 0 0 0 0 60000020 R-X CODE
.rsrc c000 600 600 8c00 0 0 0 0 40000040 R-- IDATA
.reloc e000 c 200 9200 0 0 0 0 42000040 R-- IDATA DISCARDABLE
=== RESOURCES ===
FILE_OFFSET CP LANG SIZE TYPE NAME
0x8ca0 0 0 736 VERSION #1
0x8f80 0 0 490 MANIFEST #1
=== IMPORTS ===
MODULE_NAME HINT ORD FUNCTION_NAME
mscoree.dll 0 _CorExeMain
=== VERSION INFO ===
# VS_FIXEDFILEINFO:
FileVersion : 1.0.0.0
ProductVersion : 1.0.0.0
StrucVersion : 0x10000
FileFlagsMask : 0x3f
FileFlags : 0
FileOS : 4
FileType : 1
FileSubtype : 0
VarFileInfo : [ 0x0, 0x4b0 ]
# StringTable 000004b0:
FileDescription : "PloutusService"
FileVersion : "1.0.0.0"
InternalName : "PloutusService.exe"
LegalCopyright : "Copyright \u00A9 2013"
OriginalFilename : "PloutusService.exe"
ProductName : "PloutusService"
ProductVersion : "1.0.0.0"
Assembly Version : "1.0.0.0"
=== Packer / Compiler ===
.NET executable
File pos Mem pos ID Text
======== ======= == ====
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
000000000178 000000400178 0 .text
0000000001A0 0000004001A0 0 .rsrc
0000000001C7 0000004001C7 0 @.reloc
0000000002B3 0000004020B3 0 xaaXXXa
0000000002F2 0000004020F2 0 ,J s
0000000003A3 0000004021A3 0 :+Ya %
0000000003AB 0000004021AB 0 )Xaa
0000000003B7 0000004021B7 0 )5Y T
0000000003C9 0000004021C9 0 XYXYa
00000000055D 00000040235D 0 n_ SA
000000000570 000000402370 0 /*'aaXc
000000000629 000000402429 0 &aa_b
000000000782 000000402582 0 hI/X HD
00000000078A 00000040258A 0 2a +'
00000000079B 00000040259B 0 }'XYj!0
0000000007B2 0000004025B2 0 Y!VBQP
0000000008F9 0000004026F9 0 YaY!SYv
000000000922 000000402722 0 YYX!\':
00000000094B 00000040274B 0 Xaa!X
000000000C9D 000000402A9D 0 9YYX Q
000000000CE0 000000402AE0 0 IkXYYYYY
000000000CF1 000000402AF1 0 EXXYa
000000000D36 000000402B36 0 #d YI5
000000000D7B 000000402B7B 0 ,eMSXaa
000000000DAD 000000402BAD 0 LXYYYa4
000000000E33 000000402C33 0 *aaYYXXX
000000000E4D 000000402C4D 0 0lzXYa
000000000E66 000000402C66 0 sYYY
000000000E88 000000402C88 0 NcaYaa
000000000E9A 000000402C9A 0 0Lp X
000000000EAD 000000402CAD 0 ZXXYYXX}
000000000F10 000000402D10 0 B@6YYa
000000000F39 000000402D39 0 bYX <
000000000F55 000000402D55 0 jFXYa4)
000000001039 000000402E39 0 k~XY
000000001045 000000402E45 0 I%aY X
00000000105B 000000402E5B 0 s58XXXaY
000000001079 000000402E79 0 XaaX_b
0000000010C3 000000402EC3 0 1L h]<
0000000010F1 000000402EF1 0 YYXYa "
000000001107 000000402F07 0 -_rXa w
00000000111F 000000402F1F 0 '<tY
000000001133 000000402F33 0 XXa u
000000001156 000000402F56 0 aXYXYY_bj
0000000011B0 000000402FB0 0 |SiY Q
0000000011D4 000000402FD4 0 =*xmY
0000000011DF 000000402FDF 0 XaXaa C
0000000011ED 000000402FED 0 OXY_bY*
000000001243 000000403043 0 XXXX
00000000128D 00000040308D 0 QYaaaY m
000000001298 000000403098 0 aYa_b
0000000012ED 0000004030ED 0 EX nB
0000000012FD 0000004030FD 0 -aXa
000000001314 000000403114 0 QXYX
000000001322 000000403122 0 Xaa_b
0000000013B6 0000004031B6 0 wz_YX
0000000014D0 0000004032D0 0 0dXX
0000000014D9 0000004032D9 0 vVLiXYYaa(#
00000000151E 00000040331E 0 'Ga o_
File pos Mem pos ID Text
======== ======= == ====
000000001536 000000403336 0 YXX "Xn
000000001567 000000403367 0 XXYXY
000000001576 000000403376 0 XaaXa
000000001591 000000403391 0 6CPXXYa v/o
0000000015B8 0000004033B8 0 *Xaaa_b
0000000016F5 0000004034F5 0 nX 9O
000000001704 000000403504 0 7eCaa
000000001AEF 0000004038EF 0 YaX
000000001AF5 0000004038F5 0 .aM 0
000000001B0B 00000040390B 0 PyYXYa
000000001B25 000000403925 0 bXXaX_bX
000000001D0C 000000403B0C 0 xC DI6ia
000000001D2E 000000403B2E 0 @aYa_b
000000001D69 000000403B69 0 2XXX SK
000000001DF0 000000403BF0 0 m|LX Z<
000000001DFE 000000403BFE 0 XYa ;
000000001E16 000000403C16 0 wa eW
000000001E20 000000403C20 0 +laa
000000001E2B 000000403C2B 0 !>;Y
000000001E34 000000403C34 0 aYY_b
000000001E93 000000403C93 0 dXYYX
000000001E9C 000000403C9C 0 CYX_b
000000001EC2 000000403CC2 0 RDA !8_ a X
000000001ECF 000000403CCF 0 aYX F
000000001EDB 000000403CDB 0 3,a OP
000000001EE7 000000403CE7 0 {XY z-
000000001EF9 000000403CF9 0 Maaa_cX*
000000001F69 000000403D69 0 P} /braYX i
000000001F99 000000403D99 0 XYaX
000000001FAB 000000403DAB 0 %*aaY tm
000000001FBD 000000403DBD 0 c"aa 0T
000000001FD0 000000403DD0 0 *YaYX
000000001FE3 000000403DE3 0 eaY RY
000000001FEF 000000403DEF 0 ~YYXYXa
000000002031 000000403E31 0 y/_Y
000000002043 000000403E43 0 zYa q
000000002064 000000403E64 0 OmYa
000000002072 000000403E72 0 waXaa
0000000020A1 000000403EA1 0 Daaaaa
000000002102 000000403F02 0 ECYY
000000002121 000000403F21 0 a X C
000000002135 000000403F35 0 MYaX
000000002147 000000403F47 0 =YYaaaY
0000000021C6 000000403FC6 0 S<KX
0000000021D9 000000403FD9 0 XXXY
000000002202 000000404002 0 ~QmXYY B
0000000022E7 0000004040E7 0 vL#QTI:
000000002547 000000404347 0 V+7Jr
000000002657 000000404457 0 V>@S}
000000002693 000000404493 0 *.vfY9
00000000269B 00000040449B 0 =#KuB
0000000029F6 0000004047F6 0 a)CgiG
000000002A57 000000404857 0 [$04U,
000000002A81 000000404881 0 hD,>=
000000002AF0 0000004048F0 0 ,Ej$&
000000002C91 000000404A91 0 Z#$gx
000000002C98 000000404A98 0 e3W|qM:58
000000002DDE 000000404BDE 0 ai%hZ
000000002FB6 000000404DB6 0 "G)@/U
000000003035 000000404E35 0 u#(H~
File pos Mem pos ID Text
======== ======= == ====
000000003100 000000404F00 0 Na1s3!
000000003272 000000405072 0 ~!KD[_
00000000330A 00000040510A 0 ?lZX68
000000003359 000000405159 0 3V,mU+
0000000033A0 0000004051A0 0 :/Is(z<
000000003570 000000405370 0 OB#CF
000000003593 000000405393 0 CK=Fuy
0000000035D9 0000004053D9 0 TT?K,q
00000000369F 00000040549F 0 *MFEp
00000000389F 00000040569F 0 #dZ5
00000000399C 00000040579C 0 w?wJ>
000000003A0A 00000040580A 0 "1HG+::
000000003A8E 00000040588E 0 JjdHa
000000003B18 000000405918 0 _WrL/J
000000003B65 000000405965 0 $>2e0
000000003CF9 000000405AF9 0 /X(j9
000000003D8D 000000405B8D 0 ,P{Q8
0000000040C6 000000405EC6 0 {HQZh
0000000040D9 000000405ED9 0 GI(.w
00000000416E 000000405F6E 0 x>WHE
000000004210 000000406010 0 ymOF<
000000004262 000000406062 0 44cHf
00000000427C 00000040607C 0 n2),b
0000000044A6 0000004062A6 0 PfGQzB1
0000000045BA 0000004063BA 0 '}$1O
0000000045EC 0000004063EC 0 UD\fW
000000004605 000000406405 0 ZSd-{Q
00000000467B 00000040647B 0 uSdleg
0000000047EE 0000004065EE 0 w<#w4
000000004854 000000406654 0 Sl<V!k
000000004AB5 0000004068B5 0 /"P3z
000000004AD8 0000004068D8 0 @h#_
000000004B88 000000406988 0 M*rm.
000000004BF7 0000004069F7 0 c?dG-Q3B
000000004C46 000000406A46 0 vLA l
000000004DB9 000000406BB9 0 o<sPq
000000004DC9 000000406BC9 0 t\d}6
000000004E13 000000406C13 0 F f6l
000000004EDB 000000406CDB 0 s ]@1z-
0000000050EA 000000406EEA 0 fDC1BU
000000005127 000000406F27 0 +R|Q*VqA
0000000051E0 000000406FE0 0 (;g';
00000000524D 00000040704D 0 71hFy
0000000052C6 0000004070C6 0 d h~n
00000000535E 00000040715E 0 yLv5(
000000005398 000000407198 0 wE.g4}
0000000053B4 0000004071B4 0 %BiRw
00000000543F 00000040723F 0 "o&8R
0000000057CF 0000004075CF 0 Y.A8_G
00000000581A 00000040761A 0 >&[Y4
0000000058FA 0000004076FA 0 c A~I
0000000059CD 0000004077CD 0 CD,6"
000000005A33 000000407833 0 WPXGk
000000005A85 000000407885 0 ||o*Pdp
000000005AFB 0000004078FB 0 4j*N
000000005C52 000000407A52 0 C.-Vb
000000005D04 000000407B04 0 OFke8d
000000005DE8 000000407BE8 0 @ &"/
000000005F44 000000407D44 0 ~3:5+
000000005FC9 000000407DC9 0 uY6Jy
File pos Mem pos ID Text
======== ======= == ====
000000006073 000000407E73 0 UlZEs
00000000620F 00000040800F 0 -{dX05%
00000000627D 00000040807D 0 H.4)5
00000000636E 00000040816E 0 9d rQ~[OA
00000000637A 00000040817A 0 ~W0E
0000000063FA 0000004081FA 0 }I*+\
000000006470 000000408270 0 i0@w
0000000064CC 0000004082CC 0 MgF[t+c
000000006511 000000408311 0 t"(4]
0000000065C9 0000004083C9 0 I)"vwz5-D5
000000006609 000000408409 0 E$!i;
00000000671F 00000040851F 0 BIav=
00000000673E 00000040853E 0 1|6<V
00000000694F 00000040874F 0 lQUG{
000000006955 000000408755 0 I-pB;2
000000006970 000000408770 0 G"?;RX
0000000069B2 0000004087B2 0 Garqyd
000000006A8D 00000040888D 0 [#/4tx
000000006BE3 0000004089E3 0 *XK/CA
000000006D0E 000000408B0E 0 #@:yq
000000006F91 000000408D91 0 72}!.
000000006FA1 000000408DA1 0 klxFp
000000006FEE 000000408DEE 0 uYdq4
000000007131 000000408F31 0 Mt-Yr
0000000073FE 0000004091FE 0 9L$G#
0000000076EF 0000004094EF 0 fBSJB
000000007700 000000409500 0 v2.0.50727
000000007724 000000409524 0 #Strings
000000007744 000000409544 0 #GUID
000000007754 000000409554 0 #Blob
00000000800D 000000409E0D 0 PloutusService.exe
000000008020 000000409E20 0 PloutusService
00000000802F 000000409E2F 0 mscorlib
000000008051 000000409E51 0 <Module>
00000000805A 000000409E5A 0 .cctor
000000008061 000000409E61 0 CompressShell
00000000806F 000000409E6F 0 Object
000000008076 000000409E76 0 System
000000008089 000000409E89 0 Module
000000008090 000000409E90 0 System.Reflection
0000000080A2 000000409EA2 0 GetLenToPosState
0000000080B7 000000409EB7 0 BinaryReader
0000000080C4 000000409EC4 0 System.IO
0000000080CE 000000409ECE 0 Stream
0000000080D5 000000409ED5 0 Assembly
0000000080DE 000000409EDE 0 Encoding
0000000080E7 000000409EE7 0 System.Text
0000000080F3 000000409EF3 0 get_UTF8
0000000080FC 000000409EFC 0 ResolveEventArgs
00000000810D 000000409F0D 0 get_Name
000000008116 000000409F16 0 GetBytes
00000000811F 000000409F1F 0 GetString
00000000812E 000000409F2E 0 GetTypeFromHandle
000000008140 000000409F40 0 RuntimeTypeHandle
000000008152 000000409F52 0 get_Assembly
00000000815F 000000409F5F 0 GetManifestResourceStream
000000008179 000000409F79 0 .ctor
00000000817F 000000409F7F 0 get_Length
00000000818A 000000409F8A 0 ReadBytes
000000008194 000000409F94 0 IDisposable
File pos Mem pos ID Text
======== ======= == ====
0000000081A0 000000409FA0 0 Dispose
0000000081B2 000000409FB2 0 Buffer
0000000081B9 000000409FB9 0 BlockCopy
0000000081C3 000000409FC3 0 Array
0000000081C9 000000409FC9 0 DecryptAsm
0000000081D4 000000409FD4 0 sender
0000000081DD 000000409FDD 0 ResolveResource
0000000081ED 000000409FED 0 RijndaelManaged
0000000081FD 000000409FFD 0 System.Security.Cryptography
00000000821A 00000040A01A 0 CryptoStream
000000008227 00000040A027 0 MemoryStream
000000008234 00000040A034 0 ReadInt32
00000000823E 00000040A03E 0 SymmetricAlgorithm
000000008251 00000040A051 0 CreateDecryptor
000000008261 00000040A061 0 ICryptoTransform
000000008272 00000040A072 0 CryptoStreamMode
000000008288 00000040A088 0 BitConverter
000000008295 00000040A095 0 ToUInt32
00000000829E 00000040A09E 0 ReadByte
0000000082A7 00000040A0A7 0 Exception
0000000082B1 00000040A0B1 0 Decrypt
0000000082BD 00000040A0BD 0 modPow
0000000082D0 00000040A0D0 0 MethodBase
0000000082DB 00000040A0DB 0 GetEntryAssembly
0000000082EC 00000040A0EC 0 LoadModule
0000000082F7 00000040A0F7 0 AppDomain
000000008301 00000040A101 0 get_CurrentDomain
000000008313 00000040A113 0 ResolveEventHandler
000000008327 00000040A127 0 add_AssemblyResolve
00000000833B 00000040A13B 0 ResolveMethod
000000008349 00000040A149 0 GetParameters
000000008357 00000040A157 0 ParameterInfo
000000008365 00000040A165 0 Invoke
00000000836C 00000040A16C 0 Int32
00000000837C 00000040A17C 0 STAThreadAttribute
00000000838F 00000040A18F 0 State
000000008395 00000040A195 0 ValueType
00000000839F 00000040A19F 0 Index
0000000083AA 00000040A1AA 0 UpdateChar
0000000083B5 00000040A1B5 0 UpdateMatch
0000000083C1 00000040A1C1 0 UpdateRep
0000000083CB 00000040A1CB 0 UpdateShortRep
0000000083DA 00000040A1DA 0 IsCharState
0000000083E6 00000040A1E6 0 OutWindow
0000000083F0 00000040A1F0 0 _buffer
0000000083FD 00000040A1FD 0 _windowSize
000000008409 00000040A209 0 _streamPos
000000008414 00000040A214 0 _stream
00000000841C 00000040A21C 0 Create
000000008423 00000040A223 0 windowSize
00000000842E 00000040A22E 0 stream
000000008435 00000040A235 0 solid
00000000843B 00000040A23B 0 ReleaseStream
000000008449 00000040A249 0 Write
00000000844F 00000040A24F 0 Flush
000000008455 00000040A255 0 CopyBlock
00000000845F 00000040A25F 0 distance
000000008468 00000040A268 0 PutByte
000000008472 00000040A272 0 GetByte
00000000847A 00000040A27A 0 Decoder
File pos Mem pos ID Text
======== ======= == ====
000000008482 00000040A282 0 Range
00000000848D 00000040A28D 0 Normalize
000000008497 00000040A297 0 DecodeDirectBits
0000000084A8 00000040A2A8 0 numTotalBits
0000000084B5 00000040A2B5 0 BitDecoder
0000000084C5 00000040A2C5 0 Decode
0000000084CC 00000040A2CC 0 rangeDecoder
0000000084D9 00000040A2D9 0 BitTreeDecoder
0000000084E8 00000040A2E8 0 Models
0000000084EF 00000040A2EF 0 NumBitLevels
0000000084FC 00000040A2FC 0 numBitLevels
000000008509 00000040A309 0 ReverseDecode
000000008517 00000040A317 0 startIndex
000000008522 00000040A322 0 LzmaDecoder
00000000852E 00000040A32E 0 m_OutWindow
00000000853A 00000040A33A 0 m_RangeDecoder
000000008549 00000040A349 0 m_IsMatchDecoders
00000000855B 00000040A35B 0 m_IsRepDecoders
00000000856B 00000040A36B 0 m_IsRepG0Decoders
00000000857D 00000040A37D 0 m_IsRepG1Decoders
00000000858F 00000040A38F 0 m_IsRepG2Decoders
0000000085A1 00000040A3A1 0 m_IsRep0LongDecoders
0000000085B6 00000040A3B6 0 m_PosSlotDecoder
0000000085C7 00000040A3C7 0 m_PosDecoders
0000000085D5 00000040A3D5 0 m_PosAlignDecoder
0000000085E7 00000040A3E7 0 m_LenDecoder
0000000085F4 00000040A3F4 0 m_RepLenDecoder
000000008604 00000040A404 0 m_LiteralDecoder
000000008615 00000040A415 0 m_DictionarySize
000000008626 00000040A426 0 m_DictionarySizeCheck
00000000863C 00000040A43C 0 m_PosStateMask
00000000864B 00000040A44B 0 _solid
00000000865B 00000040A45B 0 SetDictionarySize
00000000866D 00000040A46D 0 dictionarySize
00000000867C 00000040A47C 0 SetLiteralProperties
000000008697 00000040A497 0 SetPosBitsProperties
0000000086AF 00000040A4AF 0 inStream
0000000086B8 00000040A4B8 0 outStream
0000000086C2 00000040A4C2 0 inSize
0000000086C9 00000040A4C9 0 outSize
0000000086D1 00000040A4D1 0 SetDecoderProperties
0000000086E6 00000040A4E6 0 properties
0000000086F1 00000040A4F1 0 LenDecoder
0000000086FC 00000040A4FC 0 m_Choice
000000008705 00000040A505 0 m_Choice2
00000000870F 00000040A50F 0 m_LowCoder
00000000871A 00000040A51A 0 m_MidCoder
000000008725 00000040A525 0 m_HighCoder
000000008731 00000040A531 0 m_NumPosStates
000000008740 00000040A540 0 numPosStates
00000000874D 00000040A54D 0 posState
000000008756 00000040A556 0 LiteralDecoder
000000008765 00000040A565 0 m_Coders
00000000876E 00000040A56E 0 m_NumPrevBits
00000000877C 00000040A57C 0 m_NumPosBits
000000008789 00000040A589 0 m_PosMask
000000008793 00000040A593 0 numPosBits
00000000879E 00000040A59E 0 numPrevBits
0000000087AA 00000040A5AA 0 GetState
0000000087B7 00000040A5B7 0 prevByte
File pos Mem pos ID Text
======== ======= == ====
0000000087C0 00000040A5C0 0 DecodeNormal
0000000087CD 00000040A5CD 0 DecodeWithMatchByte
0000000087E1 00000040A5E1 0 matchByte
0000000087EB 00000040A5EB 0 Decoder2
0000000087F4 00000040A5F4 0 m_Decoders
0000000087FF 00000040A5FF 0 ConfusedByAttribute
000000008813 00000040A613 0 Attribute
00000000881D 00000040A61D 0 ___.netmodule
00000000882B 00000040A62B 0 PloutusService.NCR.resources
000000008848 00000040A648 0 PloutusService.Properties.Resources.resources
000000008876 00000040A676 0 PloutusService.ProjectInstaller.resources
000000008B5A 00000040A95A 0 Confuser v1.9.0.0
000000008BC2 00000040A9C2 0 _CorExeMain
000000008BCE 00000040A9CE 0 mscoree.dll
000000008F83 00000040C383 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
000000008FBC 00000040C3BC 0 <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
000000009007 00000040C407 0 <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
000000009049 00000040C449 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
000000009081 00000040C481 0 <security>
000000009091 00000040C491 0 <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
0000000090D7 00000040C4D7 0 <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
00000000911E 00000040C51E 0 </requestedPrivileges>
00000000913C 00000040C53C 0 </security>
00000000914D 00000040C54D 0 </trustInfo>
00000000915D 00000040C55D 0 </assembly>
0000000088A3 00000040A6A3 0 Can't Read 1
0000000088BD 00000040A6BD 0 ___.netmodule
000000008CA6 00000040C0A6 0 VS_VERSION_INFO
000000008D02 00000040C102 0 VarFileInfo
000000008D22 00000040C122 0 Translation
000000008D46 00000040C146 0 StringFileInfo
000000008D6A 00000040C16A 0 000004b0
000000008D82 00000040C182 0 FileDescription
000000008DA4 00000040C1A4 0 PloutusService
000000008DCA 00000040C1CA 0 FileVersion
000000008DE4 00000040C1E4 0 1.0.0.0
000000008DFA 00000040C1FA 0 InternalName
000000008E14 00000040C214 0 PloutusService.exe
000000008E42 00000040C242 0 LegalCopyright
000000008E76 00000040C276 0 2013
000000008E8A 00000040C28A 0 OriginalFilename
000000008EAC 00000040C2AC 0 PloutusService.exe
000000008EDA 00000040C2DA 0 ProductName
000000008EF4 00000040C2F4 0 PloutusService
000000008F1A 00000040C31A 0 ProductVersion
000000008F38 00000040C338 0 1.0.0.0
000000008F4E 00000040C34E 0 Assembly Version
000000008F70 00000040C370 0 1.0.0.0
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
000000000178 000000400178 0 .text
0000000001A0 0000004001A0 0 .rsrc
0000000001C7 0000004001C7 0 @.reloc
0000000002B3 0000004020B3 0 xaaXXXa
0000000002F2 0000004020F2 0 ,J s
0000000003A3 0000004021A3 0 :+Ya %
0000000003AB 0000004021AB 0 )Xaa
0000000003B7 0000004021B7 0 )5Y T
0000000003C9 0000004021C9 0 XYXYa
00000000055D 00000040235D 0 n_ SA
000000000570 000000402370 0 /*'aaXc
File pos Mem pos ID Text
======== ======= == ====
000000000629 000000402429 0 &aa_b
000000000782 000000402582 0 hI/X HD
00000000078A 00000040258A 0 2a +'
00000000079B 00000040259B 0 }'XYj!0
0000000007B2 0000004025B2 0 Y!VBQP
0000000008F9 0000004026F9 0 YaY!SYv
000000000922 000000402722 0 YYX!\':
00000000094B 00000040274B 0 Xaa!X
000000000C9D 000000402A9D 0 9YYX Q
000000000CE0 000000402AE0 0 IkXYYYYY
000000000CF1 000000402AF1 0 EXXYa
000000000D36 000000402B36 0 #d YI5
000000000D7B 000000402B7B 0 ,eMSXaa
000000000DAD 000000402BAD 0 LXYYYa4
000000000E33 000000402C33 0 *aaYYXXX
000000000E4D 000000402C4D 0 0lzXYa
000000000E66 000000402C66 0 sYYY
000000000E88 000000402C88 0 NcaYaa
000000000E9A 000000402C9A 0 0Lp X
000000000EAD 000000402CAD 0 ZXXYYXX}
000000000F10 000000402D10 0 B@6YYa
000000000F39 000000402D39 0 bYX <
000000000F55 000000402D55 0 jFXYa4)
000000001039 000000402E39 0 k~XY
000000001045 000000402E45 0 I%aY X
00000000105B 000000402E5B 0 s58XXXaY
000000001079 000000402E79 0 XaaX_b
0000000010C3 000000402EC3 0 1L h]<
0000000010F1 000000402EF1 0 YYXYa "
000000001107 000000402F07 0 -_rXa w
00000000111F 000000402F1F 0 '<tY
000000001133 000000402F33 0 XXa u
000000001156 000000402F56 0 aXYXYY_bj
0000000011B0 000000402FB0 0 |SiY Q
0000000011D4 000000402FD4 0 =*xmY
0000000011DF 000000402FDF 0 XaXaa C
0000000011ED 000000402FED 0 OXY_bY*
000000001243 000000403043 0 XXXX
00000000128D 00000040308D 0 QYaaaY m
000000001298 000000403098 0 aYa_b
0000000012ED 0000004030ED 0 EX nB
0000000012FD 0000004030FD 0 -aXa
000000001314 000000403114 0 QXYX
000000001322 000000403122 0 Xaa_b
0000000013B6 0000004031B6 0 wz_YX
0000000014D0 0000004032D0 0 0dXX
0000000014D9 0000004032D9 0 vVLiXYYaa(#
00000000151E 00000040331E 0 'Ga o_
000000001536 000000403336 0 YXX "Xn
000000001567 000000403367 0 XXYXY
000000001576 000000403376 0 XaaXa
000000001591 000000403391 0 6CPXXYa v/o
0000000015B8 0000004033B8 0 *Xaaa_b
0000000016F5 0000004034F5 0 nX 9O
000000001704 000000403504 0 7eCaa
000000001AEF 0000004038EF 0 YaX
000000001AF5 0000004038F5 0 .aM 0
000000001B0B 00000040390B 0 PyYXYa
000000001B25 000000403925 0 bXXaX_bX
000000001D0C 000000403B0C 0 xC DI6ia
File pos Mem pos ID Text
======== ======= == ====
000000001D2E 000000403B2E 0 @aYa_b
000000001D69 000000403B69 0 2XXX SK
000000001DF0 000000403BF0 0 m|LX Z<
000000001DFE 000000403BFE 0 XYa ;
000000001E16 000000403C16 0 wa eW
000000001E20 000000403C20 0 +laa
000000001E2B 000000403C2B 0 !>;Y
000000001E34 000000403C34 0 aYY_b
000000001E93 000000403C93 0 dXYYX
000000001E9C 000000403C9C 0 CYX_b
000000001EC2 000000403CC2 0 RDA !8_ a X
000000001ECF 000000403CCF 0 aYX F
000000001EDB 000000403CDB 0 3,a OP
000000001EE7 000000403CE7 0 {XY z-
000000001EF9 000000403CF9 0 Maaa_cX*
000000001F69 000000403D69 0 P} /braYX i
000000001F99 000000403D99 0 XYaX
000000001FAB 000000403DAB 0 %*aaY tm
000000001FBD 000000403DBD 0 c"aa 0T
000000001FD0 000000403DD0 0 *YaYX
000000001FE3 000000403DE3 0 eaY RY
000000001FEF 000000403DEF 0 ~YYXYXa
000000002031 000000403E31 0 y/_Y
000000002043 000000403E43 0 zYa q
000000002064 000000403E64 0 OmYa
000000002072 000000403E72 0 waXaa
0000000020A1 000000403EA1 0 Daaaaa
000000002102 000000403F02 0 ECYY
000000002121 000000403F21 0 a X C
000000002135 000000403F35 0 MYaX
000000002147 000000403F47 0 =YYaaaY
0000000021C6 000000403FC6 0 S<KX
0000000021D9 000000403FD9 0 XXXY
000000002202 000000404002 0 ~QmXYY B
0000000022E7 0000004040E7 0 vL#QTI:
000000002547 000000404347 0 V+7Jr
000000002657 000000404457 0 V>@S}
000000002693 000000404493 0 *.vfY9
00000000269B 00000040449B 0 =#KuB
0000000029F6 0000004047F6 0 a)CgiG
000000002A57 000000404857 0 [$04U,
000000002A81 000000404881 0 hD,>=
000000002AF0 0000004048F0 0 ,Ej$&
000000002C91 000000404A91 0 Z#$gx
000000002C98 000000404A98 0 e3W|qM:58
000000002DDE 000000404BDE 0 ai%hZ
000000002FB6 000000404DB6 0 "G)@/U
000000003035 000000404E35 0 u#(H~
000000003100 000000404F00 0 Na1s3!
000000003272 000000405072 0 ~!KD[_
00000000330A 00000040510A 0 ?lZX68
000000003359 000000405159 0 3V,mU+
0000000033A0 0000004051A0 0 :/Is(z<
000000003570 000000405370 0 OB#CF
000000003593 000000405393 0 CK=Fuy
0000000035D9 0000004053D9 0 TT?K,q
00000000369F 00000040549F 0 *MFEp
00000000389F 00000040569F 0 #dZ5
00000000399C 00000040579C 0 w?wJ>
000000003A0A 00000040580A 0 "1HG+::
File pos Mem pos ID Text
======== ======= == ====
000000003A8E 00000040588E 0 JjdHa
000000003B18 000000405918 0 _WrL/J
000000003B65 000000405965 0 $>2e0
000000003CF9 000000405AF9 0 /X(j9
000000003D8D 000000405B8D 0 ,P{Q8
0000000040C6 000000405EC6 0 {HQZh
0000000040D9 000000405ED9 0 GI(.w
00000000416E 000000405F6E 0 x>WHE
000000004210 000000406010 0 ymOF<
000000004262 000000406062 0 44cHf
00000000427C 00000040607C 0 n2),b
0000000044A6 0000004062A6 0 PfGQzB1
0000000045BA 0000004063BA 0 '}$1O
0000000045EC 0000004063EC 0 UD\fW
000000004605 000000406405 0 ZSd-{Q
00000000467B 00000040647B 0 uSdleg
0000000047EE 0000004065EE 0 w<#w4
000000004854 000000406654 0 Sl<V!k
000000004AB5 0000004068B5 0 /"P3z
000000004AD8 0000004068D8 0 @h#_
000000004B88 000000406988 0 M*rm.
000000004BF7 0000004069F7 0 c?dG-Q3B
000000004C46 000000406A46 0 vLA l
000000004DB9 000000406BB9 0 o<sPq
000000004DC9 000000406BC9 0 t\d}6
000000004E13 000000406C13 0 F f6l
000000004EDB 000000406CDB 0 s ]@1z-
0000000050EA 000000406EEA 0 fDC1BU
000000005127 000000406F27 0 +R|Q*VqA
0000000051E0 000000406FE0 0 (;g';
00000000524D 00000040704D 0 71hFy
0000000052C6 0000004070C6 0 d h~n
00000000535E 00000040715E 0 yLv5(
000000005398 000000407198 0 wE.g4}
0000000053B4 0000004071B4 0 %BiRw
00000000543F 00000040723F 0 "o&8R
0000000057CF 0000004075CF 0 Y.A8_G
00000000581A 00000040761A 0 >&[Y4
0000000058FA 0000004076FA 0 c A~I
0000000059CD 0000004077CD 0 CD,6"
000000005A33 000000407833 0 WPXGk
000000005A85 000000407885 0 ||o*Pdp
000000005AFB 0000004078FB 0 4j*N
000000005C52 000000407A52 0 C.-Vb
000000005D04 000000407B04 0 OFke8d
000000005DE8 000000407BE8 0 @ &"/
000000005F44 000000407D44 0 ~3:5+
000000005FC9 000000407DC9 0 uY6Jy
000000006073 000000407E73 0 UlZEs
00000000620F 00000040800F 0 -{dX05%
00000000627D 00000040807D 0 H.4)5
00000000636E 00000040816E 0 9d rQ~[OA
00000000637A 00000040817A 0 ~W0E
0000000063FA 0000004081FA 0 }I*+\
000000006470 000000408270 0 i0@w
0000000064CC 0000004082CC 0 MgF[t+c
000000006511 000000408311 0 t"(4]
0000000065C9 0000004083C9 0 I)"vwz5-D5
000000006609 000000408409 0 E$!i;
00000000671F 00000040851F 0 BIav=
File pos Mem pos ID Text
======== ======= == ====
00000000673E 00000040853E 0 1|6<V
00000000694F 00000040874F 0 lQUG{
000000006955 000000408755 0 I-pB;2
000000006970 000000408770 0 G"?;RX
0000000069B2 0000004087B2 0 Garqyd
000000006A8D 00000040888D 0 [#/4tx
000000006BE3 0000004089E3 0 *XK/CA
000000006D0E 000000408B0E 0 #@:yq
000000006F91 000000408D91 0 72}!.
000000006FA1 000000408DA1 0 klxFp
000000006FEE 000000408DEE 0 uYdq4
000000007131 000000408F31 0 Mt-Yr
0000000073FE 0000004091FE 0 9L$G#
0000000076EF 0000004094EF 0 fBSJB
000000007700 000000409500 0 v2.0.50727
000000007724 000000409524 0 #Strings
000000007744 000000409544 0 #GUID
000000007754 000000409554 0 #Blob
00000000800D 000000409E0D 0 PloutusService.exe
000000008020 000000409E20 0 PloutusService
00000000802F 000000409E2F 0 mscorlib
000000008051 000000409E51 0 <Module>
00000000805A 000000409E5A 0 .cctor
000000008061 000000409E61 0 CompressShell
00000000806F 000000409E6F 0 Object
000000008076 000000409E76 0 System
000000008089 000000409E89 0 Module
000000008090 000000409E90 0 System.Reflection
0000000080A2 000000409EA2 0 GetLenToPosState
0000000080B7 000000409EB7 0 BinaryReader
0000000080C4 000000409EC4 0 System.IO
0000000080CE 000000409ECE 0 Stream
0000000080D5 000000409ED5 0 Assembly
0000000080DE 000000409EDE 0 Encoding
0000000080E7 000000409EE7 0 System.Text
0000000080F3 000000409EF3 0 get_UTF8
0000000080FC 000000409EFC 0 ResolveEventArgs
00000000810D 000000409F0D 0 get_Name
000000008116 000000409F16 0 GetBytes
00000000811F 000000409F1F 0 GetString
00000000812E 000000409F2E 0 GetTypeFromHandle
000000008140 000000409F40 0 RuntimeTypeHandle
000000008152 000000409F52 0 get_Assembly
00000000815F 000000409F5F 0 GetManifestResourceStream
000000008179 000000409F79 0 .ctor
00000000817F 000000409F7F 0 get_Length
00000000818A 000000409F8A 0 ReadBytes
000000008194 000000409F94 0 IDisposable
0000000081A0 000000409FA0 0 Dispose
0000000081B2 000000409FB2 0 Buffer
0000000081B9 000000409FB9 0 BlockCopy
0000000081C3 000000409FC3 0 Array
0000000081C9 000000409FC9 0 DecryptAsm
0000000081D4 000000409FD4 0 sender
0000000081DD 000000409FDD 0 ResolveResource
0000000081ED 000000409FED 0 RijndaelManaged
0000000081FD 000000409FFD 0 System.Security.Cryptography
00000000821A 00000040A01A 0 CryptoStream
000000008227 00000040A027 0 MemoryStream
000000008234 00000040A034 0 ReadInt32
File pos Mem pos ID Text
======== ======= == ====
00000000823E 00000040A03E 0 SymmetricAlgorithm
000000008251 00000040A051 0 CreateDecryptor
000000008261 00000040A061 0 ICryptoTransform
000000008272 00000040A072 0 CryptoStreamMode
000000008288 00000040A088 0 BitConverter
000000008295 00000040A095 0 ToUInt32
00000000829E 00000040A09E 0 ReadByte
0000000082A7 00000040A0A7 0 Exception
0000000082B1 00000040A0B1 0 Decrypt
0000000082BD 00000040A0BD 0 modPow
0000000082D0 00000040A0D0 0 MethodBase
0000000082DB 00000040A0DB 0 GetEntryAssembly
0000000082EC 00000040A0EC 0 LoadModule
0000000082F7 00000040A0F7 0 AppDomain
000000008301 00000040A101 0 get_CurrentDomain
000000008313 00000040A113 0 ResolveEventHandler
000000008327 00000040A127 0 add_AssemblyResolve
00000000833B 00000040A13B 0 ResolveMethod
000000008349 00000040A149 0 GetParameters
000000008357 00000040A157 0 ParameterInfo
000000008365 00000040A165 0 Invoke
00000000836C 00000040A16C 0 Int32
00000000837C 00000040A17C 0 STAThreadAttribute
00000000838F 00000040A18F 0 State
000000008395 00000040A195 0 ValueType
00000000839F 00000040A19F 0 Index
0000000083AA 00000040A1AA 0 UpdateChar
0000000083B5 00000040A1B5 0 UpdateMatch
0000000083C1 00000040A1C1 0 UpdateRep
0000000083CB 00000040A1CB 0 UpdateShortRep
0000000083DA 00000040A1DA 0 IsCharState
0000000083E6 00000040A1E6 0 OutWindow
0000000083F0 00000040A1F0 0 _buffer
0000000083FD 00000040A1FD 0 _windowSize
000000008409 00000040A209 0 _streamPos
000000008414 00000040A214 0 _stream
00000000841C 00000040A21C 0 Create
000000008423 00000040A223 0 windowSize
00000000842E 00000040A22E 0 stream
000000008435 00000040A235 0 solid
00000000843B 00000040A23B 0 ReleaseStream
000000008449 00000040A249 0 Write
00000000844F 00000040A24F 0 Flush
000000008455 00000040A255 0 CopyBlock
00000000845F 00000040A25F 0 distance
000000008468 00000040A268 0 PutByte
000000008472 00000040A272 0 GetByte
00000000847A 00000040A27A 0 Decoder
000000008482 00000040A282 0 Range
00000000848D 00000040A28D 0 Normalize
000000008497 00000040A297 0 DecodeDirectBits
0000000084A8 00000040A2A8 0 numTotalBits
0000000084B5 00000040A2B5 0 BitDecoder
0000000084C5 00000040A2C5 0 Decode
0000000084CC 00000040A2CC 0 rangeDecoder
0000000084D9 00000040A2D9 0 BitTreeDecoder
0000000084E8 00000040A2E8 0 Models
0000000084EF 00000040A2EF 0 NumBitLevels
0000000084FC 00000040A2FC 0 numBitLevels
000000008509 00000040A309 0 ReverseDecode
File pos Mem pos ID Text
======== ======= == ====
000000008517 00000040A317 0 startIndex
000000008522 00000040A322 0 LzmaDecoder
00000000852E 00000040A32E 0 m_OutWindow
00000000853A 00000040A33A 0 m_RangeDecoder
000000008549 00000040A349 0 m_IsMatchDecoders
00000000855B 00000040A35B 0 m_IsRepDecoders
00000000856B 00000040A36B 0 m_IsRepG0Decoders
00000000857D 00000040A37D 0 m_IsRepG1Decoders
00000000858F 00000040A38F 0 m_IsRepG2Decoders
0000000085A1 00000040A3A1 0 m_IsRep0LongDecoders
0000000085B6 00000040A3B6 0 m_PosSlotDecoder
0000000085C7 00000040A3C7 0 m_PosDecoders
0000000085D5 00000040A3D5 0 m_PosAlignDecoder
0000000085E7 00000040A3E7 0 m_LenDecoder
0000000085F4 00000040A3F4 0 m_RepLenDecoder
000000008604 00000040A404 0 m_LiteralDecoder
000000008615 00000040A415 0 m_DictionarySize
000000008626 00000040A426 0 m_DictionarySizeCheck
00000000863C 00000040A43C 0 m_PosStateMask
00000000864B 00000040A44B 0 _solid
00000000865B 00000040A45B 0 SetDictionarySize
00000000866D 00000040A46D 0 dictionarySize
00000000867C 00000040A47C 0 SetLiteralProperties
000000008697 00000040A497 0 SetPosBitsProperties
0000000086AF 00000040A4AF 0 inStream
0000000086B8 00000040A4B8 0 outStream
0000000086C2 00000040A4C2 0 inSize
0000000086C9 00000040A4C9 0 outSize
0000000086D1 00000040A4D1 0 SetDecoderProperties
0000000086E6 00000040A4E6 0 properties
0000000086F1 00000040A4F1 0 LenDecoder
0000000086FC 00000040A4FC 0 m_Choice
000000008705 00000040A505 0 m_Choice2
00000000870F 00000040A50F 0 m_LowCoder
00000000871A 00000040A51A 0 m_MidCoder
000000008725 00000040A525 0 m_HighCoder
000000008731 00000040A531 0 m_NumPosStates
000000008740 00000040A540 0 numPosStates
00000000874D 00000040A54D 0 posState
000000008756 00000040A556 0 LiteralDecoder
000000008765 00000040A565 0 m_Coders
00000000876E 00000040A56E 0 m_NumPrevBits
00000000877C 00000040A57C 0 m_NumPosBits
000000008789 00000040A589 0 m_PosMask
000000008793 00000040A593 0 numPosBits
00000000879E 00000040A59E 0 numPrevBits
0000000087AA 00000040A5AA 0 GetState
0000000087B7 00000040A5B7 0 prevByte
0000000087C0 00000040A5C0 0 DecodeNormal
0000000087CD 00000040A5CD 0 DecodeWithMatchByte
0000000087E1 00000040A5E1 0 matchByte
0000000087EB 00000040A5EB 0 Decoder2
0000000087F4 00000040A5F4 0 m_Decoders
0000000087FF 00000040A5FF 0 ConfusedByAttribute
000000008813 00000040A613 0 Attribute
00000000881D 00000040A61D 0 ___.netmodule
00000000882B 00000040A62B 0 PloutusService.NCR.resources
000000008848 00000040A648 0 PloutusService.Properties.Resources.resources
000000008876 00000040A676 0 PloutusService.ProjectInstaller.resources
000000008B5A 00000040A95A 0 Confuser v1.9.0.0
File pos Mem pos ID Text
======== ======= == ====
000000008BC2 00000040A9C2 0 _CorExeMain
000000008BCE 00000040A9CE 0 mscoree.dll
000000008F83 00000040C383 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
000000008FBC 00000040C3BC 0 <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
000000009007 00000040C407 0 <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
000000009049 00000040C449 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
000000009081 00000040C481 0 <security>
000000009091 00000040C491 0 <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
0000000090D7 00000040C4D7 0 <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
00000000911E 00000040C51E 0 </requestedPrivileges>
00000000913C 00000040C53C 0 </security>
00000000914D 00000040C54D 0 </trustInfo>
00000000915D 00000040C55D 0 </assembly>
0000000088A3 00000040A6A3 0 Can't Read 1
0000000088BD 00000040A6BD 0 ___.netmodule
000000008CA6 00000040C0A6 0 VS_VERSION_INFO
000000008D02 00000040C102 0 VarFileInfo
000000008D22 00000040C122 0 Translation
000000008D46 00000040C146 0 StringFileInfo
000000008D6A 00000040C16A 0 000004b0
000000008D82 00000040C182 0 FileDescription
000000008DA4 00000040C1A4 0 PloutusService
000000008DCA 00000040C1CA 0 FileVersion
000000008DE4 00000040C1E4 0 1.0.0.0
000000008DFA 00000040C1FA 0 InternalName
000000008E14 00000040C214 0 PloutusService.exe
000000008E42 00000040C242 0 LegalCopyright
000000008E76 00000040C276 0 2013
000000008E8A 00000040C28A 0 OriginalFilename
000000008EAC 00000040C2AC 0 PloutusService.exe
000000008EDA 00000040C2DA 0 ProductName
000000008EF4 00000040C2F4 0 PloutusService
000000008F1A 00000040C31A 0 ProductVersion
000000008F38 00000040C338 0 1.0.0.0
000000008F4E 00000040C34E 0 Assembly Version
000000008F70 00000040C370 0 1.0.0.0