2660 lines
368 KiB
XML
2660 lines
368 KiB
XML
<!--
|
|
This file is part of the pestudio solution (www.winitor.com).
|
|
Any usage of this file outside of the context of pestudio (e.g. in third-party application, tools chain, etc...) must be explicitely authorized.
|
|
|
|
Please note that this file will be modified when running pestudio.
|
|
-->
|
|
<xml version="1.0" encoding="utf-8">
|
|
<sigs>
|
|
|
|
<sig name="EPack" more="!EPack V1" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 68 xx xx xx xx B8 xx xx xx xx FF 10</pattern>
|
|
<pattern ep="1">90 90 90 90 61 B8 xx xx xx xx FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00 00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53</pattern>
|
|
<pattern ep="1">33 C0 8B C0 68 xx xx xx xx 68 xx xx xx xx E8</pattern>
|
|
<pattern ep="1">33 C0 8B C0 68 xx xx xx xx 68 xx xx xx xx E8 xx 00 00 00 68 xx xx xx xx 68 xx xx xx xx E8 xx 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Yoda" more="PseudoSigner 0.2 - Yoda" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 03 00 00 00 EB 01 90 90</pattern>
|
|
</sig>
|
|
|
|
<sig name="32Lite" more="32Lite v0.03a" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 06 FC 1E 07 BE xx xx xx xx 6A 04 68 xx 10 xx xx 68</pattern>
|
|
</sig>
|
|
|
|
<sig name="Aase Crypter" more="Aase Crypter" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="ABC Cryptor" more="ABC Cryptor 1.0" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 xx xx xx xx BF 00 xx xx xx B9 00 xx xx xx 80 37 xx 47 39 CF 75 F8</pattern>
|
|
</sig>
|
|
|
|
<sig name="AcidCrypt" more="AcidCrypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 B9 xx xx xx 00 BA xx xx xx 00 BE xx xx xx 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB</pattern>
|
|
<pattern ep="1">BE xx xx xx xx 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB</pattern>
|
|
</sig>
|
|
|
|
<sig name="ACProtect" more="ACProtect" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 50 E8 01 00 00 00 75 83</pattern>
|
|
<pattern ep="1">60 E8 01 00 00 00 7C 83 04 24 06 C3</pattern>
|
|
<pattern ep="1">60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3</pattern>
|
|
<pattern ep="1">60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01</pattern>
|
|
<pattern ep="1">47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73</pattern>
|
|
<pattern ep="1">47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73</pattern>
|
|
<pattern ep="1">60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="ActiveMARK" more="ActiveMARK 5.x -> Trymedia Systems" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67</pattern>
|
|
</sig>
|
|
|
|
<sig name="aPack" more="aPack v0.X" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">1E 06 8C C8 8E D8 xx xx xx 8E C0 50 BE xx xx 33 FF FC B6</pattern>
|
|
<pattern ep="1">1E 06 8C CB BA xx xx 03 DA 8D xx xx xx FC 33 F6 33 FF 48 4B 8E C0 8E DB</pattern>
|
|
<pattern ep="1">1E 06 8C C8 8E D8 05 xx xx 8E C0 50 BE xx xx 33 FF FC B2 xx BD xx xx 33 C9 50 A4 BB xx xx 3B F3 76</pattern>
|
|
<pattern ep="1">8C CB BA xx xx 03 DA FC 33 F6 33 FF 4B 8E DB 8D xx xx xx 8E C0 B9 xx xx F3 A5 4A 75</pattern>
|
|
<pattern ep="1">93 07 1F 05 xx xx 8E D0 BC xx xx EA</pattern>
|
|
</sig>
|
|
|
|
<sig name="sfx" more="Self Extracting (SFX) Archive" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="1">8C C8 8C DB 8E D8 8E C0 89 xx xx xx 2B C3 A3 xx xx 89 xx xx xx BE xx xx B9 xx xx BF xx xx BA xx xx FC AC 32 C2 8A D8</pattern>
|
|
<pattern ep="1">60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73</pattern>
|
|
</sig>
|
|
|
|
<sig name="sfx" more="ARJ Self Extracting (SFX) Archive" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="1">64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC D6 40 00 A1 D0 D6</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A</pattern>
|
|
</sig>
|
|
|
|
<sig name="Armadillo" more="Armadillo" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 60 33 C9 75 02 EB 15 xx 33 C9 75 18 7A 0C 70 0E EB 0D xx 72 0E 79 F1 xx xx xx 79 09 74 F0 xx 87 DB 7A F0 xx xx 61 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 xx 8B 04 24 EB 03 7A 29 xx C6 00 90 C3 xx 70 F0 87 D2 71 07 xx xx 40 8B DB 7A 11 EB 08 xx EB F7 EB C3 xx 7A E9 70 DA 7B D1 71 F3 xx 7B F3 71 D6 xx 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 xx 33 C9 75 18 7A 0C 70 0E EB 0D xx 72 0E 79 F1 xx xx xx 79 09 74 F0 EB 87 xx 7A F0 xx xx 61 8B 9C BD 26 42</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 60 33 C9 75 02 EB 15 xx 33 C9 75 18 7A 0C 70 0E EB 0D xx 72 0E 79 F1 xx xx xx 79 09 74 F0 xx 87 DB 7A F0 xx xx 61 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 xx 8B 04 24 EB 03 7A 29 xx C6 00 90 C3 xx 70 F0 87 D2 71 07 xx xx 40 8B DB 7A 11 EB 08 xx EB F7 EB C3 xx 7A E9 70 DA 7B D1 71 F3 xx 7B F3 71 D6 xx 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 xx 33 C9 75 18 7A 0C 70 0E EB 0D xx 72 0E 79 F1 xx xx xx 79 09 74 F0 EB 87 xx 7A F0 xx xx 61 8B 9C BD AB 76</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 60 33 C9 75 02 EB 15 xx 33 C9 75 18 7A 0C 70 0E EB 0D xx 72 0E 79 F1 xx xx xx 79 09 74 F0 xx 87 DB 7A F0 xx xx 61 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 xx 8B 04 24 EB 03 7A 29 xx C6 00 90 C3 xx 70 F0 87 D2 71 07 xx xx 40 8B DB 7A 11 EB 08 xx EB F7 EB C3 xx 7A E9 70 DA 7B D1 71 F3 xx 7B F3 71 D6 xx 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 40 xx xx 00 68 80 xx xx 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 xx xx 00 33 D2 8A D4 89 15 30 xx xx 00 8B C8 81 E1 FF 00 00 00 89 0D 2C xx xx 00 C1 E1 08 03 CA 89 0D 28 xx xx 00 C1 E8 10 A3 24</pattern>
|
|
<pattern ep="1">44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 4F 44 45 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 53 27 20 61 6E 64 20 27 25 53 27 00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27 25 73 27 29 00 47 65 74 53 74 72 69 6E 67 28 29 2C 20 66 61 6C 73 65 00 00 47 65 74 53</pattern>
|
|
<pattern ep="1">44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43</pattern>
|
|
<pattern ep="1">31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 73 DC F6 D1 05 42 55 53 79 73 74 65 6D 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 44 44 45 20 50 72 6F 63 65 73 73 69 6E 67 00 00 53 77 50 44 44 45 00 00 44 00 44 00 45 00 20 00 50 00 72 00 6F 00 63 00 65 00 73 00 73 00 69 00 6E 00 67 00 00 00 00 00 53 00 77 00 50 00 44 00 44 00 45 00 00 00 00 00 3C 00 00 00</pattern>
|
|
<pattern ep="1">31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 xx xx xx xx 83 C4 04 89 45 FC 8B 45 FC 51 B9 00 08 00 00 B9 06 00 00 00 F7 D1 0F C8 F7 D1 41 41 41 41 41 41 41 83 C1 04 41 41 41 41 83 C1 03 41 41 41 41 41 41 49 41 FE C1 FE C1 FE C1 83 C1 0D FE C1 FE C1 FE C1 FE C1 FE C1 83 C1 0A 49 52 BA 04 00 00 00 03 CA 41 5A 0F C8 23 C1 59 F7 D8 1B C0 F7 D8 5A 89 45 F4 8B 0D xx xx xx xx 33 0D xx xx xx xx D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 xx xx xx xx 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 xx xx xx xx 83 C4 04 89 45 FC 8B 45 FC 53 BB 80 00 00 00 EB 05 BB 04 00 00 00 BB 32 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 E0 00 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 40 5B 89 45 F4 8B 0D xx xx xx xx 33 0D xx xx xx xx D1 E1 89 4D F8 83 7D F4 00 74 09 8B 55 F8 83 CA 01 89 55 F8 8B 45 F8 50 FF 15 xx xx xx xx 83 C4 04 5F 5E 5B 8B E5 5D C3 55 8B EC 83 EC 0C 53 56 57 8B 45 08 50 FF 15 xx xx xx xx 83 C4 04 89 45 FC 8B 45 FC 70 07 7C 03 EB 05 E9 74 FB EB F9 53 BB FF FF 00 00 23 C3 51 B5 2C 80 ED 01 80 ED 20 FE CD FE CD 80 ED 04 FE CD 80 ED 03 FE CD 22 E5 B1 70 80 E9 02 FE C9 FE C9 FE C9 80 E9 06 F6 D0 0F C9 F6 D0 0F C9 FE C9 FE C9 80 E9 10 FE C9 FE C9 80 C1 0C FE C9 FE C9 FE C9 70 07 7C 03 EB 05 C7 74 FB EB F9 FE C9 FE C9 FE C9 FE C9 80 E9 10 80 E9 01 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 FE C9 F7 D1 0F C8 F7 D1 0F C8 FE C1 80 C1 02 22 C1 59 5B 85 C0 0F 85 94 00 00 00 8B 45 FC 53 BB 00 08 00 00 EB 05 BB 80 00 00 00 BB 72 00 00 00 F7 D3 0F C8 F7 D3 43 43 83 C3 08 4B 51 B9 04 00 00 00 03 D9 43 59 0F C8 23 C3 5B F7 D8 1B C0 40 5A 8B C8 51 8B 45 FC 52 BA FF FF</pattern>
|
|
<pattern ep="1">83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 xx xx xx xx E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D xx xx xx xx 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 xx xx xx xx 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 xx xx xx xx FF 15 xx xx xx xx 8B D8 3B DF 75 4C 39 3D xx xx xx xx 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3</pattern>
|
|
<pattern ep="1">E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 xx xx xx xx E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75</pattern>
|
|
<pattern ep="1">E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 xx xx xx xx E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D xx xx xx xx 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 xx xx xx xx 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 xx xx xx xx FF 15 xx xx xx xx 8B D8 3B DF 75 4C 39 3D xx xx xx xx 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3</pattern>
|
|
<pattern ep="1">83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 xx xx xx xx E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58</pattern>
|
|
<pattern ep="1">6A xx 8B B5 xx xx xx xx C1 E6 04 8B 85 xx xx xx xx 25 07 xx xx 80 79 05 48 83 C8 F8 40 33 C9 8A 88 xx xx xx xx 8B 95 xx xx xx xx 81 E2 07 xx xx 80 79 05 4A 83 CA F8 42 33 C0 8A 82</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 60 33 C9 75 02 EB 15 xx 33 C9 75 18 7A 0C 70 0E EB 0D xx 72 0E 79 F1 xx xx xx 79 09 74 F0 xx 87 DB 7A F0 xx xx 61 50 51 EB 0F xx EB 0F xx EB 07 xx EB 0F xx EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC xx 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 xx 8B 04 24 EB 03 7A 29 xx C6 00 90 C3 xx 70 F0 87 D2 71 07 xx xx 40 8B DB 7A 11 EB 08 xx EB F7 EB C3 xx 7A E9 70 DA 7B D1 71 F3 xx 7B F3 71 D6 xx 9D 61 83 ED 06 33 FF 47 60 33 C9 75 02 EB 15 xx 33 C9 75 18 7A 0C 70 0E EB 0D xx 72 0E 79 F1 xx xx xx 79 09 74 F0 EB 87 xx 7A F0 xx xx 61 8B 9C BD B8 43</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3</pattern>
|
|
</sig>
|
|
|
|
<sig name="AsCrypt" more="AsCrypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">80 xx xx xx 83 xx xx xx xx 90 90 90 E2</pattern>
|
|
<pattern ep="1">80 xx xx xx 83 xx xx xx xx 90 90 90 83 xx xx E2</pattern>
|
|
<pattern ep="1">80 xx xx xx 83 xx xx xx xx 90 90 90 51 xx xx xx 01 00 00 00 83 xx xx E2</pattern>
|
|
<pattern ep="1">81 xx xx xx xx xx xx 83 xx xx xx xx xx xx xx 83 xx xx E2 xx EB</pattern>
|
|
</sig>
|
|
|
|
<sig name="ASDPack" more="ASDPack" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9</pattern>
|
|
<pattern ep="1">8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00</pattern>
|
|
<pattern ep="1">55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 xx xx xx 00 00 00 00 00 00 00 40 00 00 xx xx 00 00 00 00 00 00 00 00 00 xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx 00 00 00 00 00 00 00 00 00 00 xx xx 00 00 10 00 00 00 xx 00 00 00 xx xx 00 00 xx xx 00 00 xx xx 00 00 xx 00 00 00 xx xx 00 00 xx 00 00 00 xx xx 00 00 xx 00 00 00 xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F</pattern>
|
|
<pattern ep="1">90 90 90 75 01 90 E9</pattern>
|
|
</sig>
|
|
|
|
<sig name="ASPack" more="ASPack" flag="1" severity="2" file="0" tool="1" url="www.aspack.com">
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 81 ED 92 1A 44 xx B8 8C 1A 44 xx 03 C5 2B 85 CD 1D 44 xx 89 85 D9 1D 44 xx 80 BD C4 1D 44</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 81 ED D2 2A 44 xx B8 CC 2A 44 xx 03 C5 2B 85 A5 2E 44 xx 89 85 B1 2E 44 xx 80 BD 9C 2E 44</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 81 ED 3E D9 43 xx B8 38 xx xx xx 03 C5 2B 85 0B DE 43 xx 89 85 17 DE 43 xx 80 BD 01 DE 43 xx xx 75 15 FE 85 01 DE 43 xx E8 1D xx xx xx E8 79 02 xx xx E8 12 03 xx xx 8B 85 03 DE 43 xx 03 85 17 DE 43 xx 89 44 24 1C 61 FF</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 81 ED 96 78 43 xx B8 90 78 43 xx 03 C5 2B 85 7D 7C 43 xx 89 85 89 7C 43 xx 80 BD 74 7C 43</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 81 ED AE 98 43 xx B8 A8 98 43 xx 03 C5 2B 85 18 9D 43 xx 89 85 24 9D 43 xx 80 BD 0E 9D 43</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 81 ED xx xx xx xx B8 xx xx xx xx 03 C5 2B 85 xx 12 9D xx 89 85 1E 9D xx xx 80 BD 08 9D</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 81 ED CE 3A 44 xx B8 C8 3A 44 xx 03 C5 2B 85 B5 3E 44 xx 89 85 C1 3E 44 xx 80 BD AC 3E 44</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 81 ED EA A8 43 xx B8 E4 A8 43 xx 03 C5 2B 85 78 AD 43 xx 89 85 84 AD 43 xx 80 BD 6E AD 43</pattern>
|
|
<pattern ep="1">90 90 90 75 00 E9</pattern>
|
|
<pattern ep="1">90 90 75 00 E9</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D xx xx xx xx xx xx B8 xx xx xx xx 03 C5</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 81 ED xx xx xx xx B8 xx xx xx xx 03 C5 2B 85 xx 0B DE xx 89 85 17 DE xx xx 80 BD 01 DE</pattern>
|
|
<pattern ep="1">90 90 90 75 xx E9</pattern>
|
|
<pattern ep="1">60 EB xx 5D EB xx FF xx xx xx xx xx E9</pattern>
|
|
<pattern ep="1">60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 xx xx xx 44 00 BB 10 xx 44 00 03 DD 2B 9D</pattern>
|
|
<pattern ep="1">60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 xx xx xx 44 xx BB 10 xx 44 xx 03 DD 2B 9D</pattern>
|
|
<pattern ep="1">90 90 75 xx 90 E9</pattern>
|
|
<pattern ep="1">90 90 90 75 xx 90 E9</pattern>
|
|
<pattern ep="1">60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 xx 44 00 03 DD 2B 9D 72</pattern>
|
|
<pattern ep="1">90 90 75 01 90 E9</pattern>
|
|
<pattern ep="1">90 75 01 90 E9</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D xx xx xx xx xx xx BB xx xx xx xx 03 DD</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D xx xx xx xx xx xx BB xx xx xx xx 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E</pattern>
|
|
<pattern ep="1">60 E8 41 06 00 00 EB 41</pattern>
|
|
<pattern ep="1">60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A</pattern>
|
|
<pattern ep="1">90 75 01 FF E9</pattern>
|
|
<pattern ep="1">90 90 90 75 01 FF E9</pattern>
|
|
<pattern ep="1">90 90 75 01 FF E9</pattern>
|
|
<pattern ep="1">60 E8 70 05 00 00 EB 4C</pattern>
|
|
<pattern ep="1">60 E8 72 05 00 00 EB 4C</pattern>
|
|
<pattern ep="1">60 E9 3D 04 00 00</pattern>
|
|
<pattern ep="1">60 E8 02 00 00 00 EB 09 5D 55</pattern>
|
|
<pattern ep="1">xx xx xx xx 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 0x x3 xx xx 0x xx 0x xx xx xx xx xx 0x xx xF xx xx x3 0x xx xx 8x xx xx xx xx xx xx xx xx 0x x0 0x xx xx xx xx xx xx xx xx xx xx xx xx xx xF 95</pattern>
|
|
<pattern ep="1">xx x8 0x x0 00 xx xx xx xx xD xx xx xx xx xx xx xx xx xx 5x xx xx xx xx xx xx xx xx xx xx xx xx 0x x3 xx xx 0x xx 0x xx xx xx xx xx 0x xx xF xx xx x3 0x xx xx 8x xx xx xx xx xx xx xx xx 0x x0 0x xx xx xx xx xx xx xx xx xx xx xx xx xx xF 95 xx xx xx xx 8x xx xD</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB</pattern>
|
|
<pattern ep="1">60 E8 72 05 00 00 EB 33 87 DB 90 00</pattern>
|
|
<pattern ep="1">A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95</pattern>
|
|
<pattern ep="1">A8 03 xx xx 61 75 08 B8 01 xx xx xx C2 0C xx 68 xx xx xx xx C3 8B 85 26 04 xx xx 8D 8D 3B 04 xx xx 51 50 FF 95</pattern>
|
|
</sig>
|
|
|
|
<sig name="ASProtect" more="ASProtect" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB xx xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">68 01 xx xx xx E8 01 00 00 00 C3 C3</pattern>
|
|
<pattern ep="1">68 01 xx 40 00 E8 01 00 00 00 C3 C3</pattern>
|
|
<pattern ep="1">68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00</pattern>
|
|
<pattern ep="1">90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C</pattern>
|
|
<pattern ep="1">90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00</pattern>
|
|
<pattern ep="1">90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C</pattern>
|
|
<pattern ep="1">60 E8 01 xx xx xx 90 5D 81 ED xx xx xx xx BB xx xx xx xx 03 DD 2B 9D</pattern>
|
|
<pattern ep="1">60 E9 xx xx xx xx 91 78 79 79 79 E9</pattern>
|
|
<pattern ep="1">90 60 E8 1B xx xx xx E9 FC</pattern>
|
|
<pattern ep="1">60 E9 xx 04 xx xx E9 xx xx xx xx xx xx xx EE</pattern>
|
|
<pattern ep="1">90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 xx xx xx 00</pattern>
|
|
<pattern ep="1">68 01 xx xx 00 E8 01 00 00 00 C3 C3</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00</pattern>
|
|
<pattern ep="1">90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB xx xx xx xx 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00</pattern>
|
|
<pattern ep="1">68 01 xx xx xx E8 01 xx xx xx C3 C3</pattern>
|
|
<pattern ep="1">00 00 68 01 xx xx xx C3 AA</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 xx xx 5D 45 55 C3 E8 01 00 00 00 EB 5D BB xx xx xx xx 03 DD</pattern>
|
|
<pattern ep="1">90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 xx xx 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">60 xx xx xx xx xx 90 5D xx xx xx xx xx xx xx xx xx xx xx 03 DD</pattern>
|
|
</sig>
|
|
|
|
<sig name="Python" more="Python-Script" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="0">12 34 56 78</pattern>
|
|
</sig>
|
|
|
|
<sig name="RTF" more="Rich Text Format (RTF)" flag="1" file="1" tool="0" severity="2">
|
|
<pattern ep="0">7B 5C 72 74 66 31</pattern>
|
|
</sig>
|
|
|
|
<sig name="XML" more="Extended Markup Language (XML)" flag="1" file="0" tool="0" severity="3">
|
|
<pattern ep="0">3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E</pattern>
|
|
</sig>
|
|
|
|
<sig name="AverCryptor" more="AverCryptor -> os1r1s" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="AVPACK" more="AVPACK v1.20" flag="1" file="0" tool="1" severity="2" >
|
|
<pattern ep="1">50 1E 0E 1F 16 07 33 F6 8B FE B9 xx xx FC F3 A5 06 BB xx xx 53 CB</pattern>
|
|
</sig>
|
|
|
|
<sig name="AZProtect" more="AZProtect" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83</pattern>
|
|
<pattern ep="1">EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30</pattern>
|
|
</sig>
|
|
|
|
<sig name="BlackEnergy Crypter" more="BlackEnergy DDoS Bot Crypter" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 xx xx 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 xx 03 00 00 xx xx 83 C4 10 xx FF 89 7D F4 0F</pattern>
|
|
</sig>
|
|
|
|
<sig name="Blade Joiner" more="Blade Joiner v1.5" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85</pattern>
|
|
</sig>
|
|
|
|
<sig name="BlindSpot" more="BlindSpot 1.0 -> s134k" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15</pattern>
|
|
</sig>
|
|
|
|
<sig name="BobPack" more="BobPack v1.00 -> BoB / BobSoft" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED xx xx xx xx E8 3D 00 00 00 89 85 xx xx xx xx 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01</pattern>
|
|
</sig>
|
|
|
|
<sig name="BopCrypt" more="BopCrypt v1.0" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 BD xx xx xx xx E8 xx xx 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Borland" more="Borland C/C++" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">3B CF 76 05 2B CF FC F3 AA 59</pattern>
|
|
<pattern ep="1">EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90</pattern>
|
|
<pattern ep="1">2E 8C 06 xx xx 2E 8C 1E xx xx BB xx xx 8E DB 1E E8 xx xx 1F</pattern>
|
|
<pattern ep="1">8C C8 8E D8 8C 1E xx xx 8C 06 xx xx 8C 06 xx xx 8C 06</pattern>
|
|
<pattern ep="1">8C CA 2E 89 xx xx xx B4 30 CD 21 8B 2E xx xx 8B 1E xx xx 8E DA A3 xx xx 8C</pattern>
|
|
<pattern ep="1">A1 xx xx xx xx C1 xx xx A3 xx xx xx xx 83 xx xx xx xx 75 xx 57 51 33 C0 BF</pattern>
|
|
<pattern ep="1">A1 xx xx xx xx C1 xx xx A3 xx xx xx xx 57 51 33 C0 BF xx xx xx xx B9 xx xx xx xx 3B CF 76</pattern>
|
|
<pattern ep="1">A1 xx xx xx xx C1 E0 02 A3 xx xx xx xx 57 51 33 C0 BF xx xx xx xx B9 xx xx xx xx 3B CF 76 05 2B CF FC F3 AA 59 5F</pattern>
|
|
</sig>
|
|
|
|
<sig name="Delphi" more="Borland Delphi" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="0">01 00 00 CC 00 00 00 00 2F 00 00 00 01 C8 50 52 4F 47 52 41 4D 00 10 91 45 78 74 43 74 72 6C 73 00</pattern>
|
|
<pattern ep="0">26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83</pattern>
|
|
<pattern ep="0">01 00 00 CC 00 00 00 00 18 00 00 00 01 0D 49 6E 73 74 61 6C 6C 00 1C 28 53 68 6C 4F 62 6A 00 00 C7</pattern>
|
|
<pattern ep="0">26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 xx xx xx xx E8 xx xx xx xx E8</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 xx 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 B4 B8 xx xx xx xx E8 xx xx xx xx E8 xx xx xx xx 8D 40</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 xx xx 45 00 E8 xx xx xx FF A1 xx xx 45 00 8B 00 E8 xx xx FF FF 8B 0D</pattern>
|
|
<pattern ep="1">BA xx xx xx xx 83 7D 0C 01 75 xx 50 52 C6 05 xx xx xx xx xx 8B 4D 08 89 0D xx xx xx xx 89 4A 04</pattern>
|
|
<pattern ep="1">50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00</pattern>
|
|
<pattern ep="1">50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 37 20 42 6F 72 6C 61 6E 64 00</pattern>
|
|
<pattern ep="1">50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00</pattern>
|
|
<pattern ep="1">E8 xx xx xx xx 6A xx E8 xx xx xx xx 89 05 xx xx xx xx E8 xx xx xx xx 89 05 xx xx xx xx C7 05 xx xx xx xx 0A xx xx xx B8 xx xx xx xx C3</pattern>
|
|
<pattern ep="1">50 6A xx E8 xx xx FF FF BA xx xx xx xx 52 89 05 xx xx xx xx 89 42 04 E8 xx xx xx xx 5A 58 E8 xx xx xx xx C3 55 8B EC 33 C0</pattern>
|
|
<pattern ep="1">50 6A 00 E8 xx xx FF FF BA xx xx xx xx 52 89 05 xx xx xx xx 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 xx xx xx xx 5A 58 E8 xx xx xx xx C3</pattern>
|
|
<pattern ep="1">50 6A xx E8 xx xx FF FF BA xx xx xx xx 52 89 05 xx xx xx xx 89 42 04 C7 42 08 xx xx xx xx C7 42 0C xx xx xx xx E8 xx xx xx xx 5A 58 E8 xx xx xx xx C3</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 xx xx 40 00 E8 xx xx FF FF E8 xx xx FF FF E8 xx xx FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">53 8B D8 33 C0 A3 00 xx xx xx 06 A0 0E 80 xx xx 0F FA 30 xx xx xx 0A 10 xx xx xx 0A 30 xx xx xx 03 3C 0A 30 xx xx xx 03 3C 0A 30 xx xx xx E8</pattern>
|
|
<pattern ep="1">53 8B D8 33 C0 A3 0x xx xx x0 6A 00 E8 0x xx x0 FF A3 0x xx xx x0 A1 0x xx xx x0 A3 0x xx xx x0 33 C0 A3 0x xx xx x0 33 C0 A3 0x xx xx x0 E8</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 xx xx xx xx E8 xx xx FB FF A1 xx xx xx xx 8B xx E8 xx xx FF FF 8B 0D xx xx xx xx A1 xx xx xx xx 8B 00 8B 15 xx xx xx xx E8 xx xx FF FF A1 xx xx xx xx 8B xx E8 xx xx FF FF E8 xx xx FB FF 8D 40</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 xx xx 40 00 E8 xx xx FF FF A1 xx 72 40 00 33 D2 E8 xx xx FF FF A1 xx 72 40 00 8B 00 83 C0 14 E8 xx xx FF FF E8 xx xx FF FF</pattern>
|
|
<pattern ep="1">53 8B D8 33 C0 A3 xx xx xx xx 6A 00 E8 xx xx xx FF A3 xx xx xx xx A1 xx xx xx xx A3 xx xx xx xx 33 C0 A3 xx xx xx xx 33 C0 A3 xx xx xx xx E8</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 53 B8 90 41 61 00 E8 83 CA DE FF</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 94 53 56 57 33 C0</pattern>
|
|
<pattern ep="1">55 8B EC 81 C4 DC FD FF FF 53 56</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 C4 B8 CC 66 61 00</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F4 B8 E0 7C 41 00</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 C4 B8 A0 12 62 00</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 C4 B8 9C 22 62 00</pattern>
|
|
<pattern ep="1">8B FF 55 8B EC E8 xx xx xx xx E8 xx xx xx xx 5D C3</pattern>
|
|
<pattern ep="1">A2 8C DF 98 7B 3C 3A 79 26 71 3F 09</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 C4 B8 xx xx xx xx E8 xx xx xx xx 33 C0 55</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F4 53 B8 60 5C 45 00 E8 0F 06 FB FF</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 53 56 B8 xx xx xx xx E8 xx xx xx xx 33 C0 55 68 xx xx xx xx 64 FF 30 64 89 20 B8</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 53 B8 xx xx xx xx E8 xx xx xx xx 33 C0 55 68 xx xx xx xx 64 FF 30 64 89 20 B8 xx xx xx xx E8</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 xx xx xx xx E8</pattern>
|
|
<pattern ep="0">54 50 46 30</pattern>
|
|
</sig>
|
|
|
|
<sig name="Borland" more="Borland Pascal" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00</pattern>
|
|
<pattern ep="1">B8 xx xx BB xx xx 8E D0 8B E3 8C D8 8E C0 0E 1F A1 xx xx 25 xx xx A3 xx xx E8 xx xx 83 3E xx xx xx 75</pattern>
|
|
<pattern ep="1">B8 xx xx 8E D8 8C xx xx xx 8C D3 8C C0 2B D8 8B C4 05 xx xx C1 xx xx 03 D8 B4 xx CD 21 0E</pattern>
|
|
</sig>
|
|
|
|
<sig name="Cerberus" more="Cerberus v2.0" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">9C 2B ED 8C xx xx 8C xx xx FA E4 xx 88 xx xx 16 07 BF xx xx 8E DD 9B F5 B9 xx xx FC F3 A5</pattern>
|
|
</sig>
|
|
|
|
<sig name="CExe" more="CExe v1.0a" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 81 EC 0C 02 xx xx 56 BE 04 01 xx xx 8D 85 F8 FE FF FF 56 50 6A xx FF 15 54 10 40 xx 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16</pattern>
|
|
</sig>
|
|
|
|
<sig name="ChinaProtect" more="ChinaProtect" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">C3 E8 xx xx xx xx B9 xx xx xx xx E8 xx xx xx xx FF 30 C3 B9 xx xx xx xx E8 xx xx xx xx FF 30 C3 B9 xx xx xx xx E8 xx xx xx xx FF 30 C3 B9 xx xx xx xx E8 xx xx xx xx FF 30 C3 56 8B xx xx xx 6A 40 68 00 10 00 00 8D xx xx 50 6A 00 E8 xx xx xx xx 89 30 83 C0 04 5E C3 8B 44 xx xx 56 8D xx xx 68 00 40 00 00 FF 36 56 E8 xx xx xx xx 68 00 80 00 00 6A 00 56 E8 xx xx xx xx 5E C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="ChSfx" more="ChSfx v1.1" flag="1" severity="2">
|
|
<pattern ep="1">BA xx xx E8 xx xx 8B EC 83 EC xx 8C C8 BB xx xx B1 xx D3 EB 03 C3 8E D8 05 xx xx 89</pattern>
|
|
</sig>
|
|
|
|
<sig name="CipherWall" more="CipherWall Self-Extrator/Decryptor 1.5" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4</pattern>
|
|
<pattern ep="1">90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4</pattern>
|
|
</sig>
|
|
|
|
<sig name="Code Virtualizer" more="Code Virtualizer V1.3.X" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 9C FC E8 00 00 00 00 5F 81 EF xx xx xx xx 8B C7 81 C7 xx xx xx xx 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F xx 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9</pattern>
|
|
</sig>
|
|
|
|
<sig name="Code-Lock" more="Code-Lock vx.x" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="CodeCrypt" more="CodeCrypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F</pattern>
|
|
<pattern ep="1">E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F</pattern>
|
|
<pattern ep="1">E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34</pattern>
|
|
<pattern ep="1">E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F</pattern>
|
|
</sig>
|
|
|
|
<sig name="codeCrypter" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">50 58 53 5B 90 BB xx xx 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3</pattern>
|
|
<pattern ep="1">50 58 53 5B 90 BB xx xx xx 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC</pattern>
|
|
</sig>
|
|
|
|
<sig name="Crunch/PE" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 15 03 00 00 00 06</pattern>
|
|
<pattern ep="1">EB 15 03 xx xx xx 06 xx xx xx xx xx xx xx xx xx xx xx 68 xx xx xx xx 55 E8</pattern>
|
|
<pattern ep="1">EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2</pattern>
|
|
<pattern ep="1">EB 10 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 55 E8 xx xx xx xx 5D 81 ED 18 xx xx xx 8B C5 55 60 9C 2B 85 E9 06 xx xx 89 85 E1 06 xx xx FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24</pattern>
|
|
<pattern ep="1">EB 10 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 55 E8 xx xx xx xx 5D 81 ED 18 xx xx xx 8B C5 55 60 9C 2B 85 xx xx xx xx 89 85 xx xx xx xx FF 74</pattern>
|
|
<pattern ep="1">EB 10 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 55 E8 xx xx xx xx 5D 81 ED 18 xx xx xx 8B C5 55 60 9C 2B 85 E9 06 xx xx 89 85 E1 06 xx xx FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2</pattern>
|
|
<pattern ep="1">55 E8 xx xx xx xx 5D 83 ED 06 8B C5 55 60 89 AD xx xx xx xx 2B 85</pattern>
|
|
<pattern ep="1">2E xx xx xx xx 2E xx xx xx B4 30 CD 21 3C 03 73 xx BB xx xx 8E DB 8D xx xx xx B4 09 CD 21 06 33 C0 50 CB</pattern>
|
|
</sig>
|
|
|
|
<sig name="Crypter" more="Crypter 3.1 -> SLESH" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68</pattern>
|
|
</sig>
|
|
|
|
<sig name="Cryptic" more="Cryptic 2.0 -> Tughack" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">B8 00 00 40 00 BB xx xx xx 00 B9 00 10 00 00 BA xx xx xx 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 xx 41 EB F6 FF E3</pattern>
|
|
</sig>
|
|
|
|
<sig name="Crypto-Lock" more="Crypto-Lock 2" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47</pattern>
|
|
<pattern ep="1">60 BE xx 90 40 00 8D BE xx xx FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0</pattern>
|
|
<pattern ep="1">60 BE xx 90 40 00 8D BE xx xx FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF 5E 89 F7 B9 55 00 00 00 8A 07 47 2C E8 3C 01 77 F7 80 3F 01 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07</pattern>
|
|
</sig>
|
|
|
|
<sig name="CRYPToCRACk" more="CRYPToCRACk's PE Protector -> Lukas Fleischer" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 xx xx 81 3E 50 45 00 00 75 26</pattern>
|
|
<pattern ep="1">5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1</pattern>
|
|
</sig>
|
|
|
|
<sig name="CrypWrap" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 B8 xx xx xx E8 90 02 xx xx 83 F8 xx 75 07 6A xx E8 xx xx xx xx FF 15 49 8F 40 xx A9 xx xx xx 80 74 0E</pattern>
|
|
</sig>
|
|
|
|
<sig name="Dev-C++ 4" more="Dev-C++ 4 -> Bloodshed Software" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 xx xx xx 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 xx xx xx 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D xx xx xx 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 83 C4 F4 6A xx A1 xx xx xx 00 FF D0 E8 xx FF FF FF</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 14 6A xx FF 15 xx xx xx 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE-lock" more="Ding Boy's PE-lock" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00</pattern>
|
|
<pattern ep="1">55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC</pattern>
|
|
<pattern ep="1">9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0</pattern>
|
|
<pattern ep="1">55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="diPacker" more="diPacker 1.x -> diProtector Software" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5</pattern>
|
|
</sig>
|
|
|
|
<sig name="diProtector" more="diProtector 1.x -> diProtector Software" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5</pattern>
|
|
</sig>
|
|
|
|
<sig name="DJoin" more="DJoin v0.7 public" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">C6 05 xx xx 40 00 00 C6 05 xx xx 40 00 00 xx xx xx xx xx xx xx xx 00 xx xx xx xx 00 xx xx xx xx xx 00</pattern>
|
|
<pattern ep="1">C6 05 xx xx 40 00 00 xx xx xx xx xx xx xx xx 00 xx xx xx xx 00 xx xx xx xx xx 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="DotFix" more="DotFix Nice Protect" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8</pattern>
|
|
<pattern ep="1">E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 xx xx xx xx 03 C5 50 B8 xx xx xx xx 03 C5 FF 10 BB xx xx xx xx 03 DD 83 C3 0C 53 50 B8 xx xx xx xx 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3</pattern>
|
|
<pattern ep="1">60 E8 55 00 00 00 8D BD 00 10 40 00 68 xx xx xx 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29</pattern>
|
|
</sig>
|
|
|
|
<sig name="DragonArmor" more="DragonArmor -> Orient" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BF 4C xx xx 00 83 C9 FF 33 C0 68 34 xx xx 00 F2 AE F7 D1 49 51 68 4C xx xx 00 E8 11 0A 00 00 83 C4 0C 68 4C xx xx 00 FF 15 00 xx xx 00 8B F0 BF 4C xx xx 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C xx xx 00 8B D1 68 34 xx xx 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3</pattern>
|
|
<pattern ep="1">BF 4C xx xx 00 83 C9 FF 33 C0 68 34 xx xx 00 F2 AE F7 D1 49 51 68 4C xx xx 00 E8 11 0A 00 00 83 C4 0C 68 4C xx xx 00 FF 15 00 xx xx 00 8B F0 BF 4C xx xx 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C xx xx 00 8B D1 68 34 xx xx 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C xx xx 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C xx xx 00 E8 C0 09 00 00 8B 1D 04 xx xx 00 83 C4 0C 68 5C xx xx 00 56 FF D3 A3 D4 xx xx 00 BF 5C xx xx 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C xx xx 00 8B D1 68 34 xx xx 00 C1 E9 02 F3 AB 8B CA 83 E1</pattern>
|
|
</sig>
|
|
|
|
<sig name="Dropper Creator" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 8D 05 xx xx xx xx 29 C5 8D 85 xx xx xx xx 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09</pattern>
|
|
</sig>
|
|
|
|
<sig name="DSHIELD" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">06 E8 xx xx 5E 83 EE xx 16 17 9C 58 B9 xx xx 25 xx xx 2E</pattern>
|
|
</sig>
|
|
|
|
<sig name="Dual's Cryptor" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E</pattern>
|
|
</sig>
|
|
|
|
<sig name="DzA Patcher" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35</pattern>
|
|
<pattern ep="1">EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00</pattern>
|
|
<pattern ep="1">EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B</pattern>
|
|
<pattern ep="1">BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 48 20 40 00 E8 C2 00 00 00 E8 C8 FF FF FF BF 40 40 40 00 FF 35 4C 20 40 00 E8 A1 00 00 00 8B 0F 83 F9 00 74 B1 60 6A 00 6A 04 6A 01 51 FF 35 48 20 40 00 E8 75 00 00 00 61 60 BB 5C 20 40 00 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 75 00 00 00 61 A0 5C 20 40 00 8A 5F 05 3A C3 74 14 FF 35 4C 20 40 00 E8 4B 00 00 00 6A 03 E8 4A 00 00 00 EB A2 60 8D 5F 04 6A 00 6A 01 53 51 FF 35 48 20 40 00 E8 4B 00 00 00 61 83 C7 06 FF 35 4C 20 40 00 E8 1E 00 00 00 6A 03 E8 1D 00 00 00 E9 72 FF FF FF FF 25 70 30 40 00 FF 25 78</pattern>
|
|
</sig>
|
|
|
|
<sig name="Embed PE" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 9C 64 FF 35 00 00 00 00 E8 79</pattern>
|
|
<pattern ep="1">60 9C 64 FF 35 00 00 00 00 E8 7A</pattern>
|
|
<pattern ep="1">60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00</pattern>
|
|
<pattern ep="1">83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00</pattern>
|
|
<pattern ep="1">83 EC 50 60 68 xx xx xx xx E8 CB FF 00 00</pattern>
|
|
<pattern ep="1">83 EC 50 60 68 xx xx xx xx E8 xx xx 00 00</pattern>
|
|
<pattern ep="1">83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68</pattern>
|
|
<pattern ep="1">45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35</pattern>
|
|
<pattern ep="1">83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33</pattern>
|
|
<pattern ep="1">83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 A3 F5 0B 85 97 7C BA 1D 96 DD 07 F8 FD D2 3A 98 83 CC 46 99 9D DF 6F 89 92 54 46 9F 94 43 CC 41 43 9B 8C 61 B9 D8 6F 96 3B D1 07 32 24 DD 07 05 8E CB 6F A1 07 5C 62 20 E0 DB BA 9D 83 54 46 E6 83 51 7A 2B 94 54 64 8A 83 05 68 D7 5E 2D C6 B7 57 00 B3 E8 3C 71 B8 3C 97 7C 36 19 32 7C 08 2A 06 51 64 73 A3 F1 4E 92 25 CB 80 8D 99 54 46 B0 E1 D3 46 A5 2D 10 68 B6 83 91 46 F2 DF 64 FD D1 BC CA AA 70 E2 AB 39 AE 3B 5A 6F 9B 15 BD 25 98 25 30 4C AD 7D 55 07 A8 A3 AC 0A C1 BD 54 72 BC 83 54 82 A3 97 B1 1A B3 83 54 46 83</pattern>
|
|
<pattern ep="1">60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Enigma" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 83 xx xx 81</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 83 C5 FA 81</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 83 ED 06 81</pattern>
|
|
<pattern ep="1">45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9</pattern>
|
|
<pattern ep="1">60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89</pattern>
|
|
<pattern ep="1">00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61</pattern>
|
|
</sig>
|
|
|
|
<sig name="EXE joiner" more="EXE joiner -> Amok" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">A1 14 A1 40 00 C1 E0 02 A3 18 A1 40</pattern>
|
|
</sig>
|
|
|
|
<sig name="Exe Locker" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="EXE Packer" more="EXE Packer v7.0 by TurboPower Software" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">1E 06 8C C3 83 xx xx 2E xx xx xx xx B9 xx xx 8C C8 8E D8 8B F1 4E 8B FE</pattern>
|
|
</sig>
|
|
|
|
<sig name="EXE Shield" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40</pattern>
|
|
<pattern ep="1">EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40</pattern>
|
|
<pattern ep="1">EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 00 03 9D E6 90 40 00 53 8B C3 8B FB 2D AC 90 40 00 89 85 AD 90 40 00 8D B5 AC 90 40 00 B9 40 04 00 00 F3 A5 8B FB C3 BD 00 00 00 00 8B F7 83 C6 54 81 C7 FF 10 00 00 56 57 57 56 FF 95 DA 90 40 00 8B C8 5E 5F 8B C1 C1 F9 02 F3 A5 03 C8 83 E1 03 F3 A4 EB 26 D0 12 5B 00 AC 12 5B 00 48 12 5B 00 00 00 40 00 00 D0 5A 00 00 10 5B 00 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 87 DB 8B 0E B5 E6 90 40 07 56 03 76 EE 0F 18 83 C6 14 12 35 97 80 8D BD 63 39 0D B9 06 86 02 07 F3 A5 6A 04 68 06 10 12 1B FF B5 51 29 EE 10 22 95</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC xx xx xx F8</pattern>
|
|
<pattern ep="1">65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC</pattern>
|
|
</sig>
|
|
|
|
|
|
<sig name="EXE Stealth" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40</pattern>
|
|
<pattern ep="1">EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20</pattern>
|
|
<pattern ep="1">EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40</pattern>
|
|
<pattern ep="1">90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00</pattern>
|
|
<pattern ep="1">60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC</pattern>
|
|
<pattern ep="1">EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9</pattern>
|
|
<pattern ep="1">EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC</pattern>
|
|
<pattern ep="1">EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41</pattern>
|
|
<pattern ep="1">EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F</pattern>
|
|
<pattern ep="1">EB xx 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20</pattern>
|
|
</sig>
|
|
|
|
<sig name="EXE32Pack" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC xx xx xx xx 02 81 xx xx xx xx xx xx xx 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40</pattern>
|
|
<pattern ep="1">3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC xx xx xx xx 02 81 xx xx xx xx xx xx xx 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40</pattern>
|
|
<pattern ep="1">3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC xx xx xx xx 02 81 xx xx xx xx xx xx xx 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40</pattern>
|
|
<pattern ep="1">3B xx 74 02 81 83 55 3B xx 74 02 81 xx 53 3B xx 74 01 xx xx xx xx xx 02 81 xx xx E8 xx xx xx xx 3B 74 01 xx 5D 8B D5 81 ED</pattern>
|
|
</sig>
|
|
|
|
<sig name="ExeBundle" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11</pattern>
|
|
<pattern ep="1">00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB</pattern>
|
|
</sig>
|
|
|
|
<sig name="EXECryptor" flag="1" file="0" tool="1" severity="2" url="www.strongbit.com">
|
|
<pattern ep="1">55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1</pattern>
|
|
</sig>
|
|
|
|
<sig name="ExeJoiner" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00</pattern>
|
|
<pattern ep="1">68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 xx xx xx xx 68 xx xx xx xx 6A 00 E8</pattern>
|
|
</sig>
|
|
|
|
<sig name="ExeSmasher" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">9C FE 03 xx 60 BE xx xx 41 xx 8D BE xx 10 FF FF 57 83 CD FF EB 10</pattern>
|
|
</sig>
|
|
|
|
<sig name="ExeSplitter" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 xx xx xx xx 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D xx xx xx xx 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC</pattern>
|
|
<pattern ep="1">E9 FE 01 00 00 xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3</pattern>
|
|
<pattern ep="1">15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 xx xx xx xx 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 xx xx xx xx xx xx xx 66</pattern>
|
|
</sig>
|
|
|
|
<sig name="ExeTools Encruptor" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 xx xx 5D 83 ED xx 8C DA 2E 89 96 xx xx 83 C2 xx 8E DA 8E C2 2E 01 96 xx xx 60</pattern>
|
|
<pattern ep="1">E8 xx xx 5D 83 xx xx 1E 8C DA 83 xx xx 8E DA 8E C2 BB xx xx BA xx xx 85 D2 74</pattern>
|
|
</sig>
|
|
|
|
<sig name="eXPressor" more="eXPressor 1 -> CGSoftLabs" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 EC xx 53 56 57 EB 0C 45</pattern>
|
|
<pattern ep="1">65 58 50 72 2D 76 2E 31 2E 34 2E</pattern>
|
|
<pattern ep="1">45 78 50 72 2D 76 2E 31 2E 32 2E</pattern>
|
|
<pattern ep="1">45 78 50 72 2D 76 2E 31 2E 33 2E</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC xx 53 56 57 83 65 DC 00 F3 EB 0C</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC xx 53 56 57 83 65 xx 00 F3 EB 0C</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76</pattern>
|
|
<pattern ep="1">E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13</pattern>
|
|
<pattern ep="1">5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0</pattern>
|
|
<pattern ep="1">E9 xx xx 00 00 E9 xx xx 00 00 E9 xx 12 00 00 E9 xx 0C 00 00 E9 xx xx 00 00 E9 xx xx 00 00 E9 xx xx 00 00</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC xx xx xx xx 53 56 57 EB xx 45 78 50 72 2D 76 2E 31 2E 32 2E 2E</pattern>
|
|
<pattern ep="1">E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC xx 02 00 00 53 56 57 83 A5 xx FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC xx xx xx xx 53 56 57 83 A5 xx xx xx xx xx F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C xx 75 23 8B 45 08 A3 xx xx xx xx 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 xx xx xx xx A3 xx xx xx xx EB 04</pattern>
|
|
<pattern ep="1">EB 01 68 EB 01 xx xx xx xx 83 EC 0C 53 56 57 EB 01 xx 83 3D xx xx xx xx 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 xx xx xx xx 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 xx xx xx xx 68 xx xx xx xx B8 xx xx xx xx FF D0 59 59 EB 01 C8 EB 02</pattern>
|
|
<pattern ep="1">EB 01 68 EB 01 xx xx xx xx 83 EC 0C 53 56 57 EB 01 xx 83 3D xx xx xx xx 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 xx xx xx xx 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 xx xx xx xx 68 xx xx xx xx B8 xx xx xx xx FF D0 59 59 EB 01 C8 EB 02 66 F0 68 xx xx xx xx E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F xx xx xx xx xx xx 33 45 F4 8B 4D F4 88 xx xx xx xx xx EB 01 EB EB</pattern>
|
|
</sig>
|
|
|
|
<sig name="EZIP" more="EZIP v1.0" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C</pattern>
|
|
</sig>
|
|
|
|
<sig name="FACRYPT" more="FACRYPT v1.0" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">B9 xx xx B3 xx 33 D2 BE xx xx 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3</pattern>
|
|
</sig>
|
|
|
|
<sig name="FakeNinja" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA xx xx xx xx FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF</pattern>
|
|
<pattern ep="1">BA xx xx xx xx FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40</pattern>
|
|
</sig>
|
|
|
|
<sig name="FASM" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">6A 00 FF 15 xx xx 40 00 A3 xx xx 40 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="fEaRzCrypter" more="fEaRzCrypter v1.0 -> fEaRz" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 xx 53 56 57 B8 xx xx xx xx E8 xx xx xx xx 33 C0 55 68 xx xx xx xx 64 FF 30 64 89 20 BA xx xx xx xx B8 xx xx xx xx E8 xx xx xx xx 8B D8 85 DB 75 xx 6A 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Fish PE" more="Fish PE Shield 1 -> HellFish" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14</pattern>
|
|
<pattern ep="1">60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00</pattern>
|
|
<pattern ep="1">60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 xx xx xx xx C4 03 00 00 BC A0 00 00 00 40 01 00 xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 xx 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 xx 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 xx 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 xx 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B</pattern>
|
|
<pattern ep="1">60 E8 EA FD FF FF FF D0 C3 8D 40 00 xx 00 00 00 2C 00 00 00</pattern>
|
|
<pattern ep="1">60 E8 EA FD FF FF FF D0 C3 8D 40 00 xx 00 00 00 2C 00 00 00 xx xx xx 00 xx xx 00 00 xx xx xx 00 00 xx xx 00 xx xx xx 00 xx xx xx 00 xx 00 00 00 00 xx xx 00 xx xx 00 00 xx 00 00 00 00 xx xx 00 00 10 00 00 xx xx xx 00 40 xx xx xx 00 00 xx xx 00 00 xx xx 00 xx xx xx 00 40 xx xx xx 00 00 xx 00 00 00 xx xx 00 xx xx 00 00 40</pattern>
|
|
<pattern ep="1">60 E8 EA FD FF FF FF D0 C3 8D 40 00 xx 00 00 00 2C 00 00 00 xx xx xx 00 xx xx 00 00 xx xx xx 00 00 xx xx 00 xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx 00 00 00 00 xx xx 00 00 10 00 00 xx xx xx 00 40 xx xx xx 00 00 xx xx 00 00 xx xx 00 xx xx xx 00 40 xx xx xx 00 00 xx 00 00 00 xx xx 00 xx xx 00 00 40</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx C3 90 09 00 00 00 2C 00 00 00 xx xx xx xx C4 03 00 00 BC A0 00 00 00 40 01 00 xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 xx xx 00 00 xx xx xx xx 00 00 02 00 00 00 A0 00 00 18 01 00 00 xx xx xx xx 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 xx xx xx xx 00 00 00 00 00 00 C0 00 00 40 39 00 00 xx xx xx xx 00 00 08 00 00 00 00 01 00 C8 06 00 00</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx C3 90 09 00 00 00 2C 00 00 00 xx xx xx xx C4 03 00 00 BC A0 00 00 00 40 01 00 xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 xx xx 00 00 xx xx xx xx 00 00 02 00 00 00 A0 00 00 18 01 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="FixupPak" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 E8 00 00 00 00 5D 81 ED xx xx 00 00 BE 00 xx 00 00 03 F5 BA 00 00 xx xx 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8</pattern>
|
|
</sig>
|
|
|
|
<sig name="Fly-Crypter" more="Fly-Crypter 1.0 -> ut1lz" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">53 56 57 55 BB 2C xx xx 44 BE 00 30 44 44 BF 20 xx xx 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 xx xx 44 00 74 06 FF 15 10 xx xx 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90</pattern>
|
|
</sig>
|
|
|
|
<sig name="FreeBASIC" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 xx xx xx 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 xx xx xx 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 xx xx xx 00 89 EC 5D</pattern>
|
|
</sig>
|
|
|
|
<sig name="FreeCryptor" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 xx xx 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08</pattern>
|
|
<pattern ep="1">8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 xx xx 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08</pattern>
|
|
<pattern ep="1">33 D2 90 1E 68 1B xx xx xx 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A</pattern>
|
|
</sig>
|
|
|
|
<sig name="FreeJoiner" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52</pattern>
|
|
<pattern ep="1">E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00</pattern>
|
|
<pattern ep="1">E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00</pattern>
|
|
<pattern ep="1">86 D6 90 86 F2 B9 93 60 08 FE 90 86 D6 90 86 F2 B9 9D 13 45 01 86 D6 90 86 F2 81 C2 93 60 08 FE 33 C9 B9 30 74 4D FF 86 D6 90 86 F2 33 C9 C7 05 B4 17 40 00 00 00 00 00 90 68 00 01 00 00 68 D1 17 40 00 6A 00 E8 CE 02 00 00 90 33 C9 86 D6 90 86 F2 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 D1 17 40 00 E8 9E 02 00 00 A3 CD 17 40 00 86 D6</pattern>
|
|
<pattern ep="1">E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00</pattern>
|
|
<pattern ep="1">E8 xx xx FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 86 FF 68 00 01 00 00 68 F8 13 40 00 6A 00 E8 F3 01 00 00 8A C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 F8 13 40 00 E8 C9 01 00 00 A3 E0 13 40 00 40 0F 84 8B 01 00 00 90 90 90 90 90 6A 02 6A 00 6A FB FF 35 E0 13 40 00 E8 D1 01 00 00 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 E0 13 40 00 E8 B2 01 00 00 8A C0 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50</pattern>
|
|
<pattern ep="1">E8 0E FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50</pattern>
|
|
<pattern ep="1">E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00</pattern>
|
|
<pattern ep="1">E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00</pattern>
|
|
<pattern ep="1">50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00</pattern>
|
|
<pattern ep="1">50 32 xx 66 8B C3 58 E8 xx FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00</pattern>
|
|
<pattern ep="1">50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00</pattern>
|
|
<pattern ep="1">51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Frusion" more="Frusion -> biff" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14</pattern>
|
|
</sig>
|
|
|
|
<sig name="FSG" more="FSG 1 -> dulek/xt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00</pattern>
|
|
<pattern ep="1">23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 xx xx 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA</pattern>
|
|
<pattern ep="1">2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E xx xx 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80</pattern>
|
|
<pattern ep="1">1B DB E8 02 00 00 00 1A 0D 5B 68 80 xx xx 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13</pattern>
|
|
<pattern ep="1">03 F7 23 FE 33 FB EB 02 CD 20 BB 80 xx 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB</pattern>
|
|
<pattern ep="1">03 DE EB 01 F8 B8 80 xx 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE</pattern>
|
|
<pattern ep="1">C1 F0 07 EB 02 CD 20 BE 80 xx xx 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6</pattern>
|
|
<pattern ep="1">0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 xx xx 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB</pattern>
|
|
<pattern ep="1">0F B6 D0 E8 01 00 00 00 0C 5A B8 80 xx xx 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01</pattern>
|
|
<pattern ep="1">33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 xx 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE</pattern>
|
|
<pattern ep="1">EB 02 CD 20 EB 01 91 8D 35 80 xx xx 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA</pattern>
|
|
<pattern ep="1">C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 xx 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx 00 53 BB xx xx xx 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB</pattern>
|
|
<pattern ep="1">BE xx xx xx 00 BF xx xx xx 00 BB xx xx xx 00 53 BB xx xx xx 00 B2 80</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx xx 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 51 FF FF FF 5F BB 28 xx xx 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 xx xx xx FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1C xx xx 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx xx 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B</pattern>
|
|
<pattern ep="1">EB 02 CD 20 03 xx 8D xx 80 xx xx 00 xx xx xx xx xx xx xx xx xx EB 02</pattern>
|
|
<pattern ep="1">80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0</pattern>
|
|
<pattern ep="1">EB 01 02 EB 02 CD 20 B8 80 xx 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB 27 xx xx 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 07 74 EF FE 07 75 06 47 FF 37 AF EB 09 FE 07 0F 84 1A xx xx FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 1B xx xx 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">EB 02 CD 20 2B C8 68 80 xx xx 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9</pattern>
|
|
<pattern ep="1">23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 xx xx 00 0F B6 C9 EB 02 CD 20 BB</pattern>
|
|
<pattern ep="1">23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 xx xx 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA 33 0F B6 C9 0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F BE C0 4B EB 02 CD 20 0F BE C9 2B C9 3B D9 75 B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2 22 E2 A0 xx xx xx E2 35 CA EC E2 E2 E2 E4 B4 57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1 F6 06 55 DA 15 AB E1 F6 06 55 FA 15 A2 E1 F6 06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57 21 8C CD BE CA 25 E2 E2 E2 0D AD 57 F2 CA 1A E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A A3 C2 EA 8E CA 04 E2 E2 E2 1F E2 5F E2 E2 55 EC 62 DE E7 55 E8 65 DA 61 59 E4</pattern>
|
|
<pattern ep="1">2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E xx xx 18 EB 02 AB A0 03 F7</pattern>
|
|
<pattern ep="1">2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E xx xx 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 xx xx xx B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 F 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05</pattern>
|
|
<pattern ep="1">2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E xx xx 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01 00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD 20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE E1 A4 65 xx xx xx B3 09 A1 C6 BF C2 C5 CA 9D 43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA 12 25 77 FF 3D D6 0F 27 3A 8C 34 52 E2 24 3C 4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD 9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD 88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD 79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55 EF 68 E7 F3 64 FA 7A F2 7C 77 05</pattern>
|
|
<pattern ep="1">EB 01 2E EB 02 A5 55 BB 80 xx xx 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02</pattern>
|
|
<pattern ep="1">EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 xx xx 00 EB 02 82 B8 EB 01 10 8D 05 F4</pattern>
|
|
<pattern ep="1">1B DB E8 02 00 00 00 1A 0D 5B 68 80 xx xx 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 xx xx xx 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9</pattern>
|
|
<pattern ep="1">C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 xx xx 77 EB 02 CD 20 5E EB 02 CD 20 2B F7</pattern>
|
|
<pattern ep="1">1B DB E8 02 00 00 00 1A 0D 5B 68 80 xx xx 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00</pattern>
|
|
<pattern ep="1">EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 xx 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB</pattern>
|
|
<pattern ep="1">F7 D8 0F BE C2 BE 80 xx xx 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94</pattern>
|
|
<pattern ep="1">03 F7 23 FE 33 FB EB 02 CD 20 BB 80 xx 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B</pattern>
|
|
<pattern ep="1">03 F7 23 FE 33 FB EB 02 CD 20 BB 80 xx 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB 02 F0 49 C1 F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20 C1 E7 0A 48 EB 01 89 C1 E7 14 2B FF 3B C7 75 A8 E8 01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD 1E 2E 5E 1E DC xx xx 5E 1E 71 06 28 1E 1E 1E 20 F0 93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1 20 1D 32 42 91 16 51 E7 1D 32 42 91 36 51 DE 1D 32 42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91 17 93 5D C8 09 FA 06 61 1E 1E 1E 49 E9 93 2E 06 56 1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A AF 66 DF FE 26 CA 06 40 1E 1E 1E 5B 1E 9B 1E 1E 91 28 9E 1A 23 91 24 A1 16 9D 95 20</pattern>
|
|
<pattern ep="1">EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 xx 8F 83 EB 02 3D 0F 5A</pattern>
|
|
<pattern ep="1">EB 02 09 94 0F B7 FF 68 80 xx xx 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47</pattern>
|
|
<pattern ep="1">C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 xx xx EF 80 F3 F6 2B C1 EB 01 DE 68 77</pattern>
|
|
<pattern ep="1">2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 xx xx 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB</pattern>
|
|
<pattern ep="1">33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 xx xx xx EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB</pattern>
|
|
<pattern ep="1">E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 xx xx 00 8B FA EB 01 A8</pattern>
|
|
<pattern ep="1">0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 xx xx 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27</pattern>
|
|
<pattern ep="1">0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 xx xx 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 EB 02 82 53 EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7 0B D0 4E 1B D2 EB 02 CD 20 2B D2 3B F2 75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61 1F xx xx xx 61 B4 49 6B 61 61 61 63 33 D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85 D4 59 94 2A 60 75 85 D4 79 94 21 60 75 85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B 4C 3D 49 A4 61 61 61 8C 2C D6 71 49 99 61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41 69 0D 49 83 61 61 61 9E 61 DE 61 61 D4 6B E1 5D 66 D4 67 E4 59 E0 D8 63</pattern>
|
|
<pattern ep="1">0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 xx xx xx EB 02 CD 20 03 D3 8D 35 F4 00</pattern>
|
|
<pattern ep="1">87 FE E8 02 00 00 00 98 CC 5F BB 80 xx xx 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3</pattern>
|
|
<pattern ep="1">EB 02 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00</pattern>
|
|
<pattern ep="1">F7 D8 40 49 EB 02 E0 0A 8D 35 80 xx xx xx 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80</pattern>
|
|
<pattern ep="1">F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF xx A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68</pattern>
|
|
<pattern ep="1">F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B xx xx FB C1 C1 03 33 F7 EB 02 CD 20 68</pattern>
|
|
<pattern ep="1">03 DE EB 01 F8 B8 80 xx 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3</pattern>
|
|
<pattern ep="1">03 DE EB 01 F8 B8 80 xx 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE EB 02 CD 20 57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00 C5 62 5A 4E E8 01 00 00 00 43 5A 2B DB 3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4 B5 xx xx 36 FF 45 D9 FA FB FE FD FE CD 6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D 47 DB 09 AE DF E3 F6 50 E4 12 9E C8 EC FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70 B0 A0 AB F9 B5 C0 BF ED 78 25 CB 96 E5 A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77 B2 45 8C B9 96 95 A0 DC A2 1E 9C 9B 11 93 08 83 9B F8 9E 0A 8E 10 F7 85</pattern>
|
|
<pattern ep="1">91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 xx xx 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00</pattern>
|
|
<pattern ep="1">C1 CE 10 C1 F6 0F 68 00 xx xx 00 2B FA 5B 23 F9 8D 15 80 xx xx 00 E8 01 00 00 00 B6 5E 0B</pattern>
|
|
<pattern ep="1">D1 E9 03 C0 68 80 xx xx 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E</pattern>
|
|
<pattern ep="1">E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 xx xx 00 EB 02 61 E9 68 F4 00 00 00 C1 C8</pattern>
|
|
<pattern ep="1">EB 01 4D 83 F6 4C 68 80 xx xx 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38</pattern>
|
|
<pattern ep="1">EB 02 AB 35 EB 02 B5 C6 8D 05 80 xx xx 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8</pattern>
|
|
<pattern ep="1">F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF xx xx BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68</pattern>
|
|
<pattern ep="1">EB 02 CD 20 xx CF xx xx 80 xx xx 00 xx xx xx xx xx xx xx xx 00</pattern>
|
|
<pattern ep="1">BB D0 01 40 xx BF xx 10 40 xx BE</pattern>
|
|
<pattern ep="1">E8 01 00 00 00 xx xx E8 xx 00 00 00</pattern>
|
|
<pattern ep="1">EB 01 xx EB 02 xx xx xx 80 xx xx 00</pattern>
|
|
<pattern ep="1">BB D0 01 40 xx BF xx 10 40 xx BE xx xx xx xx FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16</pattern>
|
|
<pattern ep="1">C1 F0 07 EB 02 CD 20 BE 80 xx xx 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F xx xx xx 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF</pattern>
|
|
<pattern ep="1">0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 xx xx 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 xx xx xx B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F</pattern>
|
|
<pattern ep="1">0F B6 D0 E8 01 00 00 00 0C 5A B8 80 xx xx 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 F7 2B FE EB 01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10 80 EA 03 40 EB 01 20 4E EB 01 3D 83 FE 00 75 A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F ED 33 97 xx xx xx 5D F0 45 29 55 57 55 71 63 02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C 83 11 E0 5D 20 AE 5C 71 83 D0 7B 10 97 54 17 11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56 6C 89 C8 F7 CD 70 D5 E3 DD 08 E8 4E 25 FF 0D F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D B2 CD E7 89 CB 13 D7 D5 E3 1E DF 5A E3 D5 50 DF B3 39 32 C0 2D B0 3F B4 B4 43</pattern>
|
|
<pattern ep="1">33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 xx 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE 58 80 EA 33 C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88 16 F7 D8 46 EB 01 C0 4B 40 8D 0D 00 00 00 00 3B D9 75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA 96 67 54 8D CC xx xx 51 8E 18 74 53 82 83 80 47 B4 D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83 37 39 43 50 A2 32 DC 81 32 3A 4B 97 3D D9 63 1F 55 42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4 49 C4 99 09 47 F9 42 8C 48 51 4E 70 CF B8 12 2B 78 09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E A2 58 B8 D6 0F A8 E5 10 EB E8 F1 23 EF 61 E5 E2 54 EA A9 2A 22 AF 17 A1 23 97 9A 1C</pattern>
|
|
<pattern ep="1">C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 xx 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 EB 02 42 C0 EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B EB 01 55 34 44 0B DB 75 AD E8 01 00 00 00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2 00 xx xx 7C C2 6F DA BC C2 C2 C2 CC 1C 3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE 97 BA D7 EB C3 AE DE 91 AA D5 02 0D 1E EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88 C9 DE CA 07 C2 C2 C2 17 79 49 B2 DA 0A C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2 AA 56 8A E4 C2 C2 C2 07 C2 47 C2 C2 17 B8 42 C6 8D 31 88 45 BA 3D 2B BC</pattern>
|
|
<pattern ep="1">4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 xx 00 00 00 00 00</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB xx xx xx 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 xx xx xx FF 57 55 FF 53 04 09 06 AD 75 DB 8B EC C3 xx xx xx 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx 00 53 BB xx xx xx 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB xx xx xx 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 xx xx xx FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 xx xx xx 00 00 00 00 00 00 00 00 00 88 01 00 00</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx xx 53 BB xx xx xx xx B2 80 A4 B6 80 FF D3 73 F9 33 C9</pattern>
|
|
<pattern ep="1">BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx xx 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB xx xx xx xx 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE</pattern>
|
|
<pattern ep="1">BB D0 01 40 00 BF 00 10 40 00 BE xx xx xx xx 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB xx xx xx xx 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE xx 74 EF FE</pattern>
|
|
</sig>
|
|
|
|
<sig name="FSG" more="FSG v2.0 -> bart/xt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">87 25 xx xx xx 00 61 94 55 A4 B6 80 FF 13</pattern>
|
|
<pattern ep="1">87 25 xx xx xx xx 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75</pattern>
|
|
</sig>
|
|
|
|
<sig name="Fusion" more="Fusion 1.0 -> jaNooNi" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="G!X Protector" more="G!X Protector 1.2 -> Guru.eXe" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="GameGuard" more="GameGuard - nProtect" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE xx xx xx xx 31 FF 74 06 61 E9 4A 4D 50 30 8D BE xx xx xx xx 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B</pattern>
|
|
</sig>
|
|
|
|
<sig name="Gardian Angel" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">06 8C C8 8E D8 8E C0 FC BF xx xx EB</pattern>
|
|
</sig>
|
|
|
|
<sig name="Goat's PE Mutilator" more="Goat's PE Mutilator 1.6" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 EA 0B 00 00 xx xx xx 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Goats Mutilator" more="Goats Mutilator v1.6 -> Goat/_e0f" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 EA 0B 00 00 xx xx xx 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D</pattern>
|
|
</sig>
|
|
|
|
<sig name="GP-Install" more="GP-Install v5.0.3.32" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0</pattern>
|
|
</sig>
|
|
|
|
<sig name="HASP HL Protection" more="HASP HL Protection 1.X -> Aladdin" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 53 56 57 60 8B C4 A3 xx xx xx xx B8 xx xx xx xx 2B 05 xx xx xx xx A3 xx xx xx xx 83 3D xx xx xx xx 00 74 15 8B 0D xx xx xx xx 51 FF 15 xx xx xx xx 83 C4 04 E9 A5 00 00 00 68 xx xx xx xx FF 15 xx xx xx xx A3 xx xx xx xx 68 xx xx xx xx FF 15</pattern>
|
|
</sig>
|
|
|
|
<sig name="HEALTH" more="HEALTH v.5.1 by Muslim M.Polyak" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">1E E8 xx xx 2E 8C 06 xx xx 2E 89 3E xx xx 8B D7 B8 xx xx CD 21 8B D8 0E 1F E8 xx xx 06 57 A1 xx xx 26</pattern>
|
|
</sig>
|
|
|
|
<sig name="Hide PE" more="Hide PE 1.01 -> BGCorp" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">xx BA xx xx xx 00 B8 xx xx xx xx 89 02 83 C2 04 B8 xx xx xx xx 89 02 83 C2 04 B8 xx xx xx xx 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D</pattern>
|
|
</sig>
|
|
|
|
<sig name="Hide and Protect" more="Hide and Protect 1.016 -> SoftWar Company" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">90 90 90 E9 D8 xx 05 00 95 xx 53 00 95 4A 50 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE-Armor" more="PE-Armor -> Hying CCG" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 AA 00 00 00 2D xx xx xx 00 00 00 00 00 00 00 00 3D</pattern>
|
|
<pattern ep="1">E8 03 00 00 00 EB 01 xx BB 55 00 00 00 E8 03 00 00 00 EB 01 xx E8 8E 00 00 00 E8 03 00 00 00 EB 01 xx E8 81 00 00 00 E8 03 00 00 00 EB 01 xx E8 B7 00 00 00 E8 03 00 00 00 EB 01 xx E8 AA 00 00 00 E8 03 00 00 00 EB 01 xx 83 FB 55 E8 03 00 00 00 EB 01 xx 75</pattern>
|
|
<pattern ep="1">01 00 xx xx 00 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 xx xx xx xx xx xx xx xx xx xx xx xx 61 xx xx xx 59 xx xx xx xx 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00 00 00 8D xx xx xx xx 00 00 00 00 00 00 00 9D xx xx xx 8D xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 5D 81 ED F0 00 00 00 8D B5 07 01 00 00 55 56 81 C5 xx xx xx xx 55 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="hying's PEArmor" more="hying's PEArmor V0.76 -> hying" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A xx E8 A3 00 00 00</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED xx xx xx xx 8D B5 xx xx xx xx 55 56 81 C5 xx xx xx xx 55 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="ICrypt" more="ICrypt 1.0 - by BuGGz" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B</pattern>
|
|
</sig>
|
|
|
|
<sig name="ID Application Protector" more="ID Application Protector V1.2 -> ID Security Suite" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C</pattern>
|
|
</sig>
|
|
|
|
<sig name="ILUCRYPT v4" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">8B EC FA C7 46 F7 xx xx 42 81 FA xx xx 75 F9 FF 66 F7</pattern>
|
|
<pattern ep="1">8B EC FA C7 xx xx xx xx 4C 4C C3 FB BF xx xx B8 xx xx 2E xx xx D1 C8 4F 81</pattern>
|
|
</sig>
|
|
|
|
<sig name="INCrypter" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B</pattern>
|
|
</sig>
|
|
|
|
<sig name="Inno Installer" more="Inno Installer v5.1.2" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 xx xx xx xx 68 00 50 00 00 68 D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC</pattern>
|
|
</sig>
|
|
|
|
<sig name="Inno Setup" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 xx 53 56 57 33 C0 89 45 F0 89 45 xx 89 45 xx E8 xx xx FF FF E8 xx xx FF FF E8 xx xx FF FF E8 xx xx FF FF E8 xx xx FF FF</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC 14 xx 00 00 53 56 57 6A 00 FF 15 xx xx xx xx 68 xx xx xx xx FF 15 xx xx xx xx 85 C0 74 29</pattern>
|
|
<pattern ep="1">49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43</pattern>
|
|
</sig>
|
|
|
|
<sig name="InstallAnywhere" more="InstallAnywhere 6.1 -> Zero G Software Inc" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07</pattern>
|
|
</sig>
|
|
|
|
<sig name="Installer VISE Custom" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx 40 00 68 xx xx 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 xx xx 40 00 33 D2 8A D4 89 15 xx xx 40 00 8B C8 81 E1 FF 00 00 00 89 0D</pattern>
|
|
</sig>
|
|
|
|
<sig name="InstallShield Custom" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">64 A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C B1 40 00 A1 70 B1</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC 44 56 FF 15 xx xx 41 00 8B F0 85 F6 75 08 6A FF FF 15 xx xx 41 00 8A 06 57 8B 3D xx xx 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B</pattern>
|
|
</sig>
|
|
|
|
<sig name="IFF" more="Interchange Format File (IFF)" flag="0" file="0" tool="0" severity="2">
|
|
<pattern ep="1">46 4F 52 4D xx xx xx xx 57 56 51 41 56 51 48 44</pattern>
|
|
</sig>
|
|
|
|
<sig name="IPB Protect" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00</pattern>
|
|
<pattern ep="1">EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00</pattern>
|
|
<pattern ep="1">EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="JAM" more="JAM v2.11" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">50 06 16 07 BE xx xx 8B FE B9 xx xx FD FA F3 2E A5 FB 06 BD xx xx 55 CB</pattern>
|
|
</sig>
|
|
|
|
<sig name="JAR" more="JAR Archive" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="1">xx xx xx xx xx xx xx xx xx xx xx xx xx xx 1A 4A 61 72 1B</pattern>
|
|
</sig>
|
|
|
|
<sig name="JDPack" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 xx xx xx E8 01 00 00 00 xx xx xx xx xx xx 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 8B D5 81 ED xx xx xx xx 2B 95 xx xx xx xx 81 EA 06 xx xx xx 89 95 xx xx xx xx 83 BD 45</pattern>
|
|
</sig>
|
|
|
|
<sig name="JExeCompressor" more="JExeCompressor 1.0 - by Arash Veyskarami" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8</pattern>
|
|
<pattern ep="1">0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE xx xx xx xx 21 F9 BE xx xx xx xx 23 CF 0F BC FE D2 DC 85 EF B9 xx xx xx xx C6 C0 F7 8D 35 xx xx xx xx 8D 0D</pattern>
|
|
</sig>
|
|
|
|
<sig name="Joiner" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01</pattern>
|
|
</sig>
|
|
|
|
<sig name="KBys Packer" more="KBys Packer 0.28 -> Shoooo" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53</pattern>
|
|
<pattern ep="1">68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx BA xx xx xx xx 03 C2 FF E0 xx xx xx xx 60 E8 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="KGB SFX" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73</pattern>
|
|
</sig>
|
|
|
|
<sig name="KGCrypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 xx xx xx xx 5D 81 ED xx xx xx xx 64 A1 30 xx xx xx 84 C0 74 xx 64 A1 20 xx xx xx 0B C0 74</pattern>
|
|
</sig>
|
|
|
|
<sig name="kkrunchy" more="kkrunchy -> Ryd" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BD 08 xx xx 00 C7 45 00 xx xx xx 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF xx xx xx 00 57 BE xx xx xx 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10</pattern>
|
|
<pattern ep="1">BD 08 xx xx 00 C7 45 00 xx xx xx 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF xx xx xx 00 57 BE xx xx xx 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 EB 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 DB 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 BD 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 B2 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE xx xx xx 00 BB xx xx xx 00 55 46 AD 85 C0 74 29 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 0D 56 55 FF 53 04 AB 85 C0</pattern>
|
|
<pattern ep="1">BD 08 xx xx 00 C7 45 00 xx xx xx 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF xx xx xx 00 57 BE xx xx xx 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 xx 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 xx 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 xx 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 xx 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE xx xx xx 00 BB xx xx xx 00 55 46 AD 85 C0 74 xx 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 xx 56 55 FF 53 04 AB 85 C0</pattern>
|
|
<pattern ep="1">BD xx xx xx xx C7 45 00 xx xx xx 00 B8 xx xx xx 00 89 45 04 89 45 54 50 C7 45 10 xx xx xx 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF</pattern>
|
|
<pattern ep="1">BD xx xx xx xx C7 45 00 xx xx xx 00 B8 xx xx xx 00 89 45 04 89 45 54 50 C7 45 10 xx xx xx 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF xx xx xx 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE</pattern>
|
|
<pattern ep="1">BD xx xx xx xx C7 45 xx xx xx xx xx FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF xx xx xx xx 57 BE xx xx xx xx 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6</pattern>
|
|
</sig>
|
|
|
|
<sig name="Krypton" more="Krypton v0.X" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">8B 0C 24 E9 0A 7C 01 xx AD 42 40 BD BE 9D 7A 04</pattern>
|
|
<pattern ep="1">8B 0C 24 E9 C0 8D 01 xx C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA</pattern>
|
|
<pattern ep="1">54 E8 xx xx xx xx 5D 8B C5 81 ED 61 34 xx xx 2B 85 60 37 xx xx 83 E8 06</pattern>
|
|
<pattern ep="1">54 E8 xx xx xx xx 5D 8B C5 81 ED 71 44 xx xx 2B 85 64 60 xx xx EB 43 DF</pattern>
|
|
</sig>
|
|
|
|
<sig name="kryptor" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 03 xx xx xx E9 EB 6C 58 40 FF E0</pattern>
|
|
<pattern ep="1">E8 03 xx xx xx E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 5E B9 xx xx xx xx 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 xx 66 B9</pattern>
|
|
</sig>
|
|
|
|
<sig name="LamCrypt" more="LamCrypt -> LaZaRuS" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 66 9C BB 00 xx xx 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8</pattern>
|
|
<pattern ep="1">60 66 9C BB xx xx xx xx 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61</pattern>
|
|
</sig>
|
|
|
|
<sig name="LamerStop" more="LamerStop v1.0c Stefan Esser" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 xx xx 05 xx xx CD 21 33 C0 8E C0 26 xx xx xx 2E xx xx xx 26 xx xx xx 2E xx xx xx BA xx xx FA</pattern>
|
|
</sig>
|
|
|
|
<sig name="Lattice C" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">FA B8 xx xx 05 xx xx B1 xx D3 E8 8C CB 03 C3 8E D8 8E D0 26 xx xx xx xx 2B D8 F7 xx xx xx 75 xx B1 xx D3 E3 EB</pattern>
|
|
<pattern ep="1">FA B8 xx xx 8E D8 B8 xx xx 8E</pattern>
|
|
</sig>
|
|
|
|
<sig name="LaunchAnywhere" more="LaunchAnywhere 4" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="Launcher Generator" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A xx 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="LCC Win32" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 xx xx xx FF 75 10 FF 75 0C FF 75 08 A1</pattern>
|
|
<pattern ep="1">64 A1 xx xx xx xx 55 89 E5 6A FF 68 xx xx xx xx 68 9A 10 40 xx 50</pattern>
|
|
<pattern ep="1">64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40</pattern>
|
|
</sig>
|
|
|
|
<sig name="LGLZ" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BF xx xx 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21</pattern>
|
|
<pattern ep="1">FC 1E 06 0E 8C C8 xx xx xx xx BA xx xx 03 C2 8B D8 05 xx xx 8E DB 8E C0 33 F6 33 FF B9 xx xx F3 A5 4B 48 4A 79</pattern>
|
|
</sig>
|
|
|
|
<sig name="LOCK98" more="LOCK98 V1.00.28 -> keenvim" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 E8 00 00 00 00 5D 81 xx xx xx xx xx EB 05 E9 xx xx xx xx EB 08</pattern>
|
|
</sig>
|
|
|
|
<sig name="LZEXE" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">06 0E 1F 8B xx xx xx 8B F1 4E 89 F7</pattern>
|
|
<pattern ep="1">BF xx xx 06 89 F9 0E 41 1F 8C CB 89 FE</pattern>
|
|
</sig>
|
|
|
|
<sig name="MarjinZ" more="MarjinZ EXE-Scrambler" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="MaskPE" more="MaskPE 1.6 -> yzkzero" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">36 81 2C 24 xx xx xx 00 C3 60</pattern>
|
|
<pattern ep="1">B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 xx 83 C0 xx 36 01 04 24 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="MASM / TASM" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">6A 00 E8 xx xx 00 00 A3 xx 32 40 00 E8 xx xx 00 00</pattern>
|
|
<pattern ep="1">6A 00 E8 xx xx 00 00 A3 xx 32 40 00 E8 xx xx 00 00</pattern>
|
|
<pattern ep="1">CC FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00</pattern>
|
|
<pattern ep="1">C2 xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00</pattern>
|
|
<pattern ep="1">C3 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00</pattern>
|
|
<pattern ep="1">FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00 FF 25 xx xx xx 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="MASM32" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">6A xx 68 00 30 40 00 68 xx 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20</pattern>
|
|
</sig>
|
|
|
|
<sig name="MEW" more="MEW-> Northfox" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">33 C0 E9 xx xx FF FF xx 1C xx xx 40</pattern>
|
|
<pattern ep="1">33 C0 E9 xx xx FF FF 6A xx xx xx xx xx 70</pattern>
|
|
<pattern ep="1">E9 xx xx xx xx 00 00 00 02 00 00 00 0C 00</pattern>
|
|
<pattern ep="1">E9 xx xx xx xx 0C xx xx xx 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">E9 xx xx xx FF 0C xx 00 00 00 00 00 00 00 00 00 00 xx xx xx 00 0C xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">E9 xx xx xx xx 00 00 00 02 00 00 00 0C xx</pattern>
|
|
<pattern ep="1">E9 xx xx xx FF 0C xx 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">E9 xx xx xx FF 0C xx xx 00 00 00 00 00 00 00 00 00 xx xx xx 00 0C</pattern>
|
|
<pattern ep="1">E9 xx xx xx FF 0C xx xx 00 00 00 00 00 00 00 00 00 xx xx xx 00 0C xx xx 00</pattern>
|
|
<pattern ep="1">E9 xx xx xx FF 0C xx 00 00 00 00 00 00 00 00 00 00 xx xx xx 00 0C xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Access" more="Microsoft Access Database" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Basic" more="Microsoft Basic Compiler v5.60 1982-97" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">9A xx xx xx xx 9A xx xx xx xx 9A xx xx xx xx 33 DB BA xx xx 9A xx xx xx xx C7 06 xx xx xx xx 33 DB</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft C" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">B4 30 CD 21 3C 02 73 xx B8</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Resource Cursors" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="0">00 00 02 00 01 00 20 20 00 00 xx 00 xx 00 E8 02 00 00 16</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual Basic" more="Microsoft Visual Basic v5.0 - v6.0" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 00 00 xx 00 00 00 30 xx 00</pattern>
|
|
<pattern ep="1">FF 25 xx xx xx xx xx xx 68 xx xx xx xx E8 xx FF FF FF</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 00 00 00 00 00 00 30 00 00 00</pattern>
|
|
<pattern ep="1">xx xx xx xx xx xx xx FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">5A 68 xx xx xx xx 68 xx xx xx xx 52 E9 xx xx FF</pattern>
|
|
<pattern ep="1">FF 25 xx xx xx xx 68 xx xx xx xx E8 xx FF FF FF xx xx xx xx xx xx 30</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual C" more="Microsoft Visual C 2.0" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">64 A1 00 00 00 00 55 8B EC 6A FF 68</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual C" more="Microsoft Visual C 5.0" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual C" more="Microsoft Visual C v2.0" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">53 56 57 BB xx xx xx xx 8B xx xx xx 55 3B FB 75</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual C# / Basic .NET" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">FF 25 00 20 xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual C# v7.0 / Basic .NET" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual C" more="Microsoft Visual C++ 4.2" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">64 A1 00 00 00 00 55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 50 64 xx xx xx xx xx xx 83 xx xx 53 56 57 89</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual C" more="Microsoft Visual C++ 5.0 - 7.1" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">55 8B EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 xx xx xx xx E8 xx xx xx xx 8D 8D FC FE FF FF 51 E8 xx xx xx xx 83 C4 04 E8 xx xx xx xx 6A 00 FF 15 xx xx xx xx 8B E5 5D C2 10 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual C" more="Microsoft Visual C++ 6.0 - 8.0" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3</pattern>
|
|
<pattern ep="1">68 xx xx xx xx 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3</pattern>
|
|
<pattern ep="1">68 xx xx xx xx 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51</pattern>
|
|
<pattern ep="1">68 xx xx xx xx 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3</pattern>
|
|
<pattern ep="1">68 xx xx xx xx 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3 40</pattern>
|
|
<pattern ep="1">68 xx xx xx xx 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3</pattern>
|
|
<pattern ep="1">8B 44 24 08 85 C0 0F 84 xx xx xx xx 83 F8 01 8B 0D xx xx xx xx 8B 09 89 0D xx xx xx xx 0F 85 xx xx xx xx 68 80 00 00 00 FF 15 xx xx xx xx 85 C0 59 A3 xx xx xx xx 0F 84 xx xx xx xx 83 20 00 A1 xx xx xx xx 68 xx xx xx xx 68 xx xx xx xx A3 xx xx xx xx E8</pattern>
|
|
<pattern ep="1">8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 xx xx 83</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D xx xx xx xx xx EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 xx xx xx xx 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E</pattern>
|
|
<pattern ep="1">E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 xx xx xx xx 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50</pattern>
|
|
<pattern ep="1">60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 xx xx xx xx xx xx xx xx xx xx xx xx xx 01</pattern>
|
|
<pattern ep="1">6A 0C 68 xx xx xx xx E8 xx xx xx xx 33 C0 40 89 45 E4 8B 75 0C</pattern>
|
|
<pattern ep="1">6A 18 68 xx xx xx xx E8 xx xx xx xx BF 94 00 00 00 8B C7 E8 xx xx xx xx 89</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB 00 00 00 89 45 F8 8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 xx xx xx xx 83 C4 04 0B C0 74 7B 83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55</pattern>
|
|
<pattern ep="1">8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 xx xx xx xx 83 7D 0C 01 A1 xx xx xx xx 8B 00 A3 xx xx xx xx 0F 84 xx xx xx xx 39 75 0C 0F 84 xx xx xx xx 33 C0 40 5E 5D C2 0C 00</pattern>
|
|
<pattern ep="1">8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 xx xx xx xx 83 7D 0C 01 A1 xx xx xx xx 8B 00 A3 xx xx xx xx 0F 85 xx xx xx xx 68 80 00 00 00 FF 15 xx xx xx xx 3B C6 59 A3 xx xx xx xx 0F 84 xx xx xx xx 89 30 A1 xx xx xx xx 68 xx xx xx xx 68 xx xx xx xx A3</pattern>
|
|
<pattern ep="1">8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 xx xx xx xx 83 7D 0C 01 A1 xx xx xx xx 8B 00 A3 xx xx xx xx 0F 85 xx xx xx xx 68 80 00 00 00 FF 15 xx xx xx xx 3B C6 59 A3 xx xx xx xx 0F 84 xx xx xx xx 89 30 A1 xx xx xx xx 68 xx xx xx xx 68 xx xx xx xx A3 xx xx xx xx E8 xx xx xx xx FF 05 xx xx xx xx 59 59 33 C0 40 5E 5D C2 0C 00</pattern>
|
|
<pattern ep="1">8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 xx xx xx xx 83 7D 0C 01 A1 xx xx xx xx 8B 00 A3 xx xx xx xx 75 44 68 80 00 00 00 FF 15 xx xx xx xx 3B C6 59 A3 xx xx xx xx 0F 84 xx xx xx xx 89 30 A1 xx xx xx xx 68 xx xx xx xx 68 xx xx xx xx A3 xx xx xx xx E8</pattern>
|
|
<pattern ep="1">8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 xx xx xx xx 7E 2D FF 0D xx xx xx xx 83 7D 0C 01 A1 xx xx xx xx 8B 00 A3 xx xx xx xx 75 3D 68 80 00 00 00 FF 15 xx xx xx xx 3B C6 59 A3 xx xx xx xx 75 04 33 C0 EB 67 89 30 A1 xx xx xx xx 68 xx xx xx xx 68</pattern>
|
|
<pattern ep="1">8B FF 55 8B EC 83 7D 0C 01 75 05 E8 4A 65 00 00 FF</pattern>
|
|
<pattern ep="1">E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9</pattern>
|
|
<pattern ep="1">E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9 xx xx xx xx E9</pattern>
|
|
<pattern ep="1">55 8D 6C xx xx 81 EC xx xx xx xx 8B 45 xx 83 F8 01 56 0F 84 xx xx xx xx 85 C0 0F 84</pattern>
|
|
<pattern ep="1">83 7C 24 08 01 75 09 8B 44 24 04 A3 xx xx 00 10 E8 8B FF FF FF</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC 44 56 FF 15 xx xx xx xx 6A 01 8B F0 FF 15</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC 44 56 FF 15 xx xx xx xx 8B F0 8A xx 3C 22</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 64 A1 xx xx xx xx 50 64 89 25 xx xx xx xx 83 EC xx 53 56 57</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC 50 53 56 57 BE xx xx xx xx 8D 7D F4 A5 A5 66 A5 8B</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx xx 00 68 xx xx xx 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC xx 53 56 57 89 65 E8 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx FF</pattern>
|
|
<pattern ep="1">xx xx 41 00 00 00 00 00 00 00 63 00 00 00 00 00 xx 00 xx xx xx xx xx 00 xx 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 xx 00 xx 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 xx xx 20 xx xx 00 xx 00 xx xx xx xx xx xx xx 00 xx xx xx xx xx xx xx xx xx xx xx 00 xx 00 xx xx xx 00 xx xx xx xx xx xx xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx xx xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx xx xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx xx xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx xx xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx xx xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 xx xx xx xx xx xx xx xx xx xx xx 00 xx 00 xx 00 xx xx xx 00 xx 00 xx 00 xx 00 xx 00 xx 00</pattern>
|
|
<pattern ep="1">xx xx 41 00 00 00 00 00 00 00 63 00 00 00 00 00 xx 00 xx xx xx xx xx 00 xx 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 xx 00 xx 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 xx xx 20 xx xx 00 xx 00 xx xx xx xx xx xx xx 00</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 xx xx 83</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10</pattern>
|
|
<pattern ep="1">6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56</pattern>
|
|
<pattern ep="1">6A xx 68 xx xx xx xx E8 xx xx xx xx BF xx xx xx xx 8B C7 E8 xx xx xx xx 89 65 xx 8B F4 89 3E 56 FF 15 xx xx xx xx 8B 4E xx 89 0D xx xx xx xx 8B 46 xx A3</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D xx xx 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC</pattern>
|
|
<pattern ep="1">6A 0C 68 xx xx xx xx E8 xx xx xx xx 33 C0 40 89 45 E4</pattern>
|
|
<pattern ep="1">83 7C 24 08 01 75 xx xx xx 24 04 50 A3 xx xx xx 50 FF 15 00 10 xx 50 33 C0 40 C2 0C 00</pattern>
|
|
<pattern ep="1">6A xx 68 xx xx xx 01 E8 xx xx 00 00 66 81 3D 00 00 00 01 4D 5A 75 xx A1 3C 00 00 01 xx xx 00 00 00 01</pattern>
|
|
<pattern ep="1">6A 14 68 xx xx xx xx E8 xx xx xx xx BB 94 00 00 00 53 6A 00 8B xx xx xx xx xx FF D7 50 FF xx xx xx xx xx 8B F0 85 F6 75 0A 6A 12 E8 xx xx xx xx 59 EB 18 89 1E 56 FF xx xx xx xx xx 56 85 C0 75 14 50 FF D7 50 FF xx xx xx xx xx B8</pattern>
|
|
<pattern ep="1">53 55 56 8B xx xx xx 85 F6 57 B8 xx xx xx xx 75 xx 8B xx xx xx xx xx 85 C9 75 xx 33 C0 5F 5E 5D 5B C2</pattern>
|
|
<pattern ep="1">55 8B EC 56 57 BF xx xx xx xx 8B xx xx 3B F7 0F</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual C++" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">48 83 EC 28 E8 xx xx 00 00 48 83 C4 28 E9 xx xx FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC</pattern>
|
|
<pattern ep="1">83 3D xx xx xx xx 00 74 1A 68 xx xx xx xx E8 xx xx xx xx 85 C0 59 74 0B FF 74 24 04 FF 15 xx xx xx xx 59 E8 xx xx xx xx 68 xx xx xx xx 68 xx xx xx xx E8 xx xx xx xx 85 C0 59 59 75 54 56 57 68 xx xx xx xx E8 xx xx xx xx BE xx xx xx xx 8B C6 BF</pattern>
|
|
<pattern ep="1">E8 xx xx 00 00 E9 xx xx FF FF</pattern>
|
|
<pattern ep="1">83 xx xx 6A 00 FF 15 F8 10 0B B0 8D xx xx xx 51 6A 08 6A 00 6A 00 68</pattern>
|
|
<pattern ep="1">53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00</pattern>
|
|
<pattern ep="1">53 56 57 BB 01 xx xx xx 8B xx 24 14</pattern>
|
|
<pattern ep="1">53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D xx xx xx xx xx 75 09 33 C0</pattern>
|
|
<pattern ep="1">55 8B EC 56 57 BF 01 00 00 00 8B 75 0C</pattern>
|
|
<pattern ep="1">53 B8 xx xx xx xx 8B xx xx xx 56 57 85 DB 55 75</pattern>
|
|
<pattern ep="1">64 A1 00 00 00 00 55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 50 64 xx xx xx xx xx xx 83 xx xx 53 56 57 89 xx xx C7</pattern>
|
|
<pattern ep="1">64 A1 00 00 00 00 55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 50 64 xx xx xx xx xx xx 83 xx xx 53 56 57 89 xx xx FF</pattern>
|
|
<pattern ep="1">64 A1 00 00 00 00 55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 50 64 89 25 00 00 00 00 83 EC xx 53 56 57</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 64 A1 00 00 00 00 50 64 89 25 00 00 00 00</pattern>
|
|
<pattern ep="1">8B 44 24 08 56 83 E8 xx 74 xx 48 75</pattern>
|
|
<pattern ep="1">8B 44 24 08 83 xx xx 74</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft Visual Studio .NET" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="CAB SFX" more="Cabinet (CAB) Self Extracting (SFX) Archive" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="0">E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18</pattern>
|
|
<pattern ep="0">E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 8B 55 20 89 50 1C 8B 55 24 89 50 20 8B 55 28 89 48 48 89 48 44 89 48 4C B9 FF FF 00 00 89 70 08 89 10 66 C7 80 B2 00 00 00 0F 00 89 88 A0 00 00 00 89 88 A8 00 00 00 89 88 A4 00 00</pattern>
|
|
<pattern ep="0">55 8B EC 83 EC 44 56 FF 15 xx 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D xx EB 0A 3C 20</pattern>
|
|
<pattern ep="0">E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC</pattern>
|
|
</sig>
|
|
|
|
<sig name="CAB" more="Cabinet (CAB) file" flag="1" severity="2" file="1" tool="1" url="">
|
|
<pattern ep="0">4D 53 43 46 00 00</pattern>
|
|
<pattern ep="0">4C 4D 50 46 0E 00 00 00 62 61 6E 61 6E 69 73 74 61 6E 2E 74 6D 70 0A 00 00 00 42 41 4E 41 4E 49</pattern>
|
|
</sig>
|
|
|
|
<sig name="MinGW" more="MinGW GCC" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">55 89 E5 E8 xx xx xx xx C9 C3 xx xx 45 58 45</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D</pattern>
|
|
<pattern ep="1">55 89 E5 xx xx xx xx xx xx FF FF xx xx xx xx xx 00 xx xx 00 xx xx xx 00 00 00 00</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 xx 00 00 00 FF 15 xx xx xx xx E8 xx xx FF FF xx xx xx xx xx xx xx xx 55</pattern>
|
|
<pattern ep="1">55 89 E5 xx xx xx xx xx xx xx xx xx xx xx 00 00 00 xx xx xx xx xx xx xx xx xx xx 00</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 F4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 3B 02 00 00 E8 C6 01 00 00 E9 75 FF FF FF E8 BC 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 6B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 48 05 00 00 8B 5D FC 89 EC 5D C3</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 00 00 EB EB 8D B4 26 00 00 00 00 85 C0 75 D0 E8 47 00 00 00 EB C9 90 8D 74 26 00 C7 04 24 80 00 00 00 E8 A4 05 00 00 A3 00 30 00 10 85 C0 74 1A C7 00 00 00 00 00 A3 10 30 00 10 E8 1B 02 00 00 E8 A6 01 00 00 E9 75 FF FF FF E8 6C 05 00 00 C7 00 0C 00 00 00 31 C0 EB 98 89 F6 55 89 E5 83 EC 08 89 5D FC 8B 15 00 30 00 10 85 D2 74 29 8B 1D 10 30 00 10 83 EB 04 39 D3 72 0D 8B 03 85 C0 75 2A 83 EB 04 39 D3 73 F3 89 14 24 E8 1B 05 00 00 31 C0 A3 00 30 00 10 C7 04 24 00 00 00 00 E8 F8 04 00 00 8B 5D FC 89 EC 5D C3</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 0C 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 5D 08 00 00 83 EC 04 E8 55 03 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 D2 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 08 41 40 00 85 C0 74 1F 89 04 24 E8 93 07 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 91 07 00 00</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 xx xx xx 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 xx xx xx 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D xx xx xx 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D xx xx xx 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 xx xx 00 00 90 90 90 90 90 90 90</pattern>
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 xx 00 00 00 FF 15 xx xx xx 00 E8 xx FE FF FF 90 8D B4 26 00 00 00 00 55</pattern>
|
|
<pattern ep="0">2E 66 69 6C 65 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Minke" more="Minke 1.0.1 - by Codius" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 F0 53 xx xx xx xx xx 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8</pattern>
|
|
<pattern ep="1">26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73</pattern>
|
|
</sig>
|
|
|
|
<sig name="mkfpack" more="mkfpack -> llydd" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6</pattern>
|
|
</sig>
|
|
|
|
<sig name="MoleBox" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">42 04 E8 xx xx 00 00 A3 xx xx xx 00 8B 4D F0 8B 11 89 15 xx xx xx 00 xx 45 FC A3 xx xx xx 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 xx 07 00 00 58 89 44 24 20 61 58 FF D0 E8 xx xx 00 00 CC CC CC CC CC CC CC</pattern>
|
|
<pattern ep="1">xx xx xx 00 8B 4D F0 8B 11 89 15 xx xx xx 00 8B 45 FC A3 xx xx xx 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 xx 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 xx xx 00 00 6A 00 FF 15 xx xx xx 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 60 E8 4F 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Morphine" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">28 xx xx xx 00 00 00 00 00 00 00 00 40 xx xx xx 34 xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C xx xx xx 5C xx xx xx 00 00 00 00 4C xx xx xx 5C xx xx xx 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63</pattern>
|
|
<pattern ep="1">FF 25 34 xx 5A 00 8B C0 FF 25 38 xx 5A 00 8B C0</pattern>
|
|
<pattern ep="1">00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">28 xx xx xx 00 00 00 00 00 00 00 00 40 xx xx xx 34 xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C xx xx xx 5C xx xx xx 00 00 00 00 4C xx xx xx 5C xx xx xx 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41</pattern>
|
|
</sig>
|
|
|
|
<sig name="mPack" more="mPack -> DeltaAziz" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5</pattern>
|
|
<pattern ep="1">E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 4E xx xx 00 00 00 00 00 00 00 00 00 5E xx xx 00 4E xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 xx xx 00 00 xx xx 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 xx xx xx 0C xx xx xx CC E4 xx xx xx xx xx xx 00 00 00 00 00 00 00 00 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 83 EB FD</pattern>
|
|
<pattern ep="1">55 8B EC 83 xx xx 33 C0 89 45 F0 B8 xx xx xx xx E8 67 C4 FF FF 33 C0 55 68 xx xx xx xx 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 xx xx xx xx 33 C0 55 68 xx xx xx xx 64 FF 30 64 89 20 A1 xx xx xx xx E8 FA C9 FF FF 83 F8 FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="MPEG" more="MPEG movie" flag="0" file="1" tool="0" severity="2">
|
|
<pattern ep="0">00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB</pattern>
|
|
</sig>
|
|
|
|
<sig name="MSLRH" more="MSLRH -> emadicius" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1</pattern>
|
|
<pattern ep="1">EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83</pattern>
|
|
<pattern ep="1">EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50</pattern>
|
|
<pattern ep="1">60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03</pattern>
|
|
<pattern ep="1">3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB</pattern>
|
|
<pattern ep="1">55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75</pattern>
|
|
<pattern ep="1">E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31</pattern>
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74</pattern>
|
|
<pattern ep="1">FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB</pattern>
|
|
<pattern ep="1">EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83</pattern>
|
|
<pattern ep="1">9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02</pattern>
|
|
<pattern ep="1">9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29</pattern>
|
|
<pattern ep="1">EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A</pattern>
|
|
<pattern ep="1">60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04</pattern>
|
|
<pattern ep="1">B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB</pattern>
|
|
<pattern ep="1">60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4</pattern>
|
|
<pattern ep="1">60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40</pattern>
|
|
<pattern ep="1">53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00</pattern>
|
|
<pattern ep="1">60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8</pattern>
|
|
<pattern ep="1">EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01</pattern>
|
|
<pattern ep="1">60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01</pattern>
|
|
<pattern ep="1">60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01</pattern>
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01</pattern>
|
|
<pattern ep="1">FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 83 BD 9C 38 40 00 01 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01</pattern>
|
|
<pattern ep="1">60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF</pattern>
|
|
<pattern ep="1">E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8</pattern>
|
|
<pattern ep="1">EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03</pattern>
|
|
<pattern ep="1">EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00</pattern>
|
|
<pattern ep="1">EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08</pattern>
|
|
<pattern ep="1">60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08</pattern>
|
|
</sig>
|
|
|
|
<sig name="mucki" more="mucki's protector -> mucki" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BE xx xx xx xx B9 xx xx xx xx 8A 06 F6 D0 88 06 46 E2 F7 E9</pattern>
|
|
<pattern ep="1">E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 xx xx xx xx BE xx xx xx xx B9 xx xx xx xx 8A 06 F6 D0 88 06 46 E2</pattern>
|
|
</sig>
|
|
|
|
<sig name="MZ0oPE" more="MZ0oPE 1.0.6b -> TaskFall" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 xx xx xx xx C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="MZ_Crypt" more="MZ_Crypt 1.0 - by BrainSt0rm" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0</pattern>
|
|
</sig>
|
|
|
|
<sig name="N-Joiner" more="N-Joiner 0.1 (Asm Version) -> NEX" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="N-Joy" more="N-Joy -> NEX" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Naked Packer" more="Naked Packer -> BigBoote" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 FC 0F B6 05 xx xx xx xx 85 C0 75 31 B8 xx xx xx xx 2B 05 xx xx xx xx A3 xx xx xx xx A1 xx xx xx xx 03 05 xx xx xx xx A3 xx xx xx xx E8 9A 00 00 00 A3 xx xx xx xx C6 05 xx xx xx xx 01 83 3D xx xx xx xx 00 75 07 61 FF 25 xx xx xx xx 61 FF 74 24 04 6A 00</pattern>
|
|
<pattern ep="1">6A xx E8 9A 05 00 00 8B D8 53 68 xx xx xx xx E8 6C FD FF FF B9 05 00 00 00 8B F3 BF xx xx xx xx 53 F3 A5 E8 8D 05 00 00 8B 3D xx xx xx xx A1 xx xx xx xx 66 8B 15 xx xx xx xx B9 xx xx xx xx 2B CF 89 45 E8 89 0D xx xx xx xx 66 89 55 EC 8B 41 3C 33 D2 03 C1</pattern>
|
|
<pattern ep="1">60 FC 0F B6 05 34 xx xx xx 85 C0 75 31 B8 50 xx xx xx 2B 05 04 xx xx xx A3 30 xx xx xx A1 00 xx xx xx 03 05 30 xx xx xx A3 38 xx xx xx E8 9A 00 00 00 A3 50 xx xx xx C6 05 34 xx xx xx 01 83 3D 50 xx xx xx 00 75 07 61 FF 25 38 xx xx xx 61 FF 74 24 04 6A 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Nakedbind" more="Nakedbind 1.0 -> nakedcrew" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Native UD Packer " more="Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40</pattern>
|
|
</sig>
|
|
|
|
<sig name="nBinder" more="nBinder v3.6.1" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C</pattern>
|
|
</sig>
|
|
|
|
<sig name="nBinder" more="nBinder v4.0" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79</pattern>
|
|
</sig>
|
|
|
|
<sig name="NeoLite" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">8B 44 24 04 8D 54 24 FC 23 05 xx xx xx xx E8 xx xx xx xx FF 35 xx xx xx xx 50 FF 25</pattern>
|
|
<pattern ep="1">8B 44 24 04 23 05 xx xx xx xx 50 E8 xx xx xx xx 83 C4 04 FE 05 xx xx xx xx 0B C0 74</pattern>
|
|
</sig>
|
|
|
|
<sig name="nMacro recorder" more="nMacro recorder 1.0" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="NME" more="NME 1.1 Public - by redlime" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B</pattern>
|
|
</sig>
|
|
|
|
<sig name="NoName Packer" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C</pattern>
|
|
</sig>
|
|
|
|
<sig name="NoodleCrypt" more="NoodleCrypt -> NoodleSpa" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 01 9A E8 76 00 00 00</pattern>
|
|
<pattern ep="1">EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01</pattern>
|
|
<pattern ep="1">EB 01 9A E8 xx 00 00 00 EB 01 9A E8 xx xx 00 00 EB 01 9A E8 xx xx 00 00 EB 01</pattern>
|
|
</sig>
|
|
|
|
<sig name="North Star PE Shrinker" more="North Star PE Shrinker 1.3 -> Liuxingping" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5</pattern>
|
|
</sig>
|
|
|
|
<sig name="nPack" more="nPack -> NEOx" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">83 3D 40 xx xx xx 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 xx xx xx 2B 05 08 xx xx xx A3 3C xx xx 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00</pattern>
|
|
<pattern ep="1">83 3D xx xx xx xx xx 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 xx xx xx xx 2B 05 xx xx xx xx A3 xx xx xx xx E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 xx xx xx xx C7 05 xx xx xx xx xx xx xx xx 01 05 xx xx xx xx FF 35 xx xx xx xx C3 C3</pattern>
|
|
<pattern ep="1">83 3D 04 xx xx xx 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E xx xx xx 2B 05 08 xx xx xx A3 00 xx xx xx E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 xx xx xx C7 05 04 xx xx xx 01 00 00 00 01 05 00 xx xx xx FF 35 00</pattern>
|
|
<pattern ep="1">83 3D xx xx xx xx xx 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 xx xx xx xx 2B 05 xx xx xx xx A3 xx xx xx xx E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 xx xx xx xx C7 05 xx xx xx xx xx xx xx xx 01 05 xx xx xx xx FF 35 xx xx xx xx C3 C3 56 57 68 xx xx xx xx FF 15 xx xx xx xx 8B 35 xx xx xx xx 8B F8 68 xx xx xx xx 57 FF D6 68 xx xx xx xx 57 A3 xx xx xx xx FF D6 5F A3 xx xx xx xx 5E C3</pattern>
|
|
<pattern ep="1">83 3D 04 xx xx xx 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E xx xx xx 2B 05 08 xx xx xx A3 00 xx xx xx E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 xx xx xx C7 05 04 xx xx xx 01 00 00 00 01 05 00 xx xx xx FF 35 00 xx xx xx C3 C3 56 57 68</pattern>
|
|
<pattern ep="1">83 3D 40 xx xx xx 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 xx xx xx 2B 05 08 xx xx xx A3 3C xx xx xx E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C xx xx xx C7 05 40 xx xx xx 01 00 00 00 01 05 00 xx xx xx FF 35 00 xx xx xx C3 C3</pattern>
|
|
<pattern ep="1">83 3D 40 xx xx xx 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 xx xx xx 2B 05 08 xx xx xx A3 3C xx xx xx E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C xx xx xx C7 05 40 xx xx xx 01 00 00 00 01 05 00 xx xx xx FF 35 00 xx xx xx C3 C3</pattern>
|
|
<pattern ep="1">83 3D 04 xx xx xx 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E xx xx xx 2B 05 08 xx xx xx A3 00 xx xx xx E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 xx xx xx C7 05 04 xx xx xx 01 00 00 00 01 05 00 xx xx xx FF 35 00 xx xx xx C3 C3</pattern>
|
|
<pattern ep="1">83 3D xx xx xx 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 xx xx xx xx 2B 05 08 xx xx xx A3 xx xx xx xx E8 9C 00 00 00 E8 xx 02 00 00 E8 xx 06 00 00 E8 xx 06 00 00 A1 xx xx xx xx C7 05 xx xx xx 00 01 00 00 00 01 05 00 xx xx xx FF 35 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="NSPack" more="NSPack -> Nort Star Software" flag="1" severity="2" file="0" tool="1" url="www.nsdsn.com">
|
|
<pattern ep="1">9C 60 70 61 63 6B 24 40</pattern>
|
|
<pattern ep="1">6E 73 70 61 63 6B 24 40</pattern>
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D 83 ED 07 8D</pattern>
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5</pattern>
|
|
<pattern ep="1">83 F9 00 74 28 43 8D B5 xx xx FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 xx xx FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 xx xx xx FF 8B B5 xx xx FF FF 0B F6 0F 84 97 00 00 00 8B 95 xx xx FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08</pattern>
|
|
<pattern ep="1">56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 xx xx xx 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C</pattern>
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D B8 xx xx 40 00 2D xx xx 40 00</pattern>
|
|
<pattern ep="1">8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53</pattern>
|
|
<pattern ep="1">FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B 07 80 7A 01</pattern>
|
|
<pattern ep="1">FF 25 A4 xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">FF 25 A4 xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00</pattern>
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00</pattern>
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="StarForce" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 xx xx xx xx FF 25</pattern>
|
|
</sig>
|
|
|
|
<sig name="NTkrnl" more="NTkrnl Secure Suite -> NTkrnl Team" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF</pattern>
|
|
<pattern ep="1">34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73</pattern>
|
|
<pattern ep="1">00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74</pattern>
|
|
<pattern ep="1">00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74</pattern>
|
|
</sig>
|
|
|
|
<sig name="NTPacker -> ErazerZ" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 xx xx 40 00 E8 xx xx FF FF 33 C0 55 68 xx xx 40 00 64 FF 30 64 89 20 8D 4D EC BA xx xx 40 00 A1 xx xx 40 00 E8 xx FC FF FF 8B 55 EC B8 xx xx 40 00 E8 xx xx FF FF 8D 4D E8 BA xx xx 40 00 A1 xx xx 40 00 E8 xx FE FF FF 8B 55 E8 B8 xx xx 40 00 E8 xx xx FF FF B8 xx xx 40 00 E8 xx FB FF FF 8B D8 A1 xx xx 40 00 BA xx xx 40 00 E8 xx xx FF FF 75 26 8B D3 A1 xx xx 40 00 E8 xx xx FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 xx xx FF FF 8B 45 E4 8B D3 E8 xx xx FF FF EB 14 8D 55 E0 33 C0 E8 xx xx FF FF 8B 45 E0 8B D3 E8 xx xx FF FF 6A 00 E8 xx xx FF FF 33 C0 5A 59 59 64 89 10 68 xx xx 40 00 8D 45 E0 BA 04 00 00 00 E8 xx xx FF FF C3 E9 xx xx FF FF EB EB 5B E8 xx xx FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31</pattern>
|
|
<pattern ep="1">4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="NullSoft" more="NullSoft Scriptable Install System" flag="1" file="1" tool="1" severity="2" >
|
|
<pattern ep="0">83 EC 0C 53 56 57 FF 15 2C 81 40</pattern>
|
|
<pattern ep="0">83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 xx xx xx xx C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 xx xx xx xx 68 xx xx xx xx A3 xx xx xx xx E8 xx xx xx xx BE</pattern>
|
|
<pattern ep="0">55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00</pattern>
|
|
<pattern ep="0">83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74</pattern>
|
|
<pattern ep="0">83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00</pattern>
|
|
<pattern ep="0">83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 xx xx xx xx C6 44 24 14 20 FF 15 xx xx xx xx 53 FF 15 xx xx xx xx 68 xx xx xx xx 68 xx xx xx xx A3 xx xx xx xx E8 02 23 00 00 BE xx xx xx xx 56</pattern>
|
|
<pattern ep="0">83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00</pattern>
|
|
<pattern ep="0">83 EC 0C 53 55 56 57 C7 44 24 10 xx xx xx xx 33 DB C6 44 24 14 20 FF 15 xx xx xx xx 53 FF 15 xx xx xx xx BE xx xx xx xx BF xx xx xx xx 56 57 A3 xx xx xx xx FF 15 xx xx xx xx E8 8D FF FF FF 8B 2D xx xx xx xx 85 C0</pattern>
|
|
<pattern ep="0">83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74</pattern>
|
|
<pattern ep="0">83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00</pattern>
|
|
<pattern ep="0">83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71</pattern>
|
|
<pattern ep="0">55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC</pattern>
|
|
<pattern ep="0">83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 80 3E 20 75 07 56 FF D7 8B F0 EB F4 80 3E 2F 75</pattern>
|
|
<pattern ep="0">83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52</pattern>
|
|
<pattern ep="0">83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03</pattern>
|
|
<pattern ep="0">83 EC 0C 53 55 56 57 FF 15 xx 70 40 00 8B 35 xx 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 xx xx xx 00 57 FF 15 xx xx 40 00 57 FF 15</pattern>
|
|
<pattern ep="0">83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 68 E4 91 40 00 56 FF D3 E8 7C FF FF FF 85 C0 0F 84 59 01 00 00 BE E0 66 42 00 56 FF 15 68 70 40 00 68 D8 91 40 00 56 E8 FE 27 00 00 57 FF 15 BC 70 40 00 BE 00 C0 42 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 C0 42 00 22 A3 E0 6E 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 C0 42 00 8B 3D 10 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52</pattern>
|
|
<pattern ep="0">83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 40 00 03 C6 50 E8 78 29 00 00 56 E8 47 2B 00 00 6A 00 56 FF D3 56 57 E8 EA 25 00 00 85 C0 75 0D C7 44 24 14 58 91 40 00 E9 72 02 00 00 57 FF 15 24 71 40 00 68 EC 91 40 00 57 E8 43</pattern>
|
|
<pattern ep="0">83 EC 0C 53 56 57 FF 15 xx xx 40 00 05 E8 03 00 00 BE xx xx xx 00 89 44 24 10 B3 20 FF 15 28 xx 40 00 68 00 04 00 00 FF 15 xx xx 40 00 50 56 FF 15 xx xx 40 00 80 3D xx xx xx 00 22 75 08 80 C3 02 BE xx xx xx 00 8A 06 8B 3D xx xx 40 00 84 C0 74 xx 3A C3 74</pattern>
|
|
<pattern ep="0">55 8B EC 81 EC xx xx 00 00 56 57 6A xx BE xx xx xx xx 59 8D BD</pattern>
|
|
<pattern ep="0">83 EC 0C 53 56 57 FF 15 xx xx 40 00 05 E8 03 00 00 BE xx xx xx 00 89 44 24 10 B3 20 FF 15 28 xx 40 00 68 00 04 00 00 FF 15 xx xx 40 00 50 56 FF 15 xx xx 40 00 80 3D xx xx xx 00 22 75 08 80 C3 02 BE xx xx xx 00 8A 06 8B 3D xx xx 40 00 84 C0 74 xx 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 74 05 56 FF D7 8B F0 89 74 24 14 xx xx xx xx xx xx xx xx xx xx xx xx 80 3E 2F</pattern>
|
|
<pattern ep="0">81 EC xx 01 00 00 53 55 56 33 DB 57 89 5C 24 18 C7</pattern>
|
|
<pattern ep="0">83 EC 5C 53 55 56 57 FF 15 xx xx xx 00</pattern>
|
|
<pattern ep="0">00 00 00 00 EF BE AD DE 4E 75 6C 6C 73 6F</pattern>
|
|
</sig>
|
|
|
|
<sig name="NX PE" more="NX PE Packer v1.0" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Obsidium" more="Obsidium -> Obsidium Software" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 02 xx xx E8 3F 1E 00 00</pattern>
|
|
<pattern ep="1">E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00</pattern>
|
|
<pattern ep="1">EB 01 xx E8 29 00 00 00 EB 02 xx xx EB 01 xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 24 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 02 xx xx EB 03 xx xx xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 03 xx xx xx EB 01 xx 50 EB 03 xx xx xx 33 C0</pattern>
|
|
<pattern ep="1">EB 01 xx E8 29 00 00 00 EB 02 xx xx EB 01 xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 24 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 02 xx xx EB 03 xx xx xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 03 xx xx xx EB 01 xx 50 EB 03 xx xx xx 33 C0 EB 04 xx xx xx xx 8B 00 EB 03 xx xx xx C3 EB 01 xx E9 FA 00 00 00 EB 02 xx xx E8 D5 FF FF FF EB 04 xx xx xx xx EB 03 xx xx xx EB 01 xx 58 EB 01 xx EB 02 xx xx 64 67 8F 06 00 00 EB 04 xx xx xx xx 83 C4 04 EB 01 xx E8 7B 21 00 00</pattern>
|
|
<pattern ep="1">EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 29 00 00 00 EB 02 xx xx EB 01 xx 8B 54 24 0C EB 02 xx xx 83 82 B8 00 00 00 22 EB 02 xx xx 33 C0 EB 04 xx xx xx xx C3 EB 04 xx xx xx xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 04 xx xx xx xx EB 01 xx 50 EB 03 xx xx xx 33 C0 EB 02 xx xx 8B 00 EB 01 xx C3 EB 04 xx xx xx xx E9 FA 00 00 00 EB 01 xx E8 D5 FF FF FF EB 02 xx xx EB 03 xx xx xx 58 EB 04 xx xx xx xx EB 01 xx 64 67 8F 06 00 00 EB 02 xx xx 83 C4 04 EB 02 xx xx E8 47 26 00 00</pattern>
|
|
<pattern ep="1">EB 01 xx E8 26 00 00 00 EB 02 xx xx EB 02 xx xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 21 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 01 xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 02 xx xx 64 67 89 26 00 00 EB 01 xx EB 03 xx xx xx 50 EB 01 xx 33 C0 EB 03</pattern>
|
|
<pattern ep="1">EB 01 xx E8 26 00 00 00 EB 02 xx xx EB 02 xx xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 21 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 01 xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 02 xx xx 64 67 89 26 00 00 EB 01 xx EB 03 xx xx xx 50 EB 01 xx 33 C0 EB 03 xx xx xx 8B 00 EB 02 xx xx C3 EB 02 xx xx E9 FA 00 00 00 EB 01 xx E8 D5 FF FF FF EB 03 xx xx xx EB 02 xx xx 58 EB 03 xx xx xx EB 04 xx xx xx xx 64 67 8F 06 00 00 EB 03 xx xx xx 83 C4 04 EB 03 xx xx xx E8 13 26 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 28 00 00 00 EB 04 xx xx xx xx EB 01 xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 25 EB 02 xx xx 33 C0 EB 03 xx xx xx C3 EB 03 xx xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 03 xx xx xx EB 04 xx xx xx xx 50 EB 04</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 28 00 00 00 EB 04 xx xx xx xx EB 01 xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 25 EB 02 xx xx 33 C0 EB 03 xx xx xx C3 EB 03 xx xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 03 xx xx xx EB 04 xx xx xx xx 50 EB 04 xx xx xx xx 33 C0 EB 02 xx xx 8B 00 EB 04 xx xx xx xx C3 EB 01 xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 04 xx xx xx xx EB 02 xx xx 58 EB 03 xx xx xx EB 01 xx 64 67 8F 06 00 00 EB 04 xx xx xx xx 83 C4 04 EB 02 xx xx E8 4F 26 00 00</pattern>
|
|
<pattern ep="1">EB 03 xx xx xx E8 2E 00 00 00 EB 04 xx xx xx xx EB 04 xx xx xx xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 23 EB 01 xx 33 C0 EB 04 xx xx xx xx C3 EB 03 xx xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 02 xx xx EB 02 xx xx 50 EB 01 xx 33 C0 EB 03 xx xx xx 8B 00 EB 03 xx xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 04 xx xx xx xx E8 D5 FF FF FF EB 01 xx EB 01 xx 58 EB 04 xx xx xx xx EB 04 xx xx xx xx 64 67 8F 06 00 00 EB 03 xx xx xx 83 C4 04 EB 04 xx xx xx xx E8 2B 26 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 26 00 00 00 EB 03 xx xx xx EB 01 xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 26 EB 01 xx 33 C0 EB 02 xx xx C3 EB 01 xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 01 xx EB 03 xx xx xx 50 EB 03 xx xx xx 33 C0 EB 03 xx xx xx 8B 00 EB 04 xx xx xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 04 xx xx xx xx EB 01 xx 58 EB 02 xx xx EB 03 xx xx xx 64 67 8F 06 00 00 EB 01 xx 83 C4 04 EB 03 xx xx xx E8 23 27 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 25 00 00 00 EB 04 xx xx xx xx EB 01 xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 23 EB 01 xx 33 C0 EB 02 xx xx C3 EB 02 xx xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 02 xx xx EB 01 xx 50 EB 01 xx 33 C0 EB 01</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 27 00 00 00 EB 02 xx xx EB 03 xx xx xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 22 EB 04 xx xx xx xx 33 C0 EB 01 xx C3 EB 02 xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 01 xx EB 03 xx xx xx 50 EB 03 xx xx xx 33 C0 EB 01 xx 8B 00 EB 03 xx xx xx C3 EB 01 xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 01 xx EB 03 xx xx xx 58 EB 03 xx xx xx EB 01 xx 64 67 8F 06 00 00 EB 01 xx 83 C4 04 EB 03</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 2A 00 00 00 EB 03 xx xx xx EB 04 xx xx xx xx 8B 54 24 0C EB 02 xx xx 83 82 B8 00 00 00 26 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 01 xx EB 03 xx xx xx 64 67 FF 36 00 00 EB 02 xx xx 64 67 89 26 00 00 EB 02 xx xx EB 01 xx 50 EB 04 xx xx xx xx 33 C0 EB 04 xx xx xx xx 8B 00 EB 02 xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 04 xx xx xx xx E8 D5 FF FF FF EB 02 xx xx EB 04 xx xx xx xx 58 EB 01 xx EB 01 xx 64 67 8F 06 00 00 EB 01 xx 83 C4 04 EB 04</pattern>
|
|
<pattern ep="1">EB 01 xx E8 29 00 00 00 EB 02 xx xx EB 03 xx xx xx 8B 54 24 0C EB 02 xx xx 83 82 B8 00 00 00 24 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 02 xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 01 xx EB 02 xx xx 50 EB 01 xx 33 C0 EB 04 xx xx xx xx 8B 00 EB 03 xx xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 02 xx xx E8 D5 FF FF FF EB 01 xx EB 04 xx xx xx xx 58 EB 02 xx xx EB 04 xx xx xx xx 64 67 8F 06 00 00 EB 01 xx 83 C4 04 EB 02 xx xx E8 5F 27 00 00</pattern>
|
|
<pattern ep="1">EB 01 xx E8 2B 00 00 00 EB 02 xx xx EB 02 xx xx 8B 54 24 0C EB 03 xx xx xx 83 82 B8 00 00 00 24 EB 04 xx xx xx xx 33 C0 EB 04 xx xx xx xx C3 EB 02 xx xx EB 01 xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 01 xx EB 02 xx xx 50 EB 02 xx xx 33 C0</pattern>
|
|
<pattern ep="1">EB 01 xx E8 2B 00 00 00 EB 02 xx xx EB 02 xx xx 8B 54 24 0C EB 03 xx xx xx 83 82 B8 00 00 00 24 EB 04 xx xx xx xx 33 C0 EB 04 xx xx xx xx C3 EB 02 xx xx EB 01 xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 01 xx EB 02 xx xx 50 EB 02 xx xx 33 C0 EB 02 xx xx 8B 00 EB 02 xx xx C3 EB 04 xx xx xx xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 03 xx xx xx EB 01 xx 58 EB 01 xx EB 02 xx xx 64 67 8F 06 00 00 EB 02 xx xx 83 C4 04 EB 02 xx xx E8 3B 27 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 29 00 00 00 EB 03 xx xx xx EB 03 xx xx xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 28 EB 03 xx xx xx 33 C0 EB 01 xx C3 EB 04 xx xx xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 02 xx xx EB 04 xx xx xx xx 50 EB 04 xx xx xx xx 33 C0 EB 01 xx 8B 00 EB 03 xx xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 04 xx xx xx xx EB 04 xx xx xx xx 58 EB 01 xx EB 03 xx xx xx 64 67 8F 06 00 00 EB 04 xx xx xx xx 83 C4 04 EB 04 xx xx xx xx E8 2B 27</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 29 00 00 00 EB 03 xx xx xx EB 03 xx xx xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 28 EB 03 xx xx xx 33 C0 EB 01 xx C3 EB 04 xx xx xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 02 xx xx EB 04 xx xx xx xx 50 EB 04</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 29 00 00 00 EB 03 xx xx xx EB 03 xx xx xx 8B xx 24 0C EB 01 xx 83 xx B8 00 00 00 28 EB 03 xx xx xx 33 C0 EB 01 xx C3 EB 04 xx xx xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 02 xx xx EB 04 xx xx xx xx 50 EB 04 xx xx xx xx 33 C0 EB 01 xx 8B 00 EB 03 xx xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 04 xx xx xx xx EB 04 xx xx xx xx 58 EB 01 xx EB 03 xx xx xx 64 67 8F 06 00 00 EB 04 xx xx xx xx 83 C4 04 EB 04 xx xx xx xx E8 2B 27 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 29 00 00 00 EB 03 xx xx xx EB 02 xx xx 8B 54 24 0C EB 03 xx xx xx 83 82 B8 00 00 00 25 EB 02 xx xx 33 C0 EB 02 xx xx C3 EB 03 xx xx xx EB 01 xx 64 67 FF 36 00 00 EB 02 xx xx 64 67 89 26 00 00 EB 02 xx xx EB 04 xx xx xx xx 50 EB 02 xx xx 33 C0 EB 01 xx 8B 00 EB 04 xx xx xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 02 xx xx E8 D5 FF FF FF EB 02 xx xx EB 03 xx xx xx 58 EB 02 xx xx EB 03 xx xx xx 64 67 8F 06 00 00 EB 03</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 28 00 00 00 EB 01 xx xx xx xx xx xx xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 26 EB 04 xx xx xx xx 33 C0 EB 01 xx C3 EB 03 xx xx xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 03 xx xx xx EB 04</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 28 00 00 00 EB 01 xx xx xx xx xx xx xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 26 EB 04 xx xx xx xx 33 C0 EB 01 xx C3 EB 03 xx xx xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 03 xx xx xx EB 04 xx xx xx xx 50 EB 01 xx 33 C0 EB 02 xx xx 8B 00 EB 04 xx xx xx xx C3 EB 04 xx xx xx xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 01 xx EB 03 xx xx xx 58 EB 02 xx xx EB 04 xx xx xx xx 64 67 8F 06 00 00 EB 04</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 27 00 00 00 EB 03 xx xx xx EB 01 xx 8B 54 24 0C EB 03 xx xx xx 83 82 B8 00 00 00 23 EB 03 xx xx xx 33 C0 EB 02 xx xx C3 EB 01 xx EB 03 xx xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 01 xx EB 01 xx 50 EB 02 xx xx 33 C0 EB 01 xx 8B 00 EB 04 xx xx xx xx C3 EB 02 xx xx E9 FA 00 00 00 EB 04 xx xx xx xx E8 D5 FF FF FF EB 01 xx EB 01 xx 58 EB 04 xx xx xx xx EB 01 xx 64 67 8F 06 00 00 EB 02 xx xx 83 C4 04 EB 01 xx E8 F7 26 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 2C 00 00 00 EB 04 xx xx xx xx EB 04 xx xx xx xx 8B 54 24 0C EB 02 xx xx 83 82 B8 00 00 00 27 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 02 xx xx EB 03 xx xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 03 xx xx xx EB 01 xx 50 EB 02 xx xx 33 C0 EB 02 xx xx 8B 00 EB 04 xx xx xx xx C3 EB 02 xx xx E9 FA 00 00 00 EB 04 xx xx xx xx E8 D5 FF FF FF EB 02 xx xx EB 04 xx xx xx xx 58 EB 04 xx xx xx xx EB 03 xx xx xx 64 67 8F 06 00 00 EB 01 xx 83 C4 04 EB 03 xx xx xx E8 23 27 00 00</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 28 00 00 00 EB 01 xx EB 01 xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 xx EB 04 xx xx xx xx 33 C0 EB 03 xx xx xx C3 EB 01 xx EB 01 xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 02 xx xx EB 01 xx 50 EB 04</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 28 00 00 00 EB 01 xx EB 01 xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 xx EB 04 xx xx xx xx 33 C0 EB 03 xx xx xx C3 EB 01 xx EB 01 xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 02 xx xx EB 01 xx 50 EB 04 xx xx xx xx 33 C0 EB 02 xx xx 8B 00 EB 03 xx xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 02 xx xx EB 04 xx xx xx xx 58 EB 04 xx xx xx xx EB 02 xx xx 64 67 8F 06 00 00 EB 04 xx xx xx xx 83 C4 04 EB 04 xx xx xx xx E8 57 27 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 29 00 00 00 EB 03 xx xx xx EB 01 xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 28 EB 02 xx xx 33 C0 EB 02 xx xx C3 EB 03 xx xx xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 01 xx EB 01 xx 50 EB 03</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 29 00 00 00 EB 03 xx xx xx EB 01 xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 28 EB 02 xx xx 33 C0 EB 02 xx xx C3 EB 03 xx xx xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 01 xx EB 01 xx 50 EB 03 xx xx xx 33 C0 EB 03 xx xx xx 8B 00 EB 04 xx xx xx xx C3 EB 04 xx xx xx xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 02 xx xx EB 04 xx xx xx xx 58 EB 03 xx xx xx EB 04 xx xx xx xx 64 67 8F 06 00 00 EB 03 xx xx xx 83 C4 04 EB 04 xx xx xx xx E8 CF 27 00 00</pattern>
|
|
<pattern ep="1">EB 01 xx E8 2A 00 00 00 EB 04 xx xx xx xx EB 02 xx xx 8B 54 24 0C EB 03 xx xx xx 83 82 B8 00 00 00 21 EB 02 xx xx 33 C0 EB 03 xx xx xx C3 EB 02 xx xx EB 01 xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 02 xx xx EB 03 xx xx xx 50 EB 04 xx xx xx xx 33</pattern>
|
|
<pattern ep="1">EB 01 xx E8 2A 00 00 00 EB 04 xx xx xx xx EB 02 xx xx 8B 54 24 0C EB 03 xx xx xx 83 82 B8 00 00 00 21 EB 02 xx xx 33 C0 EB 03 xx xx xx C3 EB 02 xx xx EB 01 xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 02 xx xx EB 03 xx xx xx 50 EB 04 xx xx xx xx 33 C0 EB 02 xx xx 8B 00 EB 04 xx xx xx xx C3 EB 02 xx xx E9 FA 00 00 00 EB 02 xx xx E8 D5 FF FF FF EB 01 xx EB 01 xx 58 EB 03 xx xx xx EB 04 xx xx xx xx 64 67 8F 06 00 00 EB 04 xx xx xx xx 83 C4 04 EB 02 xx xx E8 C3 27 00 00</pattern>
|
|
<pattern ep="1">E8 AF 1C 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 E7 1C 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 77 1E 00 00</pattern>
|
|
<pattern ep="1">EB 01 xx E8 xx 00 00 00</pattern>
|
|
<pattern ep="1">EB 01 xx E8 xx 00 00 00 EB 02 xx xx EB</pattern>
|
|
<pattern ep="1">E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00</pattern>
|
|
<pattern ep="1">EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 29 00 00 00</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 29 00 00 00 EB 02 xx xx EB 01 xx 8B 54 24 0C EB 02 xx xx 83 82 B8 00 00 00 22 EB 02 xx xx 33 C0 EB 04 xx xx xx xx C3 EB 04 xx xx xx xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 04 xx xx xx xx EB 01</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 xx 00 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 26 00 00 00 EB 03 xx xx xx EB 01 xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 26 EB 01 xx 33 C0 EB 02 xx xx C3 EB 01 xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 01 xx EB 03 xx xx xx 50 EB 03 xx xx xx 33 C0 EB</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 26 00 00 00 EB 03 xx xx xx EB 01 xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 26 EB 01 xx 33 C0 EB 02 xx xx C3 EB 01 xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 01 xx 64 67 89 26 00 00 EB 01 xx EB 03 xx xx xx 50 EB 03 xx xx xx 33 C0 EB 03 xx xx xx 8B 00 EB 04 xx xx xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 04 xx xx xx xx EB 01 xx 58 EB 02 xx xx EB 03 xx xx xx 64 67 8F 06 00 00 EB 01 xx 83 C4 04 EB 03 xx xx xx E8 23 27</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 25 00 00 00 EB 04 xx xx xx xx EB 01 xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 23 EB 01 xx 33 C0 EB 02 xx xx C3 EB 02 xx xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 02 xx xx EB 01 xx 50 EB 01 xx 33 C0 EB 01 xx 8B 00 EB 01 xx C3 EB 02 xx xx E9 FA 00 00 00 EB 02 xx xx E8 D5 FF FF FF EB 03 xx xx xx EB 04 xx xx xx xx 58 EB 02 xx xx EB 04 xx xx xx xx 64 67 8F 06 00 00 EB 03 xx xx xx 83 C4 04 EB 01 xx E8 3B 26 00 00</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 xx 00 00 00</pattern>
|
|
<pattern ep="1">EB 03 xx xx xx E8 2E 00 00 00 EB 04 xx xx xx xx EB 04 xx xx xx xx 8B xx xx xx EB 04 xx xx xx xx 83 xx xx xx xx xx xx EB 01 xx 33 C0 EB 04 xx xx xx xx C3</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 27 00 00 00 EB 02 xx xx EB 03 xx xx xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 22 EB 04 xx xx xx xx 33 C0 EB 01 xx C3 EB 02 xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 01 xx EB 03 xx xx xx 50 EB 03 xx xx xx 33</pattern>
|
|
<pattern ep="1">EB 04 xx xx xx xx E8 2A 00 00 00 EB 03 xx xx xx EB 04 xx xx xx xx 8B 54 24 0C EB 02 xx xx 83 82 B8 00 00 00 26 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 01 xx EB 03 xx xx xx 64 67 FF 36 00 00 EB 02 xx xx 64 67 89 26 00 00 EB 02 xx xx EB 01 xx 50 EB 04</pattern>
|
|
<pattern ep="1">EB 01 xx E8 29 00 00 00 EB 02 xx xx EB 03 xx xx xx 8B 54 24 0C EB 02 xx xx 83 82 B8 00 00 00 24 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 02 xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 01 xx EB 02 xx xx 50 EB 01 xx 33 C0 EB</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 29 00 00 00 EB 03 xx xx xx EB 03 xx xx xx 8B xx 24 0C EB 01 xx 83 xx B8 00 00 00 28 EB 03 xx xx xx 33 C0 EB 01 xx C3 EB 04 xx xx xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 02 xx xx EB 04 xx xx xx xx 50 EB 04</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 29 00 00 00 EB 03 xx xx xx EB 02 xx xx 8B 54 24 0C EB 03 xx xx xx 83 82 B8 00 00 00 25 EB 02 xx xx 33 C0 EB 02 xx xx C3 EB 03 xx xx xx EB 01 xx 64 67 FF 36 00 00 EB 02 xx xx 64 67 89 26 00 00 EB 02 xx xx EB 04 xx xx xx xx 50 EB 02 xx xx 33</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 2C 00 00 00 EB 04 xx xx xx xx EB 04 xx xx xx xx 8B 54 24 0C EB 02 xx xx 83 82 B8 00 00 00 27 EB 04 xx xx xx xx 33 C0 EB 02 xx xx C3 EB 02 xx xx EB 03 xx xx xx 64 67 FF 36 00 00 EB 04 xx xx xx xx 64 67 89 26 00 00 EB 03 xx xx xx EB 01 xx 50</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 26 00 00 00 EB 03 xx xx xx EB 01 xx 8B 54 24 0C EB 02 xx xx 83 82 B8 00 00 00 24 EB 03 xx xx xx 33 C0 EB 01 xx C3 EB 02 xx xx EB 02 xx xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 03 xx xx xx EB 03 xx xx xx 50 EB 04 xx xx xx xx 33 C0 EB 03 xx xx xx 8B 00 EB 03 xx xx xx C3 EB 03 xx xx xx E9 FA 00 00 00 EB 03 xx xx xx E8 D5 FF FF FF EB 01 xx EB 03 xx xx xx 58 EB 04 xx xx xx xx EB 04 xx xx xx xx 64 67 8F 06 00 00 EB 04 xx xx xx xx 83 C4 04 EB 01 xx E8 C3 27 00 00</pattern>
|
|
<pattern ep="1">EB 03 xx xx xx E8 xx xx xx xx EB 02 xx xx EB 04 xx xx xx xx 8B 54 24 0C EB 04 xx xx xx xx 83 82 B8 00 00 00 20 EB 03 xx xx xx 33 C0 EB 01 xx C3 EB 02 xx xx EB 03 xx xx xx 64 67 FF 36 00 00 EB 03 xx xx xx 64 67 89 26 00 00 EB 01 xx EB 04 xx xx xx xx 50 EB 04 xx xx xx xx 33 C0 EB 04 xx xx xx xx 8B 00 EB 03 xx xx xx C3 EB 02 xx xx E9 FA 00 00 00 EB 01 xx E8 xx xx xx xx EB 01 xx EB 02 xx xx 58 EB 04 xx xx xx xx EB 02 xx xx 64 67 8F 06 00 00 EB 02 xx xx 83 C4 04 EB 01 xx E8</pattern>
|
|
<pattern ep="1">EB 02 xx xx E8 25 00 00 00 EB 04 xx xx xx xx EB 01 xx 8B 54 24 0C EB 01 xx 83 82 B8 00 00 00 23 EB 01 xx 33 C0 EB 02 xx xx C3 EB 02 xx xx EB 04 xx xx xx xx 64 67 FF 36 00 00 EB 03 xx xx xx 64</pattern>
|
|
</sig>
|
|
|
|
<sig name="ocBat2Exe" more="ocBat2Exe 1.0 -> OC" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB xx xx xx xx E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="p0ke" more="Open Source Code Crypter" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0</pattern>
|
|
</sig>
|
|
|
|
<sig name="Pack Master" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 01 xx xx xx E8 83 C4 04 E8 01 xx xx xx E9 5D 81 ED D3 22 40 xx E8 04 02 xx xx E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46</pattern>
|
|
</sig>
|
|
|
|
<sig name="Packanoid" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BF 00 10 40 00 BE xx xx xx 00 E8 9D 00 00 00 B8</pattern>
|
|
<pattern ep="1">BF 00 xx 40 00 BE xx xx xx 00 E8 9D 00 00 00 B8 xx xx xx 00 8B 30 8B 78 04 BB xx xx xx 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 xx xx 00 00 BE 00 xx xx 00 EB 01 00 BF xx xx xx 00</pattern>
|
|
<pattern ep="1">BF xx xx xx xx BE xx xx xx xx E8 9D 00 00 00 B8 xx xx xx xx 8B 30 8B 78 04 BB xx xx xx xx 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08</pattern>
|
|
</sig>
|
|
|
|
<sig name="PKLITE" more="PKLITE v1.50 with CRC check" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">1F B4 09 BA xx xx CD 21 B8 xx xx CD 21</pattern>
|
|
</sig>
|
|
|
|
<sig name="PackItBitch" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">00 00 00 00 00 00 00 00 00 00 00 00 28 xx xx xx 35 xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 xx xx xx 50 xx xx xx 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 xx xx xx xx xx xx xx 79 xx xx xx 7D xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Packman" more="Packman -> Bubbasoft" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 58 8D A8 xx FE FF FF 8D 98 xx xx xx FF 8D xx xx 01 00 00</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 58 8D xx xx xx xx xx 8D xx xx xx xx xx 8D xx xx xx xx xx 8D xx xx 48</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 58 8D A8 xx xx FF FF 8D 98 xx xx xx FF</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA</pattern>
|
|
<pattern ep="1">0F 85 xx FF FF FF 8D B3 xx xx xx xx EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="PACKWIN" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">8C C0 FA 8E D0 BC xx xx FB 06 0E 1F 2E xx xx xx xx 8B F1 4E 8B FE 8C DB 2E xx xx xx xx 8E C3 FD F3 A4 53 B8 xx xx 50 CB</pattern>
|
|
</sig>
|
|
|
|
<sig name="PAK-SFX" more="PAK -Self Extracting (SFX) Archive" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 xx xx A1 xx xx 2E xx xx xx 2E xx xx xx xx xx 8C D7 8E C7 8D xx xx BE xx xx FC AC 3C 0D</pattern>
|
|
</sig>
|
|
|
|
<sig name="PassEXE" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">06 1E 0E 0E 07 1F BE xx xx B9 xx xx 87 14 81 xx xx xx EB xx C7 xx xx xx 84 00 87 xx xx xx FB 1F 58 4A</pattern>
|
|
</sig>
|
|
|
|
<sig name="PassLock" more="PassLock 2000 1.0 -> Moonlight-Software" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01</pattern>
|
|
</sig>
|
|
|
|
<sig name="PAV.Cryptor" more="PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">53 56 57 55 BB 2C xx xx 70 BE 00 30 00 70 BF 20 xx xx 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 xx xx 70 00 74 06 FF 15 10 xx xx 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="PC Guard" more="PC Guard for Win32 5.00 -> SofPro/Blagoje Ceklic" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 xx xx xx 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C</pattern>
|
|
</sig>
|
|
|
|
<sig name="PC Shrinker" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 E8 01 xx xx 60 01 AD B3 27 40 xx 68</pattern>
|
|
<pattern ep="1">xx BD xx xx xx xx 01 AD 55 39 40 xx 8D B5 35 39 40</pattern>
|
|
<pattern ep="1">xx BD xx xx xx xx 01 AD E3 38 40 xx FF B5 DF 38 40</pattern>
|
|
<pattern ep="1">9C 60 BD xx xx xx xx 01 AD 54 3A 40 xx FF B5 50 3A 40 xx 6A 40 FF 95 88 3A 40 xx 50 50 2D xx xx xx xx 89 85</pattern>
|
|
</sig>
|
|
|
|
<sig name="PC-Guard" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C</pattern>
|
|
<pattern ep="1">55 50 E8 xx xx xx xx 5D EB 01 E3 60 E8 03 xx xx xx D2 EB 0B 58 EB 01 48 40 EB 01</pattern>
|
|
<pattern ep="1">FC 55 50 E8 00 00 00 00 5D EB 01</pattern>
|
|
</sig>
|
|
|
|
<sig name="PCIENC Cryptor" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">06 50 43 49 45 4E</pattern>
|
|
</sig>
|
|
|
|
<sig name="PCrypt" more="PCrypt v3.51" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9</pattern>
|
|
</sig>
|
|
|
|
<sig name="PCShrink" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00</pattern>
|
|
<pattern ep="1">9C 60 BD xx xx xx xx 01 xx xx xx xx xx FF xx xx xx xx xx 6A xx FF xx xx xx xx xx 50 50 2D</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE Crypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 xx xx xx xx 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB</pattern>
|
|
<pattern ep="1">E8 xx xx xx xx 5B 83 EB 05 EB 04 52 4E 44</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 5B 83 xx xx EB xx 52 4E 44 21</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE Diminisher" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">53 51 52 56 57 55 E8 00 00 00 00</pattern>
|
|
<pattern ep="1">5D 8B D5 81 ED A2 30 40 xx 2B 95 91 33 40 xx 81 EA 0B xx xx xx 89 95 9A 33 40 xx 80 BD 99</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE Lock" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD</pattern>
|
|
<pattern ep="1">EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD</pattern>
|
|
<pattern ep="1">EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01</pattern>
|
|
<pattern ep="1">EB xx CD xx xx xx xx xx CD xx xx xx xx xx EB xx EB xx EB xx EB xx CD xx xx xx xx xx E8 xx xx xx xx E9 xx xx xx xx 50 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="Pe Ninja" more="Pe Ninja -> +DzA kRAker TNT" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE Pack" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 xx xx xx xx 5D 83 ED 06 80 BD E0 04 xx xx 01 0F 84 F2</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE Packer" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">FC 8B 35 70 01 40 xx 83 EE 40 6A 40 68 xx 30 10</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE Password" more="PE Password v0.2 SMT/SMF" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 04 xx xx xx 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 xx 81 EF xx xx xx xx 83 EF 05 89 AD 88 27 40 xx 8D 9D 07 29 40 xx 8D B5 62 28 40 xx 46 80</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE Protect" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 xx 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F</pattern>
|
|
<pattern ep="1">52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 xx xx xx xx 58 83 C0 07 C6 xx C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE-Armor" more="PE-Armor China Cracking Group" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 AA 00 00 00 2D xx xx 00 00 00 00 00 00 00 00 00 3D xx xx 00 2D xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B xx xx 00 5C xx xx 00 6F xx xx 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41</pattern>
|
|
<pattern ep="1">E8 AA 00 00 00 2D xx xx 00 00 00 00 00 00 00 00 00 3D xx xx 00 2D xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B xx xx 00 5C xx xx 00 6F xx xx 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 A2 01 00 00 xx xx 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 xx xx 00 xx xx xx 00 xx xx xx 00 xx xx xx 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 86 00 00 00 56 50 FF 55 2D 89 85 93 00 00 00 6A 04 68 00 10 00 00 FF B5 82 00 00 00 6A 00 FF 95 93 00 00 00 50 8B 9D 7E 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC</pattern>
|
|
<pattern ep="1">E8 AA 00 00 00 2D xx xx 00 00 00 00 00 00 00 00 00 3D xx xx 00 2D xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B xx xx 00 5C xx xx 00 6F xx xx 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41</pattern>
|
|
<pattern ep="1">56 52 51 53 55 E8 15 01 00 00 32 xx xx 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE-Crypt" more="PE-Crypt 1.02" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE-Crypter" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D EB 26</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE-PACK" more="PE-PACK 0.99" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE-PaCK" more="PE-PaCK 1.0 -> by ANAKiN" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70</pattern>
|
|
</sig>
|
|
|
|
<sig name="PE-Protect" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39</pattern>
|
|
<pattern ep="1">E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4</pattern>
|
|
</sig>
|
|
|
|
<sig name="PEBundle" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">9C 60 E8 02 xx xx xx 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB xx xx 40 xx 87 DD 6A 04 68 xx 10 xx xx 68 xx 02 xx xx 6A xx FF 95</pattern>
|
|
<pattern ep="1">9C 60 E8 02 xx xx xx 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB xx xx 40 xx 87 DD 01 AD xx xx xx xx 01 AD</pattern>
|
|
<pattern ep="1">9C 60 E8 02 xx xx xx 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB xx xx 40 xx 87 DD 83 BD</pattern>
|
|
<pattern ep="1">9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD xx xx xx xx 40 00 01</pattern>
|
|
</sig>
|
|
|
|
<sig name="PECompact" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81</pattern>
|
|
<pattern ep="1">EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85</pattern>
|
|
<pattern ep="1">B8 xx xx xx EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F</pattern>
|
|
<pattern ep="1">B8 xx xx xx 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00</pattern>
|
|
<pattern ep="1">EB 06 68 xx xx 40 00 C3 9C 60 BD xx xx 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5</pattern>
|
|
<pattern ep="1">EB 06 68 xx xx xx xx C3 9C 60 BD xx xx xx xx B9 02 xx xx xx B0 90 8D BD A5 4F 40 xx F3 AA 01 AD 04 51 40 xx FF B5</pattern>
|
|
<pattern ep="1">EB 06 68 xx xx xx xx C3 9C 60 E8 xx xx xx xx 5D 55 58 81 ED xx xx xx xx 2B 85 xx xx xx xx 01 85 xx xx xx xx 50 B9 02</pattern>
|
|
<pattern ep="1">EB 06 68 xx xx xx xx C3 9C 60 E8 02 xx xx xx 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 05 xx xx xx xx 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F 00 50 57 56 FF D1 58 03 43 08 8B F8 8B 53 14 8B F0 8B 46 FC 83 C0 04 2B F0 89 56 08 8B 4B 10 89 4E 18 FF D7 89 85 BB 10 00 10 5E 5A 5F 59 5B 5D 9D FF E0 8B 80 BB 10 00 10 FF E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="PEiD-Bundle" more="PEiD-Bundle -> BoB / BobSoft" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 xx 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A</pattern>
|
|
<pattern ep="1">60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A</pattern>
|
|
<pattern ep="1">60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A</pattern>
|
|
<pattern ep="1">60 E8 xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 xx xx xx 2E xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44</pattern>
|
|
<pattern ep="1">60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 xx xx xx 2E xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44</pattern>
|
|
<pattern ep="1">83 7C 24 08 01 0F 85 xx xx xx xx 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00</pattern>
|
|
<pattern ep="1">60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 xx xx xx 2E xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44</pattern>
|
|
</sig>
|
|
|
|
<sig name="Pelles" more="Pelles -> Pelle Orinius" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 89 E5 53 56 57 8B 5D 0C 8B 75 10</pattern>
|
|
<pattern ep="1">55 89 E5 6A FF 68 xx xx xx xx 68 xx xx xx xx 64 FF 35 xx xx xx xx 64 89 25 xx xx xx xx 83 EC</pattern>
|
|
</sig>
|
|
|
|
<sig name="PELOCKnt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60</pattern>
|
|
</sig>
|
|
|
|
<sig name="PEMangle" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 9C BE xx xx xx xx 8B FE B9 xx xx xx xx BB 44 52 4F 4C AD 33 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="PEncrypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 9C BE 00 10 40 00 8B FE B9 xx xx xx xx BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 xx xx xx FF</pattern>
|
|
<pattern ep="1">EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85</pattern>
|
|
<pattern ep="1">60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB xx xx xx xx AD 33 C3 E2 FA</pattern>
|
|
<pattern ep="1">E9 xx xx xx 00 F0 0F C6</pattern>
|
|
</sig>
|
|
|
|
<sig name="PENinja" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD</pattern>
|
|
<pattern ep="1">90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90</pattern>
|
|
</sig>
|
|
|
|
<sig name="PESHiELD" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 xx xx xx xx 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04</pattern>
|
|
<pattern ep="1">5D 83 ED 06 EB 02 EA 04 8D</pattern>
|
|
<pattern ep="1">60 E8 2B 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="PESpin" more="PESpin -> Cyberbob" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 01 68 60 E8 00 00 00 00 8B</pattern>
|
|
</sig>
|
|
|
|
<sig name="PEStubOEP" more="PEStubOEP v1.x" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">40 48 BE 00 xx xx 00 40 48 60 33 C0 B8 xx xx xx 00 FF E0 C3 C3</pattern>
|
|
<pattern ep="1">90 33 C9 33 D2 B8 xx xx xx 00 B9 FF</pattern>
|
|
<pattern ep="1">E8 05 00 00 00 33 C0 40 48 C3 E8 05</pattern>
|
|
</sig>
|
|
|
|
<sig name="Petite" more="Petite 1 - 2" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00</pattern>
|
|
<pattern ep="1">66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1</pattern>
|
|
<pattern ep="1">66 9C 60 50 8B D8 03 xx 68 54 BC xx xx 6A xx FF 50 14 8B CC</pattern>
|
|
<pattern ep="1">xx xx xx xx xx xx 9C 60 50 8D 88 00 xx xx xx 8D 90 xx xx 00 00 8B DC 8B E1 68 00 00 xx xx 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03</pattern>
|
|
<pattern ep="1">xx xx xx xx xx 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 xx 16 00 00 68 00 00 xx xx 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6</pattern>
|
|
<pattern ep="1">64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8</pattern>
|
|
<pattern ep="1">xx xx xx xx xx 68 xx xx xx xx 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 xx xx 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A xx 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66</pattern>
|
|
<pattern ep="1">9C 60 E8 CA xx xx xx 03 xx 04 xx 05 xx 06 xx 07 xx 08</pattern>
|
|
<pattern ep="1">xx xx xx xx xx 66 9C 60 50 8D 88 xx F0 xx xx 8D 90 04 16 xx xx 8B DC 8B E1 68 xx xx xx xx 53 50 80 04 24 08 50 80 04 24 42</pattern>
|
|
<pattern ep="1">xx xx xx xx xx 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 66 9C 60 50 8B D8 03 00 68 xx xx xx xx 6A 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 66 9C 60 50 8B D8 03 xx 68 54 BC xx xx 6A xx FF 50 18 8B CC 8D A0 54 BC xx xx 8B C3 8D 90 E0 15 xx xx 68</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 68 xx xx xx xx 64 xx xx xx xx xx xx 64 xx xx xx xx xx xx 66 9C 60 50</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 6A 00 68 xx xx xx xx 64 xx xx xx xx xx xx 64 xx xx xx xx xx xx 66 9C 60 50</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 6A xx 68 xx xx xx xx 64 FF 35 xx xx xx xx 64 89 25 xx xx xx xx 66 9C 60 50</pattern>
|
|
<pattern ep="1">B8 00 xx xx 00 xx 00 xx xx xx xx xx xx xx xx 00 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 68 xx xx xx xx 64 FF 35 xx xx xx xx 64 89 25 xx xx xx xx 66 9C 60 50</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 66 9C 60 50 8D xx xx xx xx xx 68 xx xx xx xx 83</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 66 9C 60 50</pattern>
|
|
</sig>
|
|
|
|
<sig name="PKLITE" more="PKLITE v1 - v2" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">B8 xx xx BA xx xx 3B C4 73</pattern>
|
|
<pattern ep="1">B8 xx xx BA xx xx 8C DB 03 D8 3B</pattern>
|
|
<pattern ep="1">B8 xx xx BA xx xx 05 xx xx 3B 06 xx xx 73 xx 2D xx xx FA 8E D0 FB 2D xx xx 8E C0 50 B9 xx xx 33 FF 57 BE xx xx FC F3 A5 CB B4 09 BA xx xx CD 21 CD 20</pattern>
|
|
<pattern ep="1">B8 xx xx BA xx xx 05 xx xx 3B xx xx xx 72 xx B4 09 BA xx 01 CD 21 CD 20 4E 6F</pattern>
|
|
<pattern ep="1">B8 xx xx BA xx xx 05 xx xx 3B 06 xx xx 72 xx B4 09 BA xx xx CD 21 CD 20</pattern>
|
|
<pattern ep="1">B8 xx xx BA xx xx 05 xx xx 3B 06 xx xx 72 xx B4 09 BA xx xx CD 21 B4 4C CD 21</pattern>
|
|
<pattern ep="1">2E 8C 1E xx xx 8B 1E xx xx 8C DA 81 C2 xx xx 3B DA 72 xx 81 EB xx xx 83 EB xx FA 8E D3 BC xx xx FB FD BE xx xx 8B FE</pattern>
|
|
<pattern ep="1">BA xx xx A1 xx xx 2D xx xx 8C CB 81 C3 xx xx 3B C3 77 xx 05 xx xx 3B C3 77 xx B4 09 BA xx xx CD 21 CD 20 90</pattern>
|
|
<pattern ep="1">50 B8 xx xx BA xx xx 05 xx xx 3B 06 xx xx 72 xx B4 xx BA xx xx CD 21 B8 xx xx CD 21</pattern>
|
|
<pattern ep="1">B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB</pattern>
|
|
<pattern ep="1">68 xx xx xx 00 68 xx xx xx 00 68 00 00 00 00 E8 xx xx xx xx E9</pattern>
|
|
<pattern ep="1">50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31</pattern>
|
|
<pattern ep="1">55 8B EC A1 xx xx xx xx 85 C0 74 09 B8 01 xx xx xx 5D C2 0C xx 8B 45 0C 57 56 53 8B 5D 10</pattern>
|
|
<pattern ep="1">68 xx xx xx xx 68 xx xx xx xx 68 00 00 00 00 E8</pattern>
|
|
<pattern ep="1">68 xx xx xx xx 68 xx xx xx xx B8 xx xx xx xx 2B 44 24 0C 50</pattern>
|
|
</sig>
|
|
|
|
<sig name="PKZIP" more="PKZIP-Self Extracting (SFX) Archive" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="1">FC 2E 8C 0E xx xx A1 xx xx 8C CB 81 C3 xx xx 3B C3 72 xx 2D xx xx 2D xx xx FA BC xx xx 8E D0 FB</pattern>
|
|
<pattern ep="0">50 4B 03 04</pattern>
|
|
<pattern ep="0">4D 50 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="PluginToExe" more="PluginToExe v1.00 -> BoB / BobSoft" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 xx xx xx 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 xx xx xx 00 FF D3 83 C4 10 FF 95 B0 40 40 00</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 xx xx xx 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 xx xx 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="PocketPC ARM" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">F0 41 2D E9 xx xx xx xx xx xx xx xx xx xx xx xx xx xx A0 E1 xx xx xx xx xx xx xx xx xx xx xx xx 00 00 50 E3 xx 00 00 0A xx xx xx xx xx xx A0 xx xx xx xx xx xx xx A0 xx xx xx A0 E1 00 80 xx xx xx xx xx xx xx xx xx xx xx xx A0 E1</pattern>
|
|
<pattern ep="1">F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 xx 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 xx xx xx EB F0 40 BD E8 xx 00 00 EA xx 40 2D E9</pattern>
|
|
<pattern ep="1">F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 xx 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 xx xx xx EB F0 40 BD E8 xx 00 00 EA xx 40 2D E9 xx xx 9F E5 xx xx xx xx xx 00 xx xx xx xx xx xx xx xx 9F E5 00 xx xx xx xx 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Pohernah" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11</pattern>
|
|
</sig>
|
|
|
|
<sig name="PolyBox" more="PolyBox -> Anskya" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 xx xx xx xx 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF</pattern>
|
|
<pattern ep="1">55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="PolyCrypt PE" more="PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">91 8B F4 AD FE C9 80 34 08 xx E2 FA C3 60 E8 ED FF FF FF EB</pattern>
|
|
<pattern ep="1">50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45</pattern>
|
|
</sig>
|
|
|
|
<sig name="PolyCryptor" more="PolyCryptor by SMT Version" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB xx 28 50 6F 6C 79 53 63 72 79 70 74 20 xx xx xx 20 62 79 20 53 4D 54 29</pattern>
|
|
</sig>
|
|
|
|
<sig name="PolyEnE" more="PolyEnE V0.01+ -> Lennart Hedlund" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C</pattern>
|
|
</sig>
|
|
|
|
<sig name="PoPa" more="PoPa 0.01 (Packer on Pascal)" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 xx xx xx xx 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="PowerBASIC" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">55 8B EC 53 56 57 BB 00 xx xx 00 66 2E F7 05 xx xx xx 00 04 00 0F 85</pattern>
|
|
<pattern ep="1">55 8B EC 53 56 57 BB 00 xx 40 00 66 2E F7 05 xx xx 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03</pattern>
|
|
<pattern ep="1">55 8B EC 53 56 57 BB 00 xx 40 00 66 2E F7 05 xx xx 40 00 04 00 0F 85 DB 00 00 00</pattern>
|
|
<pattern ep="1">55 8B EC 53 56 57 BB 00 xx xx 00 66 2E F7 05 xx xx 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02</pattern>
|
|
</sig>
|
|
|
|
<sig name="PPC-PROTECT" more="PPC-PROTECT 1.1X -> Alexey Gorchakov" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5</pattern>
|
|
</sig>
|
|
|
|
<sig name="Private EXE Protector" more="Private EXE Protector -> SetiSoft" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3</pattern>
|
|
<pattern ep="1">BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx B9 xx 90 01 xx BE xx 10 40 xx 68 50 91 41 xx 68 01 xx xx xx C3</pattern>
|
|
<pattern ep="1">89 xx xx 38 00 00 00 8B xx 00 00 00 00 81 xx xx xx xx xx 89 xx 00 00 00 00 81 xx 04 00 00 00 81 xx 04 00 00 00 81 xx 00 00 00 00 0F 85 D6 FF FF FF</pattern>
|
|
<pattern ep="1">53 E8 00 00 00 00 5B 8B C3 2D</pattern>
|
|
<pattern ep="1">53 E8 xx xx xx xx 5B 8B C3 2D</pattern>
|
|
<pattern ep="1">06 60 C8 xx xx xx 0E 68 xx xx 9A xx xx xx xx 3D xx xx 0F xx xx xx 50 50 0E 68 xx xx 9A xx xx xx xx 0E</pattern>
|
|
<pattern ep="1">53 E8 xx xx xx xx 5B 8B C3 2D xx xx xx xx 50 81 xx xx xx xx xx 8B</pattern>
|
|
</sig>
|
|
|
|
<sig name="PPP" more="Private Personal Packer (PPP) 1.0.x -> ConquestOfTroy.com" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8</pattern>
|
|
<pattern ep="1">E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9</pattern>
|
|
</sig>
|
|
|
|
<sig name="PRO-PACK" more="PRO-PACK v2.08, emphasis on packed size, locked" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">83 EC xx 8B EC BE xx xx FC E8 xx xx 05 xx xx 8B C8 E8 xx xx 8B</pattern>
|
|
<pattern ep="1">8C D3 8E C3 8C CA 8E DA 8B 0E xx xx 8B F1 83 xx xx 8B FE D1 xx FD F3 A5 53</pattern>
|
|
</sig>
|
|
|
|
<sig name="ProActivate" more="ProActivate V1.0X -> TurboPower Software Company" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 xx xx xx xx 90 90 90 90 90 33 C0 55 68 xx xx xx xx 64 FF 30 64 89 20 A1 xx xx xx xx 83 C0 05 A3 xx xx xx xx C7 05 xx xx xx xx 0D 00 00 00 E8 85 E2 FF FF 81 3D xx xx xx xx 21 7E 7E 40 75 7A 81 3D</pattern>
|
|
</sig>
|
|
|
|
<sig name="Program Protector" more="Program Protector XP v1.0" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 xx xx xx xx 58 83 D8 05 89 C3 81 C3 xx xx xx xx 8B 43 64 50</pattern>
|
|
</sig>
|
|
|
|
<sig name="PROTECT!" more="PROTECT! EXE/COM v5 - v6" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">1E 0E 0E 1F 07</pattern>
|
|
<pattern ep="1">1E B4 30 CD 21 3C 02 73 xx CD 20 BE xx xx E8</pattern>
|
|
</sig>
|
|
|
|
<sig name="PseudoSigner" more="PseudoSigner -> Anorganix" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">90 90 90 90 68 xx xx xx xx 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90</pattern>
|
|
<pattern ep="1">60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 xx xx xx xx E9</pattern>
|
|
<pattern ep="1">60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90</pattern>
|
|
<pattern ep="1">60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9</pattern>
|
|
<pattern ep="1">90 90 90 90 68 xx xx xx xx 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95</pattern>
|
|
<pattern ep="1">60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 90 90 90 90 68 xx xx xx xx 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90</pattern>
|
|
<pattern ep="1">55 8B EC 90 90 90 90 68 xx xx xx xx 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9</pattern>
|
|
<pattern ep="1">55 8B EC 90 90 90 90 68 xx xx xx xx 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90</pattern>
|
|
<pattern ep="1">90 90 90 90 68 xx xx xx xx 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8</pattern>
|
|
</sig>
|
|
|
|
<sig name="PUNiSHER" more="PUNiSHER 1.5 -> FEUERRADER/AHTeam" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04</pattern>
|
|
<pattern ep="1">EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED</pattern>
|
|
<pattern ep="1">3F 00 00 80 66 20 xx 00 7E 20 xx 00 92 20 xx 00 A4 20 xx 00 00 00 00 00 4B 45 52 4E 45 4C 33 32</pattern>
|
|
<pattern ep="1">EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="PuNkMoD" more="PuNkMoD 1.x -> PuNkDuDe" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">
|
|
94 B9 xx xx 00 00 BC xx xx xx xx 80 34 0C
|
|
</pattern>
|
|
</sig>
|
|
|
|
<sig name="PureBasic" more="PureBasic -> Neil Hodgson" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">68 xx xx 00 00 68 00 00 00 00 68 xx xx xx 00 E8 xx xx xx 00 83 C4 0C 68 00 00 00 00 E8 xx xx xx 00 A3 xx xx xx 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 xx xx xx 00 A3</pattern>
|
|
<pattern ep="1">83 7C 24 08 01 75 0E 8B 44 24 04 A3 xx xx xx 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 xx 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 xx 0F 00 00 A3</pattern>
|
|
<pattern ep="1">83 7C 24 08 01 75 xx 8B 44 24 04 A3 xx xx xx 10 E8</pattern>
|
|
</sig>
|
|
|
|
<sig name="RAR" more="RAR Archive" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="0">52 41 52 20 43 4F 4E 46 49 47</pattern>
|
|
<pattern ep="0">2A 2A 2A 6D 65 73 73 61 67 65 73 2A 2A 2A 0D 0A</pattern>
|
|
<pattern ep="0">52 61 72 21 1A 07 00 CF 90 73 00 00</pattern>
|
|
<pattern ep="1">E8 xx xx xx xx 50 E8 xx xx xx xx 00 00 00 00 90</pattern>
|
|
</sig>
|
|
|
|
<sig name="RatPacker" more="RatPacker (Glue) stub" flag="1" file="0" tool="1" severity="1">
|
|
<pattern ep="1">40 20 FF xx xx xx xx xx xx xx xx BE xx 60 40 xx 8D BE xx B0 FF FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="RAZOR" more="RAZOR 1911 encryptor" flag="1" file="0" tool="1" severity="1">
|
|
<pattern ep="1">E8 xx xx BF xx xx 3B FC 72 xx B4 4C CD 21 BE xx xx B9 xx xx FD F3 A5 FC</pattern>
|
|
</sig>
|
|
|
|
<sig name="RCryptor" more="RCryptor by Vaska" flag="1" file="0" tool="1" severity="1">
|
|
<pattern ep="1">83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3</pattern>
|
|
<pattern ep="1">33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3</pattern>
|
|
<pattern ep="1">60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90 3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB F3 C3</pattern>
|
|
<pattern ep="1">F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 xx xx xx xx F7 D1 83 F1 FF</pattern>
|
|
<pattern ep="1">8B 04 24 83 E8 4F 68 xx xx xx xx FF D0</pattern>
|
|
<pattern ep="1">55 8B EC 8B 44 24 04 83 E8 4F 68 xx xx xx xx FF D0 58 59 50</pattern>
|
|
<pattern ep="1">61 83 EF 4F 60 68 xx xx xx xx FF D7</pattern>
|
|
<pattern ep="1">83 2C 24 4F 68 xx xx xx xx FF 54 24 04 83 44 24 04 4F</pattern>
|
|
<pattern ep="1">33 D0 68 xx xx xx xx FF D2 B8 xx xx xx xx 3D xx xx xx xx 74 06 80 30 xx 40 EB F3</pattern>
|
|
<pattern ep="1">33 D0 68 xx xx xx xx FF D2</pattern>
|
|
<pattern ep="1">8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68</pattern>
|
|
<pattern ep="1">60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68</pattern>
|
|
<pattern ep="1">90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68</pattern>
|
|
<pattern ep="1">F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 xx 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3</pattern>
|
|
<pattern ep="1">F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 xx 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 xx 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 xx xx xx 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 xx 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD</pattern>
|
|
</sig>
|
|
|
|
<sig name="RE-Crypt" more="RE-Crypt 0.7x -> Crudd RET" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 xx xx 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 xx xx 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 xx xx 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC</pattern>
|
|
</sig>
|
|
|
|
<sig name="REC" more="REC v0.3X" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">06 1E 52 B8 xx xx 1E CD 21 86 E0 3D</pattern>
|
|
<pattern ep="1">06 1E B4 30 CD 21 3C 02 73 xx 33 C0 06 50 CB</pattern>
|
|
<pattern ep="1">06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 xx CD 20 EB</pattern>
|
|
</sig>
|
|
|
|
<sig name="Reflexive Arcade Wrapper" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8</pattern>
|
|
</sig>
|
|
|
|
<sig name="Reg2Exe" more="Reg2Exe - by Jan Vorel" flag="1" file="10" tool="1" severity="2">
|
|
<pattern ep="1">6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00</pattern>
|
|
<pattern ep="1">6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00</pattern>
|
|
<pattern ep="1">6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00</pattern>
|
|
<pattern ep="1">68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98</pattern>
|
|
</sig>
|
|
|
|
<sig name="ResCrypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 E8 xx xx xx xx 5D 81 ED 06 xx xx xx BE xx xx xx xx xx F5 8B DE BA 01 xx xx xx 33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 xx xx xx 7F 83 F8 03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9</pattern>
|
|
</sig>
|
|
|
|
<sig name="ReversingLabsProtector" more="ReversingLabsProtector 0.7.4 beta -> Ap0x" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 00 00 41 00 E8 01 00 00 00 C3 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="RJcrush" more="RJcrush v1.00" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">06 FC 8C C8 BA xx xx 03 D0 52 BA xx xx 52 BA xx xx 03 C2 8B D8 05 xx xx 8E DB 8E C0 33 F6 33 FF B9</pattern>
|
|
</sig>
|
|
|
|
<sig name="RJoiner" more="RJoiner by Vaska" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00</pattern>
|
|
<pattern ep="1">E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10</pattern>
|
|
</sig>
|
|
|
|
<sig name="RLPack" more="RLPack --> Ap0x" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 xx xx xx xx 6A 40 68 xx xx xx xx 68 xx xx xx xx 6A 00 FF 95 CD 09 00 00 89 85 xx xx xx xx EB 14 60 FF B5 14 0A</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 xx xx xx xx 6A 40 68 xx xx xx xx 68 xx xx xx xx 6A 00 FF 95 EB 09 00 00 89 85 xx xx xx xx EB 14 60 FF B5 3A 0A</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 xx xx xx EB 03 xx xx xx 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 xx xx xx xx EB 03 xx xx xx 6A 40 68 xx xx xx xx 68 xx xx xx xx 6A 00 FF 95 9B 0A</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 xx xx xx xx 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 xx xx xx xx 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 xx xx xx xx 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx 00 00 8D 9D xx xx 00 00 33 FF E8 xx xx xx xx EB 0F FF 74 37 04 FF 34 37 FF D3</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 xx 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 xx 83 C7 xx 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 xx 8B B5 16 04 00 00 8B C6 EB 01</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 xx 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 xx 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 xx 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 xx 83 C7 xx 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A xx FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 xx 8B B5 16 04 00 00 8B C6 EB 01</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx xx xx 8D 9D xx xx xx xx 33 FF E8 9F 01 00 00 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A xx FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A xx FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF xx xx xx xx xx xx xx xx xx xx 6A 40 68 xx xx xx xx 68 xx xx xx xx 6A</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 8D B5 xx xx xx xx 8D 9D xx xx xx xx 33 FF</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx EB 0F FF 74 37 04 FF 34</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx xx xx xx 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 xx xx xx xx 6A 40 68 xx xx xx xx 68 xx xx xx xx 6A 00 FF 95 EB 09 00 00 89 85</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx xx xx xx 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx xx xx 8D 9D xx xx xx xx 33 FF E8</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx xx xx xx 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 xx xx xx xx EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF xx xx xx xx xx xx xx xx xx xx 6A 40 68 xx xx xx xx 68 xx xx xx xx 6A</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx EB 0F FF 74 37 04 FF 34</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx xx xx 8D 9D xx xx xx xx 33 FF EB 0F FF xx xx xx FF xx xx xx D3 83 C4 xx 83 C7 xx 83 3C 37 00 75 EB</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx xx xx 8D 9D xx xx xx xx 33 FF 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A xx FF 95 xx xx xx xx 89 85 xx xx xx xx EB xx 60</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx xx xx 8D 9D xx xx xx xx 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx xx xx 8D 9D xx xx xx xx 33 FF E8 83 01 00 00 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A xx FF 95 xx xx xx xx 89 85 xx xx xx xx EB 14</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx xx xx 8D 9D xx xx xx xx 33 FF E8</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 xx 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 xx 83 C7 xx 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A xx 68</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 xx 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 xx 83 3C 37 00 75 E6</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx xx xx xx 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx xx xx xx 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx 00 00 8D 9D xx 02 00 00 33 FF E8 xx 01 00 00</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 xx 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 xx 83 C7 xx 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 xx xx xx xx 8D 9D xx xx xx xx 33 FF E8 9F 01 00 00 6A xx 68 xx xx xx xx 68 xx xx xx xx 6A xx FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 xx xx xx xx 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 xx xx xx xx FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 xx xx xx xx 61 C3</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 xx xx xx xx 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 xx xx xx xx FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 xx xx xx xx 61 C3</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 xx xx xx xx 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 xx xx xx xx FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 xx xx xx xx 61 C3</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 xx xx xx xx 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 xx xx xx xx FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 xx xx xx xx 61 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="ROD High TECH" more="ROD High TECH -> Ayman" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="RosAsm" more="RosAsm 2050a -> Betov" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF xx xx xx xx 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 xx xx xx xx 68 xx xx xx xx 6A 00 FF 15 xx xx xx xx 61 8B E5 5D C2 04 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="RPolyCrypt" more="RPolyCrypt v 1.0 (personal polycryptor) sign from pinch" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1</pattern>
|
|
</sig>
|
|
|
|
<sig name="Safeguard" more="Safeguard 1.0 -> Simonzh" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 00 00 00 00 EB 29</pattern>
|
|
</sig>
|
|
|
|
<sig name="Sc Obfuscator" more="Sc Obfuscator -> SuperCRacker" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 33 C9 8B 1D xx xx xx xx 03 1D xx xx xx xx 8A 04 19 84 C0 74 09 3C xx 74 05 34 xx 88 04 19 41 3B 0D xx xx xx xx 75 E7 A1 xx xx xx xx 01 05 xx xx xx xx 61 FF 25 xx xx xx xx 00 00</pattern>
|
|
<pattern ep="1">60 33 C9 8B 1D 00 xx xx xx 03 1D 08 xx xx xx 8A 04 19 84 C0 74 09 3C xx 74 05 34 xx 88 04 19 41 3B 0D 04 xx xx xx 75 E7 A1 08 xx xx xx 01 05 0C xx xx xx 61 FF 25 0C</pattern>
|
|
</sig>
|
|
|
|
<sig name="SCRAM!" more="SCRAM! v0.8a1" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">B4 30 CD 21 3C 02 77 xx CD 20 BC xx xx B9 xx xx 8B FC B2 xx 58 4C</pattern>
|
|
<pattern ep="1">B8 xx xx 50 9D 9C 58 25 xx xx 75 xx BA xx xx B4 09 CD 21 CD 20</pattern>
|
|
</sig>
|
|
|
|
<sig name="SDC" more="SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="SDProtect" more="SDProtect -> Randy Li" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx xx xx 68 88 88 88 08 64 A1</pattern>
|
|
</sig>
|
|
|
|
<sig name="SecuPack" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 xx E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 xx 64 FF 30 64 89 20 6A xx 68 80 xx xx xx 6A 03 6A xx 6A 01 xx xx xx 80</pattern>
|
|
</sig>
|
|
|
|
<sig name="SecureEXE" more="SecureEXE -> ZipWorx" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 B8 00 00 00 xx xx xx 00 xx xx xx 00 xx xx xx 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55</pattern>
|
|
</sig>
|
|
|
|
<sig name="Sentinel SuperPro" more="Sentinel SuperPro (Automatic Protection) -> Safenet" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 xx xx xx xx 6A 01 6A 00 FF 15 xx xx xx xx A3 xx xx xx xx FF 15 xx xx xx xx 33 C9 3D B7 00 00 00 A1 xx xx xx xx 0F 94 C1 85 C0 89 0D xx xx xx xx 0F 85 xx xx xx xx 55 56 C7 05 xx xx xx xx 01 00 00 00 FF 15 xx xx xx xx 01 05 xx xx xx xx FF 15</pattern>
|
|
<pattern ep="1">A1 xx xx xx xx 55 8B xx xx xx 85 C0 74 xx 85 ED 75 xx A1 xx xx xx xx 50 55 FF 15 xx xx xx xx 8B 0D xx xx xx xx 55 51 FF 15 xx xx xx xx 85 C0 74 xx 8B 15 xx xx xx xx 52 FF 15 xx xx xx xx 6A 00 6A 00 68 xx xx xx xx E8 xx xx xx xx B8 01 00 00 00 5D C2 0C 00</pattern>
|
|
<pattern ep="1">68 xx xx xx xx 6A 01 6A 00 FF 15 xx xx xx xx A3 xx xx xx xx FF 15 xx xx xx xx 33 C9 3D B7 00 00 00 A1 xx xx xx xx 0F 94 C1 85 C0 89 0D xx xx xx xx 0F 85 xx xx xx xx 55 56 C7 05 xx xx xx xx 01 00 00 00 FF 15 xx xx xx xx 01 05 xx xx xx xx FF 15 xx xx xx xx 33 05 xx xx xx xx 25 FE FF DF 3F 0D 01 00 20 00 A3 xx xx xx xx 33 C0 50 C7 04 85 xx xx xx xx 00 00 00 00 E8 xx xx xx xx 83 C4 04 83 F8 64 7C xx 68 xx xx xx xx FF 15 xx xx xx xx 8B 35 xx xx xx xx 68 xx xx xx xx FF D6 68 xx xx xx xx FF D6 68 xx xx xx xx FF D6 68 xx xx xx xx FF D6 68 xx xx xx xx FF D6 A1 xx xx xx xx 8B 2D xx xx xx xx 66 8B 55 00 83 C5 08</pattern>
|
|
<pattern ep="1">A1 xx xx xx xx 55 8B xx xx xx 85 C0 74 xx 85 ED 75 xx A1 xx xx xx xx 50 55 FF 15 xx xx xx xx 8B 0D xx xx xx xx 55 51 FF 15 xx xx xx xx 85 C0 74 xx 8B 15 xx xx xx xx 52 FF 15 xx xx xx xx 6A 00 6A 00 68 xx xx xx xx E8 xx xx xx xx B8 01 00 00 00 5D C2 0C 00 68 xx xx xx xx 6A 01 6A 00 FF 15 xx xx xx xx A3 xx xx xx xx FF 15 xx xx xx xx 33 C9 3D B7 00 00 00 A1 xx xx xx xx 0F 94 C1 85 C0 89 0D xx xx xx xx 0F 85 xx xx xx xx 56 C7 05 xx xx xx xx 01 00 00 00 FF 15 xx xx xx xx 01 xx xx xx xx xx FF 15 xx xx xx xx 33 05 xx xx xx xx 25 FE FF DF 3F 0D 01 00 20 00 A3 xx xx xx xx 33 C0 50 C7 04 xx xx xx xx xx 00 00 00 00 E8</pattern>
|
|
</sig>
|
|
|
|
<sig name="Sexe Crypter" more="Sexe Crypter 1.1 - by santasdad" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 xx xx xx xx E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79</pattern>
|
|
</sig>
|
|
|
|
<sig name="Shrink" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">50 9C FC BE xx xx BF xx xx 57 B9 xx xx F3 A4 8B xx xx xx BE xx xx BF xx xx F3 A4 C3</pattern>
|
|
<pattern ep="1">E9 xx xx 50 9C FC BE xx xx 8B FE 8C C8 05 xx xx 8E C0 06 57 B9</pattern>
|
|
<pattern ep="1">58 60 8B E8 55 33 F6 68 48 01 xx xx E8 49 01 xx xx EB</pattern>
|
|
</sig>
|
|
|
|
<sig name="Shrinker" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04</pattern>
|
|
<pattern ep="1">00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8</pattern>
|
|
<pattern ep="1">55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04</pattern>
|
|
<pattern ep="1">83 3D xx xx xx xx xx 55 8B EC 56 57 75 65 68 00 01 xx xx E8 xx E6 FF FF 83 C4 04 8B 75 08 A3 xx xx xx xx 85 F6 74 1D 68 FF</pattern>
|
|
<pattern ep="1">83 3D xx xx xx 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8</pattern>
|
|
<pattern ep="1">83 3D B4 xx xx xx xx 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 xx 0B 00 00 83 C4 04 8B 75 08 A3 B4 xx xx xx 85 F6 74 23 83 7D 0C 03 77 1D 68 FF</pattern>
|
|
<pattern ep="1">BB xx xx BA xx xx 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B</pattern>
|
|
</sig>
|
|
|
|
<sig name="Silicon Realms Install Stub" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx 92 40 00 68 xx xx 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 xx xx 40 00 33 D2 8A D4 89 15 xx xx 40 00 8B C8 81 E1 FF 00 00 00 89 0D xx xx 40 00 C1 E1 08 03 CA 89 0D xx xx 40 00 C1 E8 10 A3</pattern>
|
|
</sig>
|
|
|
|
<sig name="SimbiOZ PolyCryptor" more="SimbiOZ PolyCryptor -> Extranger" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">57 57 8D 7C 24 04 50 B8 00 xx xx xx AB 58 5F C3</pattern>
|
|
<pattern ep="1">55 50 8B C4 83 C0 04 C7 00 xx xx xx xx 58 C3 90</pattern>
|
|
<pattern ep="1">55 60 E8 00 00 00 00 5D 81 ED xx xx xx xx 8D 85 xx xx xx xx 68 xx xx xx xx 50 E8</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="Simple UPX Cryptor v30.4.2005 multi layer encryption" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 B8 xx xx xx xx B9 18 00 00 00 80 34 08 xx E2 FA 61 68 xx xx xx xx C3</pattern>
|
|
<pattern ep="1">60 B8 xx xx xx 00 B9 xx 01 00 00 80 34 08 xx E2 FA 61 68 xx xx xx 00 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="SimplePack v1" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 xx xx 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC</pattern>
|
|
<pattern ep="1">4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 xx xx xx 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">4D 5A 90 EB 01 00 52 E9 xx 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 xx xx xx 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 xx xx 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5B 8D 5B FA BD xx xx xx xx 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0</pattern>
|
|
<pattern ep="1">4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00</pattern>
|
|
<pattern ep="1">4D 5A 90 EB 01 00 52 E9 xx 01 00 00 50 45 00 00 4C 01 02 00</pattern>
|
|
<pattern ep="1">4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 xx xx xx 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04</pattern>
|
|
<pattern ep="1">4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 xx xx xx 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04</pattern>
|
|
</sig>
|
|
|
|
<sig name="SkD Undetectabler" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 xx 16 00 01 52 A1 xx 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 xx 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 xx 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D xx 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 xx 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 xx 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D xx 16 00 01 00 74</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40</pattern>
|
|
</sig>
|
|
|
|
<sig name="SLVc0deProtector" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD</pattern>
|
|
<pattern ep="1">E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6</pattern>
|
|
<pattern ep="1">E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C</pattern>
|
|
</sig>
|
|
|
|
<sig name="SmartE" more="SmartE -> Microsoft" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB 15 03 00 00 00 xx 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06</pattern>
|
|
</sig>
|
|
|
|
<sig name="SmokesCrypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 B8 xx xx xx xx B8 xx xx xx xx 8A 14 08 80 F2 xx 88 14 08 41 83 F9 xx 75 F1</pattern>
|
|
</sig>
|
|
|
|
<sig name="Soft Defender" more="Soft Defender 1.1x -> Randy Li" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44</pattern>
|
|
<pattern ep="1">74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD xx 59 9C 50 74 0A 75 08 E8 59 C2 04 xx 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 xx xx xx xx 58 05 BA 01 xx xx 03 C8 74 BE 75 BC E8</pattern>
|
|
<pattern ep="1">74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8</pattern>
|
|
<pattern ep="1">74 07 75 05 xx xx xx xx xx 74 1F 75 1D xx 68 xx xx xx 00 59 9C 50 74 0A 75 08 xx 59 C2 04 00 xx xx xx E8 F4 FF FF FF xx xx xx 78 0F 79 0D</pattern>
|
|
<pattern ep="1">74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Software Compress" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="SVKP" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC CE 05 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67</pattern>
|
|
</sig>
|
|
|
|
<sig name="Symantec C v4.00 + Libraries" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">FA B8 xx xx DB E3 8E D8 8C 06 xx xx 8B D8 2B 1E xx xx 89 1E xx xx 26</pattern>
|
|
</sig>
|
|
|
|
<sig name="Symantec Visual Cafe" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">64 8B 05 xx xx xx xx 55 8B EC 6A FF 68 xx xx 40 xx 68 xx xx 40 xx 50 64 89 25 xx xx xx xx 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC</pattern>
|
|
</sig>
|
|
|
|
<sig name="TASM / MASM" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">6A 00 E8 xx xx 00 00 A3 xx xx 40 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="tElock" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74</pattern>
|
|
<pattern ep="1">E9 59 E4 FF FF 00 00 00 00 00 00 00 xx xx xx xx EE xx xx 00 00 00 00 00 00 00 00 00 0E xx xx 00 FE xx xx 00 F6 xx xx 00 00 00 00 00 00 00 00 00 1B xx xx 00 06 xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 xx xx 00 00 00 00 00 39 xx xx 00 00 00 00 00 26 xx xx 00 00 00 00 00 39 xx xx 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C</pattern>
|
|
<pattern ep="1">E9 25 E4 FF FF 00 00 00 xx xx xx xx 1E xx xx 00 00 00 00 00 00 00 00 00 3E xx xx 00 2E xx xx 00 26 xx xx 00 00 00 00 00 00 00 00 00 4B xx xx 00 36 xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 xx xx 00 00 00 00 00 69 xx xx 00 00 00 00 00 56 xx xx 00 00 00 00 00 69 xx xx 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65</pattern>
|
|
<pattern ep="1">E9 25 E4 FF FF 00 00 00 xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx xx 00 00 00 00 xx xx xx xx 00</pattern>
|
|
<pattern ep="1">E9 xx xx FF FF 00 00 00 xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">E9 5E DF FF FF 00 00 00 xx xx xx xx E5 xx xx 00 00 00 00 00 00 00 00 00 05</pattern>
|
|
<pattern ep="1">E9 5E DF FF FF 00 00 00 xx xx xx xx E5 xx xx 00 00 00 00 00 00 00 00 00 05 xx xx 00 F5 xx xx 00 ED xx xx 00 00 00 00 00 00 00 00 00 12 xx xx 00 FD xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D xx xx 00 00 00 00 00 30 xx xx 00 00</pattern>
|
|
<pattern ep="1">E9 xx xx FF FF 00 00 00 xx xx xx xx xx xx xx 00 xx xx xx xx xx xx xx 00 xx xx xx 00 xx xx xx 00 xx xx 02 00 xx xx xx 00 xx xx xx 00 xx xx xx 00 xx xx xx 00 xx xx xx 00 xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx 00 00 00 00 00 xx xx 02 00 00</pattern>
|
|
<pattern ep="1">E9 3F DF FF FF 00 00 00 xx xx xx xx 04 xx xx 00 00 00 00 00 00 00 00 00 24 xx xx 00 14 xx xx 00 0C xx xx 00 00 00 00 00 00 00 00 00 31 xx xx 00 1C xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C xx xx 00 00 00 00 00 4F xx xx 00 00 00 00 00 3C xx xx 00 00 00 00 00 4F xx xx 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65</pattern>
|
|
<pattern ep="1">66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 xx xx 59 EB 01 EB AC 54 E8 03 xx xx xx 5C EB 08</pattern>
|
|
<pattern ep="1">C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08</pattern>
|
|
<pattern ep="1">C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 xx 8B FE 68 79 01 xx xx 59 EB 01</pattern>
|
|
<pattern ep="1">C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08</pattern>
|
|
<pattern ep="1">E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08</pattern>
|
|
<pattern ep="1">60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70</pattern>
|
|
<pattern ep="1">60 E8 ED 10 00 00 C3 83</pattern>
|
|
<pattern ep="1">60 E8 44 11 00 00 C3 83</pattern>
|
|
<pattern ep="1">60 E8 48 11 00 00 C3 83</pattern>
|
|
<pattern ep="1">60 E8 00 00 C3 83</pattern>
|
|
<pattern ep="1">60 E8 F9 11 00 00 C3 83</pattern>
|
|
<pattern ep="1">60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02</pattern>
|
|
<pattern ep="1">xx xx E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B</pattern>
|
|
<pattern ep="1">E9 7E E9 FF FF 00</pattern>
|
|
<pattern ep="1">E9 D5 E4 FF FF 00</pattern>
|
|
<pattern ep="1">E9 59 E4 FF FF 00</pattern>
|
|
<pattern ep="1">E9 25 E4 FF FF 00 00 00 xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 xx xx xx xx 00 00 00 00 xx xx xx xx 00 00 00 00 xx xx xx xx 00 00 00 00 xx xx xx xx 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00</pattern>
|
|
<pattern ep="1">E9 25 E4 FF FF 00 00 00 xx xx xx xx 1E</pattern>
|
|
<pattern ep="1">E9 25 E4 FF FF</pattern>
|
|
<pattern ep="1">E9 1B E4 FF FF</pattern>
|
|
<pattern ep="1">E9 5E DF FF FF 00 00 00 xx xx xx xx E5 xx xx 00 00 00 00 00 00 00 00 00 05 xx xx 00 F5 xx xx 00 ED xx xx 00 00 00 00 00 00 00 00 00 12 xx xx 00 FD xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D xx xx 00 00 00 00 00 30 xx xx 00 00 00 00 00 1D xx xx 00 00 00 00 00 30 xx xx 00 00 00 00 00</pattern>
|
|
<pattern ep="1">E9 E5 E2 FF FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="aPE" more="aPE Inline Patch Basic, Advanced, Stealth" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">B9 xx xx xx 00 E8 xx xx 00 00 89 01 68</pattern>
|
|
<pattern ep="1">E8 02 xx xx xx EB 01 C3 3E 8B 44 24 FC 50 B9 xx xx xx xx E8 xx xx xx xx 89</pattern>
|
|
</sig>
|
|
|
|
<sig name="The Guard Library" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">50 E8 xx xx xx xx 58 25 xx F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="TheHyper's protector" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 EC 14 8B FC E8 14 00 00 00 xx xx 01 01 xx xx 01 01 xx xx xx 00 xx xx 01 01 xx xx 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8</pattern>
|
|
<pattern ep="1">55 8B EC 83 EC 14 8B FC E8 14 00 00 00 xx xx 01 01 xx xx 01 01 xx xx xx 00 xx xx 01 01 xx xx xx 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 0C 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 53 8B 06 FF 10 89 47 04 E8 0F 00 00 00 47 65 74 50 72 6F 63 65 73 73 48 65 61 70 00 53 8B 06 FF 10 89 47 08 E8 0A 00 00 00 48 65 61 70 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 47 0C E8 09 00 00 00 48 65 61 70 46 72 65 65 00 53 8B 06 FF 10 89 47 10 57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D</pattern>
|
|
</sig>
|
|
|
|
<sig name="Themida" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 xx xx xx xx 03 C7 B9 5A xx xx xx 03 CF EB 0A B8 xx xx xx xx B9 5A xx xx xx 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA xx xx xx xx 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 xx xx xx xx FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00</pattern>
|
|
<pattern ep="1">55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA xx xx xx xx 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 xx xx xx xx FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA xx xx xx xx 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA xx xx xx xx 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB</pattern>
|
|
<pattern ep="1">B8 00 00 xx xx 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8</pattern>
|
|
<pattern ep="1">B8 00 00 xx xx 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 xx xx xx 00 03 C7 B9 xx xx xx 00 03 CF EB 0A B8 xx xx xx xx B9 5A xx xx xx 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 00 00 02 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED xx xx 35 09 89 95 xx xx 35 09 89 B5 xx xx 35 09 89 85 xx xx 35 09 83 BD xx xx 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 xx xx 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25</pattern>
|
|
<pattern ep="1">8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED xx xx 35 09 89 95 xx xx 35 09 89 B5 xx xx 35 09 89 85 xx xx 35 09 83 BD xx xx 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 xx xx 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 xx xx xx FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 xx xx xx FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 xx xx xx xx 03 C7 B9 xx xx xx xx 03 CF EB 0A B8 xx xx xx xx B9 xx xx xx xx 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9</pattern>
|
|
<pattern ep="1">B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 xx 00 00 00 80 38 E9 75 xx 61 EB xx E8 00 00 00 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 60 0B C0 74 58 E8 00 00 00 00 58 05 xx xx xx xx 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB xx xx 66 83 xx xx 66 39 18 75 12 0F B7 50 3C 03 D0 BB xx xx xx xx 83 C3 xx 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 xx xx xx xx 03 C7 B9 xx xx xx xx 03 CF EB 0A B8 xx xx xx xx B9 xx xx xx xx 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D xx xx xx xx B9 xx xx xx xx C6 00 E9 83 E9 xx 89 48 01 61 E9</pattern>
|
|
<pattern ep="1">B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 xx 00 00 00 80 38 E9 75 xx 61 EB xx DB 2D xx xx xx xx FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx xx 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D xx xx xx xx FF FF FF FF FF FF FF FF 3D xx xx xx xx 00 00 58 25 00 F0 FF FF 33 FF 66 BB xx xx 66 83 xx xx 66 39 18 75 12 0F B7 50 3C 03 D0 BB xx xx xx xx 83 C3 xx 39 1A 74 07 2D xx xx xx xx EB DA 8B F8 B8 xx xx xx xx 03 C7 B9 xx xx xx xx 03 CF EB 0A B8 xx xx xx xx B9 xx xx xx xx 50 51 E8 xx xx xx xx E8 xx xx xx xx 58 2D xx xx xx xx B9 xx xx xx xx C6 00 E9 83 E9 05 89 48 01 61 E9</pattern>
|
|
<pattern ep="1">8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED xx xx xx xx 89 95 xx xx xx xx 89 B5 xx xx xx xx 89 85 xx xx xx xx 83 BD xx xx xx xx xx 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 xx xx xx xx 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPack 0.x" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7</pattern>
|
|
<pattern ep="1">BE 48 01 40 00 AD xx xx xx A5 xx C0 33 C9 xx xx xx xx xx xx xx F3 AB xx xx 0A xx xx xx xx AD 50 97 51 xx 87 F5 58 8D 54 86 5C xx D5 72 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx B6 5F FF C1</pattern>
|
|
<pattern ep="1">BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 xx F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1</pattern>
|
|
<pattern ep="1">BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 xx F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 xx B3</pattern>
|
|
<pattern ep="1">BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 xx F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 xx B3 00</pattern>
|
|
<pattern ep="1">xx xx xx xx xx xx xx AD 8B F8 59 95 F3 A5 AD B5 xx F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 xx 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 xx B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00</pattern>
|
|
<pattern ep="1">6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 xx F3 AB AD 50 97 51 58 8D 54</pattern>
|
|
<pattern ep="1">BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 xx F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 xx B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0</pattern>
|
|
<pattern ep="1">60 E8 09 00 00 00 xx xx xx 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 xx F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72</pattern>
|
|
<pattern ep="1">BE E0 11 xx xx FF 36 E9 C3 00 00 00 48 01 xx xx 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C</pattern>
|
|
<pattern ep="1">BE B0 11 xx xx AD 50 FF 76 34 EB 7C 48 01 xx xx 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 xx xx xx 00 00 xx xx 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 xx xx xx 00 02 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">BE B0 11 xx xx AD 50 FF 76 34 EB 7C 48 01 xx xx 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 xx xx xx 00 00 xx xx 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 xx xx xx 00 02 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">BE B0 11 xx xx AD 50 FF 76 34 EB 7C 48 01 xx xx 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 xx xx xx 00 00 xx xx 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 xx xx xx 00 02 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD</pattern>
|
|
<pattern ep="1">BE 48 01 xx xx xx xx xx 95 A5 33 C0</pattern>
|
|
<pattern ep="1">BE xx xx xx xx AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 xx F3 AB C1 E0 xx B5 xx F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C xx 73 xx B0 xx 3C xx 72 02 2C xx 50 0F B6 5F FF C1 E3 xx B3 xx 8D 1C 5B 8D xx xx xx xx xx xx B0 xx 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5</pattern>
|
|
<pattern ep="1">BE xx xx xx xx AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 xx F3 AB C1 E0 xx B5 xx F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C xx 73 xx B0 xx 3C xx 72 02 2C xx 50 0F B6 5F FF C1 E3 xx B3 xx 8D 1C 5B 8D xx xx xx xx xx xx B0 xx 67 E3 29 8B D7</pattern>
|
|
<pattern ep="1">BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 55 CC 33 C9 E9 DF 00 00 00 8B 5E 0C 83 C2 30 FF D5 73 50 83 C2 30 FF D5 72 1B 83 C2 30 FF D5 72 2B 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 46 0C B1 80 8A 00 EB CF 83 C2 60 FF D5 87 5E 10 73 0D 83 C2 30 FF D5 87 5E 14 73 03 87 5E 18 3C 07 B0 08 72 02 B0 0B 50 53 8D 96 7C 07 00 00 FF 55 D0 5B 91 EB 77 3C 07 B0 07 72 02 B0 0A 50 87 5E 10 87 5E 14 89 5E 18 8D 96 C4 0B 00 00 FF 55 D0 50 48</pattern>
|
|
<pattern ep="1">BE 88 01 xx xx AD 8B F8 95</pattern>
|
|
<pattern ep="1">BE 88 01 xx xx AD 8B F8 xx xx xx xx 33</pattern>
|
|
<pattern ep="1">6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5</pattern>
|
|
<pattern ep="1">BE 88 01 40 00 AD xx xx 95 AD 91 F3 A5 AD</pattern>
|
|
<pattern ep="1">E9 xx xx xx xx 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 29</pattern>
|
|
<pattern ep="1">E9 xx xx xx xx 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 30</pattern>
|
|
<pattern ep="1">E9 xx xx xx xx 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 31</pattern>
|
|
<pattern ep="1">BE 88 01 xx xx AD 50 xx AD 91 F3 A5</pattern>
|
|
<pattern ep="1">E9 xx xx xx xx 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 32</pattern>
|
|
<pattern ep="1">BE 88 01 xx xx AD 50 xx xx AD 91 F3 A5</pattern>
|
|
<pattern ep="1">BE 88 01 xx xx AD 50 xx AD 91 xx F3 A5</pattern>
|
|
<pattern ep="1">xx xx xx xx 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40</pattern>
|
|
<pattern ep="1">8B F2 8B CA 03 4C 19 1C 03 54 1A 20</pattern>
|
|
<pattern ep="1">0B 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 18 10 00 00 10 00 00 00 xx xx xx xx xx xx xx xx 00 10 00 00 00 02 00 00 xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00</pattern>
|
|
<pattern ep="1">BE xx xx xx xx FF 36 E9 C3 00 00 00</pattern>
|
|
<pattern ep="1">AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0</pattern>
|
|
<pattern ep="1">BE B0 11 xx xx AD 50 FF 76 34 EB 7C 48 01 xx xx 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 xx xx xx 00 00 xx xx 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 xx xx xx 00 02 00 00 00 00 00 00 xx 00 00 xx 00 00 xx 00 00 xx xx 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE xx xx xx 14 00 00 00 00 xx xx xx xx xx xx 00 FF 76 38 AD 50 8B 3E BE F0 xx xx xx 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 xx xx xx xx xx 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 xx F3 AB 8B 7E 0C 57 51 E9 xx xx xx xx E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C xx 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F</pattern>
|
|
<pattern ep="1">53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33</pattern>
|
|
<pattern ep="1">BE xx xx xx xx AD 50 FF xx xx EB</pattern>
|
|
<pattern ep="1">BE B0 11 xx xx AD 50 FF 76 34 EB 7C 48 01 xx xx 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 xx xx xx 00 00 xx xx 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 xx xx xx 00 02 00 00 00 00 00 00 xx 00 00 xx 00 00 xx 00 00 xx xx 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE xx xx xx 14 00 00 00 00 xx xx xx xx xx xx 00 FF 76 38 AD 50 8B 3E BE F0 xx xx xx 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 xx xx xx xx xx 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 xx F3 AB 8B 7E 0C 57 51 E9 xx xx xx xx E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C xx 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F</pattern>
|
|
<pattern ep="1">56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91</pattern>
|
|
<pattern ep="1">FF 76 38 AD 50 8B 3E BE F0 xx xx xx 6A 27 59 F3 A5 FF 76 04 83 C8 FF</pattern>
|
|
<pattern ep="1">0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 xx xx 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 xx xx 00 00 02 00 00 00 00 00 00 xx 00 00 00 00 00 10 00 00 xx 00 00 00 00 10 00 00</pattern>
|
|
<pattern ep="1">0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 xx xx 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 xx xx 00 00 02 00 00 00 00 00 00 xx 00 00 00 00 00 10 00 00 xx 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE xx xx 00 14 00 00 00 00 xx xx 00 xx xx 00 00 FF 76 38 AD 50 8B 3E BE F0 xx xx 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 xx xx xx 00 xx 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5</pattern>
|
|
<pattern ep="1">BE B0 11 xx xx AD 50 FF 76 34 EB 7C 48 01 xx xx 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 xx xx xx 00 00 xx xx 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 xx xx xx 00 02 00 00 00 00 00 00 xx 00 00 xx 00 00 10 00 00 xx xx 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE xx xx xx 14 00 00 00 00 xx xx xx xx xx 00 00 FF 76 38 AD 50 8B 3E BE F0 xx xx xx 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 xx xx xx xx xx 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 xx F3 AB 8B 7E 0C 57 51 E9 xx xx xx xx 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B</pattern>
|
|
<pattern ep="1">60 E8 09 00 00 00 xx xx xx xx xx xx xx xx xx 33 C9 5E 87 0E</pattern>
|
|
<pattern ep="1">81 3A 00 00 00 02 00 00 00 00</pattern>
|
|
<pattern ep="1">2A A3 F2 54 CE</pattern>
|
|
<pattern ep="1">60 E8 09 00 00 00 xx xx xx 00 E9 06 02</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPolyX" more="UPolyX 0.x -> Delikon" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">81 FD 00 FB FF FF 83 D1 xx 8D 14 2F 83 FD FC 76 xx 8A 02 42 88 07 47 49 75</pattern>
|
|
<pattern ep="1">E2 xx FF xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">83 EC 04 89 xx 24 59 xx xx 00 00 00</pattern>
|
|
<pattern ep="1">BB 00 BD 46 00 83 EC 04 89 1C 24 xx B9 xx 00 00 00 80 33 xx xx xx xx xx xx 00 xx xx xx xx xx xx xx xx xx xx xx xx xx 00 xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">BB 00 BD 46 00 83 EC 04 89 1C 24 xx B9 xx 00 00 00 80 33 xx xx xx xx xx xx 00 xx xx xx xx xx xx xx xx xx xx xx xx xx 00 xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX + ECLiPSE layer" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">B8 xx xx xx xx B9 xx xx xx xx 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX 2.00-3.0X -> Markus Oberhumer, Laszlo Molnar, John Reiser" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 58 83 E8 3D</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 83 CD FF 31 DB 5E</pattern>
|
|
<pattern ep="1">60 BE xx xx xx 00 8D BE xx xx xx FF</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD FF 89 E5 8D 9C 24 xx xx xx xx 31 C0 50 39 DC 75 FB 46 46 53 68 xx xx xx xx 57 83 C3 04 53 68 xx xx xx xx 56 83 C3 04 53 50 C7 03 xx xx xx xx 90 90</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx C7 87 xx xx xx xx xx xx xx xx 57 83 CD FF 89 E5 8D 9C 24 xx xx xx xx 31 C0 50 39 DC 75 FB 46 46 53 68 xx xx xx xx 57 83 C3 04 53 68 xx xx xx xx 56 83 C3 04</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx 57 89 E5 8D 9C</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 xx xx xx FF 57 8D B0 D8 01 xx xx 83 CD FF 31 DB xx xx xx xx 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90</pattern>
|
|
<pattern ep="1">B9 xx xx BE xx xx BF C0 FF FD</pattern>
|
|
<pattern ep="1">79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 xx 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 xx 00 00 61 E9 xx xx xx FF</pattern>
|
|
<pattern ep="1">5E 89 F7 B9 xx xx xx xx 8A 07 47 2C E8 3C 01 77 F7 80 3F xx 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D xx xx xx xx xx 8B 07 09 C0 74 3C 8B 5F 04 8D xx xx xx xx xx xx 01 F3 50 83 C7 08 FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX Alternative stub" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX Inliner 1.0 by GPcH" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX -> Farb-rausch" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 xx xx xx xx 8A 07 47 2C E8 3C 01 77 F7 80 3F xx 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE xx xx xx xx 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 xx xx xx xx 01 F3 50 83 C7 08 FF 96 xx xx xx xx 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 xx xx xx xx 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 xx xx xx xx 61 E9</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2A 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 56 89 FE 29 C6 F3 A4 5E EB 9F 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 FF D3 11 C9 FF D3 72 F8 C3 31 C0 31 DB 31 C9 5E 89 F7 B9 xx xx xx xx 8A 07 47 2C E8 3C 01 77 F7 80 3F 0E 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 89 D8 E2 D9 8D BE xx xx xx xx 8B 07 09 C0 74 45 8B 5F 04 8D 84 30 xx xx xx xx 01 F3 50 83 C7 08 FF 96 xx xx xx xx 95 8A 07 47 08 C0 74 DC 89 F9 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 xx xx xx xx 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 xx xx xx xx 61 E9</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX Modifier v0.1x" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">50 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX Protector v1.0x" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB xx xx xx xx xx 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB</pattern>
|
|
<pattern ep="1">EB EC xx xx xx xx 8A 06 46 88 07 47 01 DB 75 07</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX v0.60 - v0.61" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 xx xx xx FF 57 8D B0 E8</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX v0.62" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 xx xx xx FF 57 66 81 87 xx xx xx xx xx xx 8D B0 F0 01 xx xx 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 58 83 xx xx 50 8D xx xx xx xx xx 57 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 83 xx xx 31 DB xx xx xx EB</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX v0.7X" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 xx xx xx FF 57 66 81 87 xx xx xx xx xx xx 8D B0 EC 01 xx xx 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 58 83 xx xx 50 8D xx xx xx xx xx 57 66 xx xx xx xx xx xx xx xx 8D xx xx xx xx xx 83 xx xx 31 DB EB</pattern>
|
|
<pattern ep="1">8C CB B9 xx xx BE xx xx 89 F7 1E A9 xx xx 8D xx xx xx 8E D8 05 xx xx 8E C0 FD F3 A5 FC 2E xx xx xx xx 73</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA xx xx FF 57 66 81 87 xx xx xx xx xx xx 81 C6 B3 01 xx xx EB 0A xx xx xx xx 8A 06 46 88 07 47 01 DB 75 07</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83</pattern>
|
|
<pattern ep="1">60 E8 xx xx xx xx 83 xx xx 31 DB 5E 8D xx xx xx xx xx 57 66 xx xx xx xx xx xx xx xx 81 xx xx xx xx xx EB</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D xx xx xx xx xx 66 xx xx xx xx xx xx 57 83 xx xx 31 DB EB</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX v0.8X" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">01 DB xx 07 8B 1E 83 EE FC 11 DB xx ED B8 01 00 00 00 01 DB xx 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx xx xx 00 60 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD FF</pattern>
|
|
<pattern ep="1">01 DB xx 07 8B 1E 83 EE FC 11 DB xx ED B8 01 00 00 00 01 DB xx 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 xx 75</pattern>
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 xx xx xx 00 60 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx C7 87 xx xx xx xx xx xx xx xx 57 83 CD FF EB 0E xx xx xx xx 8A 06 46 88 07 47 01 DB 75 07 8B</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 xx 8B 1E 83 xx xx 11 DB 72 xx B8 01 00 00 00 01 DB 75</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX v1.03 - v1.04" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">01 DB xx 07 8B 1E 83 EE FC 11 DB 8A 07 xx EB B8 01 00 00 00 01 DB xx 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX V1.94 -> Markus Oberhumer + Laszlo Molnar + John Reiser" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">FF D5 80 A7 xx xx xx xx xx 58 50 54 50 53 57 FF D5 58 61 8D 44 24 xx 6A 00 39 C4 75 FA 83 EC 80 E9</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX v2.X -> Markus, Laszlo + Reiser" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 FF 96 xx xx xx xx 09 C0 74 07 89 03 83 C3 04 EB xx FF 96 xx xx xx xx 8B AE xx xx xx xx 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 xx xx 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80</pattern>
|
|
<pattern ep="1">55 FF 96 xx xx xx xx 09 C0 74 07 89 03 83 C3 04 EB xx FF 96 xx xx xx xx 8B AE xx xx xx xx 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 xx xx 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9</pattern>
|
|
<pattern ep="1">FF D5 8D 87 xx xx xx xx 80 20 xx 80 60 xx xx 58 50 54 50 53 57 FF D5 58 61 8D 44 24 xx 6A 00 39 C4 75 FA 83 EC 80 E9</pattern>
|
|
<pattern ep="1">60 BE 00 30 42 00 8D BE 00 E0 FD FF 57 83 CD FF EB 10</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX" more="UPX v3.0 -> Markus Oberhumer + Laszlo Molnar + John Reiser" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 xx xx xx 8D BE 00 xx xx FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 xx xx xx 00</pattern>
|
|
<pattern ep="1">60 BE xx xx xx xx 8D BE xx xx xx FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 xx xx xx 00 57 83 C3 04 53 68 xx xx xx 00 56</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX$HiT" more="UPX$HiT 0.0.1 -> sibaway7@yahoo.com" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E2 FA 94 FF E0 61 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">94 BC xx xx xx 00 B9 xx 00 00 00 80 34 0C xx E2 FA 94 FF E0 61</pattern>
|
|
</sig>
|
|
|
|
<sig name="Upx-Lock" more="Upx-Lock 1.0 - 1.2 -> CyberDoom / Team-X + BoB / BobSoft" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61</pattern>
|
|
</sig>
|
|
|
|
<sig name="UPX-Scrambler" more="UPX-Scrambler by Guru.eXe" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE xx xx xx xx 83 EC 04 89 34 24 B9 80 00 00 00 81 36 xx xx xx xx 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6</pattern>
|
|
<pattern ep="1">66 C7 05 xx xx xx xx 75 07 E9 xx FE FF FF 00 xx xx 00 00 00 xx xx 00 xx xx 00 00 00 xx xx 00 xx xx 00 00 00 xx xx 00 xx xx 00 00 00 xx xx 00 xx xx 00 00 00 xx xx 00 xx xx 00 00 00 xx xx 00</pattern>
|
|
<pattern ep="1">90 61 BE xx xx xx xx 8D BE xx xx xx xx 57 83 CD FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="VcAsm Protector" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">EB xx 5B 56 50 72 6F 74 65 63 74 5D</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00</pattern>
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx xx 00 68 xx xx xx 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00</pattern>
|
|
<pattern ep="1">EB 0A 5B 56 50 72 6F 74 65 63 74 5D</pattern>
|
|
<pattern ep="1">EB 0B 5B 56 50 72 6F 74 65 63 74 5D</pattern>
|
|
</sig>
|
|
|
|
<sig name="vfp" more="vfp VX.00 -> Wang JianGuo" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D xx xx xx xx xx xx xx xx xx xx xx xx 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC</pattern>
|
|
<pattern ep="1">60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC</pattern>
|
|
</sig>
|
|
|
|
<sig name="Virogen Crypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01</pattern>
|
|
<pattern ep="1">9C 55 E8 xx xx xx xx 87 D5 5D 60 87 D5 8D xx xx xx xx xx 8D xx xx xx xx xx 57 56 AD 0B C0 74</pattern>
|
|
</sig>
|
|
|
|
<sig name="VisualUPX" more="VisualUPX 0.2 -> emadicius" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">66 C7 05 xx xx xx 00 75 07 E9 xx FE FF FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="VMProtect" more="VMProtect v1.x --> PolyTech" id="507" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 0F B6 06</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 66 0F B7 06</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 66 8B 06</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 89 EC 58</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 89 EC 59</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 89 EC 5A</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 89 EC 5B</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 55 50 52</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 50</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 51</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 52</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 53</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 55</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 56</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 57</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 66</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 80</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 89</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 8A</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 8B</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 8D</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx 9C</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx xx xx xx xx xx xx xx xx xx 68 00 00 00 00 8B</pattern>
|
|
<pattern ep="1">68 xx xx xx xx E8 xx xx xx xx F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9</pattern>
|
|
<pattern ep="1">55 8B EC 83 E4 F8 83 EC 34 53 8B 5D 0C 0F B7 03 56 57 68 31 74 6C 4D</pattern>
|
|
<pattern ep="1">5B 20 56 4D 50 72 6F 74 65 63 74 20</pattern>
|
|
<pattern ep="1">8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9</pattern>
|
|
<pattern ep="1">9C 60 68 00 00 00 00 8B 74 24 28 BF xx xx xx xx FC 89 F3 03 34 24 AC 00 D8</pattern>
|
|
<pattern ep="0">.vmp0</pattern>
|
|
<pattern ep="0">.vmp1</pattern>
|
|
<pattern ep="0">.vmp2</pattern>
|
|
</sig>
|
|
|
|
<sig name="VPacker" more="VPacker -> ttui" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 xx FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 xx FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC</pattern>
|
|
</sig>
|
|
|
|
<sig name="W32.Jeefo" more="W32.Jeefo (PE File Infector)" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 xx xx xx FF D0 E8 xx xx xx xx C9 C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="WATCOM C/C++" flag="1" file="0" tool="1" severity="4">
|
|
<pattern ep="1">53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87</pattern>
|
|
</sig>
|
|
|
|
<sig name="Werus Crypter" more="Werus Crypter 1.0 - by Kas" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">BB E8 12 40 00 80 33 05 E9 7D FF FF FF</pattern>
|
|
<pattern ep="1">68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40</pattern>
|
|
</sig>
|
|
|
|
<sig name="Wind of Crypt" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 83 C4 EC 53 xx xx xx xx 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55 68 CE 51 00 10 64 xx xx xx xx 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 F6 DB FF FF 8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="WinRAR" more="WinRAR 32-bit Self Extracting (SFX) Archive" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="1">E9 xx xx 00 00 00 00 00 00 90 90 90 xx xx xx xx xx xx 00 xx 00 xx xx xx xx xx FF</pattern>
|
|
</sig>
|
|
|
|
<sig name="WinUpack" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 xx xx xx xx 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00</pattern>
|
|
<pattern ep="1">60 E8 09 00 00 00 xx xx xx 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 xx F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 xx B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C</pattern>
|
|
<pattern ep="1">BE B0 11 xx xx AD 50 FF 76 34 EB 7C 48 01 xx xx 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 xx xx xx 00 00 xx xx 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 xx xx xx 00 02 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">BE B0 11 xx xx AD 50 FF 76 34 EB 7C 48 01 xx xx 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 xx xx xx xx 00 00 xx xx 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 xx xx xx 00 02 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="WinZip" more="WinZip (32-bit)" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="0">FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10</pattern>
|
|
<pattern ep="0">FF 15 xx xx xx 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 xx xx xx xx FF 15</pattern>
|
|
</sig>
|
|
|
|
<sig name="WinZip" more="WinZip Self-Extractor 2.2 personal edition" flag="1" file="0" tool="0" severity="2">
|
|
<pattern ep="1">53 FF 15 xx xx xx 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 xx xx xx xx FF 15</pattern>
|
|
<pattern ep="1">53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B</pattern>
|
|
</sig>
|
|
|
|
<sig name="Wise" more="Wise Installer Stub" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF 89 45 FC 0F 84 7B 01 00 00 8D 85 90 FC FF FF 50 56 FF 15 28 20 40 00 8D 85 98 FE FF FF 50 53 8D 85 90 FC FF FF 68 10 30 40 00 50 FF 15 24 20 40 00 53 68 80 00 00 00 6A 02 53 53 8D 85 98 FE FF FF 68 00 00 00 40 50 FF D7 83 F8 FF 89 45 F4 0F 84 2F 01 00 00 53 53 53 6A 02 53 FF 75 FC FF 15 00 20 40 00 53 53 53 6A 04 50 89 45 F8 FF 15 1C 20 40 00 8B F8 C7 45 FC 01 00 00 00 8D 47 01 8B 08 81 F9 4D 5A 9A 00 74 08 81 F9 4D 5A 90 00 75 06 80 78 04 03 74 0D FF 45 FC 40 81 7D FC 00 80 00 00 7C DB 8D 4D F0 53 51 68</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC xx xx 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 xx 40 40 00 FF 15 xx 40 40 00 8B F8 89 7D xx 8A 07 3C 22 0F 85 xx 00 00 00 8A 47 01 47 89 7D xx 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D xx EB EF 80 3F 22 75 04 47 89 7D xx 80 3F 20</pattern>
|
|
<pattern ep="1">55 8B EC 81 EC xx xx 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 xx 40 40 00 FF 15 xx 40 40 00 8B F8 89 7D xx 8A 07 3C 22 0F 85 xx 00 00 00 8A 47 01 47 89 7D xx 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D xx EB EF 80 3F 22 75 04 47 89 7D xx 80 3F 20 75 09 47 80 3F 20 74 FA 89 7D xx 53 FF 15 xx 40 40 00 80 3F 2F 89 45 xx 75 xx 8A 47 01 3C 53 74 04 3C 73 75 06 89 35</pattern>
|
|
</sig>
|
|
|
|
<sig name="WWPACK" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 6A xx 06 06 8C D3 83 xx xx 53 6A xx FC</pattern>
|
|
<pattern ep="1">BE xx xx BA xx xx BF xx xx B9 xx xx 8C CD 8E DD 81 ED xx xx 06 06 8B DD 2B DA 8B D3 FC</pattern>
|
|
<pattern ep="1">B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 33 C9 B1 xx 51 06 06 BB xx xx 53 8C D3</pattern>
|
|
<pattern ep="1">BE xx xx BF xx xx B9 xx xx 8C CD 81 ED xx xx 8B DD 81 EB xx xx 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC</pattern>
|
|
<pattern ep="1">B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 BB xx xx 53</pattern>
|
|
<pattern ep="1">03 05 C0 1A B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 B1 xx 51 8C D3</pattern>
|
|
<pattern ep="1">03 05 80 1A B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 B1 xx 51 8C D3</pattern>
|
|
<pattern ep="1">03 05 40 1A B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 B1 xx 51 8C D3</pattern>
|
|
<pattern ep="1">03 05 00 1A B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 B1 xx 51 8C D3</pattern>
|
|
<pattern ep="1">B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 B1 xx 51 8C D3</pattern>
|
|
<pattern ep="1">03 05 C0 1B B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 B1 xx 51 8C D3</pattern>
|
|
<pattern ep="1">03 05 80 1B B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 B1 xx 51 8C D3</pattern>
|
|
<pattern ep="1">03 05 40 1B B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 B1 xx 51 8C D3</pattern>
|
|
<pattern ep="1">03 05 00 1B B8 xx xx 8C CA 03 D0 8C C9 81 C1 xx xx 51 B9 xx xx 51 06 06 B1 xx 51 8C D3</pattern>
|
|
<pattern ep="1">53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32</pattern>
|
|
<pattern ep="1">53 55 8B E8 33 DB EB 60</pattern>
|
|
</sig>
|
|
|
|
<sig name="X-Pack" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">72 xx C3 8B DE 83 xx xx C1 xx xx 8C D8 03 C3 8E D8 8B DF 83 xx xx C1 xx xx 8C C0 03 C3 8E C0 C3</pattern>
|
|
<pattern ep="1">8B EC FA 33 C0 8E D0 BC xx xx 2E xx xx xx xx 2E xx xx xx xx EB</pattern>
|
|
<pattern ep="1">E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3</pattern>
|
|
<pattern ep="1">B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB</pattern>
|
|
</sig>
|
|
|
|
<sig name="Xtreme-Protector" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 xx xx 00 00 00 00 00 00 00 00</pattern>
|
|
<pattern ep="1">B8 xx xx xx 00 B9 75 xx xx 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02</pattern>
|
|
</sig>
|
|
|
|
<sig name="y0da Crypter" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33</pattern>
|
|
<pattern ep="1">60 E8 00 00 00 00 5D 81 ED xx xx xx xx B9 xx xx 00 00 8D BD xx xx xx xx 8B F7 AC</pattern>
|
|
<pattern ep="1">55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00</pattern>
|
|
<pattern ep="1">55 8B EC 53 56 57 E8 03 00 00 00 EB 01 xx E8 86 00 00 00 E8 03 00 00 00 EB 01 xx E8 79 00 00 00 E8 03 00 00 00 EB 01 xx E8 A4 00 00 00 E8 03 00 00 00 EB 01 xx E8 97 00 00 00 E8 03 00 00 00 EB 01 xx E8 2D 00 00 00 E8 03 00 00 00 EB 01 xx 60 E8 00 00 00 00</pattern>
|
|
<pattern ep="1">55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01</pattern>
|
|
<pattern ep="1">55 8B EC 53 56 57 E8 03 00 00 00 EB 01</pattern>
|
|
<pattern ep="1">55 8B EC 53 56 57 E8 03 00 00 00 EB 01 xx E8 86 00 00 00 E8 03 00 00 00 EB 01 xx E8 79 00 00 00 E8 03 00 00 00 EB 01 xx E8 A4 00 00 00 E8 03 00 00 00 EB 01 xx E8 97 00 00 00 E8 03 00 00 00 EB 01 xx E8 2D 00 00 00 E8 03 00 00 00 EB 01 xx 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 xx E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 xx 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 xx 33 C0 64 FF 30 64 89 20 CC C3</pattern>
|
|
<pattern ep="1">E8 03 00 00 00 EB 01 xx BB 55 00 00 00 E8 03 00 00 00 EB 01 xx E8 8F 00 00 00 E8 03 00 00 00 EB 01 xx E8 82 00 00 00 E8 03 00 00 00 EB 01 xx E8 B8 00 00 00</pattern>
|
|
<pattern ep="1">E8 03 00 00 00 EB 01 xx BB 55 00 00 00 E8 03 00 00 00 EB 01 xx E8 8E 00 00 00 E8 03 00 00 00 EB 01 xx E8 81 00 00 00 E8 03 00 00 00 EB 01 xx E8 B7 00 00 00 E8 03 00 00 00 EB 01 xx E8 AA 00 00 00 E8 03 00 00 00 EB 01 xx 83 FB 55 E8 03 00 00 00 EB 01 xx 75 2D E8 03 00 00 00 EB 01 xx 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 xx E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 xx 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 xx 33 C0 64 FF 30 64 89 20 4B CC C3</pattern>
|
|
</sig>
|
|
|
|
<sig name="yzPack" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C</pattern>
|
|
<pattern ep="1">4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9</pattern>
|
|
<pattern ep="1">5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 xx xx xx xx B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 xx xx xx xx 00 00 00 00 00 00 00 00 E0 00</pattern>
|
|
<pattern ep="1">25 xx xx xx xx 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12</pattern>
|
|
</sig>
|
|
|
|
<sig name="ZipWorxSecureEXE" more="ZipWorxSecureEXE 2.5 - ZipWORX Technologies LLC" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="1">E9 B8 00 00 00 xx xx xx xx xx xx xx xx xx xx xx xx 00 00 00 00 00 xx xx xx xx xx xx xx xx xx xx 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30</pattern>
|
|
</sig>
|
|
|
|
<sig name="LNK" more="Windows Shortcut" flag="1" file="1" tool="1" severity="2">
|
|
<pattern ep="0">4C 00 00 00 01 14 02 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Visual C++ 7" more="Microsoft Visual C++ 7.0 MFC" flag="0" file="0" tool="1" severity="2">
|
|
<pattern ep="1">6A 60 68 xx xx xx xx E8 xx xx xx xx BF 94 00 00 00 8B C7 E8 xx xx xx xx 89</pattern>
|
|
</sig>
|
|
|
|
<sig name="Visual C++ 8" more="Microsoft Visual C++ 8.0 MFC" flag="0" file="0" tool="1" severity="2">
|
|
<pattern ep="1">48 83 EC 28 E8 xx xx 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC CC</pattern>
|
|
<pattern ep="1">C0 xx xx 00 00 00 00 00 00 xx xx 00 00 00 00 00 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 00 xx xx xx xx xx 00 00 00 00 00 xx 00 00 00 00 00 xx xx xx 00 00 00 00 00 xx xx xx 00 00 00 00 00 xx xx xx xx 00 00 00 00 00 00 xx 00 00 00 00 00 xx xx xx 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Visual C++ 5" more="Microsoft Visual C++ 5.0/6.0 MFC" flag="0" file="0" tool="1" severity="2">
|
|
<pattern ep="1">55 8B EC 6A FF 68 xx xx xx xx 68 xx xx xx xx 64 A1 00 00 00 00 50</pattern>
|
|
</sig>
|
|
|
|
<sig name="7zSFX" more="7z - Self Extracting (SFX) Archive" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="0">3B 21 40 49 6E 73 74 61 6C 6C 40 21</pattern>
|
|
</sig>
|
|
|
|
<sig name="7-Zip" more="7-Zip file archiver" flag="1" file="1" tool="1" severity="2" url="">
|
|
<pattern ep="0">37 7A BC AF 27 1C</pattern>
|
|
</sig>
|
|
|
|
<sig name="executable" more="base64 encoded Executable" flag="1" severity="2" file="0" tool="0" url="">
|
|
<pattern ep="0">54 56 71 51 41 41</pattern>
|
|
</sig>
|
|
|
|
<sig name="MS-Compress" more="Microsoft Compressed file" flag="1" severity="2" file="1" tool="1" url="">
|
|
<pattern ep="0">53 5A 44 44 88 F0 27 33 41</pattern>
|
|
</sig>
|
|
|
|
<sig name="SWF" more="Shockwave Flash (SWF)" flag="1" severity="1" file="0" tool="1" url="">
|
|
<pattern ep="0">46 57 53 06 2B 2E 02 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="MS-CFB" more="Microsoft Compound File Binary (CFB)" flag="1" severity="2" file="1" tool="1" url="">
|
|
<pattern ep="0">00 00 01 00 07 00 00 00 2E 64 6F 63 00 A0 00 00 6C E9 13 00 D0 CF 11 E0</pattern>
|
|
</sig>
|
|
|
|
<sig name="MS-Office" flag="1" severity="2" file="1" tool="0" url="">
|
|
<pattern ep="0">D0 CF 11 E0</pattern>
|
|
</sig>
|
|
|
|
<sig name="InnoSetup" flag="1" severity="2" file="0" tool="1" url="">
|
|
<pattern ep="0">7A 6C 62 1A 5D 00 xx xx</pattern>
|
|
</sig>
|
|
|
|
<sig name="PDF" more="Portable Document Format (PDF)" flag="1" severity="2" file="1" tool="0" url="">
|
|
<pattern ep="0">25 50 44 46</pattern>
|
|
</sig>
|
|
|
|
<sig name="Reactor" more="Eziriz .NET Reactor" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="0">3C 50 72 69 76 61 74 65 49 6D 70 6C 65 6D 65 6E 74 61 74 69 6F 6E 44 65 74 61 69 6C 73 3E 7B xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 7D 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="NB10" flag="0" severity="4" file="0" tool="0" url="">
|
|
<pattern ep="0">4E 42 31 30 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Smart-installer" flag="1" severity="2" url="">
|
|
<pattern ep="0">53 6D 61 72 74 20 49 6E 73 74 61 6C 6C 20 4D 61 6B 65 72 20 76 2E 20 35 2E 30 34</pattern>
|
|
<pattern ep="0">53 6D 61 72 74 20 49 6E 73 74 61 6C 6C 20 4D 61 6B 65 72 20 76 2E 20 35 2E 30 32</pattern>
|
|
</sig>
|
|
|
|
<sig name="registry" flag="0" severity="2" file="1" tool="0" url="">
|
|
<pattern ep="0">48 4B 43 52</pattern>
|
|
<pattern ep="0">48 4B 43 4D</pattern>
|
|
</sig>
|
|
|
|
<sig name="bmp" more="bitmap" flag="0" severity="4" file="0" tool="0" url="">
|
|
<pattern ep="0">42 4D xx xx 00 00 00 00 00 00 36 xx xx 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="chtml" more="compiled html file (CHTML)" flag="1" severity="2" file="1" tool="0" url="www.russotto.net/chm/chmformat.html">
|
|
<pattern ep="0">49 54 53 46</pattern>
|
|
</sig>
|
|
|
|
<sig name="Spoon" more="Spoon Installer (Xenox)" flag="1" file="0" tool="1" severity="2" url="https:://sourceforge.net/projects/spoon-installer">
|
|
<pattern ep="0">78 76 6D 00 03 00 00 00 BE 4B 70</pattern>
|
|
</sig>
|
|
|
|
<sig name="MOF" more="Managed Object Format (MOF)" flag="1" file="1" tool="0" severity="2" url="">
|
|
<pattern ep="0">46 4F 4D 42 01 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="tlb" more="type-Library (TLB)" flag="0" file="1" tool="0" severity="2" url="">
|
|
<pattern ep="0">4D 53 46 54 02 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="PNG" more="Portable Network Graphics (PNG)" flag="0" severity="4" file="0" tool="0" url="">
|
|
<pattern ep="0">89 50 4E 47 0D 0A</pattern>
|
|
</sig>
|
|
|
|
<sig name="aPLib" more="aPLib-compressed" flag="1" severity="2" file="1" tool="1" url="">
|
|
<pattern ep="0">41 50 33 32 18 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Golang 1.x" flag="1" file="0" tool="1" severity="4" url="">
|
|
<pattern ep="1">E9 xx xx FF FF CC CC CC CC CC CC CC CC CC CC CC 51 48 8B 01 48 8B 71 10 48 8B 49 08 65 48 8B 3C 25 30 00 00 00 C7 47 68</pattern>
|
|
<pattern ep="1">E9 xx xx FF FF CC CC CC CC CC CC CC CC CC CC CC 8B 5C 24 04 64 C7 05 34 00 00 00 00 00 00 00 89 E5 8B 4B 04 89 C8 C1 E0</pattern>
|
|
</sig>
|
|
|
|
<sig name="Golang 1.5.0" flag="1" file="0" tool="1" severity="4" url="">
|
|
<pattern ep="0">Go build ID:</pattern>
|
|
</sig>
|
|
|
|
<sig name="ZPaq" flag="1" file="1" tool="1" severity="2" url="">
|
|
<pattern ep="0">37 6B 53 74</pattern>
|
|
</sig>
|
|
|
|
<sig name="AutoIt" more="AutoIt compiled script (2.XX-3.XX)" flag="0" file="1" tool="1" severity="2">
|
|
<pattern ep="0">A3 48 4B BE 98 6C 4A A9 99 4C 53 0A 86 D6 48</pattern>
|
|
</sig>
|
|
|
|
<sig name="Godevtool" id="" flag="1" file="0" tool="1" severity="2" url="">
|
|
<pattern ep="0">GoLink, GoAsm www.GoDevTool.com</pattern>
|
|
</sig>
|
|
|
|
<sig name="SQL" id="" flag="1" file="1" tool="0" severity="2" url="">
|
|
<pattern ep="0">41 4C 54 45 52 20 54 41 42 4C 45 20 42 6F 73 63 68</pattern>
|
|
</sig>
|
|
|
|
<sig name="Windows Event Manifest" id="" flag="0" file="1" tool="0" severity="4" url="">
|
|
<pattern ep="0">43 52 49 4D</pattern>
|
|
</sig>
|
|
|
|
<sig name="RIFF-Wave" more="Waveform Audio file" id="" flag="0" file="1" tool="0" severity="4" url="">
|
|
<pattern ep="0">52 49 46 46 xx xx xx xx 57 41 56 45</pattern>
|
|
</sig>
|
|
|
|
<sig name="RIFF-AVI" more="Audio Video Interleave file" id="" flag="0" file="1" tool="0" severity="4" url="">
|
|
<pattern ep="0">52 49 46 46 xx xx xx xx 41 56 49 20</pattern>
|
|
</sig>
|
|
|
|
<sig name="FASM" more="Flat Assembler (Compiler)" flag="0" severity="4" file="0" tool="0" url="">
|
|
<pattern ep="0">flat assembler</pattern>
|
|
</sig>
|
|
|
|
<sig name="HTA" id="" more="HTML Script" flag="1" severity="2" file="1" tool="0" url="">
|
|
<pattern ep="0">3C 48 54 41 3A 41 50 50 4C 49 43 41 54 49 4F 4E</pattern>
|
|
</sig>
|
|
|
|
<sig name="Confuser" id="500" flag="1" file="0" tool="1" severity="1" url="">
|
|
<pattern ep="0">Confuser</pattern>
|
|
</sig>
|
|
|
|
<sig name="Microsoft.NET" id="501" flag="0" file="0" tool="1" severity="4">
|
|
<pattern ep="1">00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 xx 00 00 FF 25</pattern>
|
|
<pattern ep="1">00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25</pattern>
|
|
<pattern ep="1">FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00</pattern>
|
|
</sig>
|
|
|
|
<sig name="Nim" id="502" more="Nim Compiler" flag="1" file="0" tool="1" severity="2">
|
|
<pattern ep="0">io.nim</pattern>
|
|
<pattern ep="0">fatal.nim</pattern>
|
|
<pattern ep="0">threads.nim</pattern>
|
|
<pattern ep="0">tables.nim</pattern>
|
|
<pattern ep="0">_NimMainModule</pattern>
|
|
<pattern ep="0">_NimMainInner</pattern>
|
|
</sig>
|
|
|
|
<sig name="Costura" id="503" flag="1" file="0" tool="1" severity="2" url="">
|
|
<pattern ep="0">Costura</pattern>
|
|
</sig>
|
|
|
|
<sig name="LordPE" id="504" flag="1" file="0" tool="1" severity="2" url="">
|
|
<pattern ep="0">LordPE</pattern>
|
|
</sig>
|
|
|
|
<sig name="MPress" id="506" more="MPress (Executable packer)" flag="1" file="0" tool="1" severity="2" url="">
|
|
<pattern ep="1">60 E8 00 00 00 00 58 05 5A 0B 00 00 8B 30 03 F0 2B</pattern>
|
|
<pattern ep="0">.MPRESS1</pattern>
|
|
<pattern ep="0">.MPRESS2</pattern>
|
|
</sig>
|
|
|
|
<sig name="SmartAssembly" id="507" more="Protector > SmartAssembly" flag="1" severity="1" tool="1" url="">
|
|
</sig>
|
|
|
|
<sig name="ELF" id="600" more="Executable Link Format (ELF)" flag="0" severity="4" file="1" tool="0" url="">
|
|
<pattern ep="0">7F 45 4C 46</pattern>
|
|
</sig>
|
|
|
|
</sigs>
|
|
</xml>
|